A step-by-step guide for upgrading RHEL 8 to RHEL 9 using the leapp tool when the system has LUKS disk encryption and FIPS enabled — a configuration that normally blocks leapp upgrades. The workaround uses Clevis to temporarily bind a LUKS unlock key to the system's TPM2 chip, allowing leapp to reboot and complete the upgrade automatically without manual passphrase entry. The guide covers verifying prerequisites, installing Clevis packages, binding the TPM2 key, running the preupgrade checks, executing the upgrade, and removing the TPM2 key afterward to restore standard passphrase-only access.
Table of contents
LimitationsLUKS and LVM strategySet the stageThe pre-upgrade reality checkThe magic bind: Solving the LUKS inhibitorSquash remaining inhibitorsTaking the leappPost-flight cleanup165 Impressions