diff --git a/ansible/initdata-debug.toml.tpl b/ansible/initdata-debug.toml.tpl index a463c3b2..65ea6302 100644 --- a/ansible/initdata-debug.toml.tpl +++ b/ansible/initdata-debug.toml.tpl @@ -24,6 +24,10 @@ kbs_cert = """{{ trustee_cert }}""" [image] image_security_policy_uri = 'kbs:///default/security-policy/{{ security_policy_flavour }}' +# On baremetal (kata), CDH fetches this credential from KBS to authenticate +# with container registries inside the CVM. On Azure peer-pods (kata-remote), +# CDH does NOT use this URI — registry auth is handled via imagePullSecrets +# on the workload's service account instead. Kept here for baremetal support. authenticated_registry_credentials_uri = 'kbs:///default/credential/regcred' ''' diff --git a/ansible/initdata-default.toml.tpl b/ansible/initdata-default.toml.tpl index daf579bf..d66cdcf7 100644 --- a/ansible/initdata-default.toml.tpl +++ b/ansible/initdata-default.toml.tpl @@ -24,6 +24,10 @@ kbs_cert = """{{ trustee_cert }}""" [image] image_security_policy_uri = 'kbs:///default/security-policy/{{ security_policy_flavour }}' +# On baremetal (kata), CDH fetches this credential from KBS to authenticate +# with container registries inside the CVM. On Azure peer-pods (kata-remote), +# CDH does NOT use this URI — registry auth is handled via imagePullSecrets +# on the workload's service account instead. Kept here for baremetal support. authenticated_registry_credentials_uri = 'