feat(secret_registration_server): add secret registration server service

The secret registration server service is an HTTPS server. It receives only
request from the counterpart secret registration client service. It creates
a disk encryption key along with resource policy tied to PCR15 of the client.

Signed-off-by: Li Tian <litian@redhat.com>

Author: litian1992

README.md

@@ -4,102 +4,76 @@
 
 ![trustee_server](https://github.com/linux-system-roles/trustee_server/workflows/tox/badge.svg)
 
-A trustee_server for an ansible role that configures some GNU/Linux subsystem or
-service. A brief description of the role goes here.
+An Ansible role that deploys [Trustee](https://confidentialcontainers.org/docs/attestation/) server components for confidential computing. Trustee provides attestation and secret delivery services (KBS, Attestation Service) for workloads running in Trusted Execution Environments (TEEs).
 
-## Requirements
+## Features
+
+- **Trustee Server (Quadlet)**: Deploys Trustee Key Broker Service(KBS), Attestation Service(AS) and Reference Value Provider Service(RVPS) using Podman Quadlets from a GitHub repository
+- **Secret Registration Server**: HTTPS service that receives attestation-backed registration requests, verifies attestation, creates disk encryption keys, and stores them in Trustee KBS
 
-Any prerequisites that may not be covered by Ansible itself or the role should
-be mentioned here.  This includes platform dependencies not managed by the
-role, hardware requirements, external collections, etc.  There should be a
-distinction between *control node* requirements (like collections) and
-*managed node* requirements (like special hardware, platform provisioning).
+## Requirements
 
-### Collection requirements
+### Control node
 
-For instance, if the role depends on some collections and has a
-`meta/collection-requirements.yml` file for installing those dependencies, and
-in order to manage `rpm-ostree` systems, it should be mentioned here that the
- user should run
+- Ansible 2.9 or later
+- Install collection dependencies:
 
 ```bash
-ansible-galaxy collection install -vv -r meta/collection-requirements.yml
+ansible-galaxy collection install -r meta/collection-requirements.yml
 ```
 
-on the *control node* before using the role.
-
-## Role Variables
-
-A description of all input variables (i.e. variables that are defined in
-`defaults/main.yml`) for the role should go here as these form an API of the
-role.  Each variable should have its own section e.g.
-
-### trustee_server_foo
+### Managed node
 
-This variable is required.  It is a string that lists the foo of the role.
-There is no default value.
+- Fedora or RHEL 9+
+- Podman
+- Python 3
 
-### trustee_server_bar
-
-This variable is optional.  It is a boolean that tells the role to disable bar.
-The default value is `true`.
-
-Variables that are not intended as input, like variables defined in
-`vars/main.yml`, variables that are read from other roles and/or the global
-scope (ie. hostvars, group vars, etc.) can be also mentioned here but keep in
-mind that as these are probably not part of the role API they may change during
-the lifetime.
-
-Example of setting the variables:
+## Example Playbook
 
 ```yaml
-trustee_server_foo: "oof"
-trustee_server_bar: false
+- name: Deploy Trustee Server
+  hosts: all
+  vars:
+    trustee_server_trustee: true
+    trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
+    trustee_server_quadlet_repo_path: "quadlet"
+    trustee_server_quadlet_repo_branch: "main"
+    trustee_server_quadlet_install_dir: "/etc/containers/systemd"
+    trustee_server_secret_registration_server_enabled: true
+    trustee_server_secret_registration_listen_port: 8081
+  roles:
+    - linux-system-roles.trustee_server
 ```
 
-## Variables Exported by the Role
-
-This section is optional.  Some roles may export variables for playbooks to
-use later.  These are analogous to "return values" in Ansible modules.  For
-example, if a role performs some action that will require a system reboot, but
-the user wants to defer the reboot, the role might set a variable like
-`trustee_server_reboot_needed: true` that the playbook can use to reboot at a more
-convenient time.
+More examples are in the [`examples/`](examples) directory.
 
-Example:
+## Trustee Server
 
-### trustee_server_reboot_needed
+When enabled, the role:
 
-Default `false` - if `true`, this means a reboot is needed to apply the changes
-made by the role
+1. Downloads the Podman Quadlets from designated repo
+2. Generates all required certficates of Trustee server components
+3. Add KBS port 8080 to firewalld
+3. Enables the services by default
 
-## Example Playbook
-
-Including an example of how to use your role (for instance, with variables
-passed in as parameters) is always nice for users too:
+Note that KBS listens on port 8080 which may require additional network security allowance depending on your environment.
 
-```yaml
-- name: Manage the trustee_server subsystem
-  hosts: all
-  vars:
-    trustee_server_foo: "foo foo!"
-    trustee_server_bar: false
-  roles:
-    - linux-system-roles.trustee_server
-```
+## Secret Registration Server
 
-More examples can be provided in the [`examples/`](examples) directory. These
-can be useful, especially for documentation.
+When enabled, the secret registration server:
 
-## rpm-ostree
+1. Listens for `POST /register-encryption-key` with `attestation_token` and `client_id` (machine-id)
+2. Verifies the attestation token (Azure TPM-based)
+3. Creates a disk encryption key and stores it in Trustee KBS
+4. Appends resource policy to `/etc/trustee/kbs/policy.rego`
 
-See README-ostree.md
+Clients can then fetch the key from Trustee CDH using attestation.
 
 ## License
 
-Whenever possible, please prefer MIT.
+MIT
 
-## Author Information
+## Author
 
 An optional section for the role authors to include contact information, or a
 website (HTML is not allowed).

defaults/main.yml

@@ -11,15 +11,6 @@ trustee_server_quadlet_repo_branch: "main"
 trustee_server_quadlet_install_dir: "/etc/containers/systemd"
 trustee_attestation_server_config_dir: "/etc/trustee"
 
-# Secret registration service configuration
-trustee_server_secret_registration_service_enabled: false
-
-# SSL certificate generation (used with -config trustee_server.conf)
-trustee_server_ssl_bits: 4096
-trustee_server_ssl_md: sha256
-trustee_server_ssl_days: 3650
-trustee_server_ssl_cn: trustee-server
-trustee_server_ssl_org: Trustee
-trustee_server_ssl_country: US
-trustee_server_ssl_cert_path: /etc/trustee/kbs/server.crt
-trustee_server_ssl_key_path: /etc/trustee/kbs/server.key
+# Secret registration server service configuration
+trustee_server_secret_registration_server_enabled: false
+trustee_server_secret_registration_listen_port: 8081

examples/simple.yml

@@ -8,6 +8,6 @@
     trustee_server_quadlet_repo_path: "quadlet"
     trustee_server_quadlet_repo_branch: "main"
     trustee_server_quadlet_install_dir: "/etc/containers/systemd"
-    trustee_server_secret_registration_service_enabled: false
+    trustee_server_secret_registration_server_enabled: false
   roles:
     - linux-system-roles.trustee-server

handlers/main.yml

@@ -1,7 +1,9 @@
 # SPDX-License-Identifier: MIT
 ---
-- name: Handler for trustee_server to restart services
+- name: Handler for trustee_attestation_server to restart services
   service:
     name: "{{ item }}"
     state: restarted
-  loop: "{{ __trustee_server_services }}"
+    enabled: true
+    daemon_reload: true
+  loop: "{{ __trustee_attestation_server_services }}"

tasks/main.yml

@@ -8,7 +8,8 @@
   include_tasks: trustee_quadlet.yml
   when: trustee_server_trustee | bool
 
-- name: Create Secret Registration Service
-  include_tasks: secret_registration_service.yml
-  when: trustee_server_secret_registration_service_enabled | bool
-
+- name: Deploy Secret Registration Server Service
+  include_tasks: secret_registration_server.yml
+  when:
+    - trustee_attestation_server_secret_registration_enabled | bool
+    - trustee_attestation_server_trustee | bool

