Can an ONTAP Upgrade be performed without knowing the Cluster Passphrase
Applies to
- ONTAP 9
- Onboard Key Manager (OKM)
Answer
Yes, an ONTAP upgrade can be performed even if the cluster's passphrase is unknown. However, certain prerequisites and considerations must be addressed based on the cluster's configuration and security settings.
Scenarios Requiring a Cluster Passphrase During Node Reboot:
-
Compliance Mode (cc-mode) Enabled:
- If the cluster is in compliance mode and a re-sync has not been completed, a re-sync will be required.
- If a motherboard (MB) replacement is necessary, a passphrase will be required.
- For more details, refer to KB: ONTAP Upgrade paused pending OKM cluster passphrase.
-
Encryption Keys Not in Sync:
- After the upgrade or a node reboot, if encryption keys are not synchronized, the giveback operation will fail.
- In such cases, a re-sync of the keys is required, which will necessitate the cluster passphrase.
Potential Impact on the Upgrade Process:
Until the encryption keys are fully synchronized, there is a risk that the upgrade process may not proceed as expected. It is critical to ensure key synchronization and address any passphrase-related requirements before initiating the upgrade to avoid disruptions.
