coco docs: clarify platforms page and agent policy - #479
Conversation
Documentation preview |
mikemckiernan
left a comment
mikemckiernan
left a comment
There was a problem hiding this comment.
A few nits, PLMK if I'm within horseshoe and hand-grenade distance.
4906897 to
2e9ee25
Compare
|
New revision with PR comments addressed: https://github.com/NVIDIA/cloud-native-docs/compare/490689733d40bb10003288e0e37eb888ac59668a..2e9ee2527e2445e280d6cf5a3907d90072368dc6 |
2e9ee25 to
34eea2d
Compare
|
@fitzthum - one more change intended to streamline agent policy + attestation in a better way: https://github.com/NVIDIA/cloud-native-docs/compare/2e9ee2527e2445e280d6cf5a3907d90072368dc6..34eea2df421ecca92ab169c4ed9e940e99429ce1 - maybe better to read the PR again instead though. |
mikemckiernan
left a comment
mikemckiernan
left a comment
There was a problem hiding this comment.
/lgtm
I opened this PR, so GH won't allow me to approve, but I'd approve. lmk if there's anything else you need from me.
Rename the supported platforms page to include software components, and document attaching a Kata agent security policy for attested production workloads. Signed-off-by: Manuel Huber <manuelh@nvidia.com>
34eea2d to
34e229e
Compare
manuelh-dev
left a comment
manuelh-dev
left a comment
There was a problem hiding this comment.
Thanks @mikemckiernan
dcmiddle
left a comment
dcmiddle
left a comment
There was a problem hiding this comment.
Good updates. A couple nits and an upstream link suggestion.
| ********** | ||
|
|
||
| * Refer to :doc:`Attestation <attestation>` for Trustee concepts and a local connectivity test. | ||
| A complete attestation process should cover the Kata Agent API surface as well as the TEE. |
There was a problem hiding this comment.
| A complete attestation process should cover the Kata Agent API surface as well as the TEE. | |
| A complete attestation policy should cover the Kata Agent API surface as well as the TEE. |
| The agent security policy is distinct from the Trustee attestation policy that decides whether | ||
| to release secrets. |
There was a problem hiding this comment.
I don't know an easier way to phrase this but there are 3 policies. Their interrelation is captured upstream here:
https://confidentialcontainers.org/docs/getting-started/securing-workloads/#understanding-coco-policies
|
|
||
| $ kubectl delete -f multi-gpu-kata.yaml | ||
|
|
||
| .. _coco-agent-security-policy: |
There was a problem hiding this comment.
nit: any reason this tag is coco-agent instead of kata-agent?
not a big deal since this string doesn't appear to the user, but it could confound refactoring in the future
3 participants
Rename the supported platforms page to include software components, and document attaching a Kata agent security policy for attested production workloads.