Skip to content

Commit

Permalink
initializer.cryptsetup: drop debug logs
Browse files Browse the repository at this point in the history
  • Loading branch information
jmxnzo committed Jan 10, 2025
1 parent a6e7e72 commit 8c985ab
Showing 1 changed file with 2 additions and 9 deletions.
11 changes: 2 additions & 9 deletions internal/kuberesource/parts.go
Original file line number Diff line number Diff line change
Expand Up @@ -481,7 +481,7 @@ func ServiceMeshProxy() *applycorev1.ContainerApplyConfiguration {
// container to setup an encrypted LUKS mount.
func CryptsetupInitCommand() string {
return `#!/bin/bash
set -ex
set -e
# Regarding https://man7.org/linux/man-pages/man8/cryptsetup.8.html
# passphrase <=> key in this document, not an actual cryptographic key
Expand All @@ -502,31 +502,24 @@ if ! cryptsetup isLuks "${device}"; then
echo "init_passphrase" > "${tmp_key_path}"
cryptsetup luksFormat --pbkdf-memory=10240 $device "${tmp_key_path}" </dev/null
blkid "${device}" -o export
# Generate passphrase based on workload secret and uuid of LUKS device.
echo "$(cat "${workload_secret_path}")$(cryptsetup luksUUID "${device}")" > "${disk_encryption_key_path}"
# Change the encryption key to use derived passphrase.
cryptsetup luksChangeKey --pbkdf-memory=10240 "${device}" --key-file "${tmp_key_path}" "${disk_encryption_key_path}"
cryptsetup luksDump ${device}
cryptsetup open "${device}" state -d "${disk_encryption_key_path}"
# Create the ext4 filesystem on the mapper device.
mkfs.ext4 /dev/mapper/state
blkid "/dev/mapper/state" -o export
else
# (Everytime)
# Generate passphrase based on workload secret and uuid of LUKS device.
echo "$(cat "${workload_secret_path}")$(cryptsetup luksUUID "${device}")" > "${disk_encryption_key_path}"
cryptsetup open "${device}" state -d "${disk_encryption_key_path}"
fi
cryptsetup luksDump ${device}
cryptsetup luksUUID "${device}"
mount /dev/mapper/state /state
touch /done
sleep inf
Expand Down

0 comments on commit 8c985ab

Please sign in to comment.