Skip to content

Commit e65f960

Browse files
richmrichm
committed
refactor: copy external files to role, copy containers to quay.io linux-system-roles
Copy quadlet files and configs into the role Copy container images to quay.io/linux-system-roles Signed-off-by: Rich Megginson <rmeggins@redhat.com>
1 parent c7892d3 commit e65f960

17 files changed

Lines changed: 356 additions & 59 deletions

‎files/configs/as/config.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"_comment": "Attestation Service Configuration for Quadlet Deployment",
3+
"work_dir": "/var/lib/as",
4+
"policy_engine": "opa",
5+
"rvps_config": {
6+
"_comment": "Connect to RVPS via gRPC on the container network",
7+
"type": "GrpcRemote",
8+
"address": "http://127.0.0.1:50003"
9+
},
10+
11+
"attestation_token_broker": {
12+
"duration_min": 5,
13+
"type": "Ear",
14+
"_comment_signer": "Attestation result token signing configuration",
15+
"signer": {
16+
"key_path": "/etc/as/token.key",
17+
"cert_path": "/etc/as/token.crt"
18+
}
19+
}
20+
}

‎files/configs/kbs/config.toml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# KBS Configuration for Quadlet Deployment
2+
# This configuration runs KBS with an external (gRPC) Attestation Service
3+
4+
[http_server]
5+
sockets = ["0.0.0.0:8080"]
6+
insecure_http = false
7+
private_key = "/etc/kbs/server.key"
8+
certificate = "/etc/kbs/server.crt"
9+
worker_count = 4
10+
11+
[admin]
12+
insecure_api = false
13+
auth_public_key = "/etc/kbs/auth.pub"
14+
15+
[attestation_token]
16+
insecure_key = false
17+
attestataion_token_type = "CoCo"
18+
trusted_certs_paths = ["/etc/kbs/trusted_certs/token0.crt"]
19+
20+
[attestation_service]
21+
# Use gRPC to connect to external Attestation Service
22+
type = "coco_as_grpc"
23+
url = "http://127.0.0.1:50004"
24+
# Timeout for AS communication
25+
timeout_ms = 10000
26+
27+
[policy_engine]
28+
policy_path = "/etc/kbs/policy.rego"
29+
30+
# Resource plugin - local filesystem storage
31+
[[plugins]]
32+
name = "resource"
33+
type = "LocalFs"
34+
dir_path = "/var/lib/kbs/repository"
35+
36+
# Uncomment to add HashiCorp Vault backend
37+
# [[plugins]]
38+
# name = "resource"
39+
# type = "Vault"
40+
# vault_url = "https://vault.example.com:8200"
41+
# token = "hvs.your-vault-token-here"
42+
# mount_path = "secret"
43+
# verify_ssl = true

‎files/configs/kbs/policy.rego‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# KBS Authorization Policy
2+
# This policy controls which resources can be accessed based on attestation claims
3+
4+
package policy
5+
6+
# Default deny all requests
7+
default allow = false
8+
input_tcb := input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]
9+
path := split(data["resource-path"], "/")
10+
11+
allow if {
12+
input["submods"]["cpu0"]["ear.status"] == "affirming"
13+
}

‎files/configs/rvps/config.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"_comment": "RVPS Configuration for Quadlet Deployment",
3+
4+
"storage": {
5+
"_comment": "Local filesystem storage for reference values",
6+
"type": "LocalJson",
7+
"file_path": "/var/lib/rvps/reference_values/reference-values.json"
8+
},
9+
10+
"_comment_grpc": "gRPC server configuration",
11+
"grpc": {
12+
"address": "0.0.0.0:50003"
13+
}
14+
}

‎files/configs/version.env‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
TRUSTEE_VERSION=0.15.0
2+
IMAGE_SOURCE=quay.io/linux-system-roles

‎files/quadlet/as-data.volume‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Attestation Service Data Volume
2+
3+
[Volume]
4+
Label=app=trustee
5+
Label=component=as
6+
Label=type=data

‎files/quadlet/kbs-data.volume‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# KBS Data Volume
2+
# Persistent storage for KBS runtime data (keys, resources, etc.)
3+
4+
[Volume]
5+
Label=app=trustee
6+
Label=component=kbs
7+
Label=type=data
8+
9+
# This volume stores:
10+
# - Registered resources/secrets
11+
# - Session data
12+
# - Runtime state

‎files/quadlet/rvps-data.volume‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# RVPS Data Volume
2+
# Persistent storage for reference values and provenance data
3+
4+
[Volume]
5+
Label=app=trustee
6+
Label=component=rvps
7+
Label=type=data
8+
9+
# This volume stores:
10+
# - Reference values
11+
# - Provenance records
12+
# - Runtime state

