luks

Description

Puppet module for managing LUKS encrypted volumes

Setup

Beginning with LUKS

This is a very basic module for configuring encrypted volumes using LUKS on Linux.

Usage

The following creates a LUKS device at /dev/mapper/secretdata, backed by the partition at /dev/sdb1, encrypted with the value of $secret_key:

  include ::luks

  secret_key = hiera('luks_secret')

  luks::device { 'secretdata':
    device         => '/dev/sdb1',
    key            => $secret_key,
    remove_catalog => true,
  }

The secret key should come from somewhere encrypted such as hiera-eyaml.

Reference

Parameters

`device`

The hardware device to back LUKS with -- any existing data will be lost when formatted as a LUKS device!

`key`

The encryption key for the LUKS device.

`force_format`

Instructs LuksFormat to run in 'batchmode' which esentially forces the block device to be formatted, use with care.

`base64`

Set to true if the key is base64-encoded (necessary for encryption keys with binary data).

Defaults to false.

`mapper`

The name to use in /dev/mapper for the device.

Defaults to the name to the name of the resource, i.e. /dev/mapper/secretdata

Limitations

At the time of writing this, it has been tested against CentOS 7.2
The key change functionality only adds new keys, the original key(s) remain in other key slots. It is highly recommended to monitor for key slot usage and manually remove redundant keys as required.
Warning: The secret key (encrypted with the node certificate) will still be cached by Puppet in the compiled catalog - unless you use a null catalog_cache_terminus to prevent this happening. Examples: https://github.com/dylanratcliffe/no_cached_catalogs and https://github.com/ross-w/secretresource

Development/Release Notes/Contributors/Etc.

Please feel free to submit issues, and merge requests or generally contribute to this module.