Bug 2327563 - Clevis bind operation for setting up LUKS encryption failed due to missing tools
Summary: Clevis bind operation for setting up LUKS encryption failed due to missing tools
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: clevis
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Sergio Arroutbi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-20 01:31 UTC by Aashish Radhakrishnan
Modified: 2024-12-15 02:39 UTC (History)
6 users (show)

Fixed In Version: clevis-21-7.fc41 clevis-21-7.fc40
Clone Of:
Environment:
Last Closed: 2024-12-03 02:51:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Aashish Radhakrishnan 2024-11-20 01:31:20 UTC
The Fedora rawhide build pipeline test failed with the following error message:

mach.Start() failed: machine 28319516-ff0b-4c0f-a1b0-7d1d045204ae entered emergency.target in initramfs

The error occurred after the upgrade of the following clevis packages from version 21-6.fc42 to 21-7.fc42:

clevis (21-6.fc42 → 21-7.fc42)
clevis-dracut (21-6.fc42 → 21-7.fc42)
clevis-luks (21-6.fc42 → 21-7.fc42)
clevis-systemd (21-6.fc42 → 21-7.fc42)



kola test failure:
[2024-11-19T13:12:28.282Z] --- FAIL: ext.config.var-mount.luks (24.31s)
[2024-11-19T13:12:28.282Z]         harness.go:1823: mach.Start() failed: machine 28319516-ff0b-4c0f-a1b0-7d1d045204ae entered emergency.target in initramfs
[2024-11-19T13:12:28.282Z] FAIL, output in /home/jenkins/agent/workspace/build/tmp/kola-lf7Xi/kola/rerun
[2024-11-19T13:12:28.282Z] Error: harness: test suite failed
[2024-11-19T13:12:28.282Z] 2024-11-19T13:12:25Z cli: harness: test suite failed
[2024-11-19T13:12:28.282Z] failed to execute cmd-kola: exit status 1



From the console log, an ignition-disks.service failure seem to have occurred as the Clevis bind operation for setting up LUKS encryption failed due to missing tools in the environment



[   16.662679] ignition[871]: disks: createLuks: op(b): [finished] opening luks device varlog
[   16.666771] ignition[871]: disks: createLuks: op(c): [started]  Clevis bind
[   18.695645] ignition[871]: disks: createLuks: op(c): [failed]   Clevis bind: exit status 1: Cmd: "clevis" "luks" "bind" "-f" "-k" "/tmp/ignition-luks-229972637" "-d" "/run/ignition/dev_aliases/dev/disk/by-partlabel/varlog" "sss" "{\"pins\":{\"tpm2\":{}},\"t\":1}" Stdout: "Warning: keyslot operation could fail as it requires more than available memory.\n" Stderr: "/usr/bin/clevis-encrypt-tpm2: line 137: tpm2_getcap: command not found\nUnable to find non-empty PCR algorithm bank, please check output of tpm2_getcap pcrs\nUnable to perform encryption with PIN 'sss' and config '{\"pins\":{\"tpm2\":{}},\"t\":1}'\nError adding new binding to /run/ignition/dev_aliases/dev/disk/by-partlabel/varlog\n"
�M
�[K[�[0;1;31mFAILED�[0m] Failed to start �[0;1;39mignition-disks.service�[0m - Ignition (disks).

�[KSee 'systemctl status ignition-disks.service' for details.

[�[0;1;38:5:185mDEPEND�[0m] Dependency failed for �[0;1;39mignition-complete.target�[0m - Ignition Complete.

[�[0;1;38:5:185mDEPEND�[0m] Dependency failed for �[0;1;39minitrd.target�[0m - Initrd Default Target.

[   18.713497] systemd[1]: ignition-disks.service: Main process exited, code=exited, status=1/FAILURE
[   18.715874] ignition[871]: disks failed




Reproducible: Always


Steps to Reproduce:
1) Build and run latest FCOS rawhide image.

cosa fetch && cosa build


2) Run kola test -  ext.config.var-mount.luks

cosa kola run ext.config.var-mount.luks


3) test fails due to mach.Start() failed: machine entered emergency.target in initramfs


Actual Results:  
ext.config.var-mount.luks kola test fails due to mach.Start() failed: machine entered emergency.target in initramfs


Expected Results:  
ext.config.var-mount.luks kola test to PASS

Comment 2 Dusty Mabe 2024-11-20 14:27:04 UTC
fix may need to be on our side: https://github.com/coreos/fedora-coreos-tracker/issues/1836#issuecomment-2487135326

Comment 3 Sergio Correia 2024-11-20 15:45:34 UTC
Actually, this seems to be caused by https://src.fedoraproject.org/rpms/clevis/pull-request/45, which added the use of tpm2_getcap but did not add it to the tpm dracut module.

Comment 5 Fedora Update System 2024-11-29 10:53:55 UTC
FEDORA-2024-57c484d6c1 (clevis-21-7.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-57c484d6c1

Comment 6 Fedora Update System 2024-11-29 10:54:41 UTC
FEDORA-2024-152e731ede (clevis-21-7.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-152e731ede

Comment 7 Fedora Update System 2024-11-30 02:41:08 UTC
FEDORA-2024-57c484d6c1 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-57c484d6c1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-57c484d6c1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-11-30 03:36:29 UTC
FEDORA-2024-152e731ede has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-152e731ede`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-152e731ede

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2024-12-03 02:51:51 UTC
FEDORA-2024-57c484d6c1 (clevis-21-7.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2024-12-15 02:39:42 UTC
FEDORA-2024-152e731ede (clevis-21-7.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.