# How to Create Encrypted Resources? (User Guide Incomplete)

**URL:** <https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859>\
**Category:** LINSTOR\
**Tags:** drbd\
**Created:** [June 12, 2025, 1:20am UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859 "2025-06-12T01:20:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![forbin](https://avatars.discourse-cdn.com/v4/letter/f/5e9695/32.png) [@forbin](https://forums.linbit.com/u/forbin)\
**Post date:** [June 12, 2025, 1:20am UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859/1 "2025-06-12T01:20:45Z")

</div>

I read the Linstor and DRBD user guides, and did the following, but the guides do not explain what to do next.

linstor encryption create-passphrase  
linstor enter passphrase  
linstor resource-group create --storage-pool sp0 --place-count 2 -l LUKS,STORAGE rg0  
linstor resource-group set-property rg0 PeerSlotsNewResource 3  
linstor resource-group drbd-options rg0 --auto-promote=no  
linstor rg spawn-resources rg0 site622 500G

 ![image](https://canada1.discourse-cdn.com/flex003/uploads/linbit/original/1X/068c8b0c96dea6ab7a18481251797576f8373628.png)

All that worked, and it leaves me with a resource that is in state “created” on both nodes. I’m used to seeing “UpToDate” and “Syncing”.

What’s the next step to bring the encrypted resource up so I can put a filesystem on it?

---

<div class="post-metadata">

**Author:** ![Devin](https://yyz1.discourse-cdn.com/flex003/user_avatar/forums.linbit.com/devin/32/26_2.png) [@Devin](https://forums.linbit.com/u/Devin)\
**Post date:** [June 13, 2025, 5:07pm UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859/2 "2025-06-13T17:07:53Z")

</div>

The layer-list you used here doesn’t include replication (DRBD).  
`linstor resource-group create --storage-pool sp0 --place-count 2 -l LUKS,STORAGE rg0`  
You’ve created just simple LVM volumes with LUKS encryption. Please note the user’s guide here where it [mentions adding a DRBD layer](https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-linstor-encrypted-volumes).

> Basic steps to use encryption:
> 
> 1. Create a master passphrase
> 2. Add `luks` to the layer-list. Note that all plugins (e.g., Proxmox) require a DRBD layer as the top most layer if they do not explicitly state otherwise.
> 3. Don’t forget to re-enter the master passphrase after a controller restart.

Try adding `DRBD` to your layer list.  
` linstor resource-group create --storage-pool sp0 --place-count 2 -l DRBD,LUKS,STORAGE rg0`

---

<div class="post-metadata">

**Author:** ![forbin](https://avatars.discourse-cdn.com/v4/letter/f/5e9695/32.png) [@forbin](https://forums.linbit.com/u/forbin)\
**Post date:** [June 23, 2025, 6:47pm UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859/3 "2025-06-23T18:47:21Z")

</div>

Hi Devin,

Apologies for the late reply. I had to travel on short notice and was gone for a week. Yes, you are correct. I was following the example commands and did not realize I needed to add the string “DRBD” to the layer list (although that makes perfect sense). I added it and the DRBD disk was created and is now doing its initial sync. Sync speed is still much lower than I am used to seeing, only 95MB as opposed to 300+ MB usually. But that’s another issue.

---

<div class="post-metadata">

**Author:** ![kreeuwijk](https://avatars.discourse-cdn.com/v4/letter/k/7ea924/32.png) [@kreeuwijk](https://forums.linbit.com/u/kreeuwijk)\
**Post date:** [July 15, 2025, 10:23am UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859/4 "2025-07-15T10:23:36Z")

</div>

How can I achieve the above with Piraeus? Is there a way to set the layer list on the `LinstorCluster` or the `StorageClass` resources to enable encryption on the cluster?

---

<div class="post-metadata">

**Author:** ![kreeuwijk](https://avatars.discourse-cdn.com/v4/letter/k/7ea924/32.png) [@kreeuwijk](https://forums.linbit.com/u/kreeuwijk)\
**Post date:** [July 15, 2025, 10:58am UTC](https://forums.linbit.com/t/how-to-create-encrypted-resources-user-guide-incomplete/859/5 "2025-07-15T10:58:45Z")

</div>

Ah it’s the `layerList` parameter on the StorageClass:

```auto
parameters:
  placementCount: "2"
  storagePool: "lvm-thin"
  resourceGroup: "lvm"
  layerList: "drbd luks storage"

```