clevis

Module to install clevis for automated disk decryption

276 downloads

204 latest version

3.1 quality score

Version information

  • 0.2.0 (latest)
  • 0.1.0
released Oct 25th 2023
This version is compatible with:
  • Puppet Enterprise 2025.4.x, 2025.3.x, 2025.2.x, 2025.1.x, 2023.8.x, 2023.7.x, 2023.6.x, 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2021.7.x
  • Puppet >= 7.24 < 9.0.0
  • CentOS
    ,
    OracleLinux
    ,
    RedHat
    ,
    Rocky
    ,
    AlmaLinux
    ,
    Scientific

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'puppet-clevis', '0.2.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppet-clevis
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppet-clevis --version 0.2.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download

Documentation

puppet/clevis — version 0.2.0 Oct 25th 2023

clevis

Build Status Release Puppet Forge Puppet Forge - downloads Puppet Forge - endorsement Puppet Forge - scores puppetmodule.info docs AGPL v3 License

Clevis is a pluggable framework for automated decryption.

Table of Contents

  1. Description
  2. Setup - The basics of getting started with clevis
  3. Usage - Configuration options and additional functionality
  4. Limitations - OS compatibility, etc.

Description

It can be used to provide automate decryption of data or even automated unlocking of LUKS volumes 2. Once Clevis has subscribed the decryption to a server, the encryption passphrase is removed, which means in a lost communication event, the server won’t be able to decrypt, not even with the passphrase. To prevent this Clevis can subscribe up to 8 keys to 8 different servers/users and it can be restricted to how many of them are required as a minimum. If you set a value t=2, means that at least 2 servers have to be available at the moment of decryption.

Setup

Setup Requirements

Clevis needs a tang server cluster ready and running andusually is installed and configured during OS provisioning.

Usage

Just include the clevis module:

include clevis

Limitations

Clevis can not be installed AFTER provisioning. It should always be part of the provisioning process.