vCenter Native Key Provider
The vCenter Native Key Provider (NKP) is an integrated key management solution in vCenter that generates and distributes encryption keys for features like VM encryption, vSAN encryption, and virtual TPMs. It removes the need for an external KMS, simplifying security and compliance within VMware environments.
This test ensures encryption health and compliance. It verifies backups, key synchronization across hosts, and TPM policy adherence. Regular checks prevent misconfigurations, backup failures, and downtime, ensuring secure VM operations and data protection. Alerts help detect issues early, supporting key rotation and regulatory requirements.
Target of the test : A VMware vCenter server
Agent deploying the test : An internal agent
Outputs of the test : One set of results for the VMware vCenter server.
| Parameter | Description |
|---|---|
|
Test Period |
How often should the test be executed. |
|
Host |
The host for which this test is to be configured. |
|
Port |
Refers to the port at which the specified host listens to. |
|
VC User and VC Password |
To connect to vCenter and extract metrics from it, this test should be configured with the name and password of a user with Administrator or Virtual Machine Administrator privileges to vCenter. However, if, owing to security constraints, you are not able to use the credentials of such users for test configuration, then you can configure this test with the credentials of a user with Read-only rights to vCenter. For this purpose, you can assign the ‘Read-only’ role to a local/domain user to vCenter, and then specify name and password of this user against the VC User and VC Password text boxes. The steps for assigning this role to a user on vCenter have been detailed in vCenter servers terminate user sessions based on timeout periods. The default timeout period is 30 mins. When you stop an agent, sessions currently in use by the agent will remain open for this timeout period until vCenter times out the session. If the agent is restarted within the timeout period, it will open a new set of sessions. If you want the eG agent to close already existing sessions on vCenter before it opens new sessions, then, instead of the ‘Read-only’ user, you can optionally configure the VC User and VC Password parameters with the credentials of a user with permissions to View and Stop Sessions on vCenter. For this purpose, you can create a special role on vCenter, grant the View and Stop Sessions privilege (prior to vCenter 4.1, this was called the View and Terminate Sessions privilege) to this role, and then assign the new role to a local/domain user to vCenter. The steps for assigning this role to a user on vCenter have been detailed in |
|
Confirm Password |
Confirm the password by retyping it in this text box. |
|
SSL |
By default, the vCenter server is SSL-enabled. Accordingly, the SSL flag is set to Yes by default. This indicates that the eG agent will communicate with the vCenter server via HTTPS by default. |
|
Webport |
By default, in most virtualized environments, vCenter listens on port 80 (if not SSL-enabeld) or on port 443 (if SSL-enabled) only. This implies that while monitoring vCenter, the eG agent, by default, connects to port 80 or 443, depending upon the SSL-enabled status of vCenter – i.e., if vCenter is not SSL-enabled (i.e., if the SSL flag above is set to No), then the eG agent connects to vCenter using port 80 by default, and if vCenter is SSL-enabled (i.e., if the ssl flag is set to Yes), then the agent-vCenter communication occurs via port 443 by default. Accordingly, the Webport parameter is set to default by default. In some environments however, the default ports 80 or 443 might not apply. In such a case, against the Webport parameter, you can specify the exact port at which vCenter in your environment listens, so that the eG agent communicates with that port for collecting metrics from vCenter. |
|
DD Frequency |
Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency. |
|
Detailed Diagnosis |
To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:
|
| Measurement | Description | Measurement Unit | Interpretation | ||||||
|---|---|---|---|---|---|---|---|---|---|
|
Key provider status |
Indicates the health and availability of the cryptographic key service used for VM Encryption, vSAN Encryption, and Host Encryption. |
|
The values that this measure reports and their corresponding numeric values are detailed in the table below:
Note: By default, this test reports the Measure Values listed in the table above to indicates Key provider status. In the graph of this measure however, the state is indicated using the numeric equivalents only. The detailed diagnosis of the Key provider status measure reveals Key Provider Name and Key Provider Type. |