Data-at-rest encryption

For more information, see Encryption in StorPool.

Should data-at-rest encryption be turned on for the whole storage cluster?

StorPool supports data-at-rest encryption via disk encryption. At the moment this is supported only with self-encrypted drives. This means the data is sent to the physical drives un-encrypted, and the drives store it encrypted. StorPool provides the keys to the drives.

Providing software encryption is on our roadmap. While it will provide similar functionality, it will work with any drive, and not only with self-encrypting drives (SED).

Would the data-at-rest encryption affect Erasure coding?

Erasure coding is independent of disk encryption. Enabling disk encryption (with SED drives now, and software encryption when available) will not impact the storage efficiency of erasure coding.

Is it okay if the data is also encrypted inside the guest OS?

When data-at-rest (disk) encryption is active for the primary-data storage, you should have no problems with enabling encryption tools like Bitlocker or LUKS in the guest OS.

Will the data-in-transit being sent to remote backup be encrypted?

Yes. No matter if you enable data-at-rest encryption or not, data that is sent from one cluster to another is encrypted. The communication between remote clusters is using TLS encryption. This encryption is in-transit only.

When received by the remote cluster the data is decrypted and processed. You can enable data-at-rest encryption on each site independently. This doesn’t affect data-in-transit encryption, which is always enabled via TLS.

For details about how the connection between StorPool clusters can be configured, see Connecting two clusters.