RAID+LUKS+LVM Disk Expansion: A Deep Dive into the Tricky Terrain

Опубликовано: 02 Апрель 2026
на канале: tinyfreed0m

243

Learn how to resize the underlying disks or partitions of a RAID+LUKS+LVM with no downtime nor data loss.

This video goes through the naive, but wrong, approach and then the correct one. Explaining the rationale behind every choice.

00:00 Introduction
01:47 WRONG naive approach
17:07 CORRECT approach
25:57 solutions to common mistakes
28:40 recap and leanings

On Debian 10. Old array (RAID1) is /dev/md0 (/dev/sdb1 + /dev/sdd1), new array
(RAID1) is /dev/md2 (/dev/sdd + /dev/sdb).

Final result

Output of `lsblk`:

```bash
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 3.6T 0 disk
└─md2 9:2 0 3.6T 0 raid1
└─md2_crypt 253:4 0 3.6T 0 crypt
├─main-home 253:5 0 509.3G 0 lvm /home
├─main-data 253:6 0 2T 0 lvm /data
└─main-swap 253:7 0 3.8G 0 lvm
sdd 8:48 0 3.6T 0 disk
└─md2 9:2 0 3.6T 0 raid1
└─md2_crypt 253:4 0 3.6T 0 crypt
├─main-home 253:5 0 509.3G 0 lvm /home
├─main-data 253:6 0 2T 0 lvm /data
└─main-swap 253:7 0 3.8G 0 lvm
```

CORRECT approach (2nd in the video)

```bash
we remove /dev/sdd1 from the RAID
mdadm --manage /dev/md0 --fail /dev/sdd1
mdadm --manage /dev/md0 --remove /dev/sdd1
lsblk
we remove the RAID superblock from /dev/sdd1
mdadm --zero-superblock /dev/sdd1 # or wipefs -a /dev/sdd1
we create a new RAID1 array with only /dev/sdd (don't use a partition this time)
mdadm --create --verbose /dev/md2 --level=1 --raid-devices=1 /dev/sdd --force # force is due to only having one disk in RAID1
we encrypt the whole RAID device, not a partition
cryptsetup -v --cipher aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 5000 --use-random --verify-passphrase luksFormat /dev/md2
we open the encrypted device
cryptsetup luksOpen /dev/md2 md2_crypt
we create a LVM physical volume on the encrypted device
pvcreate /dev/mapper/md2_crypt
we add the newly created physical volume to the exisitng volume group
vgextend main /dev/mapper/md2_crypt
we check the physical volumes
pvdisplay -m
we move the data from the old physical volume to the new one
pvmove /dev/mapper/md0p1_crypt /dev/mapper/md2_crypt
we check the disk layout
lsblk
we adapt the crypttab, to include the new encrypted device
vim /etc/crypttab
pvdisplay /dev/mapper/md0p1_crypt
we remove the old physical volume from the volume group
vgreduce main /dev/mapper/md0p1_crypt
we check the disk layout
lsblk
we close the old encrypted device
cryptsetup luksClose md0p1_crypt
we stop the old RAID array
mdadm --stop /dev/md0
we remove the RAID superblock from the old RAID array disk
mdadm --zero-superblock /dev/sdb1 # or wipefs -a /dev/sdb1
we add the old disk to the new RAID array, not a partition this time
mdadm --grow /dev/md2 --add /dev/sdb --raid-devices=2
we check the RAID status
watch cat /proc/mdstat
we update the RAID configuration, important for the initramfs
mdadm --detail --scan (angled bracket) /etc/mdadm/mdadm.conf
we update the initramfs
update-initramfs -u
reboot
lsblk
```

Telegram group: https://t.me/tinyfreed0m
Telegram channel: https://t.me/tinyfreed0m_channel