Version information
This version is compatible with:
- ,
Start using this module
Add this module to your Puppetfile:
mod 'sammcj-luks', '1.0.1'Learn more about managing modules with a PuppetfileDocumentation
luks
Description
Puppet module for managing LUKS encrypted volumes
Setup
Beginning with LUKS
This is a very basic module for configuring encrypted volumes using LUKS on Linux.
Usage
The following creates a LUKS device at /dev/mapper/secretdata, backed by
the partition at /dev/sdb1, encrypted with the value of $secret_key:
include ::luks
secret_key = hiera('luks_secret')
luks::device { 'secretdata':
device => '/dev/sdb1',
key => $secret_key,
remove_catalog => true,
}
The secret key should come from somewhere encrypted such as hiera-eyaml.
Reference
Parameters
device
The hardware device to back LUKS with -- any existing data will be lost when formatted as a LUKS device!
key
The encryption key for the LUKS device.
force_format
Instructs LuksFormat to run in 'batchmode' which esentially forces the block device to be formatted, use with care.
base64
Set to true if the key is base64-encoded (necessary for encryption keys with binary data).
Defaults to false.
mapper
The name to use in /dev/mapper for the device.
Defaults to the name to the name of the resource, i.e. /dev/mapper/secretdata
Limitations
- At the time of writing this, it has been tested against CentOS 7.2
- The key change functionality only adds new keys, the original key(s) remain in other key slots. It is highly recommended to monitor for key slot usage and manually remove redundant keys as required.
- Warning: The secret key (encrypted with the node certificate) will still be cached by Puppet in the compiled catalog - unless you use a null catalog_cache_terminus to prevent this happening. Examples: https://github.com/dylanratcliffe/no_cached_catalogs and https://github.com/ross-w/secretresource
Development/Release Notes/Contributors/Etc.
Please feel free to submit issues, and merge requests or generally contribute to this module.
Dependencies
- binford2k-node_encrypt (>= 0.2.7 < 1.0.0)
Copyright 2017 Sam McLeod.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.