To provision the Oracle Key Vault compute instance, you choose an Oracle Key Vault image as your custom image.

You will launch this image from the OCI Marketplace on a compute shape. After you complete the process, the Oracle Key Vault compute image becomes unique to your environment. The disk size of this image is 4 TB.

After you complete the launch, you can begin to use the Oracle Key Vault compute image immediately. The steps that you must perform after the launch are similar to the steps that you would perform for an on-premises Oracle Key Vault installation.

The launching process for the Oracle Key Vault compute instance should take roughly two to five minutes.

• About Launching the Oracle Key Vault Compute Instance
  The launch process requires some minor preparation work on your system.
• Step 1: Ensure That You Have Prerequisites in Place
  Before you can launch an Oracle Key Vault compute instance, you must ensure that you have prerequisites in place in the Oracle cloud.
• Step 2: Find the Oracle Key Vault Image
  The Oracle Key Vault image is available on the Oracle Cloud Marketplace web site.
• Step 3: Launch the Oracle Key Vault VM Compute Instance
  You should perform the entire launching process in the Oracle Cloud Marketplace.
• Step 4: Perform Post-Launch and Post-Installation Tasks
  After you launch Oracle Key Vault in an OCI compute instance, you first perform the post-launch task, followed by post-installation tasks.

Depending on the action you need, you can use the Oracle Key Vault management console or the OCI console.

Most system settings in an Oracle Key Vault compute instance are the same as an on-premises deployment, with a few exceptions.

Settings for system features such as auditing, email, RESTful services, integration Oracle Key Vault with Oracle Audit Vault is the same in both on-premises and OCI deployments.

• You can configure an Oracle Key Vault host name in either the OCI console or in the Oracle Key Vault management console. However, remember that if you set the IP address of the host in the OCI console, later on, you cannot change it in either the OCI console or the Oracle Key Vault management console.
• The SSH tunnel (deprecated) settings are used when on-premises Oracle Key Vault clusters provide key management services to Oracle databases that are deployed in OCI. Do not establish an SSH tunnel in OCI-based Oracle Key Vault deployments.

You can back up and restore Oracle Key Vault data between OCI environments and on-premises environments.

You can back up an Oracle Key Vault compute instance that is stored in an on-premises host: this is the same backup that will be restored. Another on-premises Oracle Key Vault server can be a backup location for a server that is being restored into an Oracle Key Vault compute instance.

Requirements are as follows:

• If you are performing a backup or restore operation from Oracle Key Vault compute instances to an OCI compute instance, then persistent network connectivity to the OCI compute instance from Oracle Key Vault compute instance must exist.
• If you want to perform a backup or restore operation between an Oracle Key Vault compute instance and an on-premises host, ensure that the VCN can span the on-premises hosts.

You terminate an Oracle Key Vault compute instance from the OCI console.

1. Log in to the OCI console.
2. Under Core Infrastructure, go to Compute, and then click Instances.
3. Select the name of the Oracle Key Vault compute instance that you want to remove.
4. Click Terminate, and then respond to the confirmation prompt.

You can transition an Oracle Key Vault deployment from on-premises to OCI, and from OCI back to on-premises.

You can quickly set up a production Oracle Key Vault deployment in OCI to address your immediate key management needs and then transition to the on-premises deployment. Alternately, Oracle Key Vault compute instances require little to no overhead of hardware and VM management. To eliminate this overhead, you may want to transition your on-premises Oracle Key Vault deployment to OCI.

You can use the Oracle Key Vault backup and restore features to migrate an Oracle Key Vault cluster from on-premises to OCI, and back. You can transition an on-premises Oracle Key Vault cluster deployment to OCI by adding Oracle Key Vault compute instances to the cluster and removing on-premises Oracle Key Vault nodes from the cluster. The cluster is fully transitioned to OCI when no on-premises Oracle Key Vault node is left in the cluster. Similarly, you can also transition an Oracle Key Vault cluster in OCI to on-premises.

A user who has the System Administrator role can transition the Oracle Key Vault deployment from on-premises to OCI using backup and restore.