‎files/quadlet/trustee-as.container‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Trustee Attestation Service (AS)
2+
# Verifies TEE evidence and generates attestation tokens
3+
#
4+
# AS depends on RVPS for reference values and is required by KBS for attestation.
5+
# It acts as the "Verifier" in the RATS architecture.
6+
7+
[Unit]
8+
Description=Trustee Attestation Service
9+
Documentation=https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.10/html/deploying_trustee/
10+
11+
# Start after RVPS is available
12+
After=network-online.target trustee-rvps.service
13+
Wants=network-online.target
14+
Requires=trustee-rvps.service
15+
16+
[Container]
17+
# Container image - uses Red Hat registry
18+
# For development/testing, override with: Image=quay.io/confidential-containers/as:latest
19+
Image=quay.io/linux-system-roles/trustee-as:0.15.0
20+
Pod=trustee.pod
21+
22+
# Container name for DNS resolution on the trustee network
23+
ContainerName=trustee-as
24+
25+
# Configuration mount (read-only)
26+
Volume=/etc/trustee/as:/etc/as:ro,Z
27+
28+
# Data persistence
29+
Volume=as-data.volume:/var/lib/as:Z
30+
31+
# Environment variables
32+
Environment=RUST_LOG=info
33+
Environment=AS_CONFIG_FILE=/etc/as/config.json
34+
35+
# Security hardening
36+
NoNewPrivileges=true
37+
38+
# Drop all capabilities
39+
DropCapability=ALL
40+
41+
# Health check
42+
HealthCmd=sh -c 'ss -tlnp | grep -q 50004 || exit 1'
43+
HealthInterval=30s
44+
HealthTimeout=10s
45+
HealthRetries=3
46+
HealthStartPeriod=15s
47+
48+
# Resource limits (adjust based on workload)
49+
# Memory=512M
50+
51+
[Service]
52+
# Restart policy
53+
Restart=on-failure
54+
RestartSec=10s
55+
56+
# Startup/shutdown timeouts
57+
TimeoutStartSec=90s
58+
TimeoutStopSec=30s
59+
60+
# Logging
61+
StandardOutput=journal
62+
StandardError=journal
63+
SyslogIdentifier=trustee-as
64+
65+
[Install]
66+
WantedBy=multi-user.target default.target

‎files/quadlet/trustee-kbs.container‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Trustee Key Broker Service (KBS)
2+
# The main entry point for confidential workloads to retrieve secrets
3+
#
4+
# KBS implements the RCAR protocol (Request-Challenge-Attestation-Response)
5+
# and acts as the "Relying Party" in the RATS architecture.
6+
# It depends on AS for attestation verification.
7+
8+
[Unit]
9+
Description=Trustee Key Broker Service
10+
Documentation=https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.10/html/deploying_trustee/
11+
12+
# Start after AS is available (which implies RVPS is also ready)
13+
After=network-online.target trustee-as.service
14+
Wants=network-online.target
15+
Requires=trustee-as.service
16+
17+
[Container]
18+
# Container image - uses Red Hat registry
19+
# For development/testing, override with: Image=quay.io/confidential-containers/kbs:latest
20+
Image=quay.io/linux-system-roles/trustee-kbs:0.15.0
21+
Pod=trustee.pod
22+
23+
# Container name for DNS resolution
24+
ContainerName=trustee-kbs
25+
26+
# Configuration mount (read-only)
27+
Volume=/etc/trustee/kbs:/etc/kbs:ro,Z
28+
29+
# Data persistence for resources/secrets
30+
Volume=kbs-data.volume:/var/lib/kbs:Z
31+
32+
# Environment variables
33+
Environment=RUST_LOG=info
34+
Environment=KBS_CONFIG_FILE=/etc/kbs/config.toml
35+
36+
# Optional: set the policy path (can also be set in config.toml)
37+
Environment=KBS_POLICY_PATH=/etc/kbs/policy.rego
38+
39+
# Security hardening
40+
NoNewPrivileges=true
41+
42+
# Drop all capabilities
43+
DropCapability=ALL
44+
45+
# If binding to port < 1024, uncomment:
46+
# AddCapability=CAP_NET_BIND_SERVICE
47+
48+
# Health check - HTTP endpoint
49+
HealthCmd=curl -sk https://localhost:8080/ || exit 1
50+
HealthInterval=30s
51+
HealthTimeout=10s
52+
HealthRetries=3
53+
HealthStartPeriod=20s
54+
55+
# Resource limits (adjust based on workload)
56+
# Memory=512M
57+
58+
# Enable auto-update from registry (optional)
59+
# AutoUpdate=registry
60+
61+
[Service]
62+
# Restart policy
63+
Restart=on-failure
64+
RestartSec=10s
65+
66+
# Startup/shutdown timeouts
67+
TimeoutStartSec=120s
68+
TimeoutStopSec=30s
69+
70+
# Logging
71+
StandardOutput=journal
72+
StandardError=journal
73+
SyslogIdentifier=trustee-kbs
74+
75+
[Install]
76+
# This is the main service users will enable/start
77+
WantedBy=multi-user.target default.target

0 commit comments

Comments
 (0)