If you want to move a Cryptographic Security Platform Vault node to a different server, you can install the Cryptographic Security Platform Vault software on the new server and join the new server to the cluster so that the object store is copied to the new server and all your configuration settings are retained. Then you can remove the old server from the cluster and decommission it.

Note: If you want to move a Cryptographic Security Platform Vault node in a multi-node cluster, see Moving a CSP Vault Node to a New Server in a Multi-Node Environment.

Procedure 

  1. Set up the new server and install Cryptographic Security Platform Vault as an additional node in a cluster with the old Cryptographic Security Platform Vault node. For details, see CSP Vault ISO Installation for Hypervisors or CSP Vault OVA Installation.

    Make note of the IP address you assigned to the new server.

  2. Make sure your new node is properly configured by logging into the Cryptographic Security Platform Vault Management webGUI on the new server using an account with Domain Admin privileges.

    Note: If you are using Cluster Node Mappings, you need to log in using an account with Cloud Admin privileges as well in order to update the Mappings later in this procedure.

  3. In the top menu bar, click Cluster. The cluster Status should be Healthy and both nodes should appear on the Servers tab.

  4. If you have registered the Cryptographic Security Platform Vault IP address directly on each Policy Agent (as opposed to using a Cluster Node Mapping), log into each server connected to Cryptographic Security Platform Vault and issue the command:

    # hcl updatekc kc_hostname[:port]

    Where kc_hostname is the IP address of the new server and port is an optional port number if the port is anything other than the default (443).

  5. If you set up one or more Cluster Node Mappings, you need to update them:

    1. Log into the Cryptographic Security Platform Vault for VM Encryption webGUI.
    2. In the top menu bar, click Workloads.
    3. Click the Mappings tab.
    4. Select the Node Mapping in the list, then select Actions > Edit Mapping.
    5. Add the new Cryptographic Security Platform Vault node to the Node Mapping and then remove the old Cryptographic Security Platform Vault node.
    6. Click Update.
    7. The new Cluster Node Mapping will be communicated to the associated Policy Agents on the next heartbeat. You can either wait for that to happen to make sure the agents are using the new Cryptographic Security Platform Vault IP address or you can log into the VMs and run the command hcl updatekc –a.

  6. After all VMs in the system are using the new Cryptographic Security Platform Vault IP address, you can remove the old node and decommission the server.

    Important: If you are using Cluster Node Mappings, make sure that the Node Mapping information has updated on all the VMs registered with Cryptographic Security Platform Vault before you remove the old node from the cluster. Just changing the Node Mapping in Cryptographic Security Platform Vault is not enough. Each VM must heartbeat with Cryptographic Security Platform Vault before the change in the Node Mapping file can be disseminated to the VM. If you remove the old node before this happens, the VM will be unable to connect to Cryptographic Security Platform Vault and access to the encrypted data on the VM could be lost.

    1. Log into the Cryptographic Security Platform Vault Management webGUI.
    2. In the top menu bar, click Cluster.
    3. Click the Servers tab.
    4. Click the old node in the list and select Actions > Remove.

    5. Log into the existing server as htadmin.

      Cryptographic Security Platform Vault displays the Entrust Cryptographic Security Platform Vault System Console TUI (Text-based User Interface).

    6. Shut down the server by selecting Shutdown System from the Entrust Cryptographic Security Platform Vault System Console.
    7. If desired, uninstall Cryptographic Security Platform Vault as described in Decommissioning a Cryptographic Security Platform Vault Node.
    8. Decommission or re-purpose the old server as needed.