Skip to content

Commit 4b0a717

Browse files
butler54beraldoleal
butler54
and
beraldoleal
authored
feat: support ga release of trustee including sensible policies (#14)
* feat: update trustee to support 1.0.0 best practice defaults * fix: move tls ESOs to sync-wave 6 after PushSecret * fix: remove empty data field from pcrs-eso template * feat: force version bump for GA release Signed-off-by: Chris Butler <chris.butler@redhat.com> --------- Signed-off-by: Chris Butler <chris.butler@redhat.com> Co-authored-by: Beraldo Leal <bleal@redhat.com>
1 parent 6e99f17 commit 4b0a717

22 files changed

Lines changed: 342 additions & 51 deletions

‎Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ keywords:
77
- confidential-containers
88
name: trustee
99
# DO NOT EDIT VERSION HERE, IT IS AUTO-GENERATED BY SEMANTIC-RELEASE
10-
version: 0.1.0
10+
version: 0.2.0

‎README.md‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# trustee
22

3-
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)
3+
![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square)
44

55
A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
66

@@ -24,12 +24,23 @@ In order to use this chart, you will need to:
2424

2525
| Key | Type | Default | Description |
2626
|-----|------|---------|-------------|
27+
| attestation.commonName | string | `"kbs-trustee-operator-system"` | |
28+
| attestation.organization | string | `"Red Hat"` | |
29+
| global.coco.attestationStatus | string | `"secret/data/hub/attestationStatus"` | |
30+
| global.coco.secured | bool | `false` | |
31+
| global.coco.securityPolicy | string | `"secret/data/hub/securityPolicyConfig"` | |
32+
| global.coco.securityPolicyFlavour | string | `"insecure"` | |
2733
| global.secretStore.backend | string | `""` | |
34+
| kbs.cosignKeys | string | `"secret/data/hub/coSignKeys"` | |
2835
| kbs.publicKey | string | `"secret/data/hub/kbsPublicKey"` | |
29-
| kbs.secretResources | list | `[]` | |
30-
| kbs.securityPolicy | string | `"secret/data/hub/securityPolicyConfig"` | |
31-
| secretStore.kind | string | `""` | |
32-
| secretStore.name | string | `""` | |
36+
| kbs.secretResources[0].key | string | `"secret/data/hub/kbsres1"` | |
37+
| kbs.secretResources[0].name | string | `"kbsres1"` | |
38+
| kbs.secretResources[1].key | string | `"secret/data/hub/passphrase"` | |
39+
| kbs.secretResources[1].name | string | `"passphrase"` | |
40+
| kbs.tdx.collateralService | string | `"https://api.trustedservices.intel.com/sgx/certification/v4/"` | |
41+
| kbs.tdx.enabled | bool | `false` | |
42+
| secretStore.kind | string | `"ClusterSecretStore"` | |
43+
| secretStore.name | string | `"vault-backend"` | |
3344

3445
----------------------------------------------
3546
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎templates/attestation-certificate.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: attestation-token
6+
namespace: trustee-operator-system
7+
annotations:
8+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
9+
argocd.argoproj.io/sync-wave: "3"
10+
spec:
11+
secretName: attestation-cert
12+
duration: 8760h # 1 year
13+
renewBefore: 720h # 30 days
14+
commonName: {{ .Values.attestation.commonName | default "kbs-trustee-operator-system" }}
15+
subject:
16+
organizations:
17+
- {{ .Values.attestation.organization | default "Red Hat" }}
18+
privateKey:
19+
algorithm: ECDSA
20+
size: 256
21+
issuerRef:
22+
name: attestation-self-signed-issuer
23+
kind: Issuer

‎templates/attestation-issuer.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: attestation-self-signed-issuer
6+
namespace: trustee-operator-system
7+
annotations:
8+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
9+
argocd.argoproj.io/sync-wave: "2"
10+
spec:
11+
selfSigned: {}

