Ubuntu 22.04.5, 24.04.2 LTS Server - ADE - Rotate KEK - Reencrypt Failure - ValueError: True is not in list - handle.py, line 361

ValueError: True is not in list
handle.py, line 361 is vague at best.

---

Summary...

- Allowing Azure to automatically re-encrypt VM after rotating the Key Encryption Key (KEK) failed.
- Attempting to use Azure Powershell to activate re-encryption sequence failed.
- Now, attempting to manually update Ubuntu 24.04.2 VM from CLI using cryptsetup commands... first attempt failed, and we had to restore from SNAPSHOT. LUKS key was updated, but the disk was not actually re-encrypted... researching further... and determining how to update the /mnt/azure_bek_disk/LinuxPassPhraseFileName manually.

`sudo cryptsetup luksChangeKey /dev/sda1 --key-file /mnt/azure_bek_disk/LinuxPassPhraseFileName --header /boot/luks/osluksheader`

---

After initially rotating encryption key in KeyStore/KEK with PowerShell to simulate yearly policy and test backup/restore methods... Ubuntu 24.04.2 VM serial console output appears to hint that Azure is attempting to re-encrypt the VM failed (verified)...

```
[AzureDiskEncryption] 1797: [Info] After key addition, keyslots for /dev/disk/azure/scsi1/lun0-part1: []
[AzureDiskEncryption] 1797: [Info] Path /mnt/azure_bek_disk already exists.
[AzureDiskEncryption] 1797: [Info] BEK Volume already in expected state.
[AzureDiskEncryption] 1797: [Info] Failed to store BEK in BEK VOLUME with error: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 44, in store_bek_passphrase
self.store_passphrase(key_File_Path=self.bek_filesystem_mount_point,
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/AbstractBekUtilImpl.py', line 63, in store_passphrase
f.write(passphrase)
TypeError: a bytes-like object is required, not 'str'

[AzureDiskEncryption] 1797: [Warning] Failed to clear new luks key with error: a bytes-like object is required, not 'str', stack trace: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 498, in clear_new_luks_keys
bek_util.store_bek_passphrase(encryption_config, old_passphrase)
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtil.py', line 47, in store_bek_passphrase
return self.bekUtilImpl.store_bek_passphrase(encryption_config,passphrase)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 50, in store_bek_passphrase
raise e
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 44, in store_bek_passphrase
self.store_passphrase(key_File_Path=self.bek_filesystem_mount_point,
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/AbstractBekUtilImpl.py', line 63, in store_passphrase
f.write(passphrase)
TypeError: a bytes-like object is required, not 'str'

[AzureDiskEncryption] 1797: [Error] Failed to update encryption settings with error: True is not in list, stack trace: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list
```

---

Then, attempting to re-encrypt with Azure Powershell...

```
$ResourceGroupName = 'rg-infra-subscription'
$VMName = 'vm-subscription-vmname'
$KeyVaultName = 'kv-subscription'
$KeyVaultKeyName = 'key-subscription-kek' # Key Exchange Key
$KeyVaultKeyUrl = (Get-AzKeyVaultKey -VaultName $KeyVaultName -Name $KeyVaultKeyName).Key.kid
$KeyVaultResourceId = (Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $ResourceGroupName).ResourceId
$KeyVaultUri = (Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $ResourceGroupName).VaultUri
$AzVMDiskEncryptionExtension = @{
Debug = $true
DiskEncryptionKeyVaultId = $KeyVaultResourceId
DiskEncryptionKeyVaultUrl = $KeyVaultUri
Force = $true
KeyEncryptionKeyUrl = $KeyVaultKeyUrl
KeyEncryptionKeyVaultId = $KeyVaultResourceId
ResourceGroupName = $ResourceGroupName
SequenceVersion = [Guid]::NewGuid() # not sure if this is really needed; If you've made changes to the disk or VM, re-run the encryption script using the "sequence version" variable.
SkipVMBackup = $true
VMName = $VMName
VolumeType = 'All'
#VolumeType = 'OS' # Exception: Moving from volume type All to volume type OS is not allowed
}
[void] (Set-AzVMDiskEncryptionExtension @AzVMDiskEncryptionExtension)
```

