Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot install with secureboot and encryption? #9415

Closed
uhthomas opened this issue Oct 1, 2024 · 2 comments · Fixed by #9442
Closed

Cannot install with secureboot and encryption? #9415

uhthomas opened this issue Oct 1, 2024 · 2 comments · Fixed by #9442
Assignees
@smira

Comments

@uhthomas
Copy link
Contributor

uhthomas commented Oct 1, 2024

Bug Report

Description

mapped device is still in use?

image

install:
    image: factory.talos.dev/installer-secureboot/63cccc87bd7433e412eb150d89eb047b78faddb1f8c7a666534c411185665a76:v1.8.0
    wipe: true

    diskSelector:
        wwid: eui.1234
...
systemDiskEncryption:
    ephemeral:
        provider: luks2
        keys:
            - slot: 0
                tpm: {}
            - slot: 1
                static:
                    passphrase: abc
    state:
        provider: luks2
        keys:
            - slot: 0
                tpm: {}
            - slot: 1
                static:
                    passphrase: abc

Logs

Environment

  • Talos version: 1.8.0
  • Kubernetes version: N/A
  • Platform: bare metal
@uhthomas
Copy link
Contributor Author

uhthomas commented Oct 1, 2024

Okay, I figured it out. I don't have a TPM. Somewhere in the logs is says it can't open /dev/tpm0. Would it be worth leaving this issue open to handle that case a bit better?

@smira smira self-assigned this Oct 3, 2024
@smira
Copy link
Member

smira commented Oct 3, 2024

Yes, this is a bug, it should have just used passphrase or failed on encryption step.

smira added a commit to smira/talos that referenced this issue Oct 4, 2024
@smira
fix: volume encryption with failing keyslots
420b818 
Fix the flow when a failing key slot leads to repeated attempts to open
the volume, while it's already open, but the failure was to sync other
keys.

Refactor the code to get rid of variable assignment in the outer block
from closures.

Fixes siderolabs#9415

Signed-off-by: Andrey Smirnov <[email protected]>
@smira smira mentioned this issue Oct 4, 2024
Merged
smira added a commit to smira/talos that referenced this issue Oct 4, 2024
@smira
fix: volume encryption with failing keyslots
d4403c8 
Fix the flow when a failing key slot leads to repeated attempts to open
the volume, while it's already open, but the failure was to sync other
keys.

Refactor the code to get rid of variable assignment in the outer block
from closures.

Fixes siderolabs#9415

Signed-off-by: Andrey Smirnov <[email protected]>
smira added a commit to smira/talos that referenced this issue Oct 7, 2024
@smira
fix: volume encryption with failing keyslots
50002fe 
Fix the flow when a failing key slot leads to repeated attempts to open
the volume, while it's already open, but the failure was to sync other
keys.

Refactor the code to get rid of variable assignment in the outer block
from closures.

Fixes siderolabs#9415

Signed-off-by: Andrey Smirnov <[email protected]>
smira added a commit to smira/talos that referenced this issue Oct 8, 2024
@smira
fix: volume encryption with failing keyslots
4d279c6 
Fix the flow when a failing key slot leads to repeated attempts to open
the volume, while it's already open, but the failure was to sync other
keys.

Refactor the code to get rid of variable assignment in the outer block
from closures.

Fixes siderolabs#9415

Signed-off-by: Andrey Smirnov <[email protected]>
(cherry picked from commit 0a2b455)
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Dec 7, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@smira smira

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: volume encryption with failing keyslots smira/talos
2 participants
@smira @uhthomas