As Gilles pointed out, you obviously need the key somewhere, and if you want this process automated with no password input required and no requirement to manually insert an external USB, then you essentially need a TPM or equivalent device.
To be a bit more precise though, you don't technically need secure boot. I think this phrase is sometimes used broadly, but in this context I'm referring to the boot-up security feature of the UEFI spec responsible for validating digital signatures over components in the boot chain. In fact, secure boot and TPMs are totally independent. Secure boot can be utilized without a TPM, and TPMs can be utilized without secure boot, or they can be used simultaneously.
Furthermore, TPMs are more commonly used with a similar technology to secure boot called trusted boot, but there is also no requirement that one must use trusted boot with a TPM either, though it expands your capability in terms of what components in the system can be tied into your chain of trust and thus have their integrity play a role in dictating whether a TPM will hand over secrets to some piece of software requesting them.
In a very, very brief summary that leaves much actual detail out, a TPM acquires SHA-1 and/or SHA-256 hash digests (depending on TPM version), or measurements, over software components in the system as the machine boots. They are accumulated in TPM internal registers called PCRs, or platform configuration registers. The nature of which components have their firmware/software measured is largely dependent on support for this whole paradigm by the various components in your system, but you essentially end up with a slew of measurements that can then be used to lock down various secrets through the capabilities offered by the TPM. For instance, a key could be written into the TPM's NVRAM and locked to a specific set of these measurements such that the TPM will not allow read access unless the exact set and their values match what was present or specified at the time of writing. There are other ways too, this is just a brief bit.
Practically though, what this ends up meaning is that you end up needing to write a bit of software, or use something existing, to handle talking to the TPM and acquiring secrets from it, and then using them for whatever purpose you need, such as decrypting a LUKS partition.