Zen

Translation

The root filesystem can also be moved to LUKS. In theat case of the root filesystem, the LUKS device must be backpinned by https://github.com/coreos/ignition/blob/master/docscoreos.github.io/ignition/operator-notes.md/#clevis-based-devices[cClevis]. There is simplified FCC syntax for encrypting the root filesystem; for example:are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
English type: Plain text
The root filesystem can also be moved to LUKS. In that case, the LUKS device must be pinned by https://coreos.github.io/ignition/operator-notes/#clevis-based-devices[Clevis]. There are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
328/2880 · 288

Sign in to save the translation.

English Portuguese (Brazil) Actions
variant: fcos
version: {butane-latest-stable-spec}
storage:
filesystems:
- device: /dev/disk/by-partlabel/root
wipe_filesystem: true
format: ext4
label: root
variant: fcos
version: 1.3.0
storage:
filesystems:
- device: /dev/disk/by-partlabel/root
wipe_filesystem: true
format: ext4
label: root
Similarly to the previous section, you can also move the root filesystem entirely. Here, we're moving root to a RAID0 device:
Similar à seção anterior, você também pode mover o sistema de arquivos raiz inteiramente. Aqui, estamos movendo a raiz para um dispositivo RAID1:
Moving the root filesystem to RAID0
Movendo o sistema de arquivos raiz para RAID0
variant: fcos
version: {butane-latest-stable-spec}
storage:
raid:
- name: myroot
level: raid0
devices:
- /dev/disk/by-id/virtio-disk1
- /dev/disk/by-id/virtio-disk2
filesystems:
- device: /dev/md/myroot
format: xfs
wipe_filesystem: true
label: root
variant: fcos
version: 1.3.0
storage:
raid:
- name: myroot
level: raid0
devices:
- /dev/disk/by-id/virtio-disk1
- /dev/disk/by-id/virtio-disk2
filesystems:
- device: /dev/md/myroot
format: xfs
wipe_filesystem: true
label: root
You don't need the `path` or `with_mount_unit` keys; FCOS knows that the root partition is special and will figure out how to find it and mount it.
Você não precisa das chaves `path` ou `with_mount_unit`; FCOS sabe que a partição raiz é especial e irá descobrir como encontrá-la e montá-la.
If you want to replicate the boot disk across multiple drives for resiliency to drive failure, you need to mirror all the default partitions (root, boot, EFI System Partition, and bootloader code). There is special Butane config syntax for this:
Se você deseja replicar o disco de inicialização em várias unidades para resiliência à falha da unidade, é necessário espelhar todas as partições padrão (raiz, inicialização, partição de sistema EFI e código do carregador de inicialização). Há uma sintaxe FCC especial para isso:
Mirroring the boot disk onto two drives
Espelhando o disco de inicialização em duas unidades
variant: fcos
version: {butane-latest-stable-spec}
boot_device:
mirror:
devices:
- /dev/sda
- /dev/sdb
variant: fcos
version: 1.3.0
boot_device:
mirror:
devices:
- /dev/sda
- /dev/sdb
Defining a filesystem
Definindo um sistema de arquivos
This example demonstrates the process of creating the filesystem by defining and labeling the partitions, combining them into a RAID array, and formatting that array as ext4.
Este exemplo demonstra o processo de criação do sistema de arquivos definindo e rotulando as partições, combinando-as em um arranjo RAID e formatando esse arranjo como ext4.
Defining a filesystem on a RAID storage device
Definindo um sistema de arquivos em um dispositivo de armazenamento RAID
variant: fcos
version: {butane-latest-stable-spec}
storage:
disks:
# This defines two partitions, each on its own disk. The disks are
# identified by their WWN.
- device: /dev/disk/by-id/wwn-0x50014ee261e524e4
wipe_table: true
partitions:
-
# Each partition gets a human-readable label.
label: "raid.1.1"
# Each partition is placed at the beginning of the disk and is 64 GiB
# long.
number: 1
size_mib: 65536
start_mib: 0
- device: /dev/disk/by-id/wwn-0x50014ee0b8442cd3
wipe_table: true
partitions:
- label: "raid.1.2"
number: 1
size_mib: 65536
start_mib: 0
# We use the previously defined partitions as devices in a RAID1 md array.
raid:
- name: publicdata
level: raid1
devices:
- /dev/disk/by-partlabel/raid.1.1
- /dev/disk/by-partlabel/raid.1.2
# The resulting md array is used to create an EXT4 filesystem.
filesystems:
- path: /var/publicdata
device: /dev/md/publicdata
format: ext4
label: PUB
with_mount_unit: true
variant: fcos
version: 1.3.0
storage:
disks:
# Isso define duas partições, cada uma em seu próprio disco. Os
# discos são identificados por seu WWN.
- device: /dev/disk/by-id/wwn-0x50014ee261e524e4
wipe_table: true
partitions:
-
# Cada partição se torna legível por humanos.
label: "raid.1.1"
# Cada partição é colocada no início do disco e tem 64 GiB de
# comprimento.
number: 1
size_mib: 65536
start_mib: 0
- device: /dev/disk/by-id/wwn-0x50014ee0b8442cd3
wipe_table: true
partitions:
- label: "raid.1.2"
number: 1
size_mib: 65536
start_mib: 0
# Usamos as partições definidas anteriormente como dispositivos em
# uma aranjo RAID1 md.
raid:
- name: publicdata
level: raid1
devices:
- /dev/disk/by-partlabel/raid.1.1
- /dev/disk/by-partlabel/raid.1.2
# O arranjo md resultante é usado para criar um sistema de arquivos
# EXT4.
filesystems:
- path: /var/publicdata
device: /dev/md/publicdata
format: ext4
label: PUB
Encrypted storage (LUKS)
Armazenamento criptografado (LUKS)
Here is an example to configure a LUKS device at `/var/lib/data`.
Aqui está um exemplo de como configurar um dispositivo LUKS em `/var/lib/data`.
variant: fcos
version: {butane-latest-stable-spec}
storage:
luks:
- name: data
device: /dev/vdb
filesystems:
- path: /var/lib/data
device: /dev/mapper/data
format: xfs
label: DATA
with_mount_unit: true
variant: fcos
version: 1.3.0
storage:
luks:
- name: data
device: /dev/vdb
filesystems:
- path: /var/lib/data
device: /dev/mapper/data
format: xfs
label: DATA
with_mount_unit: true
The root filesystem can also be moved to LUKS. In that case, the LUKS device must be pinned by https://coreos.github.io/ignition/operator-notes/#clevis-based-devices[Clevis]. There are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
O sistema de arquivos raiz também pode ser movido para LUKS. No caso do sistema de arquivos raiz, o dispositivo LUKS deve ser coberto por https://github.com/coreos/ignition/blob/master/docs/operator-notes.md#clevis-based-devices[clevis]. Há uma sintaxe FCC simplificada para criptografar o sistema de arquivos raiz; por exemplo:
TPM2 pinning just binds encryption to the physical machine in use. Make sure to understand its threat model before choosing between TPM2 and Tang pinning. For more information, see https://github.com/latchset/clevis/blob/master/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc#threat-model[this section] of the Clevis TPM2 pin documentation.
 
There is simplified Butane config syntax for configuring root filesystem encryption and pinning. Here is an example of using it to create a TPM2-pinned encrypted root filesystem:
 
Encrypting the root filesystem with a TPM2 Clevis pin
Mudando o sistema de arquivos raiz para ext4
variant: fcos
version: {butane-latest-stable-spec}
boot_device:
luks:
tpm2: true
variant: fcos
version: 1.3.0
boot_device:
luks:
tpm2: true
This is equivalent to the following expanded config:
Isso é equivalente à seguinte configuração expandida:
Encrypting the root filesystem with a TPM2 Clevis pin without using boot_device
Movendo o sistema de arquivos raiz para LUKS sem usar boot_device
variant: fcos
version: {butane-latest-stable-spec}
storage:
luks:
- name: root
label: luks-root
device: /dev/disk/by-partlabel/root
clevis:
tpm2: true
wipe_volume: true
filesystems:
- device: /dev/mapper/root
format: xfs
wipe_filesystem: true
label: root
variant: fcos
version: 1.3.0
storage:
luks:
- name: root
label: luks-root
device: /dev/disk/by-partlabel/root
clevis:
tpm2: true
wipe_volume: true
filesystems:
- device: /dev/mapper/root
format: xfs
wipe_filesystem: true
label: root
The expanded config doesn't include the `path` or `with_mount_unit` keys; FCOS knows that the root partition is special and will figure out how to find it and mount it.
A configuração expandida não inclui as chaves `path` ou `with_mount_unit`; FCOS sabe que a partição raiz é especial e irá descobrir como encontrá-la e montá-la.
This next example binds the root filesystem encryption to PCR 7 which corresponds to the https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/[UEFI Boot Component] used to track the Secure Boot certificate from memory. Therefore, updates to the the UEFI firmware/certificates should not affect the value stored in PCR 7.
 
Binding for PCR 8 (UEFI Boot Component used to track commands and kernel command line) is not supported as the kernel command line changes with every OS update.
 
Encrypting the root filesystem with a TPM2 Clevis pin bound to PCR 7
Mudando o sistema de arquivos raiz para ext4
variant: fcos
version: {butane-latest-stable-spec}
storage:
luks:
- name: root
label: luks-root
device: /dev/disk/by-partlabel/root
clevis:
custom:
needs_network: false
pin: tpm2
config: '{"pcr_bank":"sha1","pcr_ids":"7"}'
wipe_volume: true
filesystems:
- device: /dev/mapper/root
format: xfs
wipe_filesystem: true
label: root
variant: fcos
version: 1.3.0
storage:
luks:
- name: root
label: luks-root
device: /dev/disk/by-partlabel/root
clevis:
tpm2: true
wipe_volume: true
filesystems:
- device: /dev/mapper/root
format: xfs
wipe_filesystem: true
label: root
More documentation for the `config` fields can be found in the `clevis` man pages: `man clevis-encrypt-tpm2`
 
The following `clevis` command can be used to confirm that the root file system encryption is bound to PCR 7.
 
$ sudo clevis luks list -d /dev/disk/by-partlabel/root
1: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
 

Loading…

User avatar None

String updated in the repository

  1. fedora-docs-l10n/fedora-coreos
  2. master/pages/storage
  3. Portuguese (Brazil)
The root filesystem can also be moved to LUKS. In that case, the LUKS device must be pinned by https://coreos.github.io/ignition/operator-notes/#clevis-based-devices[Clevis]. There are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
O sistema de arquivos raiz também pode ser movido para LUKS. No caso do sistema de arquivos raiz, o dispositivo LUKS deve ser coberto por https://github.com/coreos/ignition/blob/master/docs/operator-notes.md#clevis-based-devices[clevis]. Há uma sintaxe FCC simplificada para criptografar o sistema de arquivos raiz; por exemplo:
a year ago
User avatar None

Source string changed

  1. fedora-docs-l10n/fedora-coreos
  2. master/pages/storage
  3. Portuguese (Brazil)
The root filesystem can also be moved to LUKS. In theat case of the root filesystem, the LUKS device must be backpinned by https://github.com/coreos/ignition/blob/master/docscoreos.github.io/ignition/operator-notes.md/#clevis-based-devices[cClevis]. There is simplified FCC syntax for encrypting the root filesystem; for example:are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
a year ago
Browse all string changes

Things to check

Mismatched colon

Source and translation do not both end with a colon

Reset

Mismatched full stop

Source and translation do not both end with a full stop

Reset

Glossary

English Portuguese (Brazil)
Ignition Ignition fedora-docs-l10n/fedora-coreos
root filesystem sistema de arquivos raiz fedora-docs-l10n/fedora-coreos

String information

Source string description
type: Plain text
Flags
placeholders:r"`[\w.\/\-_=@&*:$●+~()\] ]*`"
Source string location
pages/storage.adoc:268
String age
a year ago
Last updated
11 months ago
Source string age
a year ago
Translation file
po/pt_BR/master/pages/storage.po, string 44