From c063cbff3a13cdd59bec52a0764a6d7344afd496 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Thu, 6 Aug 2026 15:34:20 -0400 Subject: [PATCH] Change to using systemd-cryptenroll where available --- confluent_osdeploy/el8/profiles/default/scripts/pre.sh | 6 +++++- .../el8/profiles/default/scripts/tpm_luks.sh | 10 ++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh index 880d22ac..53d30208 100644 --- a/confluent_osdeploy/el8/profiles/default/scripts/pre.sh +++ b/confluent_osdeploy/el8/profiles/default/scripts/pre.sh @@ -98,7 +98,11 @@ if [ "$cryptboot" == "tpm2" ]; then chmod 000 /etc/confluent/luks.key LUKSPARTY="--encrypted --passphrase=$lukspass" echo $cryptboot >> /tmp/cryptboot - echo clevis-dracut >> /tmp/cryptpkglist + if [ -e /bin/systemd-cryptenroll ]; then + echo tpm2-tools >> /tmp/cryptpkglist + else + echo clevis-dracut >> /tmp/cryptpkglist + fi fi diff --git a/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh b/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh index 359c46f6..19cf9630 100644 --- a/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh +++ b/confluent_osdeploy/el8/profiles/default/scripts/tpm_luks.sh @@ -1,5 +1,11 @@ #!/bin/sh cryptdisk=$(blkid -t TYPE="crypto_LUKS"|sed -e s/:.*//) -clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key +if [ -x /bin/systemd-cryptenroll ]; then + PASSWORD=$(cat /etc/confluent/luks.key) systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs="" $cryptdisk + sed -e 's/ discard/ tpm2-device=auto,discard/' -i /etc/crypttab + dracut -f +else + clevis luks bind -f -d $cryptdisk -k - tpm2 '{}' < /etc/confluent/luks.key + #cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey +fi chmod 000 /etc/confluent/luks.key -#cryptsetup luksRemoveKey $cryptdisk < /etc/confluent/confluent.apikey