docs: update disk-encryption.md #10194
Open
+6
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add note about required DHCP server when using kms disk encryption Signed-off-by: greenpsi <[email protected]>
|
Greetings! Thanks for the PR. Can you also update 1.10 docs? |
frezbo
reviewed
Jan 22, 2025
| @@ -37,6 +37,9 @@ Talos Linux supports four encryption methods, which can be combined together for | |||
| > Note: `nodeID` encryption is not designed to protect against attacks where physical access to the machine, including the drive, is available. | |||
| > It uses the hardware characteristics of the machine in order to decrypt the data, so drives that have been removed, or recycled from a cloud environment or attached to a different virtual machine, will maintain their protection and encryption. | |||
| > Note: When using kms encryption, a DHCP server is required for the talos nodes, as the static Network configuration is only loaded after the disk is decrypted. | |||
There was a problem hiding this comment.
I'm not sure this is entirely correct based on how static network info is provided, if it's kernel cmdline I think it should work, am I right @smira ?
There was a problem hiding this comment.
yes, and it also depends on STATE/EPHEMERAL, and network config might come from too many place. but if you have your static network config in STATE, of course using KMS doesn't make sense
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request
What? (description)
Add note about required DHCP server when using kms disk encryption
Why? (reasoning)
Acceptance
Please use the following checklist:
make conformance)make fmt)make lint)make docs)make unit-tests)