tasks/secret_registration_server.yml

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: MIT
+---
+# Secret registration server: receives client requests with Trustee attestation,
+# and client ID (machine-id), creates disk encryption keys and stores them in KBS.
+# Requires Trustee (trustee_quadlet) to be deployed.
+
+- name: Ensure secret registration server dependencies are installed
+  ansible.builtin.package:
+    name: "{{ __trustee_server_secret_registration_packages }}"
+    state: present
+    use: "{{ (__trustee_server_is_ostree | d(false)) |
+          ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
+
+- name: Deploy secret registration server script
+  ansible.builtin.template:
+    src: secret_registration_server.py.j2
+    dest: "/usr/local/bin/secret_registration_server.py"
+    mode: "0755"
+  register: __trustee_attestation_server_secret_reg_script
+
+- name: Deploy secret registration server systemd unit
+  ansible.builtin.template:
+    src: secret_registration_server.service.j2
+    dest: /etc/systemd/system/secret_registration_server.service
+    mode: "0644"
+  register: __trustee_attestation_server_secret_reg_service
+
+- name: Gather service facts for firewall check
+  ansible.builtin.service_facts:
+
+- name: Allow secret registration server port in firewall
+  ansible.posix.firewalld:
+    port: "{{ trustee_server_secret_registration_listen_port }}/tcp"
+    permanent: true
+    immediate: true
+    state: enabled
+  when: (ansible_facts.services | default({})).get('firewalld.service', {}).get('state', '') == 'running'
+
+- name: Append secret registration server service to the list of services to restart
+  set_fact:
+    __trustee_attestation_server_services: >-
+      {{ __trustee_attestation_server_services | default([]) + ['secret_registration_server'] }}
+  changed_when: true
+  notify: Handler for trustee_attestation_server to restart services

tasks/secret_registration_service.yml

@@ -70,10 +70,14 @@
 - name: Generate certificates for all components
   ansible.builtin.shell: |
     # Trustee Server SSL
-    if [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.crt ] || [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.key ]; then
-      openssl req -new -x509 -nodes -sha256 -days 3550 \
+    if [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.key ] || [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/server.crt ]; then
+      openssl req -x509 -newkey rsa:2048 -nodes -keyout {{ trustee_attestation_server_config_dir }}/kbs/server.key \
         -subj "/CN=$(hostname -f)/O=Red Hat" \
-        -out {{ trustee_attestation_server_config_dir }}/kbs/server.crt -keyout {{ trustee_attestation_server_config_dir }}/kbs/server.key
+        -addext "basicConstraints=CA:FALSE" \
+        -addext "keyUsage=digitalSignature,keyEncipherment" \
+        -addext "extendedKeyUsage=serverAuth" \
+        -addext "subjectAltName=DNS:$(hostname -f)" \
+        -out {{ trustee_attestation_server_config_dir }}/kbs/server.crt
     fi
     # KBS authentication key pair
     if [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/auth.key ] || [ ! -f {{ trustee_attestation_server_config_dir }}/kbs/auth.pub ]; then
@@ -89,6 +93,7 @@
       mkdir -p {{ trustee_attestation_server_config_dir }}/kbs/trusted_certs
       cp {{ trustee_attestation_server_config_dir }}/as/token.crt {{ trustee_attestation_server_config_dir }}/kbs/trusted_certs/token0.crt
     fi
+  changed_when: true
 
 - name: Gather service facts
   ansible.builtin.service_facts:
@@ -99,26 +104,25 @@
     permanent: true
     immediate: true
     state: enabled
-  when: ansible_facts.services['firewalld.service'].state == 'running'
+  when: (ansible_facts.services | default({})).get('firewalld.service', {}).get('state', '') == 'running'
 
 - name: Get the installed Trustee Server pod name
   ansible.builtin.find:
     paths: "{{ trustee_server_quadlet_install_dir }}"
     patterns: "*.pod"
-  register: trustee_server_pod_name
+  register: __trustee_attestation_server_pod_name
 
-- name: Enable and start Trustee Server services
-  ansible.builtin.systemd:
-    name: "{{ trustee_server_pod_name.files[0].path | basename | regex_replace('\\.pod$', '') }}-pod.service"
-    enabled: true
-    state: restarted
-    daemon_reload: true
-  when: trustee_server_pod_name.files | length > 0
-  failed_when: false
+- name: Append Trustee Server services to the list of services to restart
+  set_fact:
+    __trustee_attestation_server_services: >-
+      {{ __trustee_attestation_server_services | default([]) + [__trustee_attestation_server_pod_name.files[0].path | basename | replace('.pod', '-pod')] }}
+  when: __trustee_attestation_server_pod_name.files | length > 0
+  changed_when: true
+  notify: Handler for trustee_attestation_server to restart services
 
 # TODO keep the server.crt and DNS names in the role variables
 
 - name: Clean up temporary repository directory
   ansible.builtin.file:
     path: "{{ __trustee_server_quadlet_repo_dir.path }}"
-    state: absent
+    state: absent