‎templates/attestation-policy.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: attestation-policy
5+
namespace: trustee-operator-system
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "4"
8+
data:
9+
default_cpu.rego: |
10+
package policy
11+
12+
import rego.v1
13+
default executables := 33
14+
default hardware := 97
15+
default configuration := 36
16+
17+
## miminimal but reliable attestation policy
18+
## hardware and firmware changes. This is not in our control. It's up to the user to update acceptable measurements
19+
## In conjuction with verification with the service provider.
20+
## currently setup for azure vTPM
21+
22+
23+
##### Azure vTPM SNP
24+
executables := 3 if {
25+
# input.azsnpvtpm.measurement in data.reference.measurement
26+
input.azsnpvtpm.tpm.pcr03 in data.reference.snp_pcr03
27+
input.azsnpvtpm.tpm.pcr08 in data.reference.snp_pcr08
28+
input.azsnpvtpm.tpm.pcr09 in data.reference.snp_pcr09
29+
input.azsnpvtpm.tpm.pcr11 in data.reference.snp_pcr11
30+
input.azsnpvtpm.tpm.pcr12 in data.reference.snp_pcr12
31+
}
32+
33+
hardware := 2 if {
34+
# Check the reported TCB to validate the ASP FW
35+
# input.azsnpvtpm.reported_tcb_bootloader in data.reference.tcb_bootloader
36+
# input.azsnpvtpm.reported_tcb_microcode in data.reference.tcb_microcode
37+
# input.azsnpvtpm.reported_tcb_snp in data.reference.tcb_snp
38+
# input.azsnpvtpm.reported_tcb_tee in data.reference.tcb_tee
39+
input.azsnpvtpm
40+
}
41+
42+
# For the 'configuration' trust claim 2 stands for
43+
# "The configuration is a known and approved config."
44+
#
45+
# For this, we compare all the configuration fields.
46+
configuration := 2 if {
47+
# input.azsnpvtpm.platform_smt_enabled in data.reference.smt_enabled
48+
# input.azsnpvtpm.platform_tsme_enabled in data.reference.tsme_enabled
49+
# input.azsnpvtpm.policy_abi_major in data.reference.abi_major
50+
# input.azsnpvtpm.policy_abi_minor in data.reference.abi_minor
51+
# input.azsnpvtpm.policy_single_socket in data.reference.single_socket
52+
# input.azsnpvtpm.policy_smt_allowed in data.reference.smt_allowed
53+
input.azsnpvtpm
54+
}
55+
56+
##### Azure vTPM TDX
57+
executables := 3 if {
58+
input.aztdxvtpm.tpm.pcr03 in data.reference.tdx_pcr03
59+
input.aztdxvtpm.tpm.pcr08 in data.reference.tdx_pcr08
60+
input.aztdxvtpm.tpm.pcr09 in data.reference.tdx_pcr09
61+
input.aztdxvtpm.tpm.pcr11 in data.reference.tdx_pcr11
62+
input.aztdxvtpm.tpm.pcr12 in data.reference.tdx_pcr12
63+
}
64+
65+
hardware := 2 if {
66+
# Check the quote is a TDX quote signed by Intel SGX Quoting Enclave
67+
input.aztdxvtpm.quote.header.tee_type == "81000000"
68+
input.aztdxvtpm.quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
69+
70+
# Check TDX Module version and its hash. Also check OVMF code hash.
71+
# input.aztdxvtpm.quote.body.mr_seam in data.reference.mr_seam
72+
# input.aztdxvtpm.quote.body.tcb_svn in data.reference.tcb_svn
73+
# input.aztdxvtpm.quote.body.mr_td in data.reference.mr_td
74+
}
75+
76+
configuration := 2 if {
77+
# input.aztdxvtpm.quote.body.xfam in data.reference.xfam
78+
input.aztdxvtpm
79+
}

