Skip to content

Commit e35a552

Browse files
bpradiptbpradipt
authored
Merge pull request #56 from lmilleri/latest-upstream
Update configuration files
2 parents 8c52a84 + 629786d commit e35a552

File tree

14 files changed

+206
-199
lines changed

14 files changed

+206
-199
lines changed

‎README.md‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -97,20 +97,29 @@ metadata:
9797
name: kbs-config-grpc
9898
namespace: trustee-operator-system
9999
data:
100-
kbs-config.json: |
101-
{
102-
"insecure_http" : false,
103-
"sockets": ["0.0.0.0:8080"],
104-
"auth_public_key": "/etc/auth-secret/kbs.pem",
105-
"private_key": "/etc/https-key/key.pem",
106-
"certificate": "/etc/https-cert/cert.pem",
107-
"attestation_token_config": {
108-
"attestation_token_type": "CoCo"
109-
},
110-
"grpc_config" : {
111-
"as_addr": "http://127.0.0.1:50004"
112-
}
113-
}
100+
kbs-config.toml: |
101+
[http_server]
102+
sockets = ["0.0.0.0:8080"]
103+
insecure_http = true
104+
[admin]
105+
insecure_api = true
106+
auth_public_key = "/etc/auth-secret/kbs.pem"
107+
108+
[attestation_token]
109+
insecure_key = true
110+
111+
[attestation_service]
112+
type = "coco_as_grpc"
113+
as_addr = "http://127.0.0.1:50004"
114+
115+
[[plugins]]
116+
name = "resource"
117+
type = "LocalFs"
118+
dir_path = "/opt/confidential-containers/kbs/repository"
119+
120+
[policy_engine]
121+
policy_path = "/opt/confidential-containers/opa/policy.rego"
122+
114123
```
115124

116125
If HTTPS support is not needed, please set `insecure_http=true` and no need to specify the attributes `private_key` and `certificate`.
@@ -216,10 +225,6 @@ You’ll need a Kubernetes cluster to run against. You can use [KIND](https://si
216225

217226
This is an example. Change it to real values as per your requirements.
218227

219-
It is recommended to uncomment the secret generation for the trustee authorization in the [kustomization.yaml](config/samples/microservices/kustomization.yaml), for both public and private key (`kbs-auth-public-key` and `kbs-client` secrets)
220-
221-
For enabling logs with DEBUG severity, uncomment the `patch-env-vars.yaml` line in the [kustomization.yaml](config/samples/microservices/kustomization.yaml).
222-
223228
```sh
224229
cd config/samples/microservices
225230
# or config/samples/all-in-one for the integrated mode

‎config/samples/all-in-one/ita-kbs-config.yaml‎

Lines changed: 26 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,29 @@ metadata:
44
name: ita-kbs-config
55
namespace: trustee-operator-system
66
data:
7-
kbs-config.json: |
8-
{
9-
"insecure_http" : true,
10-
"sockets": ["0.0.0.0:8080"],
11-
"auth_public_key": "/etc/auth-secret/kbs.pem",
12-
"attestation_token_config": {
13-
"attestation_token_type": "Jwk",
14-
"trusted_certs_paths": ["https://portal.trustauthority.intel.com"]
15-
},
16-
"repository_config": {
17-
"type": "LocalFs",
18-
"dir_path": "/opt/confidential-containers/kbs/repository"
19-
},
20-
"as_config": {
21-
"work_dir": "/opt/confidential-containers/attestation-service",
22-
"policy_engine": "opa",
23-
"attestation_token_broker": "Simple",
24-
"attestation_token_config": {
25-
"duration_min": 5
26-
},
27-
"rvps_config": {
28-
"store_type": "LocalJson",
29-
"store_config": {
30-
"file_path": "/opt/confidential-containers/rvps/reference-values/reference-values.json"
31-
}
32-
}
33-
},
34-
"policy_engine_config": {
35-
"policy_path": "/opt/confidential-containers/opa/policy.rego"
36-
},
37-
"intel_trust_authority_config" : {
38-
"base_url": "https://api.trustauthority.intel.com",
39-
"api_key": "tBfd5kKX2x9ahbodKV1...",
40-
"certs_file": "https://portal.trustauthority.intel.com"
41-
}
42-
}
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = true
11+
12+
[admin]
13+
insecure_api = true
14+
auth_public_key = "/etc/auth-secret/kbs.pem"
15+
16+
[attestation_token]
17+
trusted_jwk_sets = ["https://portal.trustauthority.intel.com"]
18+
19+
[attestation_service]
20+
type = "intel_ta"
21+
base_url = "https://api.trustauthority.intel.com"
22+
api_key = "tBfd5kKX2x9ahbodKV1..."
23+
certs_file = "https://portal.trustauthority.intel.com"
24+
allow_unmatched_policy = true
25+
26+
[[plugins]]
27+
name = "resource"
28+
type = "LocalFs"
29+
dir_path = "/opt/confidential-containers/kbs/repository"
30+
31+
[policy_engine]
32+
policy_path = "/opt/confidential-containers/opa/policy.rego"

