1
Diagnostic step 1
Boot into a rescue environment or single-user mode and verify current partition UUIDs with lsblk -f and blkid.
FULL AI ANALYSIS
Ubuntu 22.04 service fails to start after re-encrypting LUKS volume changed partition UUIDs
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Re-encryption changed block device identifiers (UUIDs) referenced by crypttab/fstab and the initramfs used at early boot still contains the old identifiers, causing mounts and dependent services to be skipped at the systemd init stage. Systemd treats failed mounts as failed dependencies and prevents services from activating. Updating /etc/crypttab and /etc/fstab alone is insufficient until the initramfs used by the bootloader is regenerated and the boot-time cryptsetup hooks are updated. Other possibilities include wrong crypttab formatting, mismatch between device-mapper names and crypttab entries, or missing dracut/initramfs hooks for unlocking encrypted volumes early.
Possible causes
Initramfs contains cached old identifiers and was not rebuilt, so early-boot unlock fails
90%Outdated /etc/crypttab or /etc/fstab entries referencing old UUIDs after re-encryption
80%Race between device node creation and systemd mount due to missing systemd-cryptsetup service enabled in initramfs
35%Incorrect crypttab syntax or keyfile path causing cryptsetup in initramfs to skip unlocking
20%Suggested fixes
2
Diagnostic step 2
Update /etc/crypttab and /etc/fstab to use the new UUIDs or persistent /dev/mapper names; do not remove existing entries until verified.
3
Diagnostic step 3
Regenerate the initramfs used by your kernel(s) with sudo update-initramfs -u -k all, then inspect /boot for expected initramfs timestamp changes.
4
Diagnostic step 4
Ensure cryptsetup hooks are enabled in initramfs scripts (verify presence of /usr/share/initramfs-tools/hooks/cryptsetup) and run an additional reboot test.
5
Diagnostic step 5
If services still fail, enable debug on the initramfs by adding 'break=mount' or 'break=top' to the kernel cmdline to drop to a busybox shell during early boot and diagnose which mount/crypt step fails (reversible and non-destructive). If LUKS header or keyfiles appear damaged, stop and escalate to a storage/security specialist and preserve copies of /etc/crypttab, /etc/fstab, and the LUKS header (use cryptsetup luksHeaderBackup) before making destructive repairs.