Bug 1759015
| Summary: | [downstream clone - 4.3.7] Add clevis RPMs to RHV-H image / repo | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Virtualization Manager | Reporter: | RHV bug bot <rhv-bugzilla-bot> |
| Component: | ovirt-host | Assignee: | Yuval Turgeman <yturgema> |
| Status: | CLOSED ERRATA | QA Contact: | shiyi lei <shlei> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 4.3.6 | CC: | bkunal, cshao, dholler, dwhitley, jcall, lsurette, lsvaty, mavital, mflanner, mkalinin, nlevy, pelauter, qiyuan, rdlugyhe, sbonazzo, weiwang, yaniwang, ycui, yturgema |
| Target Milestone: | ovirt-4.3.7 | Keywords: | ZStream |
| Target Release: | 4.3.7 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ovirt-host-4.3.5-1.el7ev | Doc Type: | Bug Fix |
| Doc Text: |
Previously, using LUKS alone was a problem because the Red Hat Virtualization Manager could reboot a node using Power Management commands. However, the node would not reboot because it was waiting for the user to enter a decrypt/open/unlock passphrase. This release fixes the issue by adding clevis RPMs to the Red Hat Virtualization Host (RHVH) image. As a result, a Manager can automatically unlock/decrypt/open an RHVH using TPM or NBDE.
|
Story Points: | --- |
| Clone Of: | 1741792 | Environment: | |
| Last Closed: | 2019-12-12 10:36:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | Node | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1741792 | ||
| Bug Blocks: | 1750302 | ||
|
Description
RHV bug bot
2019-10-07 08:04:23 UTC
Here is my simplified steps to test Clevis. 1. Install the Tang server... [root@tang-srv ~]# yum -y install tang [root@tang-srv ~]# systemctl enable tangd.socket --now [root@tang-srv ~]# firewall-cmd --add-port 80/tcp --permanent [root@tang-srv ~]# firewall-cmd --reload 2. Install RHV-H with encryption. See attached kickstart file, or check the encryption box via the Anaconda GUI) 3. Configure the Clevis client, and rebuild the initramfs. (change /dev/sda3 to whatever is appropriate) # curl -o /etc/yum.repos.d/clevis.repo http://people.redhat.com/jcall/clevis.repo # yum -y install 'clevis*' # lsblk -o +VENDOR,MODEL # clevis bind luks -d /dev/sda3 tang '{"url":"http://192.168.0.99:300"}' # echo 'kernel_cmdline="ip=dhcp"' > /etc/dracut.conf.d/clevis-nbde.conf # dracut -fv # systemctl enable clevis-luks-askpass.path # reboot (Originally by John Call) Created attachment 1604298 [details]
kickstart to deploy RHV-H via PXE (including cleanup from previous installs)
kickstart to deploy RHV-H via PXE (including cleanup from previous installs)
(Originally by John Call)
(In reply to John Call from comment #1) > # clevis bind luks -d /dev/sda3 tang '{"url":"http://192.168.0.99:300"}' Oops, I co-located Tang on a server of mine that was already using port 80, so I changed it to use port 300 (with some systemd and SElinux foo) The line above should be simplified to just this... # clevis bind luks -d /dev/sda3 tang '{"url":"http://192.168.0.99"}' (Originally by John Call) To clarify, this BZ is here to include clevis rpms in RHVH image only. This bz does not imply any testing on RHV side of clevis-tang functionality on RHV. The test of this functionality in RHHI-V is covered in this bz#1750302. John, fyi and correct me if I am wrong. (In reply to Marina Kalinin from comment #12) > To clarify, this BZ is here to include clevis rpms in RHVH image only. This > bz does not imply any testing on RHV side of clevis-tang functionality on > RHV. > The test of this functionality in RHHI-V is covered in this bz#1750302. > > John, fyi and correct me if I am wrong. Yes, you are correct. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:4230 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |