Kernel zones require encryption keys on the target host after a zone migration.
If you are migrating a zone by using live migration, the encryption key on the target host will be automatically defined as part of the live migration process.
If you are migrating a zone by means of a cold or a warm migration, use the zonecfg export command on the source system to generate a command file to be used on the target system. The command file will meet the requirements for a kernel zone encryption key. For example, to generate a command file for a zone migrated from global1 to global2:
global1$ zonecfg -z kzone1 export -f /net/.../kzone1.cfg global2$ zonecfg -z kzone1 -f /net/.../kzone1.cfg