decrypt-root: Rework around a udev rule to fix slow PXE/ISO boots

[chewi]

decrypt-root: Rework around a udev rule to fix slow boots

PXE and ISO boots were taking over 1m30s because decrypt-root.service was waiting for the ROOT partition to appear just in case it needed to be decrypted.

Making this service conditional on non-PXE/ISO boots was considered, but users may well want an encrypted ROOT when booting using these methods. Adding conditions didn't avoid the delay caused by the Wants directive in any case.

This change makes decrypt-root.service more reactive by having it triggered by a udev rule matching a LUKS-encrypted partition named ROOT. systemd knows to wait for /dev/mapper/rootencrypted to appear before attempting to switch root.

Adding After=ignition-disks.service ensures that the service does not try to decrypt ROOT before Ignition wipes it again due to flatcar.first_boot=1 being given.

The service itself has been simplified. crypttab is just as happy with a block device path, so there is no need to determine the UUID. The udev rule only matches LUKS-encrypted partitions, so there is no need to check the header either. The rest is simple enough to include in the service unit directly, removing the need for a separate shell script. systemd-cryptsetup-generator can read the crypttab from stdin, avoiding the creation of a temporary file. It is also important to call daemon-reload before attempting to start the generated unit.

Closes: flatcar/Flatcar#1514

How to use

Images are present on bincache. A regular ISO or PXE boot with QEMU should only take a few seconds. You can experiment with encryption using these:

variant: flatcar
version: 1.0.0
storage:
  disks:
  - device: /dev/vda
    wipe_table: true
    partitions:
    - label: ROOT
  luks:
    - name: rootencrypted
      wipe_volume: true
      device: "/dev/disk/by-partlabel/ROOT"
  filesystems:
    - device: /dev/mapper/rootencrypted
      format: ext4
      label: ROOT
systemd:
  units:
    - name: cryptenroll-helper.service
      enabled: true
      contents: |
        [Unit]
        ConditionFirstBoot=true
        OnFailure=emergency.target
        OnFailureJobMode=isolate
        [Service]
        Type=oneshot
        RemainAfterExit=yes
        ExecStart=systemd-cryptenroll --tpm2-device=auto --unlock-key-file=/etc/luks/rootencrypted --wipe-slot=0 --tpm2-pcrs= /dev/disk/by-partlabel/ROOT
        ExecStart=rm /etc/luks/rootencrypted
        [Install]
        WantedBy=multi-user.target

qemu-img create -f qcow2 disk.img 6g
./flatcar_production_pxe.sh -i ignition.json -I disk.img -T swtpm -- -append 'flatcar.autologin flatcar.first_boot=1 root=/dev/mapper/rootencrypted'

You can use the regular QCOW2 image by removing the disks section so that it encrypts the existing ROOT partition.

Testing done

A lot of manual testing around the above. The Jenkins packages_all_arches job passed fine.

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update) -- I'll add this to flatcar/scripts
• Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

[krnowak]

Asking only for a commit message update. Otherwise looks good. I assume that Jenkins job you mentioned was http://jenkins.infra.kinvolk.io:8080/job/container/job/packages_all_arches/4534/cldsv/, right?