Skip to content

Commit f928983

Browse files
butler54claude
butler54
and
claude
authored
feat: add baremetal TDX/SNP and NVIDIA GPU attestation support (#21)
* feat: add baremetal TDX and SNP attestation support Add direct TEE attestation rules for baremetal Intel TDX and AMD SEV-SNP. These use init_data hash verification (platform-independent) rather than Azure vTPM PCR measurements. Make pcr-stash secret lookup conditional in RVPS policy so baremetal deployments (which lack pcr-stash) don't fail. The init_data reference value is always included for both Azure and baremetal platforms. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: disable TLS cert verification for PCCS in QCNL config The PCCS service uses a self-signed certificate which causes SGX_QL_ROOT_CA_UNTRUSTED errors during TDX quote verification. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: support both Azure vTPM and baremetal init_data reference values The init_data RVPS entry now includes four values: - PCR8_HASH (secure + debug): SHA256(zeros || SHA256(toml)) for Azure vTPM - RAW_HASH padded (secure + debug): SHA256(toml) zero-padded to 48 bytes for baremetal TDX/SNP This allows a single attestation server to validate both Azure vTPM attestation (which presents PCR-extended hashes) and baremetal TDX/SNP attestation (which presents raw SHA-256 initdata hashes in the quote's mr_config_id field, zero-padded to SHA-384 width). Long-term, veritas (https://github.com/confidential-devhub/veritas) should be integrated for comprehensive reference value generation including firmware, kernel, and RTMR measurements. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: use chained single-item append calls for ACM compatibility ACM ConfigurationPolicy template engine rejects variadic append (want 2 got 11). Chain individual append calls instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add NVIDIA GPU attestation via NRAS remote verifier - Add kbs.gpu.enabled value (default false) for GPU attestation support - Configure NRAS remote verifier when GPU enabled (kbs-config-map) - Add default_gpu.rego policy for NRAS x-nvidia-* claims - Add GPU-aware resource policy requiring both cpu0 and gpu0 affirming - Existing GPU rules in default_cpu.rego handle CPU-class + GPU evidence Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: ensure GPU attestation is required when GPU is enabled Previously, when GPU attestation was enabled, the policy would still allow access with only CPU attestation due to the first rule being unconditionally present. This fix ensures the CPU-only rule only applies when GPU is disabled, preventing the bypass. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * chore: version bump Signed-off-by: Chris Butler <chris.butler@redhat.com> --------- Signed-off-by: Chris Butler <chris.butler@redhat.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 1c4f616 commit f928983

8 files changed

Lines changed: 117 additions & 7 deletions

File tree

‎Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ keywords:
77
- confidential-containers
88
name: trustee
99
# DO NOT EDIT VERSION HERE, IT IS AUTO-GENERATED BY SEMANTIC-RELEASE
10-
version: 0.3.2
10+
version: 0.3.3

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# trustee
22

3-
![Version: 0.3.2](https://img.shields.io/badge/Version-0.3.2-informational?style=flat-square)
3+
![Version: 0.3.3](https://img.shields.io/badge/Version-0.3.3-informational?style=flat-square)
44

55
A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
66

@@ -34,6 +34,7 @@ In order to use this chart, you will need to:
3434
| kbs.admin.format | string | `"v1.0"` | |
3535
| kbs.cosignKeys | string | `"secret/data/hub/coSignKeys"` | |
3636
| kbs.extraSecrets | list | `[]` | |
37+
| kbs.gpu.enabled | bool | `false` | |
3738
| kbs.publicKey | string | `"secret/data/hub/kbsPublicKey"` | |
3839
| kbs.secretResources[0].key | string | `"secret/data/hub/kbsres1"` | |
3940
| kbs.secretResources[0].name | string | `"kbsres1"` | |

‎templates/attestation-policy.yaml‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,78 @@ data:
5353
5454
configuration := 2 if {
5555
input["az-tdx-vtpm"]
56-
}
56+
}
57+
58+
##### Baremetal TDX
59+
executables := 3 if {
60+
input["tdx"]
61+
input.init_data in query_reference_value("init_data")
62+
}
63+
hardware := 2 if { input["tdx"] }
64+
configuration := 2 if { input["tdx"] }
65+
66+
##### Baremetal SNP
67+
executables := 3 if {
68+
input["snp"]
69+
input.init_data in query_reference_value("init_data")
70+
}
71+
hardware := 2 if { input["snp"] }
72+
configuration := 2 if { input["snp"] }
73+
{{- if .Values.kbs.gpu.enabled }}
74+
75+
##### GPU Attestation (NVIDIA H100/H200) — CPU-class evidence with GPU data
76+
hardware := 2 if {
77+
input["snp"]
78+
input["gpu"]
79+
}
80+
81+
executables := 3 if {
82+
input["snp"]
83+
input["gpu"]
84+
input.init_data in query_reference_value("init_data")
85+
}
86+
87+
configuration := 2 if {
88+
input["snp"]
89+
input["gpu"]
90+
}
91+
{{- end }}
92+
{{- if .Values.kbs.gpu.enabled }}
93+
default_gpu.rego: |
94+
package policy
95+
96+
import rego.v1
97+
98+
default hardware := 97
99+
default executables := 33
100+
default configuration := 36
101+
102+
trust_claims := {
103+
"executables": executables,
104+
"hardware": hardware,
105+
"configuration": configuration,
106+
}
107+
108+
hardware := 2 if {
109+
input.nvidia
110+
input.nvidia["x-nvidia-gpu-attestation-report-cert-chain"]["x-nvidia-cert-status"] == "valid"
111+
input.nvidia["x-nvidia-gpu-attestation-report-parsed"]
112+
input.nvidia["x-nvidia-gpu-attestation-report-signature-verified"]
113+
input.nvidia["x-nvidia-gpu-arch-check"]
114+
}
115+
116+
configuration := 2 if {
117+
input.nvidia.secboot
118+
input.nvidia.dbgstat == "disabled"
119+
}
120+
121+
executables := 3 if {
122+
input.nvidia["x-nvidia-gpu-driver-rim-fetched"]
123+
input.nvidia["x-nvidia-gpu-driver-rim-schema-validated"]
124+
input.nvidia["x-nvidia-gpu-driver-rim-signature-verified"]
125+
input.nvidia["x-nvidia-gpu-vbios-rim-fetched"]
126+
input.nvidia["x-nvidia-gpu-vbios-rim-schema-validated"]
127+
input.nvidia["x-nvidia-gpu-vbios-rim-signature-verified"]
128+
input.nvidia.measres == "success"
129+
}
130+
{{- end }}

