Skip to content

Commit e648c93

Browse files
abrennan89abrennan89
authored
Merge pull request #80996 from sr1kar99/1841-disk-encryption
TELCODOCS-1841: Configuring disk encryption with PCR protection
2 parents ec9060a + 6b8e52e commit e648c93

5 files changed

+116
-0
lines changed

‎edge_computing/ztp-deploying-far-edge-sites.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ include::modules/ztp-sno-siteconfig-config-reference.adoc[leveloffset=+2]
5555
[role="_additional-resources"]
5656
.Additional resources
5757

58+
* xref:../edge_computing/ztp-reference-cluster-configuration-for-vdu.adoc#ztp-sno-du-disk-encryption_sno-configure-for-vdu[About disk encryption with TPM and PCR protection].
59+
5860
* xref:../edge_computing/ztp-advanced-install-ztp.adoc#ztp-customizing-the-install-extra-manifests_ztp-advanced-install-ztp[Customizing extra installation manifests in the {ztp} pipeline]
5961
6062
* xref:../edge_computing/ztp-preparing-the-hub-cluster.adoc#ztp-preparing-the-ztp-git-repository_ztp-preparing-the-hub-cluster[Preparing the {ztp} site configuration repository]

‎edge_computing/ztp-reference-cluster-configuration-for-vdu.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,15 @@ include::modules/ztp-enabling-workload-partitioning-sno.adoc[leveloffset=+1]
3030

3131
* For the recommended {sno} workload partitioning configuration, see xref:../edge_computing/ztp-reference-cluster-configuration-for-vdu.adoc#ztp-sno-du-enabling-workload-partitioning_sno-configure-for-vdu[Workload partitioning].
3232
33+
include::modules/ztp-sno-du-disk-encryption.adoc[leveloffset=+1]
34+
35+
[role="_additional-resources"]
36+
.Additional resources
37+
38+
* xref:../security/network_bound_disk_encryption/nbde-about-disk-encryption-technology.adoc#nbde-tpm-encryption_nbde-implementation[TPM encryption]
39+
40+
* For information about enabling disk encryption, see xref:../edge_computing/ztp-reference-cluster-configuration-for-vdu.adoc#ztp-sno-du-configuring-disk-encryption-with-pcr-protection_sno-configure-for-vdu[Enabling disk encryption with TPM and PCR protection].
41+
3342
[id="ztp-sno-install-time-cluster-config"]
3443
== Recommended cluster install manifests
3544

@@ -56,6 +65,13 @@ include::modules/ztp-sno-du-disabling-crio-wipe.adoc[leveloffset=+2]
5665

5766
include::modules/ztp-sno-du-configuring-crun-container-runtime.adoc[leveloffset=+2]
5867

68+
include::modules/ztp-sno-du-configuring-disk-encryption-with-pcr-protection.adoc[leveloffset=+2]
69+
70+
[role="_additional-resources"]
71+
.Additional resources
72+
73+
* xref:../edge_computing/ztp-reference-cluster-configuration-for-vdu.adoc#ztp-sno-du-disk-encryption_sno-configure-for-vdu[About disk encryption with TPM and PCR protection]
74+
5975
[id="ztp-sno-post-install-time-cluster-config"]
6076
== Recommended postinstallation cluster configurations
6177

