i've got a request to setup DARE (data at rest encryption) on a clients nutanix cluster.. how involved is this? how risky?

Enabling DARE on an existing cluster is moderately involved: • Licensing: Confirm the cluster’s license includes encryption, Prism Central is on 7.3+, and the cluster has been relicensed. Incorrect country/deployment settings can also block activation. • Key management: Choose software encryption with Native/LKM or an external KMS. Native KMS requires at least three nodes; SED-based encryption requires an external KMS. • Capacity: If Erasure Coding is in use, data may need to be decoded and re-encoded. The effective usage must remain below 85%; otherwise, enablement fails. • Runtime impact: The encryption task runs across the cluster’s data, so it should be scheduled and monitored. There's some perf impact, keep that in mind. • Irreversibility: Treat cluster-level DARE as permanent.

i'm not familiar with erasure coding... what is that? current plan is to use native/Local KM.... from what i'm reading i can easily back up that key and then store that safely elsewhere... should i ever need it... i saw that the it rekeys automatically every year.. does that mean I need a new backup every year?

If this is a standard 3 node cluster then you won’t have erasure coding. 4 nodes is a minimum. ECX is a storage mechanism to ultimately save more space but mainly meant for static data as it is a post process operation and waits for data to become cold before parity happens. DARE is very easy to configure after you go through your prerequisite checklist. It does take a LONG time, but runs in the background. Usually recommended to run during times where you know there won’t be high IOPS (end of month, end of quarter, end of year, payroll/tax cycles for example). Once it’s done, it cannot be undone. Hope this helps. I usually enable it for all my customers that have the feature. Use an enterprise password tool to store the key. Read best practices on cycling keys.

i REALLY appreciate everyone sharing.. i'm feeling much better about this.. both from the comments here and the documentation....

We enabled it on several existing clusters a number of years ago, no issues at that time, but did take a while as mentioned. Make sure you have a good place to store your keys, and it'll prompt you to back them up once a year IIRC.