Mounting an Encrypted Data disk (Encrypted with ADE) to another VM from another VM that is being deallocated - Workflow - Clarification requested

Question

Here is a workflow:

1. I have a VM with 2 disks - One is a OS disk and one is a Data Disk (Persistent Disk)
2. I mount the Data disk to the VM and i use ADE Encryption on it using AzureDisEncryptionForLinux VM extension. The key is stored in Azure Keyvault.
3. Later the VM is being replaced by another VM. THe disk is unmounted from the old vm so it is now trying to be attached to the new VM. However It fails to be mounted because it is a LUKS file type.

My question is do we have to decrypt the disk before detaching from the old VM and mounting ot the new VM or is there a way to mount an already encrypted disk (done via ADE and key in Keyvault) to an new VM ?

Thanks

Answer 1

@nithya swaminathan
Thank you for your patience! If you're attaching an encrypted data disk to an unencrypted VM, you can try to set the same encryption settings on the second VM as you did the original VM.

For example A backup is recommended prior to performing any encryption steps on your VM.
VM1:
az vm encryption enable --resource-group "VM1-RG" --name "VM-1" --disk-encryption-keyvault "ADEvault" --volume-type "All"

VM2:
az vm encryption enable --resource-group "VM2-RG" --name "VM-2" --disk-encryption-keyvault "ADEvault" --volume-type "All"

Note:
Our Linux AD SMEs let us know that you might run into issues when doing this since this process for Linux VMs is not supported. However, if you have a backup you should be able to revert back to the last known "good" state.

If you have any other questions, please let me know.
Thank you!

Answer 2

"Our Linux AD SMEs let us know that you might run into issues when doing this since this process for Linux VMs is not supported"

@JamesTran-MSFT I did not understand this information that it is not supported for Linux. Are you saying it will work only for Windows VMs?

I will try your options.. but can you help me understand what you meant by the above statement.

Thanks

Answer 3

@nithya swaminathan

The process of:
1)Encrypting a VM with a data disk (volumeType All)
2)Moving that encrypted data disk to a new unencrypted VM
3)Encrypting that new VM with the same encryption settings as the original VM - is currently only supported for Windows VMs.

From what I was told, the reason it's not supported is because on Linux, you have to manually modify /etc/fstab and /etc/crypttab and manually open the drive in cryptsetup luksOpen, just by attaching the disk to the VM is not enough to get it to work. However, on a Windows VM, all you have to do is attach the data disk, assign it a drive letter, and re-run the sequence version encryption script.

I hope this helps to clarify why the process isn't supported.

If you have any other questions or would like to work closer with our support engineers on this process, please let me know.
Thank you for your time and patience.

Answer 4

@JamesTran-MSFT - Thank you very much for your clarifications and answers around support for ADE Encryption in Linux VMs.

I would like to take this opportunity to provide feedback regarding the ADE encryption feature in Linux VMs. In cloud computing , VMs can be replaced at any time and the ADE Encryption for disks needs to be idempotent.. that is wherever the disk is being moved , the ADE encryption for Linux extension should take care to mount LUKS disks to the new VM and abstract that away from the users. There is no point in having encryption on a disk that has data and if the VM that hosts the disks has issues, the disk has to be manually attached by the user and opened. This logic has to be taken care by the extension.

In addition, I would like to appreciate you James for prompt response to my questions. That is excellent customer service. Thanks so much

Answer 5

@JamesTran-MSFT - Could you please share if the requested feature is available for Linux? Thanks.