Encrypting New Search Indexes
You can enable encryption for new search cores when you create them.
Using SolrJ Auth to implement encryption
To use the SolrJ-Auth libraries to implement encryption, follow instructions in the solrj-auth-README.md file.
The default location of the solrj-auth-README.md file depends on the type of installation:
-
Package installations:
/usr/share/dse/solr -
Tarball installations:
<installation_location>/resources/solr
These SolrJ-Auth libraries are included in the clients directory in DataStax Enterprise distribution.
The default location of the clients directory depends on the type of installation:
-
Package installations:
/usr/share/dse/clients -
Tarball installations:
<installation_location>/clients
The SolrJ-Auth code is public.
Prerequisites
When using TDE secure local file system.
Encryption keys are stored
remotely with KMIP encryption
or locally with on-server encryption.
Procedure
Encryption is enabled per core.
To enable encryption for a new core, edit the search index config file to change the class for directoryFactory to solr.EncryptedFSDirectoryFactory.
-
Recommended: Use the
dsetool create_corecommand with automatic resource generation. Specify the class fordirectoryFactorytosolr.EncryptedFSDirectoryFactorywith the handycoreOptionsInlineargument:dsetool create_core <keyspace_name>.<table_name> generateResources=true coreOptionsInline="directory_factory_class:solr.EncryptedFSDirectoryFactory" -
Alternate: Use the
dsetool create_corecommand in this way:dsetool create_core <keyspace_name>.<table_name> schema=schema.xml solrconfig=solrconfig.xmlwhere the
solrconfig.xmlfile specifies the requireddirectoryFactory:<directoryFactory name="DirectoryFactory" class="solr.EncryptedFSDirectoryFactory"/>
The
generateResources=trueoption generates resources only if resources do not exist in thesolr_resourcestable.After you create an encrypted search core, a node restart is not required.
What is next
To disable encryption, disable encryption for the backing CQL table. No node restart is required.
