Why does a replication task with encryption off turn the target dataset into encryption root on first run?

TrueNAS General
21

So here’s the kicker. The “Include Dataset Properties” and “Properties Exclude”, work as advertised (whether you use the GUI or command-line.)

With the one exception… encryption.

If the source dataset is encrypted, specifying “Include Dataset Properties” (i.e, zfs send -p) automatically adds the -w flag for a “raw stream”.

This means that -x encryption (or “Properties Exclude”) to have the destination inherit its encryption properties from the parent will only work if the source is not encrypted.

Therefor, you’re forced into an “all or nothing” in regards to the destination dataset’s properties… if the source is encrypted.

So you have two options:

  1. Uncheck “Include Dataset Properties” and write encryption in the “Properties Exclude” field.

Or…

  1. Leave “Include Dataset Properties” checked, and leave “Properties Exclude” blank, which will result in a “raw stream” (and locked destination, unless you explicitly unlock it).

Option 2 is basically what you’ve been doing from the beginning.

1 Like
22

Thanks for looking so deep into it! The second option seems good enough, I’ll go with that then. They should really fix their stuff and change the checkbox to Properties exclude (with one exception), though! :smiley:

23

But then if the source is unencrypted, there is no exception, thus typing “encryption” in the “Properties Exclude” field will work. :stuck_out_tongue:

Native ZFS encryption of a dataset creates caveats for what used to be consistent “rules”. (For example, “embedded blocks” are not used if the dataset is encrypted.)

1 Like