Newly created ZFS pool lacks recovery key / encryption key status is blank

I’ve created a new ZFS pool from a single nvme disk using the following command:

incus storage create nvmedata zfs source=/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_1TB_XXX source.wipe=true

ZFS pool is created and available for use, however I can’t verify that it is indeed encrypted. There is no pool recovery key for this particular pool in incus admin os system security show , and encryption_key_status for the pool shows up as “-”

Documentation suggests that all zfs pools are created as encrypted, so I’m a bit torn here and not sure how I can verify that. any suggestions?

Incus itself doesn’t know how to do ZFS encryption so if you’re having Incus itself create the pool, there won’t be any encryption on it.

Instead what you want is for IncusOS itself to create the pool for you.

Ah, I see. My apologizes, the immediate distinction between incus and incusos storage management was not obvious to me in this case.

Which brings me to my next question - is there a way to partition these disks with incus before adding them to the zfs pools? What I’m actually trying to do is use part of the nvme drive for a whole zfs pool, and another part of it as a cache drive for a sata disk pool.

Not at the moment. We’ve generally been trying to stay away from exposing partitioning through the storage API partly due to how complex things could get pretty quickly but also because of ZFS generally recommending to stay away from using partitions and instead always providing full disks whenever possible.

Of course your particular case is a somewhat common one where partitioning is usually fine.

There are some tricks you can use to do ZFS setups that IncusOS doesn’t officially support, the most common way being to pass /dev/zfs as a unix-char device to a privileged container, allowing that container to directly interact with ZFS on the host.
unix-block devices can be used to pass the disks that need formatting, then adding more unix-block devices for the partitions so they can be added to ZFS.

Definitely a bit of a hack though :slight_smile:

1 Like