Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

CTE Administration

Quorum Control

search

Quorum Control

CTE supports the quorum feature of the CipherTrust Data Security Platform Service. A CipherTrust Data Security Platform Service administrator can configure a quorum policy to have multiple approvers for supported operations. After the quorum policy is configured for an operation, all the approvers need to approve the operation before it can be successfully executed.

Refer to Quorums for details on the quorum feature of the CipherTrust Data Security Platform Service.

Supported Operations

Operation Authorized Group for Approval
DeleteClientCTE CTE Admins
DeleteClientGroupCTE CTE Admins
DeleteCSIStorageGroupCTE CTE Admins
DeleteGuardPointCTE CTE Admins
DeletePolicyCTE CTE Admins
DeletePolicyElementsCTE CTE Admins
DeleteProfileCTE CTE Admins
UpdateClientGroupCTE CTE Admins
UpdateCSIStorageGroupCTE CTE Admins
UpdateGuardPointCTE CTE Admins
UpdatePolicyCTE CTE Admins
UpdatePolicyElementsCTE CTE Admins
UpdateProfileCTE CTE Admins

Supported APIs and Resources

Operation APIs Applicable to Remarks
Delete clients (DeleteClientCTE) • Single client deletion
• Bulk client deletion		 FS (CTE and RWP) clients Bulk client deletion behavior: Quorums are created for all resources. The administrators (approvers) need to approve quorum for all resources.
Do not modify/delete the requested clients after a quorum request is created for bulk deletion. To make any changes, ensure that the quorum request is deleted.
Delete client groups (DeleteClientGroupCTE) Delete client groups • NON-CLUSTER groups
• HDFS groups		 -
Update client groups (UpdateClientGroupCTE) • Update client groups
• Send LDT suspend/resume request to the CTE client groups		 • NON- CLUSTER groups
• HDFS groups		 -
Delete client GuardPoints (DeleteGuardPointCTE) • Single GuardPoint deletion
• Bulk GuardPoint deletion		 FS (CTE and RWP) GuardPoints Bulk GuardPoint deletion behavior: Quorums are created for all resources. The administrators (approvers) need to approve quorum for all resources.
Do not modify/delete the requested GuardPoints after a quorum request is created for bulk deletion. To make any changes, ensure that the quorum request is deleted.
Delete client group GuardPoints (DeleteGuardPointCTE) • Single GuardPoint deletion
• Bulk GuardPoint deletion		 • NON- CLUSTER groups
• HDFS groups		 Bulk client group GuardPoint deletion behavior: Quorums are created for all resources. The administrators (approvers) need to approve quorum for all resources.
Do not modify/delete the requested GuardPoints after a quorum request is created for bulk deletion. To make any changes, ensure that the quorum request is deleted.
Update client GuardPoints (UpdateGuardPointCTE) Single GuardPoint update FS (CTE and RWP) GuardPoints Bulk update is not supported.
Update client group GuardPoints (UpdateGuardPointCTE) Single GuardPoint update • NON- CLUSTER groups
• HDFS groups		 Bulk update is not supported.
Delete Kubernetes storage group GuardPolicies (DeleteGuardPointCTE) Delete GuardPolicies from Kubernetes storage groups Kubernetes clients -
Update Kubernetes storage group GuardPolicies (UpdateGuardPointCTE) Single Kubernetes storage group GuardPolicy update Kubernetes clients -
Delete Kubernetes storage groups (DeleteCSIStorageGroupCTE) Single Kubernetes storage group deletion from Kubernetes clients Kubernetes clients -
Update policy (UpdatePolicyCTE) • Update a policy
• Add, update, delete key rules
• Add, update, delete security rules
• Add, update, delete data transformation rules
• Add, update, delete LDT rules
• Update IDT rules
• Add, update, and delete signature rules		 • LDT policies
• IDT policies
• COS policies
• CTE for Kubernetes policies
• STANDARD policies		 -
Delete policy elements (DeletePolicyElementsCTE) Delete policy elements
• Delete a resource set
• Delete a user set
• Delete a process set
• Delete a signature set		 Delete an element Bulk deletion is not supported.
Update policy elements (UpdatePolicyElementsCTE) Update policy elements
• Update a resource set
• Update a user set
• Update a process set
• Update a signature set
• Add or remove a resource from a resource set
• Add or remove a user from a user set
• Add or remove a process from a process set
• Add or remove a signature from a signature set		 Single element update Bulk update is not supported.
Delete profiles (DeleteProfileCTE) Delete a profile - Bulk deletion is not supported.
Update profiles (UpdateProfileCTE) Update a profile - Bulk update is not supported.

Workflow

This section provides the basic flow of the quorum process for the DeleteClientCTE operation. The process is similar for all the supported operations. This section assumes that a quorum policy, which requires two approvals for the DeleteClientCTE operation, is activated on the CipherTrust Data Security Platform Service.

  1. Attempt to delete a client:

    1. Open the Transparent Encryption application.

    2. Click Clients > Clients.

    3. Under Client Name, click the overflow icon (Overflow Icon) corresponding to the client you want to delete.

    4. Click Delete. A dialog box appears prompting to confirm the action.

    5. Click Delete.

      A dialog box appears stating that a quorum request has been made, and you need to get approval for this action.

      The Quorum ID is displayed on the dialog box.

  2. View details of the quorum.

    1. On the Requesting dialog box, click the Go to Quorums Screen link.

      Alternatively, click OK on the Requesting dialog box and navigate to the Quorums page of the CipherTrust Data Security Platform Service GUI.

      The Quorums page contains the Active Quorums and Inactive Quorums tabs. These tabs show quorum details such as the operation name, the requester who initiated the quorum, status and state of the quorum, and the quorum actions.

    2. Under the Operation column, expand DeleteClientCTE: <client-name>.

      Information about the client to be deleted and the quorum approvers is displayed on the Quorum Client Info and Quorum Approvers tabs respectively.

    3. Click the Quorum Approvers tab to view details about the quorum approvers.

  3. Approve the quorum. You, another CTE administrator, or a CipherTrust Data Security Platform Service Administrator can approve the quorum.

    To approve the quorum:

    1. Under Actions, click the Approve Quorum icon (Overflow Icon) next to the desired DeleteClientCTE: <client-name> operation. The Approve Quorum dialog box is displayed.

      If you are the last approver, the dialog box displays the message, "This is the final approval. If you approve the quorum, the operation will be executed automatically."

    2. (Optional) Specify a Reason for the approval.

    3. Click Confirm to approve the quorum. A message stating that the quorum is successfully approved is displayed.

    Similarly, all the approvers need to approve the quorum for successful execution of the operation. The number of approvers is configured under Approvals Needed on the Admin Settings > Quorum Policy page.

    When the last approver approves the quorum, the operation is removed from the Active Quorums tab and the client is deleted from the Clients page. The executed operation is displayed on the Inactive Quorums tab of the Quorums page with the executed state.

    The logs of the operation are available on the Records > Server Records page.

  4. Verify the client deletion.

    1. Open the Transparent Encryption application.

    2. Click Clients > Clients.

Notice that the client is no longer listed on the Clients page. This indicates successful deletion of the client.

On this page