Cluster encryption during deployment

A management node comprising:

• a processor;
• and
• memory coupled to the processor, wherein the memory comprises a cluster deployment unit to:
• retrieve, from a blueprint, resource information required to deploy a cluster comprising a host computing system and a virtual cluster manager node to manage the host computing system, wherein the resource information comprises host information and disk information required to deploy the virtual cluster manager node, and encryption information associated with a key provider;
• based on the host information and the disk information, create a clustered datastore on the host computing system;
• deploy the virtual cluster manager node on the clustered datastore;
• based on the encryption information associated with the key provider, encrypt the virtual cluster manager node and associated disks;
• and
• upon encrypting the virtual cluster manager node, create a cluster and add the host computing system to the cluster;
• wherein cluster deployment unit is to:
• encrypt the virtual cluster manager node and associated disks using a data encryption key (DEK) generated at the host computing system;
• based on the encryption information provided in the blueprint, establish a trust with the key provider that is deployed external to the host computing system;
• and
• upon establishing the trust, encrypt the DEK using a key encryption key KEK) provided by the key provider.

A non-transitory computer readable storage medium comprising instructions executable by a processor of a management node to:

• retrieve, from a blueprint, resource information required to deploy a cluster comprising a plurality of cluster nodes and a virtual cluster manager node to manage the plurality of cluster nodes, wherein the resource information comprises host information and disk information required to deploy the virtual cluster manager node, and encryption information associated with a key provider;
• based on the host information and the disk information, create a clustered datastore on a cluster node of the plurality of cluster nodes;
• deploy the virtual cluster manager node on the clustered datastore;
• based on the encryption information associated with the key provider, encrypt the virtual cluster manager node and associated disks;
• and
• upon encrypting the virtual cluster manager node, create a cluster and add the plurality of cluster nodes that are managed by the virtual cluster manager node to the cluster;
• wherein encrypting the virtual cluster manager node and associated disks comprises:
• encrypting the virtual cluster manager node and associated disks using a data encryption key (DEK) generated at the host computing system;
• based on the encryption information provided in the blueprint, establishing a trust with the key provider that is deployed external to the host computing system;
• and
• upon establishing the trust, encrypting the DEK using a key encryption key (KEK) provided by the key provider.