With non-TPM scenario when trying to disable encryption it prompts to enter the recovery key even though the volume is mounted. According to implementation notes, it is expected that the system disables encryption without asking to enter the key in case volume is mounted.
vyos@vyos:~$ encryption disable Enter key:
Steps to reproduce:
encryption enable
encryption disable
Tested this scenario
vyos@vyos-def:~$ encryption enable WARNING: VyOS will boot into a default config when encrypted without a TPM You will need to manually login with default credentials and use "encryption load" to mount the encrypted volume and use "load /config/config.boot" Are you sure you want to proceed? [y/N] y Enter key: 1534138556418564135416543541638431531635153135413 Enter size of encrypted config partition (MB): (Default: 512) 512 Encrypted config volume has been enabled without TPM Backup the key in a safe place! Key: 1534138556418564135416543541638431531635153135413 vyos@vyos-def:~$ encryption disable Moving existing /config folder to /config.old Do you want to clear the TPM? This will cause issues if other system images use the key [y/N] y Encrypted config volume has been disabled
Summary:
work properly as expected without requesting recovery key on mounted.