‎templates/attestation-status-eso.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if ne .Values.global.secretStore.backend "none" }}
2+
---
3+
apiVersion: "external-secrets.io/v1beta1"
4+
kind: ExternalSecret
5+
metadata:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "1"
8+
name: attestation-status-eso
9+
namespace: trustee-operator-system
10+
spec:
11+
refreshInterval: 15s
12+
secretStoreRef:
13+
name: {{ .Values.secretStore.name }}
14+
kind: {{ .Values.secretStore.kind }}
15+
data:
16+
target:
17+
name: attestation-status
18+
template:
19+
type: generic
20+
dataFrom:
21+
- extract:
22+
key: {{ .Values.global.coco.attestationStatus }}
23+
{{- end }}

‎templates/certificate.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ metadata:
55
namespace: imperative
66
annotations:
77
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
8+
argocd.argoproj.io/sync-wave: "3"
89
spec:
910
secretName: kbs-tls-self-signed
1011
duration: 8760h # 1 year

‎templates/cosign-eso.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if and (ne .Values.global.secretStore.backend "none") (eq .Values.global.coco.securityPolicyFlavour "signed") }}
2+
---
3+
apiVersion: "external-secrets.io/v1beta1"
4+
kind: ExternalSecret
5+
metadata:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "1"
8+
name: cosigned-eso
9+
namespace: trustee-operator-system
10+
spec:
11+
refreshInterval: 15s
12+
secretStoreRef:
13+
name: {{ .Values.secretStore.name }}
14+
kind: {{ .Values.secretStore.kind }}
15+
data:
16+
target:
17+
name: cosign-keys
18+
template:
19+
type: generic
20+
dataFrom:
21+
- extract:
22+
key: {{ .Values.global.coco.cosignKeys }}
23+
{{- end }}

‎templates/issuer.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ metadata:
55
namespace: imperative
66
annotations:
77
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
8+
argocd.argoproj.io/sync-wave: "2"
89
spec:
910
selfSigned: {}
1011

‎templates/kbs-config-map.yaml‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ kind: ConfigMap
33
metadata:
44
name: kbs-config
55
namespace: trustee-operator-system
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "4"
68
data:
79
kbs-config.toml: |
810
[http_server]
@@ -11,31 +13,36 @@ data:
1113
private_key = "/etc/https-key/tls.key"
1214
certificate = "/etc/https-cert/tls.crt"
1315
[admin]
14-
insecure_api = true
16+
insecure_api = false
1517
auth_public_key = "/etc/auth-secret/publicKey"
1618
1719
[attestation_token]
18-
insecure_key = true
20+
insecure_key = false
1921
attestation_token_type = "CoCo"
22+
trusted_certs_paths = ["/etc/attestation-cert/tls.crt"] # Check for location in cert (based on key generated)
2023
2124
[attestation_service]
2225
type = "coco_as_builtin"
2326
work_dir = "/opt/confidential-containers/attestation-service"
2427
policy_engine = "opa"
2528
26-
[attestation_service.attestation_token_broker]
27-
type = "Ear"
28-
policy_dir = "/opt/confidential-containers/attestation-service/policies"
29+
[attestation_service.attestation_token_broker]
30+
type = "Ear"
31+
policy_dir = "/opt/confidential-containers/attestation-service/policies"
2932
30-
[attestation_service.attestation_token_config]
31-
duration_min = 5
33+
[attestation_service.attestation_token_broker.signer]
34+
key_path = "/etc/attestation-cert/tls.key"
35+
cert_path = "/etc/attestation-cert/tls.crt"
3236
33-
[attestation_service.rvps_config]
34-
type = "BuiltIn"
37+
[attestation_service.attestation_token_config]
38+
duration_min = 5
3539
36-
[attestation_service.rvps_config.storage]
37-
type = "LocalJson"
38-
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
40+
[attestation_service.rvps_config]
41+
type = "BuiltIn"
42+
43+
[attestation_service.rvps_config.storage]
44+
type = "LocalJson"
45+
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
3946
4047
[[plugins]]
4148
name = "resource"

0 commit comments

Comments
 (0)