You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In a very similar way, the RAID device is created using the encrypted layer on the disks, a filesystem is created on top of the RAID device and added to /etc/fstab as a regular device.
38
+
In a similar way, the RAID device is created on top of the encrypted layer on the disks. A filesystem is created on top of the RAID device and added to /etc/fstab as a regular device.
39
39
40
40
### Considerations
41
41
42
42
The recommended method to use is LVM-on-Crypt.
43
-
RAID is considered when LVM can't be used due to specific application/environment limitations.
44
-
You will be using the EncryptFormatAll option, please check all the information about this feature here https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux#use-encryptformatall-feature-for-data-disks-on-linux-vms
45
-
While this can be done when also encrypting the OS, we're just encrypting Data drives.
46
-
This assumes that you already reviewed the and comply with the pre-requisites mentioned here: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux and here https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-cli-quickstart
47
-
The ADE dual pass version should no longer be used on new ADE encryptions since it is on deprecation path.
43
+
RAID is considered when LVM can't be used because of specific application/environment limitations.
44
+
You'll use the EncryptFormatAll option, check all the information about this feature here https://docs.microsoft.com/azure/virtual-machines/linux/disk-encryption-linux#use-encryptformatall-feature-for-data-disks-on-linux-vms.
45
+
While this method can be done when also encrypting the OS, we're just encrypting Data drives.
46
+
This procedure assumes you already reviewed and comply with the pre-requisites mentioned here: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux and here https://docs.microsoft.com/azure/virtual-machines/linux/disk-encryption-cli-quickstart.
47
+
The ADE dual pass version should no longer be used on new ADE encryptions,it is on deprecation path.
48
48
49
49
### Procedure
50
50
51
-
When using the "on crypt" configurations you will be following the process outlined below:
51
+
When using the "on crypt" configurations, you'll be following the process outlined below:
52
52
53
53
>[!NOTE]
54
-
>We're using variables throughout the document, please replace the values accordingly.
54
+
>We're using variables throughout the document, replace the values accordingly.
Find the UUID of the filesystems recently created, create a temporary folder to mount it, add the corresponding entries on /etc/fstab and mount all the filesystems.
144
144
145
-
This also iterates on each disk defined on the "in" part of the "for" cycle:
145
+
This command also iterates on each disk defined on the "in" part of the "for" cycle:
146
146
```bash
147
147
fordiskin c d e f;do diskuuid="$(blkid -s UUID -o value /dev/sd${disk})"; \
148
148
mkdir /tempdata${disk}; \
@@ -187,7 +187,7 @@ az vm encryption enable \
187
187
--encrypt-format-all \
188
188
-o table
189
189
```
190
-
#### Verify the Encryption Status, proceed to the next step only when all the disks are encrypted.
190
+
#### Verify the Encryption Status, continue to the next step only when all the disks are encrypted.
You can notice the file systems were added to /var/lib/azure_disk_encryption_config/azure_crypt_mount (in case of an old encryption) or added to /etc/crypttab file in case or a newer encryption.
209
209
210
210
Do not modify any of these files.
211
211
212
-
This is going to be the file that will be taking care of activating these disks during the boot process so they can be later used by LVM or RAID.
212
+
This file is going to be taking care of activating these disks during the boot process so they can be later used by LVM or RAID.
213
213
214
214
Do not worry about the mount points on this file, as ADE will lose the ability to get the disks mounted as a normal file system after we do a pvcreate or mdadm --create on top of those encrypted devices (which will get rid of the file system format we used during the preparation process).
215
215
#### Remove the temp folders and temp fstab entries
@@ -237,7 +237,7 @@ Now that the underlying disks are encrypted, you can proceed to create the LVM s
237
237
Instead of using the device name, use the /dev/mapper paths for each of the disks to perform a pvcreate (on the crypt layer on top of the disk not on the disk itself).
238
238
### Configure LVM on top of the encrypted layers
239
239
#### Create the Physical Volumes
240
-
You will get a warning asking if it is OK to wipe out the filesystem signature, You may proceed by entering 'y' or simply use the echo "y" as shown:
240
+
You'll get a warning asking if it is OK to wipe out the filesystem signature. You may continue by entering 'y' or use the echo "y" as shown:
On this variation of lsblk, we're listing the devices showing the dependencies on reverse order, this helps to identify the devices grouped by the logical volume instead of the original /dev/sd[disk] device names.