‎config/samples/all-in-one/kbs-config.yaml‎

Lines changed: 34 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -4,33 +4,37 @@ metadata:
44
name: kbs-config
55
namespace: trustee-operator-system
66
data:
7-
kbs-config.json: |
8-
{
9-
"insecure_http" : true,
10-
"sockets": ["0.0.0.0:8080"],
11-
"auth_public_key": "/etc/auth-secret/kbs.pem",
12-
"attestation_token_config": {
13-
"attestation_token_type": "CoCo"
14-
},
15-
"repository_config": {
16-
"type": "LocalFs",
17-
"dir_path": "/opt/confidential-containers/kbs/repository"
18-
},
19-
"as_config": {
20-
"work_dir": "/opt/confidential-containers/attestation-service",
21-
"policy_engine": "opa",
22-
"attestation_token_broker": "Simple",
23-
"attestation_token_config": {
24-
"duration_min": 5
25-
},
26-
"rvps_config": {
27-
"store_type": "LocalJson",
28-
"store_config": {
29-
"file_path": "/opt/confidential-containers/rvps/reference-values/reference-values.json"
30-
}
31-
}
32-
},
33-
"policy_engine_config": {
34-
"policy_path": "/opt/confidential-containers/opa/policy.rego"
35-
}
36-
}
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = true
11+
12+
[admin]
13+
insecure_api = true
14+
auth_public_key = "/etc/auth-secret/kbs.pem"
15+
16+
[attestation_token]
17+
insecure_key = true
18+
19+
[attestation_service]
20+
type = "coco_as_builtin"
21+
work_dir = "/opt/confidential-containers/attestation-service"
22+
policy_engine = "opa"
23+
[attestation_service.attestation_token_broker]
24+
type = "Ear"
25+
[attestation_service.attestation_token_config]
26+
duration_min = 5
27+
[attestation_service.rvps_config]
28+
type = "BuiltIn"
29+
store_type = "LocalJson"
30+
[attestation_service.rvps_config.store_config]
31+
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
32+
33+
[[plugins]]
34+
name = "resource"
35+
type = "LocalFs"
36+
dir_path = "/opt/confidential-containers/kbs/repository"
37+
38+
[policy_engine]
39+
policy_path = "/opt/confidential-containers/opa/policy.rego"
40+

‎config/samples/all-in-one/kustomization.yaml‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,32 @@
11
## Append samples you want in your CSV to this file as resources ##
2+
namespace: trustee-operator-system
23
generatorOptions:
34
disableNameSuffixHash: true
45

56
# uncomment to generate secrets for kbs authorization
6-
# secretGenerator:
7-
# - name: kbs-auth-public-key
8-
# files:
9-
# - kbs.pem
10-
# - name: kbs-client
11-
# files:
12-
# - privateKey
7+
secretGenerator:
8+
- name: kbs-auth-public-key
9+
files:
10+
- kbs.pem
11+
- name: kbs-client
12+
files:
13+
- privateKey
1314

1415
# uncomment the following lines for injecting sample resources in kbs
15-
#- name: kbsres1
16-
# literals:
17-
# - key1=res1val1
18-
# - key2=res1val2
16+
- name: kbsres1
17+
literals:
18+
- key1=res1val1
19+
- key2=res1val2
1920

2021
patches:
2122
- path: patch-ref-values.yaml
2223
- path: patch-attestation-policy.yaml
2324
- path: patch-resource-policy.yaml
2425
- path: patch-tdx-config.yaml
2526
# uncomment the following line for injecting sample resources in kbs
26-
#- path: patch-kbs-resources.yaml
27+
- path: patch-kbs-resources.yaml
2728
# uncomment the following line for enabling DEBUG logs
28-
# - path: patch-env-vars.yaml
29+
- path: patch-env-vars.yaml
2930

3031
resources:
3132
- kbsconfig_sample.yaml

‎config/samples/all-in-one/patch-ita-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ apiVersion: confidentialcontainers.org/v1alpha1
22
kind: KbsConfig
33
metadata:
44
name: kbsconfig-sample
5-
namespace: kbs-operator-system
5+
namespace: trustee-operator-system
66
spec:
77
kbsItaConfigMapName: ita-config

