confluent/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh

#!/bin/sh
cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//)
clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key
chmod 000 /etc/confluent/luks.key
#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey
Add boot encryption support to EL8 The stock profile should now encrypt if requested 2020-06-02 16:05:44 -04:00			`#!/bin/sh`
			`cryptdisk=$(blkid -t TYPE="crypto_LUKS"\|sed -e s/:.*//)`
Fix mistake in EL8/EL9 LUKS 2024-07-29 11:22:07 -04:00			`clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key`
Amend cryptboot implementation for Ubuntu 22/24, EL8/EL9 Provide mechanism for administrator to place a custom key for potential interactive recovery into /var/lib/confluent/private/os/<profile>/pending/luks.key If not provided, generate a unique one for each install. Either way, persist the key in /etc/confluent/luks.key, to facilitate later resealing if the user wants (clevis nor systemd prior to 256 supports unlock via TPM2, so keyfile is required for now). Migrating to otherwise escrowed passphrases and/or sealing to specific TPMs will be left to operators and/or third parties. 2024-07-29 10:17:14 -04:00			`chmod 000 /etc/confluent/luks.key`
			`#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey`