[PATCH docs 4/4] storage: zfspool: add documention on encryption

[Stoiko Ivanov <s.ivanov@proxmox.com>]

add a terse description of ZFS encryption in context of repliation and
migration in PVE.

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 pve-storage-zfspool.adoc | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/pve-storage-zfspool.adoc b/pve-storage-zfspool.adoc
index 1db283d..d3339b9 100644
--- a/pve-storage-zfspool.adoc
+++ b/pve-storage-zfspool.adoc
@@ -83,6 +83,26 @@ on the parent dataset.
 |images rootdir |raw subvol     |no     |yes       |yes
 |==============================================================================
 
+Encryption
+~~~~~~~~~~
+
+ZFS supports encryption of dataset hierarchies. Each encrypted dataset, is
+either an `encryption_root`, storing the properties for encryption itself or
+descendant of its `encryption_root` - see the `zfs-load-key(8)` manpage for
+details.
+
+Sending and receiving encrypted datasets is subject to constraints as some
+encryption parameters (initialization vectors for the symmetric ciphers) need
+to be either transferred with the data, breaking inheriting the encryption
+properties on the receiving side, or need to be recreated on target, requiring
+the data to be sent unencrypted - see the `zfs-recv(8)` manpage for details.
+
+For migration and storage replication of encrypted datasets in {pve}, the
+data is sent without the encryption properties, and the state of encryption
+is determined by the target.
+
+If you want to send and receive encrypted ZFS datasets, you need to ensure that
+all involved storages on all nodes are encrypted.
 
 Examples
 ~~~~~~~~
-- 
2.47.3