Data-at-Rest Encryption and Key Management
What DARE covers
Data-at-Rest Encryption is an AOS software feature that encrypts data on the cluster's storage devices using AES-256 (XTS mode) - no self-encrypting drives required. It is enabled per cluster, ideally at cluster creation; some later AOS releases allow enabling on an existing cluster, so read the version in the question carefully. DARE protects data sitting on disk. It does not encrypt backups written to a remote target, replication payloads in flight, guest-level files, or copies already moved off-cluster.
Keys
The master key (a key-encrypting key) protects per-disk data encryption keys. Keys reside either in the native Nutanix key manager or in an external KMIP-compliant key management server. The cluster caches keys so a brief KMS outage does not stop I/O - but a permanently lost key set makes the data unrecoverable. Back up the key manager and protect it independently of the cluster. Master key rotation is supported and should be scheduled as part of key hygiene.
Traps
Assuming a cluster is encrypted because it is "compliant" or because workloads use guest-side encryption. Forgetting that the DR cluster must also be encrypted when the data classification covers DR. Forgetting that the KMS must be reachable and its certificates valid, and that KMS availability becomes a hard dependency for recovery, not just operation.
Rule of thumb
Encryption is only as strong as key custody: if the key store lives on the same platform you are protecting, you have not separated duties.