Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Record the TPM State of each node and if encryption enabled, backup the keys of each node into the report #101

Open
CodeJACKz opened this issue Sep 23, 2022 · 4 comments
Assignees
Labels
enhancement New feature or request
Milestone

Comments

@CodeJACKz
Copy link

Since TPM should now be implemented for all deployments, can this detail be added to the report?

Link with example code:
https://vm.knutsson.it/2021/07/powercli-tpm-encryption-recovery-key-backup/

I got bitten by this after a recent deployment where the keys were not recorded and a node failed a couple of weeks after. Recovery would have been possible and faster had i recorded all the keys.

@CodeJACKz
Copy link
Author

I'll get greedy by asking to record the Key Persistence status too :-)

This is used to set it:
Key persistence is not enabled by default when using 3rd party KMS. This can be enabled via the following esxcli commands:
esxcli system settings encryption set --mode=TPM
esxcli system security keypersistence enable

https://core.vmware.com/blog/support-key-persistence

@tpcarman tpcarman self-assigned this Sep 24, 2022
@tpcarman tpcarman added the enhancement New feature or request label Sep 24, 2022
@tpcarman
Copy link
Contributor

I'll look into adding the TPM information, however an as-built does not set or change a configuration, it simply documents and records the current configuration.

@CodeJACKz
Copy link
Author

Thanks Tim. I only included them "set" commands to hint at a place to check if it was even enabled or not

@tpcarman
Copy link
Contributor

Yeah thanks for that, I will likely use that to report on whether it is set or not, and probably add a health check for it too.

@tpcarman tpcarman added this to the v1.4.0 milestone Oct 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants