Skip to content

Commit 981f186

Browse files
jbern0rdjbern0rd
authored
refactor: expose SGX service through TEE services in compute services (#666)
1 parent 3a28542 commit 981f186

15 files changed

Lines changed: 200 additions & 281 deletions

‎src/main/java/com/iexec/worker/compute/app/AppComputeService.java‎

Lines changed: 11 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,10 @@
2323
import com.iexec.commons.containers.DockerRunFinalStatus;
2424
import com.iexec.commons.containers.DockerRunRequest;
2525
import com.iexec.commons.containers.DockerRunResponse;
26-
import com.iexec.commons.containers.SgxDriverMode;
2726
import com.iexec.commons.poco.task.TaskDescription;
2827
import com.iexec.worker.config.WorkerConfigurationService;
2928
import com.iexec.worker.docker.DockerService;
3029
import com.iexec.worker.metric.ComputeDurationsService;
31-
import com.iexec.worker.sgx.SgxService;
3230
import com.iexec.worker.tee.TeeService;
3331
import com.iexec.worker.tee.TeeServicesManager;
3432
import com.iexec.worker.workflow.WorkflowError;
@@ -44,19 +42,15 @@ public class AppComputeService {
4442
private final WorkerConfigurationService workerConfigService;
4543
private final DockerService dockerService;
4644
private final TeeServicesManager teeServicesManager;
47-
private final SgxService sgxService;
4845
private final ComputeDurationsService appComputeDurationsService;
4946

50-
public AppComputeService(
51-
WorkerConfigurationService workerConfigService,
52-
DockerService dockerService,
53-
TeeServicesManager teeServicesManager,
54-
SgxService sgxService,
55-
ComputeDurationsService appComputeDurationsService) {
47+
public AppComputeService(final WorkerConfigurationService workerConfigService,
48+
final DockerService dockerService,
49+
final TeeServicesManager teeServicesManager,
50+
final ComputeDurationsService appComputeDurationsService) {
5651
this.workerConfigService = workerConfigService;
5752
this.dockerService = dockerService;
5853
this.teeServicesManager = teeServicesManager;
59-
this.sgxService = sgxService;
6054
this.appComputeDurationsService = appComputeDurationsService;
6155
}
6256

@@ -67,25 +61,22 @@ public AppComputeResponse runCompute(final TaskDescription taskDescription) {
6761
binds.add(Bind.parse(dockerService.getInputBind(chainTaskId)));
6862
binds.add(Bind.parse(dockerService.getIexecOutBind(chainTaskId)));
6963

70-
final SgxDriverMode sgxDriverMode;
7164
final List<String> env;
65+
final HostConfig hostConfig;
7266
if (taskDescription.requiresSgx()) {
7367
final TeeService teeService = teeServicesManager.getTeeService(taskDescription.getTeeFramework());
7468
env = teeService.buildComputeDockerEnv(taskDescription);
7569
binds.addAll(teeService.getAdditionalBindings().stream().map(Bind::parse).toList());
76-
sgxDriverMode = sgxService.getSgxDriverMode();
70+
hostConfig = HostConfig.newHostConfig()
71+
.withBinds(binds)
72+
.withDevices(teeService.getDevices())
73+
.withNetworkMode(workerConfigService.getDockerNetworkName());
7774
} else {
7875
env = IexecEnvUtils.getComputeStageEnvList(taskDescription);
79-
sgxDriverMode = SgxDriverMode.NONE;
76+
hostConfig = HostConfig.newHostConfig()
77+
.withBinds(binds);
8078
}
8179

82-
final HostConfig hostConfig = HostConfig.newHostConfig()
83-
.withBinds(binds)
84-
.withDevices(sgxService.getSgxDevices());
85-
// Enclave should be able to connect to the LAS
86-
if (taskDescription.requiresSgx()) {
87-
hostConfig.withNetworkMode(workerConfigService.getDockerNetworkName());
88-
}
8980
final DockerRunRequest runRequest = DockerRunRequest.builder()
9081
.hostConfig(hostConfig)
9182
.chainTaskId(chainTaskId)
@@ -94,7 +85,6 @@ public AppComputeResponse runCompute(final TaskDescription taskDescription) {
9485
.cmd(taskDescription.getDealParams().getIexecArgs())
9586
.env(env)
9687
.maxExecutionTime(taskDescription.getMaxExecutionTime())
97-
.sgxDriverMode(sgxDriverMode)
9888
.build();
9989
final DockerRunResponse dockerResponse = dockerService.run(runRequest);
10090
final Duration executionDuration = dockerResponse.getExecutionDuration();

‎src/main/java/com/iexec/worker/compute/post/PostComputeService.java‎

Lines changed: 17 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,13 @@
2626
import com.iexec.commons.containers.DockerRunRequest;
2727
import com.iexec.commons.containers.DockerRunResponse;
2828
import com.iexec.commons.poco.task.TaskDescription;
29-
import com.iexec.sms.api.TeeSessionGenerationResponse;
3029
import com.iexec.sms.api.config.TeeAppProperties;
3130
import com.iexec.sms.api.config.TeeServicesProperties;
3231
import com.iexec.worker.compute.ComputeExitCauseService;
3332
import com.iexec.worker.compute.ComputeStage;
3433
import com.iexec.worker.config.WorkerConfigurationService;
3534
import com.iexec.worker.docker.DockerService;
3635
import com.iexec.worker.metric.ComputeDurationsService;
37-
import com.iexec.worker.sgx.SgxService;
3836
import com.iexec.worker.tee.TeeService;
3937
import com.iexec.worker.tee.TeeServicesManager;
4038
import com.iexec.worker.tee.TeeServicesPropertiesService;
@@ -47,7 +45,6 @@
4745
import java.nio.file.attribute.BasicFileAttributes;
4846
import java.time.Duration;
4947
import java.util.Collection;
50-
import java.util.Collections;
5148
import java.util.List;
5249
import java.util.Optional;
5350
import java.util.concurrent.atomic.AtomicBoolean;
@@ -61,23 +58,19 @@ public class PostComputeService {
6158
private final WorkerConfigurationService workerConfigService;
6259
private final DockerService dockerService;
6360
private final TeeServicesManager teeServicesManager;
64-
private final SgxService sgxService;
6561
private final ComputeExitCauseService computeExitCauseService;
6662
private final TeeServicesPropertiesService teeServicesPropertiesService;
6763
private final ComputeDurationsService postComputeDurationsService;
6864

69-
public PostComputeService(
70-
WorkerConfigurationService workerConfigService,
71-
DockerService dockerService,
72-
TeeServicesManager teeServicesManager,
73-
SgxService sgxService,
74-
ComputeExitCauseService computeExitCauseService,
75-
TeeServicesPropertiesService teeServicesPropertiesService,
76-
ComputeDurationsService postComputeDurationsService) {
65+
public PostComputeService(final WorkerConfigurationService workerConfigService,
66+
final DockerService dockerService,
67+
final TeeServicesManager teeServicesManager,
68+
final ComputeExitCauseService computeExitCauseService,
69+
final TeeServicesPropertiesService teeServicesPropertiesService,
70+
final ComputeDurationsService postComputeDurationsService) {
7771
this.workerConfigService = workerConfigService;
7872
this.dockerService = dockerService;
7973
this.teeServicesManager = teeServicesManager;
80-
this.sgxService = sgxService;
8174
this.computeExitCauseService = computeExitCauseService;
8275
this.teeServicesPropertiesService = teeServicesPropertiesService;
8376
this.postComputeDurationsService = postComputeDurationsService;
@@ -162,45 +155,42 @@ public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) {
162155
}
163156

164157
public PostComputeResponse runTeePostCompute(final TaskDescription taskDescription) {
165-
String chainTaskId = taskDescription.getChainTaskId();
158+
final String chainTaskId = taskDescription.getChainTaskId();
166159

167-
TeeServicesProperties properties =
168-
teeServicesPropertiesService.getTeeServicesProperties(chainTaskId);
160+
final TeeServicesProperties properties = teeServicesPropertiesService.getTeeServicesProperties(chainTaskId);
169161

