Azure / Azure/azure-linux-extensions
ADE: discrepancy when reporting the disks encryption status
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
We have encrypted the **OS** and **Data** disks on a Ubuntu VM a few days ago.
We can see discrepancy in the data disk encryption status depending on the tool used to query the status.
AzureDiskEncryptionForLinux version is **1.1.0.17**
OS and data disks are **encrypted**:
```
root@testencrypt12:~# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdd 8:48 0 30G 0 disk
└─sdd1 8:49 0 30G 0 part
└─4aa3a0e6-f951-4469-b4cd-d875f0ac4454 253:2 0 30G 0 crypt /datadrive
sdb 8:16 0 14G 0 disk
└─sdb1 8:17 0 14G 0 part
└─554e2186-59a8-4f4d-9239-f06cfbd3a17c 253:1 0 14G 0 crypt /mnt/resource
sdc 8:32 0 48M 0 disk
└─sdc1 8:33 0 47M 0 part
sda 8:0 0 30G 0 disk
├─sda2 8:2 0 254.1M 0 part /boot
└─sda1 8:1 0 29.8G 0 part
└─osencrypt 253:0 0 29.8G 0 crypt /
```
**Powershell** report the data status correctly:
```
PS Azure:\> Get-AzureRmVMDiskEncryptionStatus -ResourceGroupName rg2 -VMName testencrypt12
OsVolumeEncrypted : Encrypted
DataVolumesEncrypted : Encrypted
OsVolumeEncryptionSettings : Microsoft.Azure.Management.Compute.Models.DiskEncryptionSettings
ProgressMessage : Provisioning succeeded
```
The Encryption on the data disk show as **Not enabled** on the **Azure Portal**:

**az cli** reports the data disk as **Disk is not encrypted** althought the substatus report it as **Encrypted**:
```
$ az vm encryption show --resource-group rg2 --name testencrypt12
[ -- cut --]
"name": "testencrypt12_OsDisk_1_a68b55546fc8dcd0673705c7b47b6b47",
"statuses": [
{
"code": "EncryptionState/encrypted",
"displayStatus": "Encryption is enabled on disk",
"level": "Info",
"message": null,
"time": null
}
]
},
{
"encryptionSettings": null,
"name": "datadisk1",
"statuses": [
{
"code": "EncryptionState/notEncrypted",
"displayStatus": "Disk is not encrypted",
"level": "Info",
"message": null,
"time": null
}
]
}
],
"status": [
{
"code": "ProvisioningState/succeeded",
"displayStatus": "Provisioning succeeded",
"level": "Info",
"message": "",
"time": null
}
],
"substatus": [
{
"code": "ComponentStatus/Microsoft.Azure.Security.AzureDiskEncryptionForLinux/succeeded",
"displayStatus": "Provisioning succeeded",
"level": "Info",
"message": "{\"os\": \"Encrypted\", \"data\": \"Encrypted\"}",
"time": null
}
]
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
No project files or tests are named. Start by reproducing the discrepancy with AzureDiskEncryptionForLinux, PowerShell, az CLI, and the Azure Portal, then trace how the OS and data disk statuses are reported. Done means the data disk encryption status is reported consistently across these tools.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, linux, python, ubuntu
- Domain
- cloud, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100