Add an option to unconditionally preserve luks keyfiles used for luks device setup
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 974
- Forks
- 296
- Avg merge
- 6d 14h
- Merged PRs (30d)
- 9
Description
From what I can see here, luks keyfiles (provided or generated) are only written to sysroot if clevis hasn't been configured. This makes the resulting setup brittle, if there's been both keyfile and clevis configured if the keyfiles have been generated by ignition itself. We end up with a luks device with two keys, one stored in tpm, the other being effectively unusable, as it was generated randomly, used, then discarded.
While we're at it: would it be possible to change the default location of the keyfiles to /etc/cryptsetup-keys.d/volumename.key to align with systemd defaults?
Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in internal/exec/stages/files/filesystemEntries.go at the linked keyfile-writing logic. Trace how generated or provided LUKS keyfiles and clevis configuration determine whether files reach sysroot, then review the requested systemd crypttab location. Done means the unconditional-preservation option and default-path behavior are defined and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100