Migrating Encrypted Tables from Earlier Versions

Steps to migrate encrypted tables from earlier versions to the latest version of DataStax Enterprise (DSE).

Procedure

Back up the entire keyspace that has a dse_system.encrypted_keys table.
Back up all system keys.
Upgrade the cluster to DSE 6.8, following the DataStax Upgrade Guide instructions.
Restart the cluster.
Check that the dse_system.encrypted_keys table was created using the cqlsh DESCRIBE KEYSPACE command.

If you need to restore the dse_system.encrypted_keys table, load the table. Do not truncate or delete anything.
If the dse_system.encrypted_keys table was created, go to the next step; otherwise, create the table manually:
```
CREATE KEYSPACE dse_system WITH replication = {'class': 'EverywhereStrategy'};

USE dse_system;

CREATE TABLE encrypted_keys (
  key_file text,
  cipher text,
  strength int,
  key_id timeuuid,
  key text,
  PRIMARY KEY (key_file, cipher, strength, key_id)
);
```
EverywhereStrategy is the default replication strategy for the dse_system and solr_admin keyspaces. Do not use or alter any other instances of EverywhereStrategy.

Rewrite all SSTables.

nodetool upgradesstables --include-all-sstables

Verify if the search index files are encrypted:

dsetool list_index_files <keyspace_name> <table_name>