VMware vSphere SDKs and Tools 7.0

8.0 7.0 6.7 6.5

API Methods to Prepare an ESXi Host

Encryption interfaces for ESXi hosts are additions to a previously existing managed object,
HostSystem
.
  • HostSystem
     – managed object providing access to the ESXi host, including these additions:
    • HostCryptoState
       – enumeration indicating whether the ESXi host is incapable of, prepared for encryption mode, or cryptography safe with its host key already set. Safe means that the ESXi host can encrypt virtual machines and will not leak keys.
    • ConfigureCryptoKey
       – vCenter Server calls this method to set or change the key used for core dump encryption, and to place the host in safe mode. It is like calling
      PrepareCrypto
       and
      EnableCrypto
       in quick succession. Not supported if called on an ESXi host. As of vSphere 7.0 you can disable encryption on a host, after next reboot, by setting
      pendingIncapable
       in
      HostCryptoState
      .
    • PrepareCrypto
       – this method puts the ESXi host in prepared mode so it can receive sensitive data, after being enabled.
    • EnableCrypto
       – this method sets or changes the key for core dump encryption and puts the ESXi host in safe mode. It must be called in sequence after
      PrepareCrypto
      .
    The following data objects are used by the
    ConfigureCryptoKey
     and
    EnableCrypto
     methods above, and by the CryptoManager methods below in vSphere API Methods for Cryptographic Operations.
    • CryptoKeyPlain
       – data object representing a plain text cryptographic key.
    • CryptoKeyId
       – data object representing a cryptographic key.
    • CryptoKeyResult
       – data object representing the result of a cryptographic key operation.

Content feedback and comments