m/n/c/cluster: set StorageSecurity in bootstrap path
Currently this is only set properly in the register path, causing the
configuration of the bootstrap node to be inconsistent. This causes
bootup to fail with `Node startup failed: sealed configuration has
invalid node unlock key (wanted 32 bytes, got 0)`.
Fix this by also persisting the chosen storage security option in the
node configuration when bootstrapping.
Change-Id: I93bf75d412c9aa7c09b5a739ce65b6873d947fd5
Reviewed-on: https://review.monogon.dev/c/monogon/+/1815
Tested-by: Jenkins CI
Reviewed-by: Serge Bazanski <serge@monogon.tech>
diff --git a/metropolis/node/core/cluster/cluster_bootstrap.go b/metropolis/node/core/cluster/cluster_bootstrap.go
index fcc5756..690af00 100644
--- a/metropolis/node/core/cluster/cluster_bootstrap.go
+++ b/metropolis/node/core/cluster/cluster_bootstrap.go
@@ -123,7 +123,8 @@
JoinKey: jpriv,
// No ClusterCA yet, that's added by the roleserver after it finishes curator
// bootstrap.
- ClusterCa: nil,
+ ClusterCa: nil,
+ StorageSecurity: storageSecurity,
}
if err = m.storageRoot.ESP.Metropolis.SealedConfiguration.SealSecureBoot(&sc, tpmUsage); err != nil {
return fmt.Errorf("writing sealed configuration failed: %w", err)