Encrypting Your Infrastructure Without Getting Fired – Matt Moen

Tang and Clevis, open-source Linux tools that enable automatic decryption of LUKS-encrypted boot volumes via a lightweight network protocol (McCallum-Relyea exchange) without key escrow or proprietary hardware. It examines practical use cases for edge Kubernetes clusters and data centers, compares the approach to TPM-based methods, discusses advanced configurations such as multi-server quorum, and weighs operational trade-offs.