fedora-docs-l10n/fedora-coreos/master/pages/storage — English @ Fedora Weblate: variant: fcos version: {butane-latest-stable-spec} storage: luks:

Zen

Source string Source string

English

variant: fcos
version: {butane-latest-stable-spec}
storage:
  luks:
    - name: root
      label: luks-root
      device: /dev/disk/by-partlabel/root
      clevis:
        custom:
          needs_network: false
          pin: tpm2
          config: '{"pcr_bank":"sha1","pcr_ids":"7"}'
      wipe_volume: true
  filesystems:
    - device: /dev/mapper/root
      format: xfs
      wipe_filesystem: true
      label: root

Needs editing

The string is read-only.

Skip

	English	Actions
	Encrypted storage (LUKS)
	Here is an example to configure a LUKS device at `/var/lib/data`.
	variant: fcos version: {butane-latest-stable-spec} storage: luks: - name: data device: /dev/vdb filesystems: - path: /var/lib/data device: /dev/mapper/data format: xfs label: DATA with_mount_unit: true
	The root filesystem can also be moved to LUKS. In that case, the LUKS device must be pinned by https://coreos.github.io/ignition/operator-notes/#clevis-based-devices[Clevis]. There are two primary pin types available: TPM2 and Tang (or a combination of those using Shamir Secret Sharing).
	TPM2 pinning just binds encryption to the physical machine in use. Make sure to understand its threat model before choosing between TPM2 and Tang pinning. For more information, see https://github.com/latchset/clevis/blob/master/src/pins/tpm2/clevis-encrypt-tpm2.1.adoc#threat-model[this section] of the Clevis TPM2 pin documentation.
	There is simplified Butane config syntax for configuring root filesystem encryption and pinning. Here is an example of using it to create a TPM2-pinned encrypted root filesystem:
	Encrypting the root filesystem with a TPM2 Clevis pin
	variant: fcos version: {butane-latest-stable-spec} boot_device: luks: tpm2: true
	This is equivalent to the following expanded config:
	Encrypting the root filesystem with a TPM2 Clevis pin without using boot_device
	variant: fcos version: {butane-latest-stable-spec} storage: luks: - name: root label: luks-root device: /dev/disk/by-partlabel/root clevis: tpm2: true wipe_volume: true filesystems: - device: /dev/mapper/root format: xfs wipe_filesystem: true label: root
	The expanded config doesn't include the `path` or `with_mount_unit` keys; FCOS knows that the root partition is special and will figure out how to find it and mount it.
	This next example binds the root filesystem encryption to PCR 7 which corresponds to the https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/[UEFI Boot Component] used to track the Secure Boot certificate from memory. Therefore, updates to the the UEFI firmware/certificates should not affect the value stored in PCR 7.
	Binding for PCR 8 (UEFI Boot Component used to track commands and kernel command line) is not supported as the kernel command line changes with every OS update.
	Encrypting the root filesystem with a TPM2 Clevis pin bound to PCR 7
	variant: fcos version: {butane-latest-stable-spec} storage: luks: - name: root label: luks-root device: /dev/disk/by-partlabel/root clevis: custom: needs_network: false pin: tpm2 config: '{"pcr_bank":"sha1","pcr_ids":"7"}' wipe_volume: true filesystems: - device: /dev/mapper/root format: xfs wipe_filesystem: true label: root
	More documentation for the `config` fields can be found in the `clevis` man pages: `man clevis-encrypt-tpm2`
	The following `clevis` command can be used to confirm that the root file system encryption is bound to PCR 7.
	$ sudo clevis luks list -d /dev/disk/by-partlabel/root 1: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
	Here is an example of the simplified config syntax with Tang:
	Encrypting the root filesystem with a Tang Clevis pin
	variant: fcos version: {butane-latest-stable-spec} boot_device: luks: tang: - url: http://192.168.122.1:80 thumbprint: bV8aajlyN6sYqQ41lGqD4zlhe0E
	The system will contact the Tang server on boot.
	For more information about setting up a Tang server, see https://github.com/latchset/tang[the upstream documentation].
	You can configure both Tang and TPM2 pinning (including multiple Tang servers for redundancy). By default, only the TPM2 device or a single Tang server is needed to unlock the root filesystem. This can be changed using the `threshold` key:
	Encrypting the root filesystem with both TPM2 and Tang pins
	variant: fcos version: {butane-latest-stable-spec} boot_device: luks: tang: - url: http://192.168.122.1:80 thumbprint: bV8aajlyN6sYqQ41lGqD4zlhe0E tpm2: true # this will allow rootfs unlocking only if both TPM2 and Tang pins are # accessible and valid threshold: 2
	Sizing the root partition
	If you use Ignition to reconfigure or move the root partition, that partition is not automatically grown on first boot (see related discussions in https://github.com/coreos/fedora-coreos-tracker/issues/570[this issue]). In the case of moving the root partition to a new disk (or multiple disks), you should set the desired partition size using the `size_mib` field. If reconfiguring the root filesystem in place, as in the LUKS example above, you can resize the existing partition using the `resize` field:
	Resizing the root partition to its maximum size
	variant: fcos version: {butane-latest-stable-spec} storage: disks: - device: /dev/disk/by-id/coreos-boot-disk partitions: - label: root number: 4 # 0 means to use all available space size_mib: 0 resize: true luks: - name: root device: /dev/disk/by-partlabel/root clevis: tpm2: true wipe_volume: true filesystems: - device: /dev/mapper/root format: xfs wipe_filesystem: true label: root

Loading…

None

String updated in the repository

English

English 419 characters edited Current translation Read-only

a year ago

Browse all string changes

Things to check

Multiple failing checks

Following checks are failing:

Mismatching line breaks: Portuguese (Brazil)
Unchanged translation: Spanish

Reset

Glossary

English	English
No related strings found in the glossary.

16788019 String information

Source string description

type: delimited block -

Flags

no-wrap, placeholders:r"`[\w.\/\-_=@&*:$●+~()\] ]*`", read-only

Source string location

./pages/storage.adoc:334

String age

a year ago

Last updated

a year ago

Source string age

a year ago

Translation file

pot/master/pages/storage.pot, string 56

Shortcut	Action
`?`	Open available keyboard shortcuts.
`Alt` + `Home`	Navigate to the first translation in the current search.
`Alt` + `End`	Navigate to the last translation in the current search.
`Alt` + `PageUp` or `Ctrl` + `↑` or `Alt` + `↑` or `Cmd` + `↑` or	Navigate to the last translation in the current search.
`Alt` + `PageDown` or `Ctrl` + `↓` or `Alt` + `↓` or `Cmd` + `↓` or	Navigate to the next translation in the current search.
`Ctrl` + `Enter` or `Cmd` + `Enter`	Submit current form; this works the same as pressing Save and continue while editing translation.
`Ctrl` + `Shift` + `Enter` or `Cmd` + `Shift` +`Enter`	Unmark translation as Needing edit and submit it.
`Alt` + `Enter` or `Option` + `Enter`	Submit the string as a suggestion; this works the same as pressing Suggest while editing translation.
`Ctrl` + `E` or `Cmd` + `E`	Focus on translation editor.
`Ctrl` + `U` or `Cmd` + `U`	Focus on comment editor.
`Ctrl` + `M` or `Cmd` + `M`	Shows Automatic suggestions tab.
`Ctrl` + `1` to `Ctrl` + `9` or `Cmd` + `1` to `Cmd` + `9`	Copies placeable of a given number from source string.
`Ctrl` + `M` followed by `1` to `9` or `Cmd` + `M` followed by `1` to `9`	Copy the machine translation of a given number to current translation.
`Ctrl` + `I` followed by `1` to `9` or `Cmd` + `I` followed by `1` to `9`	Ignore one item in the list of failing checks.
`Ctrl` + `J` or `Cmd` + `J`	Shows the Nearby strings tab.
`Ctrl` + `S` or `Cmd` + `S`	Focus on search field.
`Ctrl` + `O` or `Cmd` + `O`	Copy the source string.
`Ctrl` + `Y` or `Cmd` + `Y`	Toggle the Needs editing checkbox.
`→`	Browse the next translation string.
`←`	Browse the previous translation string.