302
+
On this variation of lsblk, we're listing the devices showing the dependencies on reverse order, this option helps to identify the devices grouped by the logical volume instead of the original /dev/sd[disk] device names.
303
303
304
-
Important: please make sure the nofail option is added to the mount point options of the LVM volumes created on top of an ADE encrypted device. This is very important to avoid the OS from getting stuck during the boot process (or in maintenance mode). The encrypted disk will be unlocked at the end of the boot process and the LVM volumes and file systems will be automatically mounted until they are unlocked by ADE, if the nofail option is not used, the OS will never get into the stage where ADE is started and the data disks are unlocked and mounted.
304
+
Important: Make sure the nofail option is added to the mount point options of the LVM volumes created on top of an ADE encrypted device. Is important to avoid the OS from getting stuck during the boot process (or in maintenance mode). The encrypted disk will be unlocked at the end of the boot process and the LVM volumes and file systems will be automatically mounted until they're unlocked by ADE, if the nofail option is not used, the OS will never get into the stage where ADE is started, and the data disk(s) are unlocked and mounted.
305
305
306
-
You can test rebooting the VM and validating the file systems are also automatically getting mounted after boot time. Please take under consideration that this process may take several minutes depending of the amount of file systems and the sizes
306
+
You can test rebooting the VM and validating the file systems are also automatically getting mounted after boot time. Take under consideration that this process may take several minutes depending on the number of file systems and the sizes
307
307
#### Reboot the VM and verify after reboot
308
308
```bash
309
309
shutdown -r now
@@ -313,7 +313,7 @@ lsblk
313
313
df -h
314
314
```
315
315
### For RAID-on-Crypt:
316
-
Now the underlying disks are encrypted you can proceed to create the RAID structures, same as LVM, instead of using the device name, use the /dev/mapper paths for each of the disks.
316
+
Now the underlying disks are encrypted you can continue to create the RAID structures, same as LVM, instead of using the device name, use the /dev/mapper paths for each of the disks.
317
317
318
318
#### Configure RAID on top of the encrypted layer of the disks
319
319
```bash
@@ -339,7 +339,7 @@ mdadm --detail /dev/md10
339
339
```bash
340
340
mkfs.ext4 /dev/md10
341
341
```
342
-
Create a new mountpoint for the filesystem, add the new file system to /etc/fstab and mount it
342
+
Create a new mountpoint for the filesystem, add the new file system to /etc/fstab, and mount it
343
343
```bash
344
344
fordevicein md10;do diskuuid="$(blkid -s UUID -o value /dev/${device})"; \
Important: please make sure the nofail option is added to the mount point options of the RAID volumes created on top of an ADE encrypted device.
357
+
Important: Make sure the nofail option is added to the mount point options of the RAID volumes created on top of an ADE encrypted device.
358
358
359
-
This is very important to avoid the OS from getting stuck during the boot process (or in maintenance mode). The encrypted disk will be unlocked at the end of the boot process and the RAID volumes and file systems will be automatically mounted until they are unlocked by ADE, if the nofail option is not used, the OS will never get into the stage where ADE is started and the data disks are unlocked and mounted.
359
+
This is very important to avoid the OS from getting stuck during the boot process (or in maintenance mode). The encrypted disk will be unlocked at the end of the boot process and the RAID volumes and file systems will be automatically mounted until they're unlocked by ADE, if the nofail option is not used, the OS will never get into the stage where ADE is started, and the data disks are unlocked and mounted.
360
360
361
-
You can test rebooting the VM and validating the file systems are also automatically getting mounted after boot time. Please take under consideration that this process may take several minutes depending of the amount of file systems and the sizes
361
+
You can test rebooting the VM and validating the file systems are also automatically getting mounted after boot time. Please take under consideration that this process may take several minutes depending on the amount of file systems and the sizes
362
362
```bash
363
363
shutdown -r now
364
364
```
365
-
And when you can login:
365
+
And when you can log in:
366
366
```bash
367
367
lsblk
368
368
df -h
@@ -371,4 +371,3 @@ df -h
371
371
372
372
-[Azure Disk Encryption troubleshooting](disk-encryption-troubleshooting.md)
0 commit comments