An administrator has been asked to investigate encrypting intra-cluster storage traffic.

Nutanix supports Data-in-Transit Encryption to secure traffic flowing between nodes (CVM to CVM) and between the CVM and hypervisor. This feature uses TLS to encrypt replication and storage data traffic.

However, the Security Guide notes that enabling encryption introduces computational overhead. The encryption and decryption of storage traffic are handled by the Controller VM (CVM) CPUs. Therefore, a key design consideration is that this configuration results in increased CVM CPU utilization. Consequently, due to the processing time required for encryption operations, there may be a slight increase in I/O latency. Administrators must ensure the cluster has sufficient CPU headroom on the CVMs to absorb this overhead without impacting application performance.