Puppet module for managing LUKS encrypted volumes
This is a very basic module for configuring encrypted volumes using LUKS on Linux.
The following creates a LUKS device at /dev/mapper/secretdata, backed by
the partition at /dev/sdb1, encrypted with the value of $secret_key:
include ::luks
secret_key = hiera('luks_secret')
luks::device { 'secretdata':
device => '/dev/sdb1',
key => $secret_key,
remove_catalog => true,
}The secret key should come from somewhere encrypted such as hiera-eyaml.
The hardware device to back LUKS with -- any existing data will be lost when formatted as a LUKS device!
The encryption key for the LUKS device.
Instructs LuksFormat to run in 'batchmode' which esentially forces the block device to be formatted, use with care.
Set to true if the key is base64-encoded (necessary for encryption keys with binary data).
Defaults to false.
The name to use in /dev/mapper for the device.
Defaults to the name to the name of the resource, i.e. /dev/mapper/secretdata
- At the time of writing this, it has been tested against CentOS 7.2
- The key change functionality only adds new keys, the original key(s) remain in other key slots. It is highly recommended to monitor for key slot usage and manually remove redundant keys as required.
- Warning: The secret key (encrypted with the node certificate) will still be cached by Puppet in the compiled catalog - unless you use a null catalog_cache_terminus to prevent this happening. Examples: https://github.com/dylanratcliffe/no_cached_catalogs and https://github.com/ross-w/secretresource
Please feel free to submit issues, and merge requests or generally contribute to this module.