ONTAP ANDU中にオンボードキーのインポート失敗により自動ギブバックが失敗します
環境
- ONTAP 9.8以降
- オンボード キー マネージャ
- 自動無停止アップグレード（ANDU）
- Trusted Platform Module（TPM）によるマザーボード交換
問題
- ANDUのアップグレード、show key import failuresのEMSログ：
[node-02: wafl_exempt00: crypto.ssal.failed:alert]: SSAL operation failed: SSAL Unseal operation failed.
[node-02: wafl_exempt00: crypto.debug:info]: Onboard key hierarchy import failed: failed to create NKEK: 31.
[node-02: wafl_exempt00: crypto.okmrecovery.failed:alert]: ERROR: Import of the onboard key hierarchy failed: failed to import key hierarchy. Additional information: error: ssal unseal failed.
- SKTRACE.GZ で表示される TSS エラー
2021-08-22T21:51:01Z 24880865537178 [0:0] SSAL_Error: tss_tpm_load:438 tss_execute failed
2021-08-22T21:51:01Z 24880865540576 [0:0] SSAL_Error: crypto_ssal_tpm_unseal:226 tss_tpm_load failed
2021-08-22T21:51:01Z 24880865638452 [0:0] SSAL_Error: tss_log_error:232 crypto_ssal_tpm_unseal: failed, rc 000b0009
2021-08-22T21:51:01Z 24880865640870 [0:0] SSAL_Error: tss_log_error:234 TSS_RC_BAD_CONNECTION - Failure communicating with lower layer
2021-08-22T21:51:01Z 24880865643199 [0:0] SSAL_Error: crypto_ssal_fs_unseal:167 The public portion of the blob should be NULL and of size 0
- ボリューム暗号化キーがないためギブバックが拒否されました
[node-01: cf_giveback: gb.sfo.veto.kmgr.keysmissing:error]: Giveback of aggregate aggr1_n02 failed due to unavailability of volume encryption keys for the encrypted volumes of the aggregate on the partner node node-02.
[node-01: cf_giveback: sfo.sendhome.subsystemAbort:alert]: The giveback operation of 'aggr1_n02' was aborted by 'keymanager'.