Include clevis

[sghosh151]

Include clevis to support automated disk encryption
Related: coreos/ignition#577

[cgwalters]

OK I'm in favor of this. I was researching TPMs and LUKS and clevis has pretty good support for this.

[lucab]

I do like the idea of piggybacking on clevis for LUKS support. However before blindly including it I think we have some design/experimenting groundwork to do.

In particular, some relevant points are:

• a rough sketch of how provisioning on first-boot an encrypted volume via Ignition looks like
• a rough sketch of how unlocking on subsequent-boots an encrypted volume looks like (especially the root volume)
• clouds are our main environments, so our direct targets are network-attached secret managers (Vault, AWS KMS, etc.). We should check what's clevis coverage there.

[sghosh151]

On premise baremetal is a big use case. Encrypted disk is more suitable for baremetal deployments. Cloud deployments via prebuilt AMI, etc implies lvm is already configured and common for all instances booted from same AMI.

[sghosh151]

For on-premise deployments, creating a dependency on pre-existing Tang service should be sufficent.

For cloud deployment, should support explicit tang server setting to allow reach back from cloud vpc to on-premise tang service.

[rugk]

Maybe interesting: Another post on how to use that with TPM2 unlocking.

[dustymabe]

This seems to be resolved by the recent work we did to support LUKs on the root device

coreos/fedora-coreos-config#609

[dustymabe]

The fix for this went into testing stream release 32.20200923.2.0. Please try out the new release and report issues.

[dustymabe]

The fix for this went into stable stream release 32.20200923.3.0.