Stop adding `rd.luks.key=/etc/luks/cex.key` for CEX support in sugar/config and move logic to `rdcore rootmap`
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 974
- Forks
- 296
- Avg merge
- 6d 14h
- Merged PRs (30d)
- 9
Description
Created originally in Butane by @travier: https://github.com/coreos/butane/issues/613
Right now (or soon), when CEX is enabled in the boot_device sugar, the user also has to add an rd.luks.key karg using either an Ignition karg (on non-OpenShift variants), or an OpenShift/MCO-level karg (on OpenShift; those are different right now -- the MCO has its own kargs logic and doesn't yet use Ignition kargs for first boot).
This unnecessarily incurs an additional reboot (in the case of non-OpenShift variants, upfront, in the case of OpenShift variants, by the MCO). Instead, we should probably have rdcore rootmap inject this karg like it does other LUKS-related kargs.
See:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the sugar/config handling in this repository and the rdcore rootmap entry point, especially rootmap.rs around the linked LUKS-related logic at line 153. Trace how CEX currently causes the rd.luks.key=/etc/luks/cex.key karg to be added for non-OpenShift and OpenShift variants. Done means rootmap handles the karg without the extra sugar/config or MCO-level addition and existing first-boot behavior remains covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, rust
- Domain
- operating-systems
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100