Unjoin of node fails due to SEDs
Applies to
- ONTAP 9
- NetApp Storage Encryption(NSE)
Issue
- Unable to unjoin the nodes from the cluster, gives below error:
cluster1::*> cluster unjoin -node cluster-n02
Error: command failed: Cannot remove node "cluster-n02" because its self-encrypting drives use authentication keys (AKs) that will not be available to the node after it leaves the cluster. Use the "storage encryption disk show" and "storage encryption disk modify" commands to set the FIPS and data AKs of devices owned by the node and the failover partner to the default manufacture secure ID (MSID), keyID 0x0.
- In this case when tried to set the keys to default
0x0
for both the nodecluster-n01
andcluster-n02
only the drives under the ownership of nodecluster-n01
got modified to0x0
cluster1::*> storage encryption disk modify -disk 1.* -data-key-id 0x0
12 entries were acted on.
cluster1::*> storage encryption disk show-status
FIPS Latest Start Execution Disks Disks Disks
Node Support Request Timestamp Time (sec) Begun Done Successful
------- ------- -------- ------------------ ---------- ------ ------ ----------
cluster1-n01 true modify 8/15/2023 19:44:30 2 6 6 6
cluster1-n02 true modify 8/15/2023 19:44:30 5 6 6 0
cluster-n03 true unknown - - - - -
cluster-n04 true unknown - - - - -
4 entries were displayed.
cluster1::*> storage encryption disk show
Disk Mode Data Key ID
-------- ---- ----------------------------------------------------------------
1.0.0 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.1 open 0x0
1.0.2 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.3 open 0x0
1.0.4 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.5 open 0x0
1.0.6 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.7 open 0x0
1.0.8 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.9 open 0x0
1.0.10 data 00000000000000000xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1.0.11 open 0x0