Encrypting New Search Indexes
You can enable encryption for new search cores when you create them.
When using TDE to secure a local file system, encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.
Using SolrJ Auth to implement encryption
To use the SolrJ-Auth libraries to implement encryption, follow instructions in the solrj-auth-README.md file.
The default location of the solrj-auth-README.md file depends on the type of installation:
-
Package installations:
/usr/share/dse/solr -
Tarball installations:
<installation_location>/resources/solr
These SolrJ-Auth libraries are included in the clients directory in DataStax Enterprise (DSE) distribution.
The default location of the clients directory depends on the type of installation:
-
Package installations:
/usr/share/dse/clients -
Tarball installations:
<installation_location>/clients
The SolrJ-Auth code is public.
Encryption is enabled per core.
To enable encryption for a new core, edit the search index config file to change the class for directoryFactory to solr.EncryptedFSDirectoryFactory.
-
Recommended: Use the
dsetool create_corecommand with automatic resource generation. Specify the class fordirectoryFactorytosolr.EncryptedFSDirectoryFactorywith the handycoreOptionsInlineargument:dsetool create_core <keyspace_name>.<table_name> generateResources=true coreOptionsInline="directory_factory_class:solr.EncryptedFSDirectoryFactory" -
Alternate: Use the
dsetool create_corecommand in this way:dsetool create_core <keyspace_name>.<table_name> schema=schema.xml solrconfig=solrconfig.xmlwhere the
solrconfig.xmlfile specifies the requireddirectoryFactory:<directoryFactory name="DirectoryFactory" class="solr.EncryptedFSDirectoryFactory"/>
The
generateResources=trueoption generates resources only if resources do not exist in thesolr_resourcestable.
When you create an encrypted search core, a node restart isn’t required.
To disable encryption, disable encryption for the backing CQL table. A node restart isn’t required.
