Best way to migrate data to encrypted pool?

[roemer]

What is the best way to migrate an existing (unencrypted) ZFS dataset to an encrypted ZFS dataset?
I tried zfs send/receive, but get only an error message that the encrypted dataset cannot accept an unencrypted data stream.

Code: Select all

  zfs send -ceLv src/myfiles@migration | zfs recv -s replica/encrypted/myfiles
       ...
     cannot receive new filesystem stream: incompatible embedded data stream feature with encrypted receive.


Am I missing something? Or do I have to use a standard file sync tool such as rsync or ChronoSync for this?
This would be sad because in my experience, zfs send/recv would be much faster...

[lundman]

I think it was suppose to be relying on inheritance?

zfs create -o encryption=on POOL/top
..... | zfs recv POOL/top/recvfs

So recvfs gets encrypted root of "top". Been a while since I played with it though.

[roemer]

That's what I tried to do in my original command: 'replica/enrypted' was the encrypted destination dataset, of which 'myfiles' should become a sub-dataset, inheriting the encryption property...

I played around a bit more with two temporary pools on /tmp and the following seems to work:

Code: Select all

 zfs send -Lv src/myfiles | zfs recv -sv replica/encrypted/myfiles


Apparently neither the '-R', the '-p' or the '-e' flag can be used on the send side, and no '-F' on the receive side.

There is a discussion about this on the ZOL GitHub, but the solution is a bit hidden within all the messages (cf. comment from tcaputi from 1 Nov 2017 and from aarononeal on 12 Feb):
https://github.com/zfsonlinux/zfs/issues/6793

[lundman]

I caught up with all the zfs send --raw and encryption commits yesterday in master, should they have fixed something