mirror of
https://github.com/siderolabs/talos.git
synced 2025-09-12 17:31:13 +02:00
58ff2c9808
This PR introduces the first part of disk encryption support. New config section `systemDiskEncryption` was added into MachineConfig. For now it contains only Ephemeral partition encryption. Encryption itself supports two kinds of keys for now: - node id deterministic key. - static key which is hardcoded in the config and mainly used for test purposes. Talosctl cluster create can now be told to encrypt ephemeral partition by using `--encrypt-ephemeral` flag. Additionally: - updated pkgs library version. - changed Dockefile to copy cryptsetup deps from pkgs. Signed-off-by: Artem Chernyshev <artem.0xD2@gmail.com>
35 lines
956 B
Go
35 lines
956 B
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
// Package keys contains various encryption KeyHandler implementations.
|
|
package keys
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/talos-systems/talos/pkg/machinery/config"
|
|
)
|
|
|
|
// NewHandler creates a new key handler depending on key handler kind.
|
|
func NewHandler(key config.EncryptionKey) (Handler, error) {
|
|
switch {
|
|
case key.Static() != nil:
|
|
k := key.Static().Key()
|
|
if k == nil {
|
|
return nil, fmt.Errorf("static key must have key data defined")
|
|
}
|
|
|
|
return NewStaticKeyHandler(k)
|
|
case key.NodeID() != nil:
|
|
return NewNodeIDKeyHandler()
|
|
}
|
|
|
|
return nil, fmt.Errorf("failed to create key handler: malformed config")
|
|
}
|
|
|
|
// Handler represents an interface for fetching encryption keys.
|
|
type Handler interface {
|
|
GetKey(options ...KeyOption) ([]byte, error)
|
|
}
|