Project: Piraeus Datastore (Runtime / Cloud Native Storage)
File: secure-boot.md

This guide shows you how to use the DRBD Module Loader on machines with SecureBoot enabled. When SecureBoot is enabled the Linux Kernel refuses to load unsigned kernel modules. Since the DRBD modules are built from source, they do not have a valid signature by default. To load them, they need to be signed, and the signing key needs to be inserted into the machine's trust store. To complete this guide, you should be familiar with: editing `LinstorSatelliteConfiguration` resources. generating key material with `openssl`. managing machine owner keys with `mokutil`. creating and protecting Kubernetes Secret resources. A Kubernetes node running with SecureBoot enabled. This can be checked by running the following command on each node: ``` SecureBoot enabled ``` Console access to the machine during early boot, or permissions to update the EFI platform keys another way. Create a private key and self-signed certificate using the `openssl` command line utility. The following command will create a new private key named `signingkey.pem` and a certificate named `signingkey.x509`, valid for 10 years, in the appropriate format: ``` $ openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -outform DER \ -out signingkey.x509 -keyout signingkey.pem -config - <<EOF [ req ] default_bits = 4096 distinguishedname = reqdistinguished_name prompt = no string_mask = utf8only x509_extensions = myexts [ reqdistinguishedname ] O = Piraeus Datastore CN = Piraeus Datastore kernel module signing key emailAddress = piraeus-signing-key@example.com [ myexts ] basicConstraints=critical,CA:FALSE keyUsage=digitalSignature subjectKeyIdentifier=hash authorityKeyIdentifier=keyid EOF ``` The generated certificate needs to be added to the machine's trust store. This step depends on the machine platform you are using. The instructions here apply to any system where you have console access during early boot, such as bare-metal or most virtualization platforms. First, distribute the generated certificate `signing_key.x509` to all nodes. Then, use the following command to add the certificate to the machine owner keys (MOK) using a password of your choice: ``` input password: input password again: ``` To enable the keys, start a console session on the machine, either by directly attching a keyboard and monitor, attaching a virtual console using the machines BMC, or using tools of your virtualization platform such as virt-viewer or

Then, reboot the machine, chosing to "Perform MOK management" when promted. Now: Select "Enroll MOK": Continue enrollment of the key: Enter the password chosen when running `mokutil --import`: Reboot the machine: Create a Kubernetes Secret resource containing the generated key material. The following command creates a secret named `drbd-signing-keys`: ``` $ kubectl create secret generic drbd-signing-keys --type piraeus.io/signing-key \ --from-file=signingkey.pem --from-file=signingkey.x509 secret/drbd-signing-keys created ``` Now, configure the `drbd-module-loader` to use the key material to sign the kernel modules. The following `LinstorSatelliteConfiguration` resource makes the key available in the `drbd-module-loader` container available and sets the `LB_SIGN` environment variable to start signing the modules: ```yaml apiVersion: piraeus.io/v1 kind: LinstorSatelliteConfiguration metadata: name: drbd-module-signing spec: podTemplate: spec: initContainers: name: drbd-module-loader env: name: LB_SIGN value: /signing-key volumeMounts: name: signing-key mountPath: /signing-key readOnly: true volumes: name: signing-key secret: secretName: drbd-signing-keys ``` When everything is configured correctly, the `drbd-module-loader` init container will be able to insert the DRBD modules. ``` $ kubectl logs ds/linstor-satellite.node1.example.com drbd-module-loader ... DRBD version loaded: version: 9.2.8 (api:2/proto:86-122) GIT-hash: e163b05a76254c0f51f999970e861d72bb16409a build by @linstor-satellite.k8s-21.test-zskzl, 2024-04-03 09:04:15 Transports (api:20): tcp (9.2.8) lb-tcp (9.2.8) rdma (9.2.8) ``` If the modules are not signed, or the signature is not trusted, the `drbd-module-loader` container will crash with one of the following error messages: ``` insmod: ERROR: could not insert module ./drbd.ko: Operation not permitted insmod: ERROR: could not insert module ./drbdtransporttcp.ko: Operation not permitted insmod: ERROR: could not insert module ./drbdtransportlb-tcp.ko: Operation not permitted Could not load DRBD kernel modules ``` ``` insmod: ERROR: could not insert module ./drbd.ko: Key was rejected by service insmod: ERROR: could not insert module ./drbdtransporttcp.ko: Key was rejected by service insmod: ERROR: could not insert module ./drbdtransportlb-tcp.ko: Key was rejected by service Could not load DRBD kernel modules ``` ``` insmod: ERROR: could not insert module ./drbd.ko: Required key not available insmod: ERROR: could not insert module ./drbdtransporttcp.ko: Required key not available insmod: ERROR: could not insert module ./drbdtransportlb-tcp.ko: Required key not available Could not load DRBD kernel modules ``` Additional information is available in the kernel logs: ``` $ dmesg ... Lockdown: insmod: unsigned module loading is restricted; see man kernel_lockdown.7 PKCS#7 signature not signed with a trusted key ```