Shared content for all AWS-KMS secret docs - cluster wide intro
From Portworx version 2.1 support for cluster-wide secrets has been deprecated. If you have volumes (using cluster-wide secret) that were created using older Portworx versions, those volumes will still seamlessly work with newer Portworx versions.
However, if you wish to use your previous cluster-wide secret, then you will need to pass its name as shown in the previous Named secrets section.
For example,
Lets say your generated KMS data key was called portworx_secret and you had set it as a your cluster-wide secret using the command pxctl secrets set-cluster-key portworx_secret.
To create new volumes using that same secret you will need to follow the previous Named secret section and provide the name portworx_secret as show above.
Again, existing volumes created with cluster wide, will still work without providing portworx_secret.
- For newer volumes if you do not provide any secret key, they will use per volume encryption and will NOT default to using cluster wide secret
-
This method for encrypting volumes is not supported when you want to take a cloud backup of an encrypted volume or migrate encrypted volumes between two different Portworx clusters.