Merge pull request #246 from Jakob-Naucke/decouple-tec-pcr-compute

Remove images from TEC definition & run watchers independently of TECs

Author: Jakob-Naucke

.github/workflows/rust.yml

@@ -46,7 +46,7 @@ jobs:
       - name: "cargo build"
         run: cargo build --all-targets
       - name: "cargo test"
-        run: cargo test --bins
+        run: cargo test --bins --lib
   tests-release-stable:
     name: "Tests (release), stable toolchain"
     runs-on: "ubuntu-24.04"
@@ -70,7 +70,7 @@ jobs:
       - name: "cargo build (release)"
         run: cargo build --lib --release
       - name: "cargo test (release)"
-        run: cargo test --bins --release
+        run: cargo test --bins --lib --release
   tests-release-msrv:
     name: "Tests (release), minimum supported toolchain"
     runs-on: "ubuntu-24.04"
@@ -100,7 +100,7 @@ jobs:
       - name: "cargo build (release)"
         run: cargo build --lib --release
       - name: "cargo test (release)"
-        run: cargo test --bins --release
+        run: cargo test --bins --lib --release
   tests-other-channels:
     name: "Tests, unstable toolchain"
     runs-on: "ubuntu-24.04"
@@ -128,4 +128,4 @@ jobs:
       - name: "cargo build"
         run: cargo build --lib
       - name: "cargo test"
-        run: cargo test --bins
+        run: cargo test --bins --lib

Cargo.lock

@@ -18,6 +18,7 @@ COPY operator/src/lib.rs operator/src/
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members = .*/members = ["lib", "operator"]/' Cargo.toml && \
     sed -i '/\[dev-dependencies\]/,$d' operator/Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     make crds-rs
 
 # In debug builds, build dependencies to avoid full rebuild.

Containerfile

@@ -204,10 +204,10 @@ equal-conditions:
 lint: fmt-check clippy vet equal-conditions
 
 test: crds-rs
-	cargo test --workspace --bins
+	cargo test --workspace --bins --lib
 
 test-release: crds-rs
-	cargo test --workspace --bins --release
+	cargo test --workspace --bins --lib --release
 
 integration-tests: generate trusted-cluster-gen crds-rs
 	RUST_LOG=info REGISTRY=$(REGISTRY) TAG=$(TAG) \

Makefile

@@ -92,6 +92,24 @@ func generateOperator(args *Args) error {
 					Name:    name,
 					Image:   args.image,
 					Command: []string{"/usr/bin/operator"},
+					Env: []corev1.EnvVar{
+						{
+							Name:  "RELATED_IMAGE_TRUSTEE",
+							Value: args.trusteeImage,
+						},
+						{
+							Name:  "RELATED_IMAGE_COMPUTE_PCRS",
+							Value: args.pcrsComputeImage,
+						},
+						{
+							Name:  "RELATED_IMAGE_REGISTRATION_SERVER",
+							Value: args.registerServerImage,
+						},
+						{
+							Name:  "RELATED_IMAGE_ATTESTATION_KEY_REGISTER",
+							Value: args.attestationKeyRegisterImage,
+						},
+					},
 				},
 			},
 		},
@@ -140,10 +158,6 @@ func generateTrustedExecutionClusterCR(args *Args) error {
 			Namespace: args.namespace,
 		},
 		Spec: v1alpha1.TrustedExecutionClusterSpec{
-			TrusteeImage:                     &args.trusteeImage,
-			PcrsComputeImage:                 &args.pcrsComputeImage,
-			RegisterServerImage:              &args.registerServerImage,
-			AttestationKeyRegisterImage:      &args.attestationKeyRegisterImage,
 			PublicAttestationKeyRegisterAddr: nil,
 			PublicTrusteeAddr:                nil,
 			TrusteeSecret:                    nil,

api/trusted-cluster-gen.go

@@ -35,14 +35,6 @@ var (
 // +kubebuilder:rbac:groups=trusted-execution-clusters.io,resources=trustedexecutionclusters/status;machines/status;approvedimages/status;attestationkeys/status,verbs=get;patch;update
 
