Encrypted coreos about ambassador HOT 1 OPEN

@andrew415 I take it you're referring to my post in coreos/bugs#261 . The source code I used for generating a tamper-resistant bootloader (if used as described in coreos/bugs#261 ) can be found in the https://github.com/SojournLabs/vapr repository. There are wrappers there for using the contents of the Sojournlabs/netboot repo (and several other tools we use for our systems). The script in the vapr /bin directory that you're most likely interested in is recore (modifies a CoreOS IPXE disk image to add FDE). I can't recall, but you may need to do some configuration of things before hand since we sign all our disk images (ca_create for our certificate authority and cert_create for code signing, amongst others).

If you're happy repackaging your boot image manually (or aren't using IPXE), the files we inserted into the systemd loader are are in here: https://github.com/SojournLabs/netboot/tree/master/recore.docker/profiles.
Specifically, you want the btrfs.mount target and the reformat.sh script to format your disk.

I don't specifically recommend IPXE; I happened to choose IPXE booting because I wanted to "freeze" the boot disk image for simplicity (so that there's no "out of date" USB boot disks). As you can tell from our netboot source, our boot disks simply contain our custom CA and a list of web mirrors to download our signed and modified CoreOS from.

edit: You'll also need to add the mount and encryption targets from https://github.com/SojournLabs/netboot/tree/master/recore.docker/profiles/bootserver/lib64/systemd/system in your custom boot image.

from ambassador.