OCF_HEARTBEAT_CRYPT(7)

💅 ocf_heartbeat_crypt(7) — the LUKS glow-up, bestie edition

okay so welcome to ocf_heartbeat_crypt(7), the manual page for the LUKS/crypt resource agent, brought to you by the fine people behind the OCF resource agents. sit down, hydrate, and let's talk about keeping your encrypted devices absolutely slaying ✨

---

🌸 SYNOPSIS 🌸

crypt [start | stop | monitor | meta-data | validate-all]

that's the whole vibe: five actions, no notes 💅

---

🎀 DESCRIPTION 🎀

so this is a LUKS/crypt Resource Agent, and its whole main character job is managing encrypted devices via cryptsetup(8). it's literally that girl 🫶

but bestie, hear me out — it's picky. the agent imposes limitations on the device types it supports: only luks and luks[1..N]. so no chaotic off-brand formats, we stay in our lane 💀

---

✨ SUPPORTED PARAMETERS ✨

• encrypted_dev — the encrypted backing device, which honestly should be defined by UUID: 36 characters including -s</italic>, exactly as reported by blkid(8). like, character for character, no freestyling 💅

so yes, technically you can define it as a block device path (e.g. /dev/sdh), but the UUID is highkey the move over the block device path, because UUIDs let you uniquely discover the crypt backing device given the volatile nature of /dev entries. and the example is iconic: /dev/sdh on one node may be /dev/sdg on another 😭

only define as a block device path if you know what you are doing. i'm serious, bestie 🙈

(unique, required, string, no default)

• crypt_dev — the encrypted device name, no path. i.e. the one given in cryptsetup open name .... the resulting block device path is /dev/mapper/name. that's it, that's the parameter 🌈

(unique, required, string, no default)

• key_file — key file path containing the encryption passphrase (aka key; see cryptsetup(8)). for LUKS, the passphrase as of the key_file parameter is used to decrypt a randomly selected key when the device was created. lowkey elegant tbh 🔥

(optional, string, no default)

• crypt_type — the encryption (device) type (e.g. "luks" or "luks2"). this parameter affirms the encryption format as of the crypt metadata, thus allowing for safety measures when starting the encrypted resource. it's giving responsible queen behavior 👑

(optional, string, no default)

• force_stop — okay so if processes or kernel threads are using the crypt device, it cannot be stopped. we will try to stop processes, first by sending TERM and then, if that doesn't help in seconds, using KILL. the lsof(8) program is required to get the list of array users. and of course, the kernel threads cannot be stopped this way — nope, not happening 💀 if the processes are critical for data integrity, then set this parameter to false.

heads up: in that case the stop operation will fail and the node will be fenced. not a drill, bestie 😭

(optional, boolean, default false)

• use_clevis — if the LUKS volume is set up to unlock automatically using Tang/Clevis, then set this parameter to "true". it has the side-effect of ignoring the "key_file" and "crypt_type" parameters. it's giving ~automation~, and honestly? obsessed 💖

(optional, boolean, default false)

---

🌟 SUPPORTED ACTIONS 🌟

this resource agent supports the following actions (operations) — collect them all, iykyk:

• start — starts the resource. suggested minimum timeout: 20s. go go go 🚀
• stop — stops the resource. suggested minimum timeout: 20s. bye bestie 👋
• monitor — performs a detailed status check. suggested minimum timeout: 20s. suggested interval: 10s. the vibe check, fr fr 🦋
• meta-data — retrieves resource agent metadata (internal use only). suggested minimum timeout: 5s.
• validate-all — performs a validation of the resource configuration. suggested minimum timeout: 10s. self-care for your config 💅

---

🧚 EXAMPLE CRM SHELL 🧚

this is an example configuration for a crypt resource using the crm(8) shell — copy it exactly, no ~creative liberties~:

primitive p_crypt ocf:heartbeat:crypt \
  params \
    encrypted_dev=string \
    crypt_dev=string \
  op monitor timeout="20s" interval="10s" depth="0"

slay 🎀

---

💜 EXAMPLE PCS 💜

and here's the same energy for pcs(8):

pcs resource create p_crypt ocf:heartbeat:crypt \
  encrypted_dev=string \
  crypt_dev=string \
  op monitor timeout="20s" interval="10s" OCF_CHECK_LEVEL="0"

ate, no crumbs 🍓

---

🔥 SEE ALSO 🔥

• http://clusterlabs.org/ — go say hi, they're lovely 🫶

---

👑 AUTHOR 👑

ClusterLabs contributors (see the resource agent source for information about individual authors). literal icons, every single one of them 👑

---

and that's the whole page, bestie 💖 this was resource-agents version UNKNOWN, dated 10/01/2026 — so cute, so iconic, so encrypted. now go forth and let your devices be secure and stunning ✨🌈🌸