canonical / canonical/cloud-init

[question] How is cloud-init growpart able to resize LUKS (encrypted) volumes?

Open
#4,693 8 comments 0 reactions 0 assignees View on GitHub
invalid
Dominant language
Python
Stars
3.8k
Forks
1.1k
Avg merge
2d 23h
Merged PRs (30d)
18

Description

Hello!

Apologies if this is not the correct place to be asking this, but I have been scratching my head for some time and can't figure out what's going on in this scenario (or a better place to ask).

This is directly in relation to https://github.com/canonical/cloud-init/pull/1316 and to a lesser extent https://github.com/canonical/cloud-init/pull/1032

I recently created a fresh install of Oracle Linux 9.3, and I was surprised to find out that cloud init was able to automatically extend the volume and partition size on boot. I delved into the source code e.g. https://github.com/TheRealFalcon/cloud-init/blob/3ce1e06ac6c8b1c0bb09f437695d9bf1024ed412/cloudinit/config/cc_growpart.py on line 108, there is a reference to this:

```
KEYDATA_PATH = Path("/cc_growpart_keydata")
```

I cannot fathom, nor find any documentation, where this file comes from, what creates or deletes it and how the developer of this PR knew about its existence. A google search of "cc_growpart_keydata" only yields these results:

* https://www.redhat.com/en/blog/rhel-confidential-virtual-machines-azure-technical-deep-dive
* https://github.com/canonical/encrypt-cloud-image/blob/main/encrypt.go
* https://github.com/number5/cloud-init/blob/main/cloudinit/config/cc_growpart.py

The main reasons why I want to understand this are:
1. When cloud-init extends the partition in this way, it is not effective till the next reboot
2. I am now genuinely curious how this all hangs together, and potentially think about reimplementing it myself outside of cloud-init.

TIA for any advice and support.

EDIT:

Upon some more digging, I found https://gitlab.com/vkuznets/encrypt-rhel-image/-/blob/master/encrypt-rhel-image.py?ref_type=heads which seems to indicate it is creating the key for cloud-init, but this script isn't on my server.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.