remote spoke
Chicken or the egg scenario.
I have got a flexgroup that's 150Tb large.
6 constituent volumes that I need to vol move into a new environment.
No big deal, except the destination aggregates are all encrypted with NAE.
When attempting to vol move them I get waived off because not all constituents are encrypted, but I can't ... Encrypt them... Without moving them.
Am I stuck at making a new FG and migrating into that?
south cliff
Did you try with -encrypt-with-aggr-key true?
Does this help?
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_are_the_restrictions_with_FlexGroup_volumes_and_NAE
remote spoke
Did you try with ```-encrypt-with-aggr-key true```?
Sure did.
It whines that it won't move because the other constituents aren't encrypted too lol
south cliff
But why some constituents are encrypted and some not?
remote spoke
0 are today
The goal is 100%
Moving from nodes with 0 encrypted aggregates to new nodes being 100% encrypted
south cliff
I did not work much with FlexGroups yet but can't you encrypt it in-place?
volume encryption conversion start
And then move it to another aggr once all constituents are encrypted
remote spoke
I probably can.
I've not explored NVE command set much, I'll investigate that next.
south rover
You have to convert all members to NVE first. Can be done in place. Then you can migrate with the aggregate key option
Set advanced
Vol encryption conversion start -vserver <vserver> -volume <fg_member>
(I think that is the command)
It takes a while. Another option is:
vol move start -vserver <vserver> -volume <fg_member> -encrypt-destination true -aggregate <same-as-source >
The move requires space for a second copy but I hear it’s faster then the encryption/conversion/start
After all the members are NVE, you can then try your move to encrypted aggregate again. I’ve done this process many times with customers and I know it works. It just takes time