canonical / canonical/cloud-init
[question] How is cloud-init growpart able to resize LUKS (encrypted) volumes?
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 1.1k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 18
Description
Hello!
Apologies if this is not the correct place to be asking this, but I have been scratching my head for some time and can't figure out what's going on in this scenario (or a better place to ask).
This is directly in relation to https://github.com/canonical/cloud-init/pull/1316 and to a lesser extent https://github.com/canonical/cloud-init/pull/1032
I recently created a fresh install of Oracle Linux 9.3, and I was surprised to find out that cloud init was able to automatically extend the volume and partition size on boot. I delved into the source code e.g. https://github.com/TheRealFalcon/cloud-init/blob/3ce1e06ac6c8b1c0bb09f437695d9bf1024ed412/cloudinit/config/cc_growpart.py on line 108, there is a reference to this:
```
KEYDATA_PATH = Path("/cc_growpart_keydata")
```
I cannot fathom, nor find any documentation, where this file comes from, what creates or deletes it and how the developer of this PR knew about its existence. A google search of "cc_growpart_keydata" only yields these results:
* https://www.redhat.com/en/blog/rhel-confidential-virtual-machines-azure-technical-deep-dive
* https://github.com/canonical/encrypt-cloud-image/blob/main/encrypt.go
* https://github.com/number5/cloud-init/blob/main/cloudinit/config/cc_growpart.py
The main reasons why I want to understand this are:
1. When cloud-init extends the partition in this way, it is not effective till the next reboot
2. I am now genuinely curious how this all hangs together, and potentially think about reimplementing it myself outside of cloud-init.
TIA for any advice and support.
EDIT:
Upon some more digging, I found https://gitlab.com/vkuznets/encrypt-rhel-image/-/blob/master/encrypt-rhel-image.py?ref_type=heads which seems to indicate it is creating the key for cloud-init, but this script isn't on my server.
Contributor guide
Assessment
This issue has not been assessed yet.