Adding an encrypted LUKS disk to a LUKS+LVM root filesystem?
https://askubuntu.com/questions/1563133/adding-an-encrypted-luks-disk-to-a-lukslvm-root-filesystemI have the following problem:
How can I add storage to a machine already using LUKS+LVM without being asked for a passphrase for every added disk?
Goal: Add space to the logical volume (LV) lv-var mounted on /var.
I'm using Ubuntu 24.04 LTS
What I tried:
- Added a new disk to the VM. It’s detected as sdb.
- Encrypted the disk with LUKS and opened it as luks_sdb.
- Opened the new disk’s LUKS container and created a physical volume (PV) on it.
- Added this PV to the volume group (VG) ubuntu-vg, where lv-var lives (using vgextend).
- Extended lv-var (using lvextend).
- Resized the filesystem with resize2fs because it’s ext4.
To avoid needing a separate passphrase prompt for each disk, I created a LUKS key:
- Created a keyfile and added it to the LUKS container.
- Updated /etc/crypttab and added an entry for the new disk with luks_sdb.
- Ran update-initramfs -u. Everything looked fine, so I rebooted to be sure. That’s when the bad news appeared.
It seems that because lv-var needs the device /dev/sdb and that disk is still encrypted at boot, almost everything fails... (I don’t fully understand what’s happening here).
I get a series of messages like:
mdadm: No arrays found in config file or automatically
Which is odd since I didn’t add anything with RAID.
Then:
ALERT! /dev/mapper/ubuntu--vg-ubuntu--lv does not exist. Dropping to a shell!
I end up in an initramfs shell (a minimal filesystem that helps boot Linux) with /bin/sh.
To get out, I have to run:
- cryptsetup open /dev/sdb luks_sdb It then asks the passphrase.
- exit
Then the boot process continues normally.
This isn’t very scalable — if I need to add three or four disks per machine, we’ll have to enter 4–5 passphrases just to reboot one machine.
P.S.: I already tried using initramfs hooks that should add the LUKS keyfile during boot, but that didn’t work... Maybe the LUKS+LVM setup was not thought to be used with adding encrypted disks to the root filesystem, in a logical volume such as /var, since we have on the fstab file: /var ext4 defaults 0 1, which will make this LV to mount at the same time as the root filesystem, I think.
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 35G 0 disk
├─sda1 8:1 0 1G 0 part /boot/efi
├─sda2 8:2 0 2G 0 part /boot
└─sda3 8:3 0 31.9G 0 part
└─dm_crypt-0 252:0 0 31.9G 0 crypt
├─ubuntu--vg-ubuntu--lv 252:2 0 14.4G 0 lvm /
├─ubuntu--vg-lv--opt 252:3 0 7.5G 0 lvm /opt
├─ubuntu--vg-lg--swap 252:4 0 5G 0 lvm [SWAP]
└─ubuntu--vg-lv--var 252:5 0 35G 0 lvm /var
sdb 8:16 0 500G 0 disk
└─luks_sdb 252:1 0 500G 0 crypt
└─ubuntu--vg-lv--var 252:5 0 35G 0 lvm /var
sr0 11:0 1 2.6G 0 rom
