20.4. Enabling Management Encryption Red Hat recommends enabling both management and I/O encryption, but if you only want to use I/O encryption, you can skip this section and continue with Section 20.3.1, "Enabling I/O Encryption" . Prerequisites Enabling management encryption requires that storage servers are offline. Schedule an outage window for volumes, applications, clients, and other end users before beginning this process. Be aware that features such as snapshots and geo-replication may also be affected by this outage. Procedure 20.7. Enabling management encryption Prepare to enable encryption Unmount all volumes from all clients Run the following command on each client, for each volume mounted on that client. Stop NFS Ganesha or SMB services, if used Run the following command on any gluster server to disable NFS-Ganesha. Run the following command on any gluster server to stop SMB. Unmount shared storage, if used Run the following command on all servers to unmount shared storage. Note With the release of 3.5 Batch Update 3, the mount point of shared storage is changed from /var/run/gluster/ to /run/gluster/ . Important Features that require shared storage, such as snapshots and geo-replication, may not work until after this process is complete. Stop all volumes Run the following command on any server to stop all volumes, including the shared storage volume. Stop gluster services on all servers For Red Hat Enterprise Linux 7 based installations: For Red Hat Enterprise Linux 6 based installations: Important Red Hat Gluster Storage is not supported on Red Hat Enterprise Linux 6 (RHEL 6) from 3.5 Batch Update 1 onwards. See Version Details table in section Red Hat Gluster Storage Software Components and Versions of the Installation Guide Create and edit the secure-access file on all servers and clients Create a new /var/lib/glusterd/secure-access file. This file can be empty if you are using the default settings. Your Certificate Authority may require changes to the SSL certificate depth setting, transport.socket.ssl-cert-depth , in order to work correctly. To edit this setting, add the following line to the secure-access file, replacing n with the certificate depth required by your Certificate Authority. Clean up after configuring management encryption Start the glusterd service on all servers For Red Hat Enterprise Linux 7 based installations: For Red Hat Enterprise Linux 6 based installations: Important Red Hat Gluster Storage is not supported on Red Hat Enterprise Linux 6 (RHEL 6) from 3.5 Batch Update 1 onwards. See Version Details table in section Red Hat Gluster Storage Software Components and Versions of the Installation Guide Start all volumes Run the following command on any host to start all volumes including shared storage. Mount shared storage, if used Run the following command on all servers to mount shared storage. Restart NFS Ganesha or SMB services, if used Run the following command on any gluster server to start NFS-Ganesha. Run the following command on any gluster server to start SMB. Mount volumes on clients The process for mounting a volume depends on the protocol your client is using. The following command mounts a volume using the native FUSE protocol.

Commands:
umount mount-point
systemctl stop nfs-ganesha
systemctl stop ctdb
umount /var/run/gluster/shared_storage
for vol in `gluster volume list`; do gluster --mode=script volume stop USDvol; sleep 2s; done
systemctl stop glusterd pkill glusterfs
service glusterd stop pkill glusterfs
touch /var/lib/glusterd/secure-access
echo "option transport.socket.ssl-cert-depth n " > /var/lib/glusterd/secure-access
systemctl start glusterd
service glusterd start
for vol in `gluster volume list`; do gluster --mode=script volume start USDvol; sleep 2s; done
mount -t glusterfs hostname :/gluster_shared_storage /run/gluster/shared_storage
systemctl start nfs-ganesha
systemctl start ctdb
mount -t glusterfs server1:/testvolume /mnt/glusterfs