20.15. 使用 storage RHEL 系统角色创建 LUKS2 加密的卷

流程

1. 使用以下内容创建新的 playbook.yml 文件：

   - hosts: all
     vars:
       storage_volumes:
         - name: barefs
           type: disk
           disks:
            - sdb
           fs_type: xfs
           fs_label: label-name
           mount_point: /mnt/data
           encryption: true
           encryption_password: your-password
     roles:
      - rhel-system-roles.storage

   Copy to Clipboard Toggle word wrap

   您还可以在 playbook.yml 文件中添加其他加密参数，如 encryption_key、encryption_cipher、encryption_key_size 和 encryption_luks 版本。

2. 可选：验证 playbook 语法：

   # ansible-playbook --syntax-check playbook.yml

   Copy to Clipboard Toggle word wrap

3. 在清单文件上运行 playbook:

   # ansible-playbook -i inventory.file /path/to/file/playbook.yml

   Copy to Clipboard Toggle word wrap

验证

1. 查看加密状态：

   # cryptsetup status sdb
   
   /dev/mapper/sdb is active and is in use.
   type: LUKS2
   cipher: aes-xts-plain64
   keysize: 512 bits
   key location: keyring
   device: /dev/sdb
   [...]

   Copy to Clipboard Toggle word wrap

2. 验证创建的 LUKS 加密的卷：

   # cryptsetup luksDump /dev/sdb
   
   Version:       	2
   Epoch:         	6
   Metadata area: 	16384 [bytes]
   Keyslots area: 	33521664 [bytes]
   UUID:          	a4c6be82-7347-4a91-a8ad-9479b72c9426
   Label:         	(no label)
   Subsystem:     	(no subsystem)
   Flags:       	allow-discards
   
   Data segments:
     0: crypt
   	offset: 33554432 [bytes]
   	length: (whole device)
   	cipher: aes-xts-plain64
   	sector: 4096 [bytes]
   [...]

   Copy to Clipboard Toggle word wrap

3. 查看 playbook.yml 文件中的 cryptsetup 参数，storage 角色对其支持：

   # cat ~/playbook.yml
   
       - hosts: all
         vars:
           storage_volumes:
             - name: foo
               type: disk
               disks:
                - nvme0n1
               fs_type: xfs
               fs_label: label-name
               mount_point: /mnt/data
               encryption: true
               #encryption_password: passwdpasswd
               encryption_key: /home/passwd_key
               encryption_cipher: aes-xts-plain64
               encryption_key_size: 512
               encryption_luks_version: luks2
   
         roles:
          - rhel-system-roles.storage

   Copy to Clipboard Toggle word wrap