[SOLVED] Unable to unlock zfs root dataset during boot

[jwalker]

Hello,

I've installed proxmox 8.1 and after following the outlined procedure to copy the rpool/ROOT dataset to an encrypted one, since keeping encrypted data at rest is paramount, it now hangs during boot. I'm able to mount and access the encrypted dataset in rescue mode (i.e. while booting proxmox VE in debug mode), but once I boot my system it hangs and doesn't prompt for the password to unlock the root dataset on boot:



Has anyone encountered a similar problem? Do I need to install anything on initramfs?

To try to pinpoint the problem, I removed the 'quiet' flag from grub to see if I could get more details, but to no avail, it didn't change anything.

The list of zfs datasets is presented as follows :




Thanks!

 

[jwalker]

Does anyone have any idea what I might be missing?

Thanks!

 

[Dunuin]

Do I need to install anything on initramfs?

Only if you want to unlock it remotely via ssh.

Why you don't want to encrypt your "local" storage?

 

[jwalker]

I don't need to unlock it remotely, I can enter the password during boot if/when I get the bootloader to ask for it.

What do you mean by encrypting my local storage? You mean at the pool level?

 

[Dunuin]

You got a var-lib-vz dataset that is unencrypted and usually /var/lib/vz, which is used as the "local" storage, would be part of your root filesystem (so rpool/ROOT/pve-1) storing ISOs, snippets, backups, templates and so on.

 

[jwalker]

Ah, got it.
Absolutely, I intend to migrate them as well, but only once I'm able to boot the system, since without solving it, it's not worth investing time in dealing with the other "local" datasets.

 

[bindi]

https://forum.proxmox.com/threads/e...option-system-cannot-boot.104377/#post-450093

 

[jwalker]

https://forum.proxmox.com/threads/e...option-system-cannot-boot.104377/#post-450093

You are my hero!

Since I was doing the installation via qemu, I had to boot the proxmox iso in debug mode, import the zfs pool, mount all necessary directories (/proc /dev and /sys) which allowed me to chroot into the rpool/ROOT/pve-1 dataset, add the simplefb modules and update initramfs.
After that I just rebooted the system and I'm now prompted for a password to unlock the dataset during boot

Thank you once again!