diff --git a/.README.html b/.README.html new file mode 100644 index 0000000..cc38d2d --- /dev/null +++ b/.README.html @@ -0,0 +1,276 @@ + + + + + + + + trustee_server + + + + + + +
+
+

trustee_server

+
+
+ +
+

+

An Ansible role that deploys Trustee +server components for confidential computing. Trustee provides +attestation and secret delivery services (KBS, AS, RVPS) for workloads +running in Trusted Execution Environments (TEEs).

+

Features

+ +

Requirements

+

Control node

+ +
ansible-galaxy collection install -r meta/collection-requirements.yml
+

Variables

+

trustee_server_trustee

+

Whether to deploy the Trustee server components (KBS, AS, RVPS) using +Podman Quadlets.

+

The secret registration server is only deployed when this is +true and trustee_server_secret_registration_enabled +is true.

+

Default: true

+

Type: bool

+

trustee_server_secret_registration_enabled

+

Whether to deploy the secret registration HTTPS service that receives +attestation-backed registration requests, verifies attestation, creates +disk encryption keys, and stores them in Trustee KBS.

+

This has no effect unless trustee_server_trustee +is true, because the registration server depends on +Trustee.

+

Default: false

+

Type: bool

+

trustee_server_secret_registration_listen_port

+

TCP port on which the secret registration server listens. The role +opens this port in firewalld when firewalld is running.

+

Default: 8081

+

Type: int

+

trustee_server_secure_logging

+

If true, suppress potentially sensitive output from +tasks that handle credentials, secrets, and other sensitive data by +setting no_log: true on those tasks. This prevents +passwords, API tokens, private keys, and similar sensitive information +from appearing in Ansible logs and console output.

+

If you need to debug issues with credential handling or secret +management, you can temporarily set +trustee_server_secure_logging: false to see the full output +from these tasks. However, be aware that this may expose sensitive +information in logs, so it should only be used in development or +troubleshooting scenarios.

+

Default: true

+

Type: bool

+

Example Playbook

+
- name: Deploy Trustee Server
+  hosts: all
+  vars:
+    trustee_server_trustee: true
+    trustee_server_secret_registration_enabled: true
+    trustee_server_secret_registration_listen_port: 8081
+  roles:
+    - linux-system-roles.trustee_server
+

More examples are in the examples/ directory.

+

Trustee Server

+

When enabled, the role:

+
    +
  1. Downloads the Podman Quadlets from designated repo
  2. +
  3. Generates all required certificates of Trustee server +components
  4. +
  5. Add KBS port 8080 to firewalld
  6. +
  7. Enables the services by default
  8. +
+

Note that KBS listens on port 8080 which may require additional +network security allowance depending on your environment.

+

Secret Registration Server

+

When enabled, the secret registration server:

+
    +
  1. Listens for POST /register-encryption-key with +attestation_token and client_id +(machine-id)
  2. +
  3. Verifies the attestation token (Azure TPM-based)
  4. +
  5. Creates a disk encryption key and stores it in Trustee KBS
  6. +
  7. Appends resource policy to +/etc/trustee/kbs/policy.rego
  8. +
+

Clients can then fetch the key from Trustee CDH using +attestation.

+

License

+

MIT

+

Author

+

Li Tian litian@redhat.com

+
+ + diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..47196b0 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,21 @@ +Changelog +========= + +[1.0.0] - 2026-05-07 +-------------------- + +### New Features + +- feat: Add Trustee quadlet and secret registration server (#2) +- feat: add role fingerprints to syslog (#13) +- feat: new variable `trustee_server_secure_logging` defaulting to `true` (#15) + +### Other Changes + +- ci: tox-lsr 3.17.0 - container test improvements, use ansible 2.20 for fedora 43 [citest_skip] (#1) +- ci: tox-lsr 3.17.1 - previous update broke container tests, this fixes them [citest_skip] (#3) +- test: ensure role gathers the facts it uses by having test clear_facts before include_role (#11) +- refactor: copy external files to role, copy containers to quay.io linux-system-roles (#12) +- ci: Bump actions/github-script from 8 to 9 (#14) +- docs: document role parameters [citest_skip] (#16) +