The compute-pcrs job tries to find the EFI variables based on the guest OS ID and version
|
let efivars = format!("/reference-values/efivars/qemu-ovmf/{os_id}-{os_version_id}"); |
but EFI variables are controlled by the platform, or virtualization host, owner.
EFI variables only impact PCR7. This is not a PCR that the operator is configuring as a trustee's reference value currently, mainly because any db/dbx update would cause managed nodes not to boot.
Ideally, we would need a way of knowing which platform we are running our nodes on, check if we know about its default EFI variables, and use those during PCR7 computation.
However, we are currently computing PCR7 only to fill the image-pcrs config map. This value is ignored when filling the trustee-data configmap, which is the one that does actually impact attestation.
My take on this is not to compute PCR7 on the PCR job, at least until we do have a mechanism we can trust to obtain or set the EFI variables no matter the platform we are running on. This way we would avoid the issues we might have testing guest images that are not fcos42 and the false expectations of PCR7 attestation playing a role in this setup.
The compute-pcrs job tries to find the EFI variables based on the guest OS ID and version
operator/compute-pcrs/src/main.rs
Line 46 in bbd1046
but EFI variables are controlled by the platform, or virtualization host, owner.
EFI variables only impact PCR7. This is not a PCR that the operator is configuring as a trustee's reference value currently, mainly because any db/dbx update would cause managed nodes not to boot.
Ideally, we would need a way of knowing which platform we are running our nodes on, check if we know about its default EFI variables, and use those during PCR7 computation.
However, we are currently computing PCR7 only to fill the image-pcrs config map. This value is ignored when filling the trustee-data configmap, which is the one that does actually impact attestation.
My take on this is not to compute PCR7 on the PCR job, at least until we do have a mechanism we can trust to obtain or set the EFI variables no matter the platform we are running on. This way we would avoid the issues we might have testing guest images that are not fcos42 and the false expectations of PCR7 attestation playing a role in this setup.