Encryption keys are created and stored on this external system, then shared out by vCenter. Disk groups lock when an encrypted vSAN host restarts and has no access to it.
Also called KMS.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains Key Management Server in context, with comparison tables and the common traps.
Terms in this definition
- Encryption
Scrambling data so it cannot be read without the correct secret key, which is then used to turn it back again. Hashing, by contrast, cannot be reversed.
- KEYS
Lists the column or columns that identify each target row uniquely in an AUTO CDC statement.
- External
API Management virtual network mode in which the gateway stays public but can call private back ends inside the VNet.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- vCenter
Management software for VMs, clusters and ESX hosts. Each domain in VCF gets a dedicated one.
- vSAN
VMware's software-defined storage, which combines local devices across a cluster's ESX hosts into one shared datastore. Available as OSA or ESA, VCF can use it as principal storage.
Related terms
- KMIP
An industry-standard protocol through which a client application talks to a key management server. vCenter acts as a KMIP client for a standard key provider, whereas vSphere Native Key Provider does not need a KMIP server at all.
- KMS
Legacy AKS plug-in using an Azure Key Vault key to encrypt Kubernetes Secrets at rest in etcd. On Kubernetes 1.33 onwards, Microsoft Learn points to the newer KMS data encryption experience instead.
- NKP
vSphere Native Key Provider is part of vCenter and issues the keys for VM Encryption and vTPM, so no outside key server (KMS) is required. Moving encrypted VMs by HCX bulk migration needs the target to offer a corresponding KMS or NKP.
- password loss protection
An Enterprise Manager capability that includes its own keyset when backups are encrypted, so the data can still be unlocked if the password is forgotten or the KMS cannot be reached. A paid licence is needed to use it.
- Standard key provider
Uses an outside KMIP key management server as the source of encryption keys for vCenter. Since vSphere 9.0, wrapped key mode is the default, so many keys sit under a single wrapping key held by the KMS (the Native Key Provider needs no KMS at all).