Description of problem: ------------------------ After successfully configuring Network Bound Disk Encryption(NBDE) using Clevis-Tang, automatic unlock of root filesystem doesn't happen, only in the case when FQDN was used for tang server Version-Release number of selected component (if applicable): ------------------------------------------------------------- gluster-ansible-infra-1.0.4-7 How reproducible: ----------------- Always Steps to Reproduce: -------------------- 1. Configure NBDE with RHHI-B, post running ansible playbook that configures the same, with tang server having a FQDN 2. Reboot the host Actual results: ---------------- Host doesn't automatically unlocks, Fails with 'Error communicating with server' Expected results: ----------------- Automatically unlock root filesystem and server should be up, without waiting for root encryption passphrase --- Additional comment from SATHEESARAN on 2020-04-06 10:26:30 UTC --- It was with the help of Sergio Correia, we could root cause this problem This is primarily because in RHEL 8, both 'network' and 'network-legacy' modules are loaded in initramfs <snip> [root@localhost ~]# lsinitrd /boot/initramfs-4.18.0-192.el8.x86_64.img | grep -i network network-legacy network kernel-network-modules </snip> when 'network-legacy' module is removed ( as in Fedora 31 ), and using 'network-manager' everything works fine Thanks Sergio for your efforts in help in RCA --- Additional comment from SATHEESARAN on 2020-04-06 10:30:46 UTC --- To fix the problem, the dracut drop-in configuration file ( /etc/dracut.conf.d/clevis.conf) needs to be updated with following lines: omit_dracutmodules+="network-legacy" add_dracutmodules+="clevis network-manager" Along with the original content of 'clevis.conf' file the following is the content: </snip> omit_dracutmodules+="ifcfg" omit_dracutmodules+="network-legacy" add_dracutmodules+="clevis network-manager" </snip>
Verified with gluster-ansible-infra-1.0.4-8.el8rhgs 1. Executed the playbook to setup NBDE, with DHCP based hostname for tang server 2. Post the playbook is executed successfully, reboot the host 3. Host could boot automatically without waiting passphrase prompt
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:2575