confluent/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh

#!/bin/sh
cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//)
clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/confluent.apikey
cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey
Add boot encryption support to EL8 The stock profile should now encrypt if requested 2020-06-02 16:05:44 -04:00			`#!/bin/sh`
			`cryptdisk=$(blkid -t TYPE="crypto_LUKS"\|sed -e s/:.*//)`
Do not seal to PCR 7 At least without secureboot, PCR 7 is not defined. This would potentially be worth a conditional to check on secureboot. 2020-06-17 16:23:13 -04:00			`clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/confluent.apikey`
Add boot encryption support to EL8 The stock profile should now encrypt if requested 2020-06-02 16:05:44 -04:00			`cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey`