az vm encryption enable continues even if it cannot write secret to vault
Open
act-codegen-extensibility-squad
Compute - Extensions
question
Service Attention
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
I have tested the following scenarios and established that each time the key is not written to the vault, and there is no error in the CLI, but encryption proceeds.
This means that if the VM is stopped/deallocated and then started up, the access to the encrypted volume is lost, and it is unrecoverable.
The only clue is some 500 errors which show in the logs for the ADE extension afterwards:
1. KV & VM in different sub
2. KV & VM in different region
3. KV & VM in different RG with just short path used for --disk-encryption-keyvault rather than full resource ID
4. ADE access not enabled on the KV
In each case, encryption proceeds without any warning, and no secrets are written to the vault.
Contributor guide
Assessment
This issue has not been assessed yet.