Output...

```
Long running operation failed with status 'Failed'. Additional Info:'VM has reported a failure when processing extension 'AzureDiskEncryptionForLinux' (publisher 'Microsoft.Azure.Security' and type 'AzureDiskEncryptionForLinux'). Error message: 'Failed to update encryption settings with error: True is not in list, stack trace: Traceback (most recent call last):
File "/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py", line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list
'. More information on troubleshooting is available at https://aka.ms/VMExtensionADELinuxTroubleshoot. '
ErrorCode: VMExtensionProvisioningError
ErrorMessage: VM has reported a failure when processing extension 'AzureDiskEncryptionForLinux' (publisher 'Microsoft.Azure.Security' and type 'AzureDiskEncryptionForLinux'). Error message: 'Failed to update encryption settings with error: True is not in list, stack trace: Traceback (most recent call last):
File "/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py", line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list
'. More information on troubleshooting is available at https://aka.ms/VMExtensionADELinuxTroubleshoot.
```

From Serial Console...
```
[AzureDiskEncryption] 15429: [Info] Executing: lsblk -o NAME,TYPE,FSTYPE,LABEL,SIZE,RO,MOUNTPOINT
[AzureDiskEncryption] 15429: [Info]
NAME TYPE FSTYPE LABEL SIZE RO MOUNTPOINT
loop0 loop 64M 1 /snap/core20/2379
loop1 loop 87M 1 /snap/lxd/29351
loop2 loop 63.7M 1 /snap/core20/2434
loop3 loop 89.4M 1 /snap/lxd/31333
loop4 loop 38.8M 1 /snap/snapd/21759
loop5 loop 44.4M 1 /snap/snapd/23545
sda disk 256G 0
sda1 part 255.6G 0
osencrypt crypt ext4 cloudimg-rootfs 255.6G 0 /
sda2 part ext2 256M 0 /boot
sda14 part 4M 0
sda15 part vfat UEFI 106M 0 /boot/efi
sdb disk 48M 0
sdb1 part vfat BEK VOLUME 46M 0 /mnt/azure_bek_disk

[AzureDiskEncryption] 15429: [Info] WARNING: likely app compat issue [/etc/init.d/docker]
[AzureDiskEncryption] 15429: [Info] PRECHECK: Likely app compat issue detected
[AzureDiskEncryption] 15429: [Info] WARNING: unsupported mount scheme [/boot /boot/efi]
[AzureDiskEncryption] 15429: [Info] WARNING: unsupported mount scheme [/run/snapd/ns /run/snapd/ns/lxd.mnt]
[AzureDiskEncryption] 15429: [Info] PRECHECK: Unsupported mount scheme detected
[AzureDiskEncryption] 15429: [Info] PRECHECK: Precheck failure, incompatible environment suspected
[AzureDiskEncryption] 15429: [Info] handle.py found enable encryption operation
[AzureDiskEncryption] 15429: [Info] BEK util path is followed according to VM security type TrustedLaunch
[AzureDiskEncryption] 15429: [Info] Current config KeyEncryptionKeyURL https://kv-subscription.vault.azure.net/keys/key-subscription-kek/36c1xxxxxxxxxxxxxxxxxxxxxxxxe90e differs from effective config KeyEncryptionKeyURL https://kv-subscription.vault.azure.net/keys/key-subscription-kek/63fdxxxxxxxxxxxxxxxxxxxxxxxx9352
[AzureDiskEncryption] 15429: [Info] Config has changed, updating encryption settings
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Found OS block device: /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Executing: dmsetup deps -o blkdevname /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Normalized OS block device: /dev/sda1
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sda
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sdb
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] device_item == name:loop0 type:loop fstype: mountpoint:/snap/core20/2379 label: model: size:67080192 majmin:7:0 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop0 type:loop fstype: mountpoint:/snap/core20/2379 label: model: size:67080192 majmin:7:0 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:loop1 type:loop fstype: mountpoint:/snap/lxd/29351 label: model: size:91267072 majmin:7:1 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop1 type:loop fstype: mountpoint:/snap/lxd/29351 label: model: size:91267072 majmin:7:1 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:loop2 type:loop fstype: mountpoint:/snap/core20/2434 label: model: size:66789376 majmin:7:2 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop2 type:loop fstype: mountpoint:/snap/core20/2434 label: model: size:66789376 majmin:7:2 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:loop3 type:loop fstype: mountpoint:/snap/lxd/31333 label: model: size:93745152 majmin:7:3 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop3 type:loop fstype: mountpoint:/snap/lxd/31333 label: model: size:93745152 majmin:7:3 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:loop4 type:loop fstype: mountpoint:/snap/snapd/21759 label: model: size:40714240 majmin:7:4 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop4 type:loop fstype: mountpoint:/snap/snapd/21759 label: model: size:40714240 majmin:7:4 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:loop5 type:loop fstype: mountpoint:/snap/snapd/23545 label: model: size:46596096 majmin:7:5 device_id:
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:loop5 type:loop fstype: mountpoint:/snap/snapd/23545 label: model: size:46596096 majmin:7:5 device_id:, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sda type:disk fstype: mountpoint: label: model:Virtual size:274877906944 majmin:8:0 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:sda type:disk fstype: mountpoint: label: model:Virtual size:274877906944 majmin:8:0 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sda1 type:part fstype: mountpoint: label: model: size:274493062144 majmin:8:1 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:sda1 type:part fstype: mountpoint: label: model: size:274493062144 majmin:8:1 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:osencrypt type:crypt fstype:ext4 mountpoint:/ label:cloudimg-rootfs model: size:274493062144 majmin:252:0 device_id:
[AzureDiskEncryption] 15429: [Warning] the device type: crypt is not supported yet, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sda2 type:part fstype:ext2 mountpoint:/boot label: model: size:268435968 majmin:8:2 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sda2
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] the mountpoint is the azure disk root or resource, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sda14 type:part fstype: mountpoint: label: model: size:4194304 majmin:8:14 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:sda14 type:part fstype: mountpoint: label: model: size:4194304 majmin:8:14 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sda15 type:part fstype:vfat mountpoint:/boot/efi label:UEFI model: size:111149056 majmin:8:15 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Warning] the device size is too small,111149056 so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sdb type:disk fstype: mountpoint: label: model:Virtual size:50331648 majmin:8:16 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Info] there's no file system on this device: name:sdb type:disk fstype: mountpoint: label: model:Virtual size:50331648 majmin:8:16 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb, so skip it.
[AzureDiskEncryption] 15429: [Info] device_item == name:sdb1 type:part fstype:vfat mountpoint:/mnt/azure_bek_disk label:BEK model: size:48234496 majmin:8:17 device_id:f8b3781a-1e82-4818-a1c3-63d806ec15bb
[AzureDiskEncryption] 15429: [Warning] the device size is too small,48234496 so skip it.
[AzureDiskEncryption] 15429: [Info] Required devices not encrypted for volume type All. Calling update to stamp encryption settings.
[AzureDiskEncryption] 15429: [Info] Updating encryption settings
[AzureDiskEncryption] 15429: [Info] Current secret was created in operation #0
[AzureDiskEncryption] 15429: [Info] The update call is operation #1
[AzureDiskEncryption] 15429: [Info] Executing: mount /boot
[AzureDiskEncryption] 15429: [Info] Command mount /boot failed with return code 32
stdout:

stderr:
mount: /boot: /dev/sda2 already mounted on /boot.
dmesg(1) may have more information after failed mount system call.

[AzureDiskEncryption] 15429: [Info] BEK util path is followed according to VM security type TrustedLaunch
[AzureDiskEncryption] 15429: [Info] BEK util path is followed according to VM security type TrustedLaunch
[AzureDiskEncryption] 15429: [Info] Path /mnt/azure_bek_disk already exists.
[AzureDiskEncryption] 15429: [Info] BEK Volume already in expected state.
[AzureDiskEncryption] 15429: [Info] Recreating secret to store in the KeyVault
[AzureDiskEncryption] 15429: [Info] Consolidating azure_crypt_mount
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] OS mapper name osencrypt
[AzureDiskEncryption] 15429: [Info] Using crypttab instead of azure_crypt_mount file.
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Found OS block device: /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Executing: dmsetup deps -o blkdevname /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Normalized OS block device: /dev/sda1
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sda
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sdb
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] osencrypt is one of special azure devices that should be not considered data disks.
[AzureDiskEncryption] 15429: [Info] OS volume / is mounted from /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] sda2 is one of special azure devices that should be not considered data disks.
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] OS mapper name osencrypt
[AzureDiskEncryption] 15429: [Info] Using crypttab instead of azure_crypt_mount file.
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Found OS block device: /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Executing: dmsetup deps -o blkdevname /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Normalized OS block device: /dev/sda1
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sda
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sdb
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] osencrypt is one of special azure devices that should be not considered data disks.
[AzureDiskEncryption] 15429: [Info] OS volume / is mounted from /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] sda2 is one of special azure devices that should be not considered data disks.