 // TrustedExecutionClusterSpec defines the desired state of TrustedExecutionCluster
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.trusteeImage) || has(self.trusteeImage)", message="Value is required once set"
-// +kubebuilder:validation:XValidation:rule="has(oldSelf.trusteeImage) == has(self.trusteeImage)", message="Value must be set at creation"
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.pcrsComputeImage) || has(self.pcrsComputeImage)", message="Value is required once set"
-// +kubebuilder:validation:XValidation:rule="has(oldSelf.pcrsComputeImage) == has(self.pcrsComputeImage)", message="Value must be set at creation"
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.registerServerImage) || has(self.registerServerImage)", message="Value is required once set"
-// +kubebuilder:validation:XValidation:rule="has(oldSelf.registerServerImage) == has(self.registerServerImage)", message="Value must be set at creation"
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.attestationKeyRegisterImage) || has(self.attestationKeyRegisterImage)", message="Value is required once set"
-// +kubebuilder:validation:XValidation:rule="has(oldSelf.attestationKeyRegisterImage) == has(self.attestationKeyRegisterImage)", message="Value must be set at creation"
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.publicAttestationKeyRegisterAddr) || has(self.publicAttestationKeyRegisterAddr)", message="Value is required once set"
 // +kubebuilder:validation:XValidation:rule="has(oldSelf.publicAttestationKeyRegisterAddr) == has(self.publicAttestationKeyRegisterAddr)", message="Value must be set at creation"
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.attestationKeyRegisterSecret) || has(self.attestationKeyRegisterSecret)", message="Value is required once set"
@@ -59,30 +51,6 @@ var (
 // +kubebuilder:validation:XValidation:rule="!has(oldSelf.attestationKeyRegisterPort) || has(self.attestationKeyRegisterPort)", message="Value is required once set"
 // +kubebuilder:validation:XValidation:rule="has(oldSelf.attestationKeyRegisterPort) == has(self.attestationKeyRegisterPort)", message="Value must be set at creation"
 type TrustedExecutionClusterSpec struct {
-	// Image reference to Trustee all-in-one image.
-	// If not specified, uses RELATED_IMAGE_TRUSTEE environment variable from operator deployment.
-	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
-	TrusteeImage *string `json:"trusteeImage,omitempty"`
-
-	// Image reference to trusted-cluster-operator's compute-pcrs image.
-	// If not specified, uses RELATED_IMAGE_COMPUTE_PCRS environment variable from operator deployment.
-	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
-	PcrsComputeImage *string `json:"pcrsComputeImage,omitempty"`
-
-	// Image reference to trusted-cluster-operator's register-server image.
-	// If not specified, uses RELATED_IMAGE_REGISTRATION_SERVER environment variable from operator deployment.
-	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
-	RegisterServerImage *string `json:"registerServerImage,omitempty"`
-
-	// Image reference to trusted-cluster-operator's attestation-key-register image.
-	// If not specified, uses RELATED_IMAGE_ATTESTATION_KEY_REGISTER environment variable from operator deployment.
-	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"
-	AttestationKeyRegisterImage *string `json:"attestationKeyRegisterImage,omitempty"`
-
 	// Address where attester can connect to Attestation Key Register
 	// +optional
 	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value is immutable"

api/v1alpha1/crds.go

@@ -15,6 +15,7 @@ COPY attestation-key-register/src/lib.rs attestation-key-register/src/
 
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members =.*/members = ["lib", "attestation-key-register"]/' Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     make crds-rs
 
 # In debug builds, build dependencies to avoid full rebuild.

attestation-key-register/Containerfile

@@ -16,6 +16,7 @@ COPY compute-pcrs/src/lib.rs compute-pcrs/src/
 
 # Set only required crates as members to minimize rebuilds upon changes.
 RUN sed -i 's/members =.*/members = ["compute-pcrs", "lib"]/' Cargo.toml && \
+    sed -i '/trusted-cluster-operator-test-utils/d' lib/Cargo.toml && \
     git clone --depth 1 https://github.com/trusted-execution-clusters/reference-values && \
     make crds-rs
 

compute-pcrs/Containerfile

@@ -93,3 +93,16 @@ A reference value listing for Trustee could then look like this:
 ## Data flow
 
 ![](../pics/rv-flow.png)
+
+## Ownership
+
+Unlike `reference-values`, `ApprovedImages` can live independently of a `TrustedExecutionCluster` object.
+They can be created without one existing, and reference values are written by jobs (that the `ApprovedImages` also own) to the `image-pcrs` ConfigMap, which is created by the operator and is also independent of `TrustedExecutionClusters`.
+
+However, the `ApprovedImages` are adopted by the `TrustedExecutionCluster` object, both when created with a `TrustedExecutionCluster` existing and retroactively when created before `TrustedExecutionCluster` creation.
+This ensures that removal of a `TrustedExecutionCluster` acts as a complete uninstallation.
+Finalizers on the `ApprovedImages` ensure the PCR values are removed back out of `image-pcrs` again.
+
+## Ownership flow
+
+![](../pics/image-flow.png)