‎templates/kbs-config-map.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ data:
5252
[attestation_service.rvps_config.storage]
5353
type = "LocalJson"
5454
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
55+
{{- if .Values.kbs.gpu.enabled }}
56+
57+
[attestation_service.verifier_config.nvidia_verifier]
58+
type = "Remote"
59+
{{- end }}
5560
5661
[[plugins]]
5762
name = "resource"

‎templates/resource-policy.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,15 @@ data:
1212
import rego.v1
1313
1414
default allow := false
15+
{{- if not .Values.kbs.gpu.enabled }}
1516
1617
allow if {
1718
input["submods"]["cpu0"]["ear.status"] == "affirming"
18-
}
19+
}
20+
{{- else }}
21+
22+
allow if {
23+
input["submods"]["cpu0"]["ear.status"] == "affirming"
24+
input["submods"]["gpu0"]["ear.status"] == "affirming"
25+
}
26+
{{- end }}

‎templates/rvps-values-policies.yaml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,29 @@ spec:
2121
object-templates-raw: |
2222
{{`{{- $pcr8Hash := fromConfigMap "imperative" "initdata" "PCR8_HASH" -}}`}}
2323
{{`{{- $debugPcr8Hash := fromConfigMap "imperative" "debug-initdata" "PCR8_HASH" -}}`}}
24-
{{`{{- $secretData := (lookup "v1" "Secret" "trustee-operator-system" "pcr-stash").data.json | base64dec | fromJson -}}`}}
24+
{{`{{- $rawHash := fromConfigMap "imperative" "initdata" "RAW_HASH" -}}`}}
25+
{{`{{- $debugRawHash := fromConfigMap "imperative" "debug-initdata" "RAW_HASH" -}}`}}
26+
{{`{{- $rawHashPadded := printf "%s00000000000000000000000000000000" $rawHash -}}`}}
27+
{{`{{- $debugRawHashPadded := printf "%s00000000000000000000000000000000" $debugRawHash -}}`}}
28+
{{`{{- $referenceValues := list (dict "name" "init_data" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash $rawHashPadded $debugRawHashPadded)) -}}`}}
29+
{{`{{- $pcrStash := (lookup "v1" "Secret" "trustee-operator-system" "pcr-stash") -}}`}}
30+
{{`{{- if $pcrStash -}}`}}
31+
{{`{{- $secretData := $pcrStash.data.json | base64dec | fromJson -}}`}}
2532
{{`{{- $pcr03 := $secretData.measurements.sha256.pcr03 -}}`}}
2633
{{`{{- $pcr09 := $secretData.measurements.sha256.pcr09 -}}`}}
2734
{{`{{- $pcr11 := $secretData.measurements.sha256.pcr11 -}}`}}
2835
{{`{{- $pcr12 := $secretData.measurements.sha256.pcr12 -}}`}}
29-
{{`{{- $referenceValues := list (dict "name" "snp_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) (dict "name" "tdx_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) (dict "name" "snp_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) (dict "name" "tdx_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) (dict "name" "snp_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) (dict "name" "tdx_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) (dict "name" "snp_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) (dict "name" "tdx_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) (dict "name" "snp_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) (dict "name" "tdx_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) -}}`}}
36+
{{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) -}}`}}
37+
{{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr03" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr03)) -}}`}}
38+
{{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) -}}`}}
39+
{{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr08" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr8Hash $debugPcr8Hash)) -}}`}}
40+
{{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) -}}`}}
41+
{{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr09" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr09)) -}}`}}
42+
{{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) -}}`}}
43+
{{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr11" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr11)) -}}`}}
44+
{{`{{- $referenceValues = append $referenceValues (dict "name" "snp_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) -}}`}}
45+
{{`{{- $referenceValues = append $referenceValues (dict "name" "tdx_pcr12" "expiration" "2027-12-12T00:00:00Z" "value" (list $pcr12)) -}}`}}
46+
{{`{{- end -}}`}}
3047
- complianceType: mustonlyhave
3148
objectDefinition:
3249
apiVersion: v1

‎templates/tdx-config.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ metadata:
99
data:
1010
sgx_default_qcnl.conf: |
1111
{
12-
"collateral_service": "{{ .Values.kbs.tdx.collateralService }}"
12+
"collateral_service": "{{ .Values.kbs.tdx.collateralService }}",
13+
"use_secure_cert": false
1314
}
1415
{{- end }}

‎values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ kbs:
4848
# exist in the trustee-operator-system namespace.
4949
extraSecrets: []
5050

51+
# NVIDIA GPU confidential computing configuration
52+
gpu:
53+
enabled: false
54+
5155
# Intel TDX (Trust Domain Extensions) configuration
5256
tdx:
5357
# Enable TDX attestation support

0 commit comments

Comments
 (0)