ZFS subvol encryption

[bamf]

Hello,


I have configured an encrypted ZFS on my Proxmox.

This means that rpool/ROOT is encrypted with a password and rpool/data is encrypted with a keyfile on ROOT.

Analogous to data, I have now put a mirror consisting of two spinning disks into operation and put an encrypted dataset called hdd/storage into operation there.

Problem: If I now create a mountpoint in Proxmox for example, a new subvol is created under hdd and this is then not encrypted.

root@virt:/tmp# zfs get encryption
NAME                              PROPERTY    VALUE        SOURCE
hdd                               encryption  off          default
hdd/storage                       encryption  aes-256-gcm  -
hdd/subvol-110-disk-0             encryption  off          default
rpool                             encryption  off          default
rpool/ROOT                        encryption  aes-256-gcm  -
rpool/ROOT/pve-1                  encryption  aes-256-gcm  -
rpool/ROOT/pve-1@copy             encryption  aes-256-gcm  -
rpool/data                        encryption  aes-256-gcm  -
rpool/data/subvol-110-disk-0      encryption  aes-256-gcm  -
rpool/data/subvol-120-disk-0      encryption  aes-256-gcm  -
rpool/data/vm-100-disk-1          encryption  aes-256-gcm  -
rpool/data/vm-100-disk-1@working  encryption  aes-256-gcm  -
rpool/var-lib-vz                  encryption  off          default

Encrypting the entire pool is not possible, it only works at dataset level.

What do I have to do so that Proxmox creates the subvols under hdd/storage?

 

[bamf]

Seems I did something wrong when creating the pool. Fixed it:

zpool create -o ashift=12 -o feature@encryption=enabled -O encryption=on -O keylocation=file:///.data.key -O keyformat=raw hdd-storage mirror /dev/sda /dev/sdb

Looks better:

hdd-storage                       encryption  aes-256-gcm  -
hdd-storage/subvol-110-disk-0     encryption  aes-256-gcm  -