I'm kickstarting hosts to use LUKS - and as part of that, I've got a rather basic 'default' password in the kickstart file.
We 'finish' new builds via ansible, and so as part of this - I'd like to change the default luks password to something a little more robust (and managed via Ansible).
What I can't figure out though, is how I can use cryptsetup (or something else?) non-interactively to update the password.
I do want to keep using a password (and not a key file) - we're starting to deploy Clevis/Tang to do Network Bound Disk Encryption on root drives, and want to retain the password-to-boot option.
echo "oldpassphrase newpassphrase" | cryptsetup luksAddKey /dev/sda2
Might do the trick, but it feels like a messy option?