xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-09-02 07:26:04 +00:00
Code Issues Projects Releases Wiki Activity

Change to using systemd-cryptenroll where available

Browse Source
This commit is contained in:
Jarrod Johnson
2026-08-06 15:34:20 -04:00
parent cc898d5661
commit c063cbff3a
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_osdeploy/el8/profiles/default/scripts/pre.sh
+5 -1
View File
@@ -98,7 +98,11 @@ if [ "$cryptboot" == "tpm2" ]; then
chmod 000 /etc/confluent/luks.key
LUKSPARTY="--encrypted --passphrase=$lukspass"
echo $cryptboot >> /tmp/cryptboot
echo clevis-dracut >> /tmp/cryptpkglist
if [ -e /bin/systemd-cryptenroll ]; then
echo tpm2-tools >> /tmp/cryptpkglist
else
echo clevis-dracut >> /tmp/cryptpkglist
fi
fi
confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh
+8 -2
View File
@@ -1,5 +1,11 @@
#!/bin/sh
cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//)
clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key
if [ -x /bin/systemd-cryptenroll ]; then
PASSWORD=$(cat /etc/confluent/luks.key) systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $cryptdisk
sed -e 's/ discard/ tpm2-device=auto,discard/' -i /etc/crypttab
dracut -f
else
clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key
#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey
fi
chmod 000 /etc/confluent/luks.key
#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey