VM Disk Encryption Keys
In this article, we'll guide you through the process of preparing Vault for storing our LUKS keys and obtaining the necessary details to integrate hosts with Vault. Additionally, we'll aim to conclude by setting up a client to test the entire system. To facilitate this, you should have set up a new VM and added an additional disk to it within a cluster.
Approle
To begin, we'll create a new backend on Vault using Approles instead of the KV store. Approles are particularly useful for machine or service authentication rather than human users.
Normally, we'd require the approle_id and the secret_id to obtain a valid token from Vault. However, in our current setup, only the approle and being within the specified CIDR range are necessary. Here's the command used:
This command creates an approle named "vaultlocker" with the associated policy "vaultlocker" (which we'll create shortly) and restricts access to my internal network.
Next, we need to create the policy.
Policy
We need to define a policy for this approle. Here's the policy:
After creating the policy, rerun the approle creation command.
That should cover the necessary configurations.
Vaultlocker
The script we're utilizing, called Vault Locker, appears to be part of the OpenStack suite. It's a relatively small Python script but seems to function effectively.
Installation
Installation is straightforward; you can install the vaultlocker using pip.
Additionally, you'll need to create the config directory and file:
Vaultlocker.conf
Configuration for vaultlocker is stored in /etc/vaultlocker/vaultlocker.conf. It's a simple file containing three key pieces of information. Here's a sample configuration with the IDs omitted:
You can retrieve your approle ID using the following command:
which will output the approle ID.
If you've used the provided command to create the approle, the secret ID isn't necessary.
The backend refers to the path where data is stored.
Run
Let's put our setup to the test.
Firstly, we need to gather some information about the disk we intend to encrypt, ideally its UUID. For testing, here we'll be using /dev/sdb1. You can check in /dev/disk/by-uuid to find the UUID of your disk:
Now that we have the UUID, let's proceed with encrypting it and verifying if the LUKS key is sent to Vault! Run the following command, replacing the UUID and block device with your own:
You should receive an output similar to this:
I've added line breaks for readability. In summary, it worked flawlessly!
It successfully accessed the Vault cluster, formatted the disk, encrypted it, and then extracted the hostname of the machine. Afterward, it created a new secret in the /vaultlocker backend, storing the LUKS key under the disk's UUID.
Let's verify this in the UI:
Now, onto the final step... mounting at boot.
Setting up the service file
Vaultlocker has generated a systemd service file for us. While the current configuration decrypts the device on boot, we also want it to mount. Let's add the mount command to the service file:
This addition ensures that the device is mounted to /test after decryption.
With these steps completed, your setup should be ready for use.
Last updated
