21.7. Creating an encrypted Stratis pool using Clevis

Starting with Stratis 2.4.0, you can create an encrypted pool using the Clevis mechanism by specifying Clevis options at the command line.

Prerequisites

Stratis v2.3.0 or later is installed and the stratisd service is running. For more information, see Installing Stratis.
An encrypted Stratis pool is created. For more information, see Creating an encrypted Stratis pool using a key in the kernel keyring.
Your system supports TPM 2.0.

Procedure

Erase any file system, partition table, or RAID signatures that exist on each block device that you want to use in the Stratis pool:
```
# wipefs --all block-device
```
The block-device value is the path to the block device; for example, /dev/sdb.
Create the encrypted Stratis pool and specify the Clevis mechanism to use for the encryption:
```
# stratis pool create --clevis tpm2 my-pool block-device
```
tpm2
Specifies the Clevis mechanism to use.
my-pool
Specifies the name of the new Stratis pool.
block-device
Specifies the path to an empty or wiped block device.
Alternatively, use the Clevis tang server mechanism by using the following command:
# stratis pool create --clevis tang --tang-url my-url --thumbprint thumbprint my-pool block-device
tang
Specifies the Clevis mechanism to use.
my-url
Specifies the URL of the tang server.
thumbprint
References the thumbprint of the tang server.
You can also specify multiple block devices on a single line by using the following command:
# stratis pool create --clevis tpm2 my-pool block-device-1 block-device-2

Verification