Introduction
By default, you need to manually enter the password every time you boot. Use tpm2 to replace manual input and automatically authorize.
View encrypted partition name
lsblk
lee@Lee-Ubuntu:~$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
loop0 7:0 0 4K 1 loop /snap/bare/5
loop1 7:1 0 73.9M 1 loop /snap/core22/1748
loop2 7:2 0 11.1M 1 loop /snap/firmware-updater/167
loop3 7:3 0 258M 1 loop /snap/firefox/5751
loop4 7:4 0 516M 1 loop /snap/gnome-42-2204/202
loop5 7:5 0 91.7M 1 loop /snap/gtk-common-themes/1535
loop6 7:6 0 10.8M 1 loop /snap/snap-store/1248
loop7 7:7 0 44.4M 1 loop /snap/snapd/23545
loop8 7:8 0 568K 1 loop /snap/snapd-desktop-integration/253
nvme0n1 259:0 0 476.9G 0 disk
├─nvme0n1p1 259:1 0 1G 0 part /boot/efi
├─nvme0n1p2 259:2 0 2G 0 part /boot
└─nvme0n1p3 259:3 0 473.9G 0 part
└─dm_crypt-0 252:0 0 473.9G 0 crypt
└─ubuntu--vg-ubuntu--lv 252:1 0 473.9G 0 lvm /
The partition name is /dev/nvme0n1p3
Install clevis related tools
sudo apt update
sudo apt install clevis clevis-luks clevis-initramfs clevis-tpm2 tpm2-tools
Bind TPM auto-unlock to LUKS partition
sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{}' -k
Verify clevis binding status
sudo clevis luks list -d /dev/nvme0n1p3
1: tpm2 '{"hash":"sha256","key":"ecc"}'
Update initramfs
sudo update-initramfs -u