I am trying to reproduce your issue without success. What you describe is not expected behavior. You should not get out of sync If a CFS configures an RFS that configures device(s). Please describe in detail:- Where your encrypted leafs are located. ...

Regarding the documentation, I agree it can be improved to explain when the CFS node changes tailf:aes-256-cfb-128-encrypted-string to string type for non-RFS config encrypted leafs, and how tailf:ned-ignore-compare-config is used based on what I wro...

I think we are getting to the core of the issue here. You are not supposed to change the device configuration from the CFS NSO node. The CFS NSO node only mounts the RFS from the RFS NSO nodes under the CFS NSO nodes /devices tree. You seem to access...

Regarding "a device sync-from cfs node always leads to an out-of-sync for the encrypted leafs", but "tailf:ned-ignore-compare-config is added during the make of the ned on the cfs-node". Then there is a build problem. The built FXS files used by the ...

When sending, for example, a tailf:aes-256-cfb-128-encrypted-string to a device over NETCONF, here, another NSO instance, the string is decrypted by NSO and sent to the device. The device then immediately encrypts it before storing it in its database...