updates to ephemeral encryption keys

[piyush-jena]

Description of changes:

• Adds documentation for this preview feature
• use plain mode device encryption (which is headerless) when ephemeral encryption keys are used
• encrypt and unlock in the same service to avoid storing keys in any storage (except datastore encryption)

Testing done:
FIPS test:

[ssm-user@control]$ apiclient report fips
Benchmark name:  FIPS Security Policy
Version:         v1.0.0
Reference:       https://csrc.nist.gov/
Benchmark level: 1
Start time:      2026-08-27T06:49:34.743345588Z

[PASS] 1.0       FIPS mode is enabled. (Automatic)
[PASS] 1.1       FIPS module is Amazon Linux 2023 Kernel Cryptographic API. (Automatic)
[PASS] 1.2       FIPS self-tests passed. (Automatic)

Passed:          3
Failed:          0
Skipped:         0
Total checks:    3

Compliance check result: PASS

lsblk output

bash-5.2# lsblk
NAME                     MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme1n1                  259:0    0    20G  0 disk
`-nvme1n1p1              259:12   0    20G  0 part
  `-BOTTLEROCKET-DATA    252:2    0    20G  0 crypt /var
                                                    /opt
                                                    /mnt
                                                    /local
nvme0n1                  259:1    0     2G  0 disk
|-nvme0n1p1              259:4    0     4M  0 part
|-nvme0n1p2              259:5    0    10M  0 part
|-nvme0n1p3              259:6    0    80M  0 part  /boot
|-nvme0n1p4              259:7    0   1.8G  0 part
|-nvme0n1p5              259:8    0    20M  0 part
|-nvme0n1p6              259:9    0    50M  0 part
|-nvme0n1p7              259:10   0    41M  0 part
| `-BOTTLEROCKET-PRIVATE 252:1    0    41M  0 crypt /var/lib/bottlerocket
|                                                   /.bottlerocket
`-nvme0n1p8              259:11   0     1M  0 part
nvme2n1                  259:2    0 109.9G  0 disk

keystore for datastore encryption is correctly labeled and the key is ephemeral

bash-5.2# ls -lZ /run/ | grep rottweiler
drwx------.  2 root   root   system_u:object_r:private_t:s0     40 Aug 27 06:31 rottweiler
bash-5.2# ls -lZ /run/rottweiler
total 0

systemctl status output

bash-5.2# systemctl status
● ip-172-31-16-76.us-west-2.compute.internal
    State: running
    Units: 417 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Thu 2026-08-27 06:29:39 UTC; 22min ago
  systemd: 257.13

older services were removed

bash-5.2# find . -name unlock-datastore.service
bash-5.2# find . -name encrypt-unlock-datastore.service
./etc/systemd/system/storewolf.service.requires/encrypt-unlock-datastore.service
./etc/systemd/system/migrator.service.requires/encrypt-unlock-datastore.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-datastore.service
bash-5.2# find . -name unlock-datastore.service
bash-5.2# find . -name encrypt-datastore.service
bash-5.2# find . -name encrypt-local-fs.service
bash-5.2# find . -name unlock-local-fs.service
bash-5.2# find . -name encrypt-unlock-local-fs.service
./etc/systemd/system/local-fs.target.requires/encrypt-unlock-local-fs.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-local-fs.service
bash-5.2# find . -name encrypt-unlock-private-fs.service
./etc/systemd/system/prepare-private-fs.service.requires/encrypt-unlock-private-fs.service
./x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/encrypt-unlock-private-fs.service
bash-5.2# find . -name encrypt-private-fs.service
bash-5.2# find . -name unlock-private-fs.service

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[piyush-jena]

RequiresMountsFor=/run/rottweiler

considering adding this