rvs: Run watchers independently of TECs

Watch ApprovedImages and compute reference values independently of a
TEC existing. Adopt ApprovedImages from the TEC in order to include
them in uninstallation. Have PCR computation jobs owned by the
ApprovedImages. This avoids conflicting watchers on ApprovedImages
while using a simple flow.

Test that adoption of an ApprovedImage works also when created 5
seconds before and after the TEC.

Fixes: #216

Signed-off-by: Jakob Naucke <jnaucke@redhat.com>

Author: Jakob-Naucke

.github/workflows/rust.yml

@@ -46,7 +46,7 @@ jobs:
       - name: "cargo build"
         run: cargo build --all-targets
       - name: "cargo test"
-        run: cargo test --bins
+        run: cargo test --bins --lib
   tests-release-stable:
     name: "Tests (release), stable toolchain"
     runs-on: "ubuntu-24.04"
@@ -70,7 +70,7 @@ jobs:
       - name: "cargo build (release)"
         run: cargo build --lib --release
       - name: "cargo test (release)"
-        run: cargo test --bins --release
+        run: cargo test --bins --lib --release
   tests-release-msrv:
     name: "Tests (release), minimum supported toolchain"
     runs-on: "ubuntu-24.04"
@@ -100,7 +100,7 @@ jobs:
       - name: "cargo build (release)"
         run: cargo build --lib --release
       - name: "cargo test (release)"
-        run: cargo test --bins --release
+        run: cargo test --bins --lib --release
   tests-other-channels:
     name: "Tests, unstable toolchain"
     runs-on: "ubuntu-24.04"
@@ -128,4 +128,4 @@ jobs:
       - name: "cargo build"
         run: cargo build --lib
       - name: "cargo test"
-        run: cargo test --bins
+        run: cargo test --bins --lib

Cargo.lock

@@ -18,6 +18,7 @@ COPY operator/src/lib.rs operator/src/
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members = .*/members = ["lib", "operator"]/' Cargo.toml && \
     sed -i '/\[dev-dependencies\]/,$d' operator/Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     make crds-rs
 
 # In debug builds, build dependencies to avoid full rebuild.

Containerfile

@@ -204,10 +204,10 @@ equal-conditions:
 lint: fmt-check clippy vet equal-conditions
 
 test: crds-rs
-	cargo test --workspace --bins
+	cargo test --workspace --bins --lib
 
 test-release: crds-rs
-	cargo test --workspace --bins --release
+	cargo test --workspace --bins --lib --release
 
 integration-tests: generate trusted-cluster-gen crds-rs
 	RUST_LOG=info REGISTRY=$(REGISTRY) TAG=$(TAG) \

Makefile

@@ -15,6 +15,7 @@ COPY attestation-key-register/src/lib.rs attestation-key-register/src/
 
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members =.*/members = ["lib", "attestation-key-register"]/' Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     make crds-rs
 
 # In debug builds, build dependencies to avoid full rebuild.

attestation-key-register/Containerfile

@@ -16,6 +16,7 @@ COPY compute-pcrs/src/lib.rs compute-pcrs/src/
 
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members =.*/members = ["compute-pcrs", "lib"]/' Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     git clone --depth 1 https://github.com/trusted-execution-clusters/reference-values && \
     make crds-rs
 

compute-pcrs/Containerfile

@@ -93,3 +93,16 @@ A reference value listing for Trustee could then look like this:
 ## Data flow
 
 ![](../pics/rv-flow.png)
+
+## Ownership
+
+Unlike `reference-values`, `ApprovedImages` can live independently of a `TrustedExecutionCluster` object.
+They can be created without one existing, and reference values are written by jobs (that the `ApprovedImages` also own) to the `image-pcrs` ConfigMap, which is created by the operator and is also independent of `TrustedExecutionClusters`.
+
+However, the `ApprovedImages` are adopted by the `TrustedExecutionCluster` object, both when created with a `TrustedExecutionCluster` existing and retroactively when created before `TrustedExecutionCluster` creation.
+This ensures that removal of a `TrustedExecutionCluster` acts as a complete uninstallation.
+Finalizers on the `ApprovedImages` ensure the PCR values are removed back out of `image-pcrs` again.
+
+## Ownership flow
+
+![](../pics/image-flow.png)

docs/design/reference-values.md

@@ -52,6 +52,9 @@ Machines booting this image can now register and attest.
 
 **NB:** Updating nodes is not supported yet. Updates incur one intermediary stage of PCR values (assuming no further update on that boot) because kernel update is effective one boot _before_ shim & GRUB update.
 
+**NB:** The TrustedExecutionCluster object adopts ApprovedImages, including those that lived before it.
+This ensures that removal of a TrustedExecutionCluster acts as complete uninstallation.
+
 # Disallowing a bootable container image
 
 For the example above:

docs/pics/image-flow.png

@@ -21,3 +21,6 @@ serde_json.workspace = true
 [dev-dependencies]
 # Only a generate dependency, not a Rust dependency. Included here for auto-updates.
 kopium = "0.23.0"
+http.workspace = true
+tokio.workspace = true
+trusted-cluster-operator-test-utils = { path = "../test_utils" }