How to check encryption at rest is working.

Context

When updating a cluster to use encryption at rest it is useful to know when this is working after configuring it.

---

Method

Prerequisties: xxd

On the machine required to have encryption enabled. Dump the first 16 bytes of the first wblock on a device to a file using dd. In this example, we will create /tmp/as-dump.dat.

dd if=/dev/nvme001 of=/tmp/as-dump.dat bs=16 count=1 skip=524288

Then copy these 16 bytes to a machine that has xxd installed and run xxd against the file:

xxd as-dump.dat

When encryption is not enabled, the first four bytes will be 01f2 7a03, as seen below:

00000000: 01f2 7a03 0300 5004 f5f8 6f3d 4855 adff ..z...P...o=HU..

---