Red Hat OpenShift Container Platform

You can migrate from local etcd encryption to external KMS encryption to centralize key management and improve compliance.

Prerequisites

You have access to the cluster as a user with the cluster-admin role.
You have enabled the TechPreviewNoUpgrade feature set to enable the KMSEncryption feature gate.
Your cluster is currently using aescbc or aesgcm encryption.
You have deployed the KMS plugin on all control plane nodes.
Control plane nodes have network access to the KMS provider.

Create an etcd backup before migrating.

Procedure

Back up the current etcd encryption configuration by entering the following command:
```
$ oc get apiserver cluster -o yaml > apiserver-backup.yaml
```
Edit the APIServer custom resource by entering the following command:
```
$ oc edit apiserver cluster
```

Change the encryption type from aescbc or aesgcm to KMS:

apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
  name: cluster
spec:
  encryption:
    type: KMS

Save and exit.

Migration starts automatically and typically takes several minutes.

Verify migration completion for all API servers by running the following commands:

$ oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{end}'

$ oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{end}'

$ oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{end}'

All outputs should show EncryptionCompleted.