170162
final TeeAppProperties postComputeProperties = properties.getPostComputeProperties();
171-
String postComputeImage = postComputeProperties.getImage();
163+
final String postComputeImage = postComputeProperties.getImage();
172164
if (!dockerService.getClient().isImagePresent(postComputeImage)) {
173165
log.error("Tee post-compute image not found locally [chainTaskId:{}]",
174166
chainTaskId);
175167
return PostComputeResponse.builder()
176168
.exitCauses(List.of(new WorkflowError(ReplicateStatusCause.POST_COMPUTE_IMAGE_MISSING)))
177169
.build();
178170
}
179-
TeeService teeService = teeServicesManager.getTeeService(taskDescription.getTeeFramework());
180-
List<String> env = teeService
181-
.buildPostComputeDockerEnv(taskDescription);
182-
List<Bind> binds = Stream.of(
183-
Collections.singletonList(dockerService.getIexecOutBind(chainTaskId)),
171+
final TeeService teeService = teeServicesManager.getTeeService(taskDescription.getTeeFramework());
172+
final List<String> env = teeService.buildPostComputeDockerEnv(taskDescription);
173+
final List<Bind> binds = Stream.of(
174+
List.of(dockerService.getIexecOutBind(chainTaskId)),
184175
teeService.getAdditionalBindings())
185176
.flatMap(Collection::stream)
186177
.map(Bind::parse)
187178
.toList();
188179

189-
HostConfig hostConfig = HostConfig.newHostConfig()
180+
final HostConfig hostConfig = HostConfig.newHostConfig()
190181
.withBinds(binds)
191-
.withDevices(sgxService.getSgxDevices())
182+
.withDevices(teeService.getDevices())
192183
.withNetworkMode(workerConfigService.getDockerNetworkName());
193-
DockerRunRequest request = DockerRunRequest.builder()
184+
final DockerRunRequest request = DockerRunRequest.builder()
194185
.hostConfig(hostConfig)
195186
.chainTaskId(chainTaskId)
196187
.containerName(getTaskTeePostComputeContainerName(chainTaskId))
197188
.imageUri(postComputeImage)
198189
.entrypoint(postComputeProperties.getEntrypoint())
199190
.maxExecutionTime(taskDescription.getMaxExecutionTime())
200191
.env(env)
201-
.sgxDriverMode(sgxService.getSgxDriverMode())
202192
.build();
203-
DockerRunResponse dockerResponse = dockerService.run(request);
193+
final DockerRunResponse dockerResponse = dockerService.run(request);
204194
final Duration executionDuration = dockerResponse.getExecutionDuration();
205195
if (executionDuration != null) {
206196
postComputeDurationsService.addDurationForTask(chainTaskId, executionDuration.toMillis());

‎src/main/java/com/iexec/worker/compute/pre/PreComputeService.java‎

Lines changed: 17 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
import com.iexec.worker.config.WorkerConfigurationService;
3232
import com.iexec.worker.docker.DockerService;
3333
import com.iexec.worker.metric.ComputeDurationsService;
34-
import com.iexec.worker.sgx.SgxService;
34+
import com.iexec.worker.tee.TeeService;
3535
import com.iexec.worker.tee.TeeServicesManager;
3636
import com.iexec.worker.tee.TeeServicesPropertiesService;
3737
import com.iexec.worker.workflow.WorkflowError;
@@ -40,7 +40,6 @@
4040
import org.springframework.util.unit.DataSize;
4141

4242
import java.time.Duration;
43-
import java.util.Collections;
4443
import java.util.List;
4544
import java.util.concurrent.TimeoutException;
4645

@@ -51,23 +50,19 @@ public class PreComputeService {
5150
private final DockerService dockerService;
5251
private final TeeServicesManager teeServicesManager;
5352
private final WorkerConfigurationService workerConfigService;
54-
private final SgxService sgxService;
5553
private final ComputeExitCauseService computeExitCauseService;
5654
private final TeeServicesPropertiesService teeServicesPropertiesService;
5755
private final ComputeDurationsService preComputeDurationsService;
5856