‎config/samples/all-in-one/resource-policy.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,4 @@ data:
77
policy.rego: |
88
package policy
99
10-
default allow = false
11-
allow {
12-
input["tee"] != "sample"
13-
}
10+
default allow = true

‎config/samples/microservices/as-config.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,12 @@ data:
99
"work_dir": "/opt/confidential-containers/attestation-service",
1010
"policy_engine": "opa",
1111
"rvps_config": {
12+
"type": "BuiltIn",
1213
"remote_addr":"http://127.0.0.1:50003"
1314
},
14-
"attestation_token_broker": "Simple",
15+
"attestation_token_broker": {
16+
"type": "Ear"
17+
},
1518
"attestation_token_config": {
1619
"duration_min": 5
1720
}

‎config/samples/microservices/ita-kbs-config.yaml‎

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,30 +4,29 @@ metadata:
44
name: ita-kbs-config-grpc
55
namespace: trustee-operator-system
66
data:
7-
kbs-config.json: |
8-
{
9-
"insecure_http" : true,
10-
"sockets": ["0.0.0.0:8080"],
11-
"auth_public_key": "/etc/auth-secret/kbs.pem",
12-
"private_key": "/etc/https-key/key.pem",
13-
"certificate": "/etc/https-cert/cert.pem",
14-
"attestation_token_config": {
15-
"attestation_token_type": "Jwk",
16-
"trusted_certs_paths": ["https://portal.trustauthority.intel.com"]
17-
},
18-
"grpc_config" : {
19-
"as_addr": "http://127.0.0.1:50004"
20-
},
21-
"repository_config": {
22-
"type": "LocalFs",
23-
"dir_path": "/opt/confidential-containers/kbs/repository"
24-
},
25-
"policy_engine_config": {
26-
"policy_path": "/opt/confidential-containers/opa/policy.rego"
27-
},
28-
"intel_trust_authority_config" : {
29-
"base_url": "https://api.trustauthority.intel.com",
30-
"api_key": "tBfd5kKX2x9ahbodKV1...",
31-
"certs_file": "https://portal.trustauthority.intel.com"
32-
}
33-
}
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = true
11+
12+
[admin]
13+
insecure_api = true
14+
auth_public_key = "/etc/auth-secret/kbs.pem"
15+
16+
[attestation_token]
17+
trusted_jwk_sets = ["https://portal.trustauthority.intel.com"]
18+
19+
[attestation_service]
20+
type = "intel_ta"
21+
base_url = "https://api.trustauthority.intel.com"
22+
api_key = "tBfd5kKX2x9ahbodKV1..."
23+
certs_file = "https://portal.trustauthority.intel.com"
24+
allow_unmatched_policy = true
25+
26+
[[plugins]]
27+
name = "resource"
28+
type = "LocalFs"
29+
dir_path = "/opt/confidential-containers/kbs/repository"
30+
31+
[policy_engine]
32+
policy_path = "/opt/confidential-containers/opa/policy.rego"

‎config/samples/microservices/kbs-config.yaml‎

Lines changed: 23 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,24 +4,26 @@ metadata:
44
name: kbs-config-grpc
55
namespace: trustee-operator-system
66
data:
7-
kbs-config.json: |
8-
{
9-
"insecure_http" : true,
10-
"sockets": ["0.0.0.0:8080"],
11-
"auth_public_key": "/etc/auth-secret/kbs.pem",
12-
"private_key": "/etc/https-key/key.pem",
13-
"certificate": "/etc/https-cert/cert.pem",
14-
"attestation_token_config": {
15-
"attestation_token_type": "CoCo"
16-
},
17-
"grpc_config" : {
18-
"as_addr": "http://127.0.0.1:50004"
19-
},
20-
"repository_config": {
21-
"type": "LocalFs",
22-
"dir_path": "/opt/confidential-containers/kbs/repository"
23-
},
24-
"policy_engine_config": {
25-
"policy_path": "/opt/confidential-containers/opa/policy.rego"
26-
}
27-
}
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = true
11+
12+
[admin]
13+
insecure_api = true
14+
auth_public_key = "/etc/auth-secret/kbs.pem"
15+
16+
[attestation_token]
17+
insecure_key = true
18+
19+
[attestation_service]
20+
type = "coco_as_grpc"
21+
as_addr = "http://127.0.0.1:50004"
22+
23+
[[plugins]]
24+
name = "resource"
25+
type = "LocalFs"
26+
dir_path = "/opt/confidential-containers/kbs/repository"
27+
28+
[policy_engine]
29+
policy_path = "/opt/confidential-containers/opa/policy.rego"

0 commit comments

Comments
 (0)