updates to ephemeral encryption keys

[piyush-jena]

Description of changes:

• Adds documentation for this preview feature
• use plain mode device encryption (which is headerless) when ephemeral encryption keys are used
• encrypt and unlock in the same service to avoid storing keys in any storage (except datastore encryption)

Testing done:
Containers run with containerd:

1. Tested nvidia-smoke-test - both nvidia-smi and CUDA Workload
2. Tested dotnet-test workload.

FIPS test:

[ssm-user@control]$ apiclient report fips
Benchmark name:  FIPS Security Policy
Version:         v1.0.0
Reference:       https://csrc.nist.gov/
Benchmark level: 1
Start time:      2026-08-27T06:49:34.743345588Z

[PASS] 1.0       FIPS mode is enabled. (Automatic)
[PASS] 1.1       FIPS module is Amazon Linux 2023 Kernel Cryptographic API. (Automatic)
[PASS] 1.2       FIPS self-tests passed. (Automatic)

Passed:          3
Failed:          0
Skipped:         0
Total checks:    3

Compliance check result: PASS

lsblk output

bash-5.2# lsblk
NAME                     MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme1n1                  259:0    0    20G  0 disk
`-nvme1n1p1              259:12   0    20G  0 part
  `-BOTTLEROCKET-DATA    252:2    0    20G  0 crypt /var
                                                    /opt
                                                    /mnt
                                                    /local
nvme0n1                  259:1    0     2G  0 disk
|-nvme0n1p1              259:4    0     4M  0 part
|-nvme0n1p2              259:5    0    10M  0 part
|-nvme0n1p3              259:6    0    80M  0 part  /boot
|-nvme0n1p4              259:7    0   1.8G  0 part
|-nvme0n1p5              259:8    0    20M  0 part
|-nvme0n1p6              259:9    0    50M  0 part
|-nvme0n1p7              259:10   0    41M  0 part
| `-BOTTLEROCKET-PRIVATE 252:1    0    41M  0 crypt /var/lib/bottlerocket
|                                                   /.bottlerocket
`-nvme0n1p8              259:11   0     1M  0 part
nvme2n1                  259:2    0 109.9G  0 disk

keystore for datastore encryption is correctly labeled and the key is ephemeral

bash-5.2# ls -lZ /run/ | grep rottweiler
drwx------.  2 root   root   system_u:object_r:private_t:s0     40 Aug 27 06:31 rottweiler
bash-5.2# ls -lZ /run/rottweiler
total 0

systemctl status output

bash-5.2# systemctl status
● ip-172-31-16-76.us-west-2.compute.internal
    State: running
    Units: 417 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Thu 2026-08-27 06:29:39 UTC; 22min ago
  systemd: 257.13

older services were removed

bash-5.2# find . -name unlock-datastore.service
bash-5.2# find . -name encrypt-unlock-datastore.service
./etc/systemd/system/storewolf.service.requires/encrypt-unlock-datastore.service
./etc/systemd/system/migrator.service.requires/encrypt-unlock-datastore.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-datastore.service
bash-5.2# find . -name unlock-datastore.service
bash-5.2# find . -name encrypt-datastore.service
bash-5.2# find . -name encrypt-local-fs.service
bash-5.2# find . -name unlock-local-fs.service
bash-5.2# find . -name encrypt-unlock-local-fs.service
./etc/systemd/system/local-fs.target.requires/encrypt-unlock-local-fs.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-local-fs.service
bash-5.2# find . -name encrypt-unlock-private-fs.service
./etc/systemd/system/prepare-private-fs.service.requires/encrypt-unlock-private-fs.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-private-fs.service
bash-5.2# find . -name encrypt-private-fs.service
bash-5.2# find . -name unlock-private-fs.service

Stress test:
Ran reboot loop on 3 nvidia instances with bootstrap command setting up ephemeral storage with a large data partition. Didn't get any bricked device across 300 boots.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[vigh-m]

Should this conflict with ephemeral-crypt?

[piyush-jena]

The conflict logic is made on the basis of image-feature. crypt-luks conflicts with image-feature(ephemeral-encryption-keys) and ephemeral-crypt requires image-feature(ephemeral-encryption-keys). So the additional conflict with ephemeral-crypt would just be a redundant check.

[piyush-jena]

Force push removes the requirement of a udev settle by reordering the commands in encrypt-attach-local-fs.service. This is achieved by doing the cheaper operations first - encrypt, unlock, systemd-makefs (on the smaller filesystem) followed by systemd-repart and rottweiler resize. We run systemd-growfs in a separate service because this takes the most time and is heavily dependent on the size of the block device and requires the data partition to be mounted as local.

[piyush-jena]

Force push shortens comments and adds a fix to race in rottweiler's cryptsetup_resize function. It occurs in case of plain mode only. We pass the key through STDIN. In case of LUKS2, the child process (cryptsetup-resize), reads the STDIN which contains the key and then resizes. In case of plain mode, the child process actually picks up the key from kernel keyring and runs the resize and exits. The race is that the child sometimes does this faster than the parent (rottweiler) can write to STDIN which leads to broken pipe error.

[piyush-jena]

Force push above rebases and fixes comments to hard fail if image-feature function fails instead of assuming default.

[piyush-jena]

Force push adds details to commit messages.