‎modules/ztp-sno-du-configuring-disk-encryption-with-pcr-protection.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * scalability_and_performance/ztp_far_edge/ztp-reference-cluster-configuration-for-vdu.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="ztp-sno-du-configuring-disk-encryption-with-pcr-protection_{context}"]
7+
= Enabling disk encryption with TPM and PCR protection
8+
9+
You can use the `diskEncryption` field in the `SiteConfig` custom resource (CR) to configure disk encryption with Trusted Platform Module (TPM) and Platform Configuration Registers (PCRs) protection.
10+
11+
Configuring the `SiteConfig` CR enables disk encryption at the time of cluster installation.
12+
13+
.Prerequisites
14+
15+
* You have installed the {oc-first}.
16+
* You have logged in as a user with `cluster-admin` privileges.
17+
* You read the "About disk encryption with TPM and PCR protection" section.
18+
19+
.Procedure
20+
21+
* Configure the `spec.clusters.diskEncryption` field in the `SiteConfig` CR:
22+
+
23+
.Recommended `SiteConfig` CR configuration to enable disk encryption with PCR protection
24+
[source,yaml]
25+
----
26+
apiVersion: ran.openshift.io/v1
27+
kind: SiteConfig
28+
metadata:
29+
name: "encryption-tpm2"
30+
namespace: "encryption-tpm2"
31+
spec:
32+
clusters:
33+
- clusterName: "encryption-tpm2"
34+
clusterImageSetNameRef: "openshift-v4.13.0"
35+
diskEncryption:
36+
type: "tpm2" <1>
37+
tpm2:
38+
pcrList: "1,7" <2>
39+
nodes:
40+
- hostName: "node1"
41+
role: master
42+
----
43+
<1> Set the disk encryption type to `tpm2`.
44+
<2> Configure the list of PCRs to be used for disk encryption. You must use PCR registers 1 and 7.
45+
46+
.Verification
47+
48+
* Check that the disk encryption with TPM and PCR protection is enabled by running the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ clevis luks list -d <disk_path> <1>
53+
----
54+
<1> Replace `<disk_path>` with the path to the disk. For example, `/dev/sda4`.
55+
+
56+
.Example output
57+
[source,terminal]
58+
----
59+
1: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha256","pcr_ids":"1,7"}'
60+
----

‎modules/ztp-sno-du-disk-encryption.adoc

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * scalability_and_performance/ztp_far_edge/ztp-reference-cluster-configuration-for-vdu.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="ztp-sno-du-disk-encryption_{context}"]
7+
= About disk encryption with TPM and PCR protection
8+
9+
You can use the `diskEncryption` field in the `SiteConfig` custom resource (CR) to configure disk encryption with Trusted Platform Module (TPM) and Platform Configuration Registers (PCRs) protection.
10+
11+
TPM is a hardware component that stores cryptographic keys and evaluates the security state of your system. PCRs within the TPM store hash values that represent the current hardware and software configuration of your system. You can use the following PCR registers to protect the encryption keys for disk encryption:
12+
13+
PCR 1:: Represents the Unified Extensible Firmware Interface (UEFI) state.
14+
PCR 7:: Represents the secure boot state.
15+
16+
The TPM safeguards encryption keys by linking them to the system's current state, as recorded in PCR 1 and PCR 7. The `dmcrypt` utility uses these keys to encrypt the disk. The binding between the encryption keys and the expected PCR registers is automatically updated after upgrades, if needed.
17+
18+
During the system boot process, the `dmcrypt` utility uses the TPM PCR values to unlock the disk. If the current PCR values match with the previously linked values, the unlock succeeds. If the PCR values do not match, the encryption keys cannot be released, and the disk remains encrypted and inaccessible.
19+
20+
:FeatureName: Configuring disk encryption by using the `diskEncryption` field in the `SiteConfig` CR
21+
include::snippets/technology-preview.adoc[]
22+
:!FeatureName:

‎modules/ztp-sno-siteconfig-config-reference.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,22 @@ For example, `acmpolicygenerator/acm-common-ranGen.yaml` applies to all clusters
4949
|`spec.clusters.crTemplates.KlusterletAddonConfig`
5050
|Optional. Set `KlusterletAddonConfig` to `KlusterletAddonConfigOverride.yaml to override the default `KlusterletAddonConfig` that is created for the cluster.
5151

52+
|`spec.clusters.diskEncryption`
53+
a|Configure this field to enable disk encryption with Trusted Platform Module (TPM) and Platform Configuration Registers (PCRs) protection. For more information, see "About disk encryption with TPM and PCR protection".
54+
[NOTE]
55+
====
56+
Configuring disk encryption by using the `diskEncryption` field in the `SiteConfig` CR is a Technology Preview feature in {product-title} 4.17.
57+
====
58+
59+
|`spec.clusters.diskEncryption.type`
60+
|Set the disk encryption type to `tpm2`.
61+
62+
|`spec.clusters.diskEncryption.tpm2`
63+
|Configure the Platform Configuration Registers (PCRs) protection for disk encryption.
64+
65+
|`spec.clusters.diskEncryption.tpm2.pcrList`
66+
|Configure the list of Platform Configuration Registers (PCRs) to be used for disk encryption. You must use PCR registers 1 and 7.
67+
5268
|`spec.clusters.nodes.hostName`
5369
|For single-node deployments, define a single host.
5470
For three-node deployments, define three hosts.

0 commit comments

Comments
 (0)