kmip.update

Update KMIP Server Configuration.

The system authenticates to the remote KMIP server with a TLS handshake and synchronizes ZFS/SED keys between the local database and the server according to the configuration.

This method is a job.

Type: object

Call parameters

Type: array
No Additional Items

Tuple Validation

Parameter 1: kmip_update

kmip_update

Type: object

KMIP configuration update arguments.

No Additional Properties

enabled

Enabled

Type: boolean

Whether to enable KMIP functionality. Cannot be set to disabled while there are keys pending sync, unless force_clear is also set.

manage_sed_disks

Manage Sed Disks

Type: boolean

Whether to use KMIP for managing SED (Self-Encrypting Drive) keys. When enabled, SED keys are synced from the local database to the remote KMIP server. When disabled, any SED keys still held on the KMIP server are synced back to the local database.

manage_zfs_keys

Manage Zfs Keys

Type: boolean

Whether to use KMIP for managing ZFS encryption keys. When enabled, ZFS keys are synced from the local database to the remote KMIP server. When disabled, any ZFS keys still held on the KMIP server are synced back to the local database.

certificate

Certificate

ID of the client certificate used to initiate the TLS handshake with the KMIP server, or null.

Any of

• Option 1
• Option 2

Type: integer

Type: null

certificate_authority

Certificate Authority

ID of the certificate authority used to verify the KMIP server during the TLS handshake, or null.

Any of

• Option 1
• Option 2

Type: integer

Type: null

port

Port

Type: integer

TCP port number for the KMIP server connection.

Value must be greater or equal to 1 and lesser or equal to 65535

server

Server

Hostname or IP address of the KMIP server or null if not configured.

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

ssl_version

Ssl Version

Type: enum (of string)

SSL/TLS protocol version to use for KMIP connections. Specify this to match the SSL configuration used by the KMIP server.

Must be one of:

• "PROTOCOL_TLSv1"
• "PROTOCOL_TLSv1_1"
• "PROTOCOL_TLSv1_2"

force_clear

Force Clear

Type: boolean

When enabled, removes all keys pending sync from the database. Use with extreme caution: ZFS dataset or SED disk keys may be lost, leaving them locked forever. Disabled by default.

change_server

Change Server

Type: boolean

Allows migrating data between two KMIP servers. The system first migrates keys from the old server to the local database, then from the database to the new server. If it cannot retrieve all keys from the old server the operation fails, which can be bypassed with force_clear.

validate

Validate

Type: boolean

When enabled (the default), the system tests the connection to server to make sure it is reachable before saving.

Return value

KMIPEntry

Type: object

The updated KMIP configuration.

No Additional Properties

id Required

Id

Type: integer

Unique identifier for the KMIP configuration.

enabled Required

Enabled

Type: boolean

Whether KMIP (Key Management Interoperability Protocol) is enabled.

manage_sed_disks Required

Manage Sed Disks

Type: boolean

Whether to use KMIP for managing SED (Self-Encrypting Drive) keys. When enabled, SED keys are synced from the local database to the remote KMIP server. When disabled, any SED keys still held on the KMIP server are synced back to the local database.

manage_zfs_keys Required

Manage Zfs Keys

Type: boolean

Whether to use KMIP for managing ZFS encryption keys. When enabled, ZFS keys are synced from the local database to the remote KMIP server. When disabled, any ZFS keys still held on the KMIP server are synced back to the local database.

certificate Required

Certificate

ID of the client certificate used to initiate the TLS handshake with the KMIP server, or null.

Any of

• Option 1
• Option 2

Type: integer

Type: null

certificate_authority Required

Certificate Authority

ID of the certificate authority used to verify the KMIP server during the TLS handshake, or null.

Any of

• Option 1
• Option 2

Type: integer

Type: null

port Required

Port

Type: integer

TCP port number for the KMIP server connection.

Value must be greater or equal to 1 and lesser or equal to 65535

server Required

Server

Hostname or IP address of the KMIP server or null if not configured.

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

ssl_version Required

Ssl Version

Type: enum (of string)

SSL/TLS protocol version to use for KMIP connections. Specify this to match the SSL configuration used by the KMIP server.

Must be one of:

• "PROTOCOL_TLSv1"
• "PROTOCOL_TLSv1_1"
• "PROTOCOL_TLSv1_2"

Required roles: KMIP_WRITE