isabella232 / vsi-encrypted

Create a vsi encrypted image on premises using key protect, upload to the cloud, provision vsi

Automate the Encryption of a Virtual Server Image for Deployment onto Classic Infrastructure

Overview

You can Use End to End (E2E) Encryption to provision an encrypted instance. Start with an on premises file in Virtual Hardware Device, VHD format. Encrypt the VHD on premises and end up with a Virtual Server Instance in the IBM cloud running directly from that encrypted VHD file.

Create a VSI template image that is encrypted

The scripts do not check permissions. You must ensure you have the right permissions:

• to create Classic virtual server instances with public network,
• to capture Classic instance images,
• to create Cloud Object Storage instance,
• to create Key Protect instance,

1. Copy the configuration file and set the values to match your environment.

   cp template.local.env local.env

2. Initialize and verify prerequisites - Set the default resource group and region verify prerequisites

   ./000-initialize-verify-prereqs.sh
   ``
   

3. Create a Cloud Object Storage, COS, instance and create an initial bucket

   ./010-prepare-cos.sh

4. Create the ssh key in the cloud. This will be used by all of the VSIs created.

   ./015-create-sshkey-in-cloud.sh

5. Create the VSI representing the on premises instance. The VHD will be created from this instance

   ./020-create-onprem-vm.sh

   The script installs Nginx on this instance. It will test that the virtual server instance is accessible through its public address and retrieve the Nginx home page.

6. Create a VHD image template of the on premises VSI. Copy the image into a COS bucket.

   ./030-capture-classic-to-cos.sh

7. Create a VSI used to encrypt the VHD image.

   ./040-create-encrypter-vm.sh

8. Encrypt the VHD image that is in COS: copy the VHD locally, encrypt with the data encryption key, copy encrypted VHD back to COS. Do this on a VSI.

   ./050-use-vsi-encrypter-to-encrypt-cos-image.sh

   Create a data encryption key in the file dek if the dek file does not exist.

9. Create a Key Protect service instance, a root key, and the authorization for vsi block storage to access the instance

   ./060-prepare-kp.sh

10. Create a VSI template encrypted image from the encrypted VHD image that in cos

    ./070-create-encrypted-vm-image-template.sh

11. Create a VSI from the encrypted template image

    ./080-create-test-vm.sh

    The script will test that the virtual server instance is accessible through its public address and retrieve the Nginx home page to confirm the migration worked as expected.

Cleanup

Delete everything that was created: image templates, COS instance, Key Protect instance, VSI instances

./090-cleanup.sh