Encrypt existing search indexes

Encrypting DSE Search indexes turns on encryption only for new files. Additional steps are required to encrypt existing data. When you encrypt existing DSE Search indexes, a node restart is required.

There are several ways to encrypt existing DSE Search indexes. Choose the method that is appropriate for your environment.

Encryption is enabled per core.

If the solr index is configured to be encrypted, the same key is used for the index and the database.

When using TDE to secure a local file system, encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.

To enable encryption for an existing core, change the search index config:

<directoryFactory name="DirectoryFactory" class="solr.EncryptedFSDirectoryFactory"/>

Upload the changed solrconfig.xml file.

For example, you can use dsetool to upload the changed resource file:
```
dsetool reload_core keyspace_name.table_name
```
Restart the node.

Enabling encryption does not require a node restart. However, the directoryFactory changes require a node restart.

Encryption is enabled only for new files. Additional steps are required to encrypt existing data.
To encrypt existing files, use one of these methods:
Online encryption (slowest)

Use dsetool reload_core to reload the core and reindex while the node is running:

dsetool reload_core keyspace_name.table_name deleteAll=true reindex=true

Offline encryption (fastest)

If your DSE cluster has another remote node that is running, you can use dsetool upgrade_index_files to encrypt index files on the local offline node. The encryption configuration is read from the remote node. The user that runs this command must have read and write permissions to the directory that contains the index files.

Enable encryption for all nodes that have a search index, and then run dsetool upgrade_index_files on the local offline node:

dsetool upgrade_index_files keyspace_name.table_name -h remote_node_ip_address [options]

For information about the options for this command, see the dsetool upgrade_index_files reference.

Eventual encryption (unpredictable, simplest)

This method doesn’t require any deliberate action, but it can take an indeterminate amount of time to reindex and encrypt all existing files.

If you don’t use a dsetool command, encryption occurs automatically when indexes are compacted or merged based on the frequency of new writes or compaction. Because new files are encrypted, all files are eventually encrypted.
To verify which files are encrypted, use this command to list all DSE Search index files for the specified search core on the local node:
```
dsetool list_index_files <keyspace_name>.<table_name> [--index <directory>]
```
--index <directory> specifies the data directory that contains the search index files. When not specified, the default directory is inferred from the search core name.
After you verify which files are encrypted, you can encrypt existing files using a different option.

To disable encryption, disable encryption for the backing CQL table. A node restart isn’t required.

Encrypt existing search indexes

Was this helpful?

Give Feedback