59-
public PreComputeService(
60-
DockerService dockerService,
61-
TeeServicesManager teeServicesManager,
62-
WorkerConfigurationService workerConfigService,
63-
SgxService sgxService,
64-
ComputeExitCauseService computeExitCauseService,
65-
TeeServicesPropertiesService teeServicesPropertiesService,
66-
ComputeDurationsService preComputeDurationsService) {
57+
public PreComputeService(final DockerService dockerService,
58+
final TeeServicesManager teeServicesManager,
59+
final WorkerConfigurationService workerConfigService,
60+
final ComputeExitCauseService computeExitCauseService,
61+
final TeeServicesPropertiesService teeServicesPropertiesService,
62+
final ComputeDurationsService preComputeDurationsService) {
6763
this.dockerService = dockerService;
6864
this.teeServicesManager = teeServicesManager;
6965
this.workerConfigService = workerConfigService;
70-
this.sgxService = sgxService;
7166
this.computeExitCauseService = computeExitCauseService;
7267
this.teeServicesPropertiesService = teeServicesPropertiesService;
7368
this.preComputeDurationsService = preComputeDurationsService;
@@ -159,38 +154,36 @@ private List<WorkflowError> getExitCauses(final String chainTaskId, final Intege
159154
* @return pre-compute exit code
160155
*/
161156
private Integer prepareTeeInputData(final TaskDescription taskDescription) throws TimeoutException {
162-
String chainTaskId = taskDescription.getChainTaskId();
157+
final String chainTaskId = taskDescription.getChainTaskId();
163158
log.info("Preparing tee input data [chainTaskId:{}]", chainTaskId);
164159

165-
TeeServicesProperties properties =
166-
teeServicesPropertiesService.getTeeServicesProperties(chainTaskId);
160+
final TeeServicesProperties properties = teeServicesPropertiesService.getTeeServicesProperties(chainTaskId);
167161

168162
// check that docker image is present
169163
final TeeAppProperties preComputeProperties = properties.getPreComputeProperties();
170-
String preComputeImage = preComputeProperties.getImage();
164+
final String preComputeImage = preComputeProperties.getImage();
171165
if (!dockerService.getClient().isImagePresent(preComputeImage)) {
172166
log.error("Tee pre-compute image not found locally [chainTaskId:{}]", chainTaskId);
173167
return null;
174168
}
175169
// run container
176-
List<String> env = teeServicesManager.getTeeService(taskDescription.getTeeFramework())
177-
.buildPreComputeDockerEnv(taskDescription);
178-
List<Bind> binds = Collections.singletonList(Bind.parse(dockerService.getInputBind(chainTaskId)));
179-
HostConfig hostConfig = HostConfig.newHostConfig()
170+
final TeeService teeService = teeServicesManager.getTeeService(taskDescription.getTeeFramework());
171+
final List<String> env = teeService.buildPreComputeDockerEnv(taskDescription);
172+
final List<Bind> binds = List.of(Bind.parse(dockerService.getInputBind(chainTaskId)));
173+
final HostConfig hostConfig = HostConfig.newHostConfig()
180174
.withBinds(binds)
181-
.withDevices(sgxService.getSgxDevices())
175+
.withDevices(teeService.getDevices())
182176
.withNetworkMode(workerConfigService.getDockerNetworkName());
183-
DockerRunRequest request = DockerRunRequest.builder()
177+
final DockerRunRequest request = DockerRunRequest.builder()
184178
.hostConfig(hostConfig)
185179
.chainTaskId(chainTaskId)
186180
.containerName(getTeePreComputeContainerName(chainTaskId))
187181
.imageUri(preComputeImage)
188182
.entrypoint(preComputeProperties.getEntrypoint())
189183
.maxExecutionTime(taskDescription.getMaxExecutionTime())
190184
.env(env)
191-
.sgxDriverMode(sgxService.getSgxDriverMode())
192185
.build();
193-
DockerRunResponse dockerResponse = dockerService.run(request);
186+
final DockerRunResponse dockerResponse = dockerService.run(request);
194187
final Duration executionDuration = dockerResponse.getExecutionDuration();
195188
if (executionDuration != null) {
196189
preComputeDurationsService.addDurationForTask(chainTaskId, executionDuration.toMillis());

‎src/main/java/com/iexec/worker/tee/TeeService.java‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@
1616

