Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: update disk-encryption.md #10194

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −0
Open

docs: update disk-encryption.md #10194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions website/content/v1.8/talos-guides/configuration/disk-encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ Talos Linux supports four encryption methods, which can be combined together for
> Note: `nodeID` encryption is not designed to protect against attacks where physical access to the machine, including the drive, is available.
> It uses the hardware characteristics of the machine in order to decrypt the data, so drives that have been removed, or recycled from a cloud environment or attached to a different virtual machine, will maintain their protection and encryption.
> Note: When using kms encryption, a DHCP server is required for the talos nodes, as the static Network configuration is only loaded after the disk is decrypted.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure this is entirely correct based on how static network info is provided, if it's kernel cmdline I think it should work, am I right @smira ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, and it also depends on STATE/EPHEMERAL, and network config might come from too many place. but if you have your static network config in STATE, of course using KMS doesn't make sense

> Otherwise, no connection to the kms server is possible.
## Configuration

Disk encryption is disabled by default.
Expand Down
3 changes: 3 additions & 0 deletions website/content/v1.9/talos-guides/configuration/disk-encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ Talos Linux supports four encryption methods, which can be combined together for
> Note: `nodeID` encryption is not designed to protect against attacks where physical access to the machine, including the drive, is available.
> It uses the hardware characteristics of the machine in order to decrypt the data, so drives that have been removed, or recycled from a cloud environment or attached to a different virtual machine, will maintain their protection and encryption.
> Note: When using kms encryption, a DHCP server is required for the talos nodes, as the static Network configuration is only loaded after the disk is decrypted.
> Otherwise, no connection to the kms server is possible.
## Configuration

Disk encryption is disabled by default.
Expand Down