1. Log in to the on-premises Oracle Key Vault server as a user who has the System Administrator role.
2. Configure an OCI compute instance as the backup destination.
3. Back up the on-premises Oracle Key Vault server to an OCI compute instance.
4. Launch an Oracle Key Vault compute instance with same Oracle Key Vault version as the on-premises Oracle Key Vault server.
5. Log in to the Oracle Key Vault compute instance as a user who has the System Administrator role.
6. Restore the backup from the OCI compute instance to the newly installed Oracle Key Vault compute instance.
7. To set up an Oracle Key Vault multi-master cluster, convert the restored Oracle Key Vault compute instance as the first (initial) node of the cluster.
8. Configure additional Oracle Key Vault compute instances and add them to the cluster as needed.

A user who has the System Administrator role can transition the Oracle Key Vault deployment from OCI to on-premises.

1. Log in to the Oracle Key Vault compute instance as a user who has the System Administrator role.
2. Back up the Oracle Key Vault compute instance to an on-premises system.
3. Install a new Oracle Key Vault server on-premises with same Oracle Key Vault version as the Oracle Key Vault compute instance.
4. Log in to the on-premise Oracle Key Vault server as a user who has the System Administrator role.
5. Restore the backup from the on-premises backup destination to the newly installed on-premises Oracle Key Vault server.
6. To set up an Oracle Key Vault multi-master cluster, convert the restored on-premises Oracle Key Vault server as the first (initial) node of the cluster.
7. Configure additional Oracle Key Vault compute instances and add them to the cluster as needed.

You can provision Oracle Key Vault in Microsoft Azure.

To provide familiar, continuously available, extremely scalable, and fault-tolerant key management for your Oracle databases in Azure (including ExaDB-D@Azure), you can install and create an Oracle Key Vault multi-master cluster in Microsoft Azure, or extend on-premises Oracle Key Vault deployments with Oracle Key Vault cluster nodes in Microsoft Azure. You can also move an on-premises Oracle Key Vault cluster to Microsoft Azure by removing the on-premises nodes from the cluster.

You can create an Oracle Key Vault cluster in Microsoft Azure by first creating a Base Image, and then creating Oracle Key Vault cluster nodes from it.

1. On a separate machine outside, install Oracle VM VirtualBox.
2. Create a virtual machine on Oracle VM VirtualBox, with Linux 8, Oracle (64 bit) as the Operating System.
   1. The minimum RAM for the Base Image is 8 GB.
   2. The minimum disk size for production deployments is 2 TB (recommended 4 TB); ensure to create the virtual hard disk as Fixed size and in the VHD format.
3. Create the empty VM shell with the settings from above (OL8, RAM, disk size). Do not install anything at this point.
4. Mount the installer.iso image to the virtual machine and boot the virtual machine.

   Note:

   Do not go to the post-install steps; instead, run the script that makes this Oracle Key Vault a template to clone.
5. Install an Oracle Key Vault instance on the virtual machine. Do not complete any post installation steps.
6. Log in as root on the virtual machine console.
7. Re-attach the Oracle Key Vault installation iso image to the first drive of the virtual machine before running the script in the next step.
8. Run the following command: /usr/local/okv/bin/okv_export_cloud_image azure. This script prepares the system to be exported as a base image that will be later uploaded to Microsoft Azure.
9. Shutdown the virtual machine.
10. Upload the virtual machine’s disk file to a container under storage accounts using azure CLI: az storage blob upload --account-name <storage_account_name> --container-name <container_name> --name <blob_name>.vhd --file <VM_DISK_FILE>.vhd
11. Create Image from the VHD file using these steps:
    1. Login to Azure portal and navigate to Images.
    2. Click Create.
    3. On the Create an image page, complete the information as applicable. The required options include:
       • Storage blob: Specify blob_name.vhd from the storage accounts container uploaded before this step.
       • OS Type: Linux
       • VM generation: Select Gen1 (BIOS) or Gen2 (UEFI) to match your VirtualBox virtual machine setting.
    4. Click Create + Review. Review the details of the image before it is created.
    5. Click Create.
       Once the deployment is complete, the image is ready for use.

Perform the steps to launch an Oracle Key Vault instance.

1. Login to Azure portal and navigate to Images
2. Click the Oracle Key Vault image.
   Consider these settings for the options.

   • Size : Select a VM size with at least 16 GB RAM (recommended 32 GB).
   • Authentication type: Select SSH public key.
   • Username: Enter opc. Do not use the default user name azureuser.
   • Public inbound ports: Select Allow selected ports.
   • Select inbound ports:Under Network settings, configure security group that allows HTTPS (443) and SSH (22). The required ports are open for external connection. You may need to open additional ports, see Network Port Requirements to allow access of additional services or functionality of Oracle Key Vault instance externally.
3. Complete post-installation steps. For more information, see Step 4: Perform Post-Launch and Post-Installation Tasks.

You can provision Oracle Key Vault in Amazon AWS.

Oracle Key Vault deployments in your on-premises data centers can be extended with Oracle Key Vault cluster nodes in Amazon AWS. You can also move an on-premises Oracle Key Vault cluster to Amazon AWS by removing the on-premises nodes from the cluster.

Create a Base Image first to launch Oracle Key Vault cluster nodes (instances).

1. On a separate machine outside, install Oracle VM VirtualBox.
2. Create a virtual machine on Oracle VM VirtualBox, with Linux 8, Oracle (64 bit) as the Operating System.
   1. The minimum RAM for the Base Image is 8 GB.
   2. The minimum disk size for production deployments is 2 TB (recommended 4 TB); ensure to create the virtual hard disk as the VHD format.
3. Create the empty VM shell with the settings from above (OL8, RAM, disk size). Do not install anything at this point.
4. Mount the installer.iso image to the virtual machine and boot the virtual machine.

   Note:

   Do not go to the post-install steps; instead, run the script that makes this Oracle Key Vault a template to clone.
5. Install an Oracle Key Vault instance on the virtual machine. Do not complete any post installation steps.
6. Log in as root on the virtual machine console.
7. Re-attach the Oracle Key Vault installation iso image to the first drive of the virtual machine before running the script in the next step.
8. Run the following command: /usr/local/okv/bin/okv_export_cloud_image aws. This script prepares the system to be exported as a base image that will be later uploaded to Amazon Azure.
9. Shutdown the virtual machine.
10. Upload the VM’s disk file to an Amazon S3 bucket using AWS CLI: aws s3 cp <VM_DISK_FILE>.vhd s3://<s3_bucket_name>/<VM_DISK_FILE>.vhd
11. Create a disk container JSON file. The following is an example of container.json :

    {
        "Description": "<image_description>”,
        "Format": "vhd",
        "UserBucket": {
            "S3Bucket": “<s3_bucket_name>”,
            "S3Key": "<VM_DISK_FILE>.vhd"
        }
    }

12. Import the disk as a snapshot, use the command, aws ec2 import-snapshot --disk-container file://container.json.

    The output appears similar to the following example:

    {
        "ImportTaskId": "import-snap-031f7b5abe599ae94",
        "SnapshotTaskDetail": {
            "DiskImageSize": 0.0,
            "Progress": "0",
            "Status": "active",
            "StatusMessage": "pending",
            "UserBucket": {
                "S3Bucket": "<s3_bucket_name>",
                "S3Key": "<VM_DISK_FILE>.vhd"
            }
        },
        "Tags": []
    }

13. You can monitor the status of the snapshot import by using the ImportTaskId from the output of the previous command.

    aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-031f7b5abe599ae94

    {
        "ImportSnapshotTasks": [
            {
                "ImportTaskId": "import-snap-031f7b5abe599ae94",
                "SnapshotTaskDetail": {
                    "DiskImageSize": 7654604800.0,
                    "Format": “VHD",
                    "Progress": "43",
                    "Status": "active",
                    "StatusMessage": "downloading/converting",
                    "UserBucket": {
                        "S3Bucket": "<s3_bucket_name>",
                        "S3Key": "<VM_DISK_FILE>.vhd"
                    }
                },
                "Tags": []
            }
        ]
    }

14. Create an AMI image from the imported snapshot.
    1. Go to the AWS EC2 Dashboard.
    2. Select Snapshots, under Elastic Block Store.
    3. Search for the snapshot ID, for example, snap-031f7b5abe599ae94.
    4. Click the snapshot ID.
    5. Under Actions, select Create image from snapshot.
    6. Specify image settings.
       1. Enter Image name.
       2. Under Virtualization type, choose Hardware-assisted virtualization.
       3. Choose Boot mode to match your VM setting provided.
       4. Maintain the default settings for remaining fields.
    7. Click Create. After successful creation, a note with a link to the image appears.

Perform the steps to launch an Oracle Key Vault cluster node (instance).

1. Go to the AWS EC2 dashboard.
2. Select AMIs under the Images folder from the left window pane.
3. Click the Oracle Key Vault image to launch.
4. Click Launch Instance from the AMI.
5. Provide the details in Launch an Instance page.
   Consider these settings for the options:
   1. Instance type: Make sure that the selected instance type has enough memory space as configured in the Oracle Key Vault image.
   2. Under Network settings, configure security group that allows HTTPS (443) and SSH (22). The required ports are open for external connection. You may need to open additional ports, see Network Port Requirements to allow access of additional services or functionality of Oracle Key Vault instance externally.
6. Click Launch Instance.
7. Complete post-installation steps. for more information , see Step 4: Perform Post-Launch and Post-Installation Tasks.

You can provision Oracle Key Vault in Google Cloud.

To provide familiar, continuously available, extremely scalable, and fault-tolerant key management for your Oracle Databases in Google Cloud (including ExaDB-D@GCP), you can install and create an Oracle Key Vault multi-master cluster in Google Cloud, or extend on-premises Oracle Key Vault deployments with Oracle Key Vault cluster nodes in Google Cloud. You can also move an on-premises Oracle Key Vault cluster to Google Cloud by removing the on premises nodes from the cluster.

You can create an Oracle Key Vault cluster in Google Cloud by first creating a Base Image, and then creating Oracle Key Vault cluster nodes from it.

1. On a separate machine outside, install Oracle VM VirtualBox.
2. Create a virtual machine on Oracle VM VirtualBox, with Linux 8, Oracle (64 bit) as the Operating System.
   1. The minimum RAM for the Base Image is 8 GB.
   2. The minimum disk size for production deployments is 2 TB (recommended 4 TB); ensure to create the virtual hard disk in the VMDK format.
   3. Unified Extensible Firmware Interface (UEFI) is required if disk size is greater than 2 TB.
3. Create the empty VM shell with the settings from above (Oracle Linux 8, RAM, disk size). Do not install anything at this point.
4. Mount the installer.iso image to the virtual machine and boot the virtual machine.

   Note:

   Do not run the post-install steps; instead, run the script that makes this Oracle Key Vault a template to clone.
5. Install an Oracle Key Vault instance on the virtual machine. Do not complete any post-installation steps.
6. Log in as root on the virtual machine console.
7. Reattach the Oracle Key Vault installation iso image to the first drive of the virtual machine before running the script in the next step.
8. Run the following commands:

   /usr/local/okv/bin/okv_export_cloud_image oci
   /usr/local/okv/bin/okv_enable_vm_clone_utility set_cloud_platform_flag "GCP"

   Note:

   This script prepares the system to be exported as a base image that will be later uploaded to Google Cloud Platform (GCP).
9. Shut down the virtual machine.
10. Upload the disk file of the virtual machine to a bucket under cloud storage using the following Google Cloud CLI command:

    gcloud storage cp <VM_DISK_FILE>.vmdk gs://<bucket_name>

11. Create an image from the VMDK file using Google Cloud CLI:
    1. Run the following command:

       gcloud compute images import <image_name> --source-file gs://<bucket_name>/<VM_DISK_FILE>.vmdk 
       --guest-os-features=UEFI_COMPATIBLE --data-disk --async --timeout=12h

    Note:

    You can monitor the import progress using the link available in the output of the command.

Perform the steps to launch an Oracle Key Vault cluster node (instance).

1. Go to the Google Cloud dashboard.
2. Select Compute Engine, Images from the left navigation menu.
3. Click the Oracle Key Vault image.
4. Click CREATE INSTANCE from the menu bar.
5. Select the required options to create the instance in CREATE INSTANCE.
   Use the following settings to configure the SSH access:
   1. From the Advanced options drop-down list, select Security and then MANAGE ACCESS.
   2. Click ADD ITEM to add the SSH key.
   3. The SSH key must have opc user name at the end. For example,

      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFZpsXjpc1KJO4i2XZKOTTSL/F5r9ZKU+i5aHgcSFngj opc

   Consider these settings for the options.

   • Machine configuration: Make sure that the selected Machine type has enough RAM as configured in the Oracle Key Vault image.
   • In the Firewall settings, allow HTTPS traffic.
   • Verify if the required ports are open for external connection. You may need to open additional ports, see Network Port Requirements to allow access of additional services or functionality of Oracle Key Vault instance externally.
6. Click CREATE.
7. Complete post-installation steps. For more information, see Step 4: Perform Post-Launch and Post-Installation Tasks.