17.2. Setting up Clevis clients with DHCP by using the nbde_client RHEL system role

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configure clients for unlocking of encrypted volumes by Tang servers
     hosts: managed-node-01.example.com
     tasks:
       - name: Create NBDE client bindings
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.nbde_client
         vars:
           nbde_client_bindings:
             - device: /dev/rhel/root
               encryption_key_src: /etc/luks/keyfile
               nbde_client_early_boot: true
               state: present
               servers:
                 - http://server1.example.com
                 - http://server2.example.com
             - device: /dev/rhel/swap
               encryption_key_src: /etc/luks/keyfile
               servers:
                 - http://server1.example.com
                 - http://server2.example.com

   This example playbook configures Clevis clients for automated unlocking of two LUKS-encrypted volumes when at least one of two Tang servers is available.

   The settings specified in the example playbook include the following:

   state: present

   The values of state indicate the configuration after you run the playbook. Use the present value for either creating a new binding or updating an existing one. Contrary to a clevis luks bind command, you can use state: present also for overwriting an existing binding in its device slot. The absent value removes a specified binding.

   nbde_client_early_boot: true

   The nbde_client role ensures that networking for a Tang pin is available during early boot by default. If your scenario requires to disable this feature, add the nbde_client_early_boot: false variable to your playbook.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.nbde_client/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. On your NBDE client, check that the encrypted volume that should be automatically unlocked by your Tang servers contain the corresponding information in its LUKS pins:

   # ansible managed-node-01.example.com -m command -a 'clevis luks list -d /dev/rhel/root'
   1: tang '{"url":"<http://server1.example.com/>"}'
   2: tang '{"url":"<http://server2.example.com/>"}'

2. If you do not use the nbde_client_early_boot: false variable, verify that the bindings are available for the early boot, for example:

   # ansible managed-node-01.example.com -m command -a 'lsinitrd | grep clevis-luks'
   lrwxrwxrwx   1 root     root           48 Jan  4 02:56 etc/systemd/system/cryptsetup.target.wants/clevis-luks-askpass.path -> /usr/lib/systemd/system/clevis-luks-askpass.path
   …