---
name: "ocf_heartbeat_crypt"
section: "7"
platform: "linux"
package: "resource-agents"
version: "1:4.16.0-3+deb13u2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ocf_heartbeat_crypt"
---

# ocf\_heartbeat\_crypt(7)

LUKS/crypt resource agent

## NAME

ocf\_heartbeat\_crypt - LUKS/crypt resource agent

## SYNOPSIS

**crypt** \[start \| stop \| monitor \| meta-data \| validate-all\]

## DESCRIPTION

This is a LUKS/crypt Resource Agent managing encrypted devices via [cryptsetup(8)](/cryptsetup/8.md). The agent imposes limitations on device types supported: luks, luks\[1..N\].

## SUPPORTED PARAMETERS

**encrypted\_dev**

Encrypted backing device, which should be defined by UUID, 36 characters including '-'s as reported by [blkid(8)](/blkid/8.md).

Although it can be defined as a block device path (e.g. /dev/sdh), the UUID should be preferred over the block device path to allow for the unique discovery of the crypt backing device given the volatile nature of /dev entries (e.g. /dev/sdh on one node may be /dev/sdg on another).

Only define as block device path if you know what you are doing.

(unique, required, string, no default)

**crypt\_dev**

Encrypted device name, no path. I.e. the one given in "cryptsetup open name ...". The resulting block device path is /dev/mapper/name.

(unique, required, string, no default)

**key\_file**

Key file path containing the encryption passphrase (aka key; see [cryptsetup(8)](/cryptsetup/8.md)). For LUKS, the passphrase as of the key\_file parameter is used to decrypt a randomly selected key when the device was created.

(required, string, no default)

**crypt\_type**

Encryption (device) type (e.g. "luks" or "luks2").

This parameter affirms the encryption format as of the crypt metadata thus allowing for safety measures when starting the encrypted resource.

(required, string, no default)

**force\_stop**

If processes or kernel threads are using the crypt device, it cannot be stopped. We will try to stop processes, first by sending TERM and then, if that doesn't help in seconds, using KILL. The [lsof(8)](/lsof/8.md) program is required to get the list of array users. Of course, the kernel threads cannot be stopped this way. If the processes are critical for data integrity, then set this parameter to false. Note that in that case the stop operation will fail and the node will be fenced.

(optional, boolean, default false)

## SUPPORTED ACTIONS

This resource agent supports the following actions (operations):

**start**

Starts the resource. Suggested minimum timeout: 20s.

**stop**

Stops the resource. Suggested minimum timeout: 20s.

**monitor**

Performs a detailed status check. Suggested minimum timeout: 20s. Suggested interval: 10s.

**meta-data**

Retrieves resource agent metadata (internal use only). Suggested minimum timeout: 5s.

**validate-all**

Performs a validation of the resource configuration. Suggested minimum timeout: 10s.

## EXAMPLE CRM SHELL

The following is an example configuration for a crypt resource using the [**crm**(8)](/crm/8.md) shell:

```
primitive p_crypt ocf:heartbeat:crypt \
  params \
    encrypted_dev=string \
    crypt_dev=string \
    key_file=string \
    crypt_type=string \
  op monitor timeout="20s" interval="10s" depth="0"
```

## EXAMPLE PCS

The following is an example configuration for a crypt resource using [**pcs**(8)](/pcs/8.md)

```
pcs resource create p_crypt ocf:heartbeat:crypt \
  encrypted_dev=string \
  crypt_dev=string \
  key_file=string \
  crypt_type=string \
  op monitor timeout="20s" interval="10s" OCF_CHECK_LEVEL="0"
```

## SEE ALSO

**http://clusterlabs.org/**

## AUTHOR

**ClusterLabs contributors (see the resource agent source for information about individual authors)**