Chapter 17. Configuring NBDE by using RHEL System Roles 17.1. Introduction to the nbde_client and nbde_server System Roles (Clevis and Tang) RHEL System Roles is a collection of Ansible roles and modules that provide a consistent configuration interface to remotely manage multiple RHEL systems. You can use Ansible roles for automated deployments of Policy-Based Decryption (PBD) solutions using Clevis and Tang. The rhel-system-roles package contains these system roles, the related examples, and also the reference documentation. The nbde_client System Role enables you to deploy multiple Clevis clients in an automated way. Note that the nbde_client role supports only Tang bindings, and you cannot use it for TPM2 bindings at the moment. The nbde_client role requires volumes that are already encrypted using LUKS. This role supports to bind a LUKS-encrypted volume to one or more Network-Bound (NBDE) servers - Tang servers. You can either preserve the existing volume encryption with a passphrase or remove it. After removing the passphrase, you can unlock the volume only using NBDE. This is useful when a volume is initially encrypted using a temporary key or password that you should remove after you provision the system. If you provide both a passphrase and a key file, the role uses what you have provided first. If it does not find any of these valid, it attempts to retrieve a passphrase from an existing binding. PBD defines a binding as a mapping of a device to a slot. This means that you can have multiple bindings for the same device. The default slot is slot 1. The nbde_client role provides also the state variable. Use the present value for either creating a new binding or updating an existing one. Contrary to a clevis luks bind command, you can use state: present also for overwriting an existing binding in its device slot. The absent value removes a specified binding. Using the nbde_client System Role, you can deploy and manage a Tang server as part of an automated disk encryption solution. This role supports the following features: Rotating Tang keys Deploying and backing up Tang keys Additional resources For a detailed reference on Network-Bound Disk Encryption (NBDE) role variables, install the rhel-system-roles package, and see the README.md and README.html files in the /usr/share/doc/rhel-system-roles/nbde_client/ and /usr/share/doc/rhel-system-roles/nbde_server/ directories. For example system-roles playbooks, install the rhel-system-roles package, and see the /usr/share/ansible/roles/rhel-system-roles.nbde_server/examples/ directories. For more information on RHEL System Roles, see Preparing a control node and managed nodes to use RHEL System Roles . 17.2. Using the nbde_server System Role for setting up multiple Tang servers Follow the steps to prepare and apply an Ansible playbook containing your Tang server settings. Prerequisites Access and permissions to one or more managed nodes , which are systems you want to configure with the nbde_server System Role. Access and permissions to a control node, which is a system from which Red Hat Ansible Core configures other systems. On the control node: The ansible-core and rhel-system-roles packages are installed. Important RHEL 8.0-8.5 provided access to a separate Ansible repository that contains Ansible Engine 2.9 for automation based on Ansible. Ansible Engine contains command-line utilities such as ansible , ansible-playbook , connectors such as docker and podman , and many plugins and modules. For information about how to obtain and install Ansible Engine, see the How to download and install Red Hat Ansible Engine Knowledgebase article. RHEL 8.6 and 9.0 have introduced Ansible Core (provided as the ansible-core package), which contains the Ansible command-line utilities, commands, and a small set of built-in Ansible plugins. RHEL provides this package through the AppStream repository, and it has a limited scope of support. For more information, see the Scope of support for the Ansible Core package included in the RHEL 9 and RHEL 8.6 and later AppStream repositories Knowledgebase article. An inventory file which lists the managed nodes. Procedure Prepare your playbook containing settings for Tang servers. You can either start from the scratch, or use one of the example playbooks from the /usr/share/ansible/roles/rhel-system-roles.nbde_server/examples/ directory. Edit the playbook in a text editor of your choice, for example: Add the required parameters. The following example playbook ensures deploying of your Tang server and a key rotation: Note Since nbde_server_manage_firewall and nbde_server_manage_selinux are both set to true, the nbde_server role will use the firewall and selinux roles to manage the ports used by the nbde_server role. Apply the finished playbook: Where: * inventory-file is the inventory file. * logging-playbook.yml is the playbook you use. Important To ensure that networking for a Tang pin is available during early boot by using the grubby tool on the systems where Clevis is installed: Additional resources For more information, install the rhel-system-roles package, and see the /usr/share/doc/rhel-system-roles/nbde_server/ and usr/share/ansible/roles/rhel-system-roles.nbde_server/ directories. 17.3. Using the nbde_client System Role for setting up multiple Clevis clients Follow the steps to prepare and apply an Ansible playbook containing your Clevis client settings. Note The nbde_client System Role supports only Tang bindings. This means that you cannot use it for TPM2 bindings at the moment. Prerequisites Access and permissions to one or more managed nodes , which are systems you want to configure with the nbde_client System Role. Access and permissions to a control node , which is a system from which Red Hat Ansible Core configures other systems. The Ansible Core package is installed on the control machine. The rhel-system-roles package is installed on the system from which you want to run the playbook. Procedure Prepare your playbook containing settings for Clevis clients. You can either start from the scratch, or use one of the example playbooks from the /usr/share/ansible/roles/rhel-system-roles.nbde_client/examples/ directory. Edit the playbook in a text editor of your choice, for example: Add the required parameters. The following example playbook configures Clevis clients for automated unlocking of two LUKS-encrypted volumes by when at least one of two Tang servers is available: Apply the finished playbook: Important To ensure that networking for a Tang pin is available during early boot by using the grubby tool on the system where Clevis is installed: Additional resources For details about the parameters and additional information about the NBDE Client System Role, install the rhel-system-roles package, and see the /usr/share/doc/rhel-system-roles/nbde_client/ and /usr/share/ansible/roles/rhel-system-roles.nbde_client/ directories.

Commands:
cp /usr/share/ansible/roles/rhel-system-roles.nbde_server/examples/simple_deploy.yml ./my-tang-playbook.yml
vi my-tang-playbook.yml
--- - hosts: all vars: nbde_server_rotate_keys: yes nbde_server_manage_firewall: true nbde_server_manage_selinux: true roles: - rhel-system-roles.nbde_server
ansible-playbook -i inventory-file my-tang-playbook.yml
grubby --update-kernel=ALL --args="rd.neednet=1"
cp /usr/share/ansible/roles/rhel-system-roles.nbde_client/examples/high_availability.yml ./my-clevis-playbook.yml
vi my-clevis-playbook.yml
--- - hosts: all vars: nbde_client_bindings: - device: /dev/rhel/root encryption_key_src: /etc/luks/keyfile servers: - http://server1.example.com - http://server2.example.com - device: /dev/rhel/swap encryption_key_src: /etc/luks/keyfile servers: - http://server1.example.com - http://server2.example.com roles: - rhel-system-roles.nbde_client
ansible-playbook -i host1 , host2 , host3 my-clevis-playbook.yml
grubby --update-kernel=ALL --args="rd.neednet=1"