vCenter Native Key Provider

The vCenter Native Key Provider (NKP) is an integrated key management solution in vCenter that generates and distributes encryption keys for features like VM encryption, vSAN encryption, and virtual TPMs. It removes the need for an external KMS, simplifying security and compliance within VMware environments.

This test ensures encryption health and compliance. It verifies backups, key synchronization across hosts, and TPM policy adherence. Regular checks prevent misconfigurations, backup failures, and downtime, ensuring secure VM operations and data protection. Alerts help detect issues early, supporting key rotation and regulatory requirements.

Target of the test : A VMware vCenter server

Agent deploying the test : An internal agent

Outputs of the test : One set of results for the VMware vCenter server.

Configurable parameters for the test
Parameter Description

Test Period

How often should the test be executed.

Host

The host for which this test is to be configured.

Port

Refers to the port at which the specified host listens to.

VC User and VC Password

To connect to vCenter and extract metrics from it, this test should be configured with the name and password of a user with Administrator or Virtual Machine Administrator privileges to vCenter. However, if, owing to security constraints, you are not able to use the credentials of such users for test configuration, then you can configure this test with the credentials of a user with Read-only rights to vCenter. For this purpose, you can assign the ‘Read-only’ role to a local/domain user to vCenter, and then specify name and password of this user against the VC User and VC Password text boxes. The steps for assigning this role to a user on vCenter have been detailed in the Creating a Special Role on vCenter and Assigning the Role to a New User topic under the eG Monitoring Capabilities -> Virtualization and Containers -> Virtualization Technologies -> VMware vSphere ESX node sequence in the eG Enterprise documentation portal. 

vCenter servers terminate user sessions based on timeout periods. The default timeout period is 30 mins. When you stop an agent, sessions currently in use by the agent will remain open for this timeout period until vCenter times out the session. If the agent is restarted within the timeout period, it will open a new set of sessions. If you want the eG agent to close already existing sessions on vCenter before it opens new sessions, then, instead of the ‘Read-only’ user, you can optionally configure the VC User and VC Password parameters with the credentials of a user with permissions to View and Stop Sessions on vCenter. For this purpose, you can create a special role on vCenter, grant the View and Stop Sessions privilege (prior to vCenter 4.1, this was called the View and Terminate Sessions privilege) to this role, and then assign the new role to a local/domain user to vCenter. The steps for assigning this role to a user on vCenter have been detailed in the Creating a Special Role on vCenter and Assigning the Role to a New User topic under the eG Monitoring Capabilities -> Virtualization and Containers -> Virtualization Technologies -> VMware vSphere ESX node sequence in the eG Enterprise documentation portal. 

Confirm Password

Confirm the password by retyping it in this text box.

SSL

By default, the vCenter server is SSL-enabled. Accordingly, the SSL flag is set to Yes by default. This indicates that the eG agent will communicate with the vCenter server via HTTPS by default.

Webport

By default, in most virtualized environments, vCenter listens on port 80 (if not SSL-enabeld) or on port 443 (if SSL-enabled) only. This implies that while monitoring vCenter, the eG agent, by default, connects to port 80 or 443, depending upon the SSL-enabled status of vCenter – i.e., if vCenter is not SSL-enabled (i.e., if the SSL flag above is set to No), then the eG agent connects to vCenter using port 80 by default, and if vCenter is SSL-enabled (i.e., if the ssl flag is set to Yes), then the agent-vCenter communication occurs via port 443 by default.  Accordingly, the Webport parameter is set to default by default. 

In some environments however, the default ports 80 or 443 might not apply. In such a case, against the Webport parameter, you can specify the exact port at which vCenter in your environment listens, so that the eG agent communicates with that port for collecting metrics from vCenter.

DD Frequency

Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.

Detailed Diagnosis

To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability
  • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.
Measurements made by the test
Measurement Description Measurement Unit Interpretation

Key provider status

Indicates the health and availability of the cryptographic key service used for VM Encryption, vSAN Encryption, and Host Encryption.

 

The values that this measure reports and their corresponding numeric values are detailed in the table below:

Measure Value Numeric Value
Unknown 0
Active 1

Note:

By default, this test reports the Measure Values listed in the table above to indicates Key provider status. In the graph of this measure however, the state is indicated using the numeric equivalents only.

The detailed diagnosis of the Key provider status measure reveals Key Provider Name and Key Provider Type.