Dustin C. Hatch
59be10a51c
The *gasket-dkms* package provides the `gasket` and `apex` kernel modules, which are needed fro the Google Coral Edge TPU. Since these are out-of-tree modules, they are not allowed in Fedora proper, so they are provided in a COPR, and have to be rebuilt for every kernel version. The DKMS framework handles automatically building the modules whenever the kernel updates. For systems usign UEFI with SecureBoot enabled, kernel modules must be signed by a key trusted by the platform. For locally-built modules, we can use the Machine Owner Key (MOK). Unfortunately, enrolling a new MOK requires rebooting and manual intervention during the boot process. Therefore, the *gasket-dkms* role has a `pause` step to ensure someone is paying attention and able handle the key enrollment interactively. Eventually, I'd like to have an RPM package with these modules pre-built, so production servers do not need the kernel development tools (`perl`, `gcc`, headers, etc.). It will be tricky, though, to make sure the modules get rebuilt for every kernel version as Fedora releases them.
26 lines
478 B
YAML
26 lines
478 B
YAML
# vim: set ft=yaml.jinja :
|
|
|
|
- name: enroll uefi mok
|
|
shell: |
|
|
mokutil --import /etc/pki/tls/certs/dkms.der <<EOF
|
|
{{ vault_mok_password }}
|
|
{{ vault_mok_password }}
|
|
EOF
|
|
notify:
|
|
- reboot notify
|
|
- reboot the system
|
|
tags:
|
|
- mok
|
|
|
|
- name: reboot notify
|
|
pause:
|
|
prompt: >-
|
|
The machine will now reboot and you must manually enroll the MOK.
|
|
Pres ENTER to continue
|
|
|
|
- name: reboot the system
|
|
reboot:
|
|
reboot_timeout: 300
|
|
tags:
|
|
- reboot
|