1717
package com.iexec.worker.tee;
1818

19+
import com.github.dockerjava.api.model.Device;
1920
import com.iexec.commons.poco.chain.WorkerpoolAuthorization;
2021
import com.iexec.commons.poco.task.TaskDescription;
2122
import com.iexec.sms.api.SmsClientCreationException;
2223
import com.iexec.sms.api.TeeSessionGenerationError;
2324
import com.iexec.sms.api.TeeSessionGenerationResponse;
24-
import com.iexec.worker.sgx.SgxService;
2525
import com.iexec.worker.sms.SmsService;
2626
import com.iexec.worker.sms.TeeSessionGenerationException;
2727
import com.iexec.worker.workflow.WorkflowError;
@@ -36,24 +36,17 @@
3636

3737
@Slf4j
3838
public abstract class TeeService {
39-
private final SgxService sgxService;
4039
private final SmsService smsService;
4140
protected final TeeServicesPropertiesService teeServicesPropertiesService;
4241

4342
private final Map<String, TeeSessionGenerationResponse> teeSessions = new ConcurrentHashMap<>();
4443

45-
protected TeeService(final SgxService sgxService,
46-
final SmsService smsService,
44+
protected TeeService(final SmsService smsService,
4745
final TeeServicesPropertiesService teeServicesPropertiesService) {
48-
this.sgxService = sgxService;
4946
this.smsService = smsService;
5047
this.teeServicesPropertiesService = teeServicesPropertiesService;
5148
}
5249

53-
public boolean isTeeEnabled() {
54-
return sgxService.isSgxEnabled();
55-
}
56-
5750
public List<WorkflowError> areTeePrerequisitesMetForTask(final String chainTaskId) {
5851
if (!isTeeEnabled()) {
5952
return List.of(new WorkflowError(TEE_NOT_SUPPORTED));
@@ -98,6 +91,8 @@ public TeeSessionGenerationResponse getTeeSession(final String chainTaskId) {
9891
return teeSessions.get(chainTaskId);
9992
}
10093

94+
public abstract boolean isTeeEnabled();
95+
10196
/**
10297
* Start any required service(s) to use TEE with selected technology for given task.
10398
*
@@ -114,6 +109,8 @@ public TeeSessionGenerationResponse getTeeSession(final String chainTaskId) {
114109

115110
public abstract Collection<String> getAdditionalBindings();
116111

112+
public abstract List<Device> getDevices();
113+
117114
// region Purge
118115

119116
/**

‎src/main/java/com/iexec/worker/tee/gramine/TeeGramineService.java‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
package com.iexec.worker.tee.gramine;
1818

19+
import com.github.dockerjava.api.model.Device;
1920
import com.iexec.common.lifecycle.purge.Purgeable;
2021
import com.iexec.commons.poco.task.TaskDescription;
2122
import com.iexec.sms.api.TeeSessionGenerationResponse;
@@ -38,10 +39,18 @@ public class TeeGramineService extends TeeService implements Purgeable {
3839
private static final String SPS_SESSION_ENV_VAR = "session";
3940
private static final String AESMD_SOCKET = "/var/run/aesmd/aesm.socket";
4041

41-
public TeeGramineService(SgxService sgxService,
42-
SmsService smsService,
43-
TeeServicesPropertiesService teeServicesPropertiesService) {
44-
super(sgxService, smsService, teeServicesPropertiesService);
42+
private final SgxService sgxService;
43+
44+
public TeeGramineService(final SgxService sgxService,
45+
final SmsService smsService,
46+
final TeeServicesPropertiesService teeServicesPropertiesService) {
47+
super(smsService, teeServicesPropertiesService);
48+
this.sgxService = sgxService;
49+
}
50+
51+
@Override
52+
public boolean isTeeEnabled() {
53+
return sgxService.isSgxEnabled();
4554
}
4655

4756
@Override
@@ -72,6 +81,11 @@ public Collection<String> getAdditionalBindings() {
7281
return bindings;
7382
}
7483

84+
@Override
85+
public List<Device> getDevices() {
86+
return sgxService.getSgxDevices();
87+
}
88+
7589
private List<String> getDockerEnv(final TeeSessionGenerationResponse session) {
7690
return List.of(
7791
SPS_URL_ENV_VAR + "=" + session.getSecretProvisioningUrl(),

0 commit comments

Comments
 (0)