无法从 ONTAP 访问 Google Cloud KMS 密钥
适用于
- ONTAP 9
- Google Cloud Platform Key Management Service (GCP KMS)
- 外部密钥管理集成
问题
- 运行 security key-manager external gcp check 显示 service_reachability 为失败。
node01::*> security key-manager external gcp check -category service_reachability -status !OKVserver: <vservername>Node: node01Category: service_reachabilityStatus: FAILEDDetails: Google Cloud Key Management Service operation "ENCRYPT" failed.Cryptsoft error: IOCryptsoft status: SUCCESSCryptsoft reason: SUCCESSCryptsoft message:HTTP response code:HTTP payload:Unable to communicate with the Google Cloud provider instance.Issue (privilege: diag) "security key-managerexternal <azure|aws|gcp|ikp> invoke" for moreinformation.
- 多个节点上的 KMS 服务可达性状态为失败。
- Telnet 和 DNS 检查表明存在常规网络连接。
node01::*> systemshell -node * -command telnet cloudkms.googlexxxx.com 443(system node systemshell)Node: node01Trying 199.xx.xxx.x...Connected to storage.googlexxxx.com.Escape character is 'off'.Connection closed by foreign host.