[AzureDiskEncryption] 15429: [Info] Executing: /sbin/cryptsetup luksDump /dev/disk/azure/scsi1/lun0-part1
[AzureDiskEncryption] 15429: [Info] Command /sbin/cryptsetup luksDump /dev/disk/azure/scsi1/lun0-part1 failed with return code 4
stdout:

stderr:
Device /dev/disk/azure/scsi1/lun0-part1 does not exist or access denied.

[AzureDiskEncryption] 15429: [Info] Before key addition, keyslots for /dev/disk/azure/scsi1/lun0-part1: []
[AzureDiskEncryption] 15429: [Info] Adding new key for /dev/disk/azure/scsi1/lun0-part1
[AzureDiskEncryption] 15429: [Info] Executing: /sbin/cryptsetup luksAddKey /dev/disk/azure/scsi1/lun0-part1 /tmp/tmpcrrq4de9 -d /mnt/azure_bek_disk/LinuxPassPhraseFileName -q
[AzureDiskEncryption] 15429: [Info] Command /sbin/cryptsetup luksAddKey /dev/disk/azure/scsi1/lun0-part1 /tmp/tmpcrrq4de9 -d /mnt/azure_bek_disk/LinuxPassPhraseFileName -q failed with return code 4
stdout:

stderr:
Device /dev/disk/azure/scsi1/lun0-part1 does not exist or access denied.

[AzureDiskEncryption] 15429: [Info] luks add result is 4
[AzureDiskEncryption] 15429: [Info] Executing: /sbin/cryptsetup luksDump /dev/disk/azure/scsi1/lun0-part1
[AzureDiskEncryption] 15429: [Info] Command /sbin/cryptsetup luksDump /dev/disk/azure/scsi1/lun0-part1 failed with return code 4
stdout:

stderr:
Device /dev/disk/azure/scsi1/lun0-part1 does not exist or access denied.

[AzureDiskEncryption] 15429: [Info] After key addition, keyslots for /dev/disk/azure/scsi1/lun0-part1: []
[AzureDiskEncryption] 15429: [Info] Path /mnt/azure_bek_disk already exists.
[AzureDiskEncryption] 15429: [Info] BEK Volume already in expected state.
[AzureDiskEncryption] 15429: [Info] Failed to store BEK in BEK VOLUME with error: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 44, in store_bek_passphrase
self.store_passphrase(key_File_Path=self.bek_filesystem_mount_point,
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/AbstractBekUtilImpl.py', line 63, in store_passphrase
f.write(passphrase)
TypeError: a bytes-like object is required, not 'str'

[AzureDiskEncryption] 15429: [Warning] Failed to clear new luks key with error: a bytes-like object is required, not 'str', stack trace: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 498, in clear_new_luks_keys
bek_util.store_bek_passphrase(encryption_config, old_passphrase)
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtil.py', line 47, in store_bek_passphrase
return self.bekUtilImpl.store_bek_passphrase(encryption_config,passphrase)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 50, in store_bek_passphrase
raise e
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/BekUtilVolumeImpl.py', line 44, in store_bek_passphrase
self.store_passphrase(key_File_Path=self.bek_filesystem_mount_point,
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/AbstractBekUtilImpl.py', line 63, in store_passphrase
f.write(passphrase)
TypeError: a bytes-like object is required, not 'str'

[AzureDiskEncryption] 15429: [Error] Failed to update encryption settings with error: True is not in list, stack trace: Traceback (most recent call last):
File '/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.4.0.10/main/handle.py', line 361, in update_encryption_settings
new_keyslot = list([x[0] != x[1] for x in zip(before_keyslots, after_keyslots)]).index(True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: True is not in list

[AzureDiskEncryption] 15429: [Info] Path /mnt/azure_bek_disk already exists.
[AzureDiskEncryption] 15429: [Info] BEK Volume already in expected state.
[AzureDiskEncryption] 15429: [Info] Executing: /bin/umount /mnt/azure_bek_disk
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Found OS block device: /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] Executing: dmsetup deps -o blkdevname /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] Normalized OS block device: /dev/sda1
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sda
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] getting blk info for: /dev/sdb
[AzureDiskEncryption] 15429: [Info] Executing: lvs --noheadings --nameprefixes --unquoted -o lv_name,vg_name,lv_kernel_major,lv_kernel_minor
[AzureDiskEncryption] 15429: [Info] osencrypt is one of special azure devices that should be not considered data disks.
[AzureDiskEncryption] 15429: [Info] OS volume / is mounted from /dev/mapper/osencrypt
[AzureDiskEncryption] 15429: [Info] sda2 is one of special azure devices that should be not considered data disks.
2025/04/08 15:58:35.715233 Info Information: EventLogging severity level setting is 2
2025/04/08 15:58:35.750043 Info starting enable
2025/04/08 15:58:35.750200 Info patch_class_name: UbuntuPatching and orig_distro: Ubuntu
```

Start with main/handle.py around update_encryption_settings at line 361, then read BekUtilVolumeImpl.py and AbstractBekUtilImpl.py around the reported bytes-versus-string failure. Reproduce the Azure Disk Encryption key-rotation path using the logged LUKS and BEK-volume conditions, and compare the before/after keyslot state. Done requires a confirmed failure cause and tests or verification covering the affected path.

Written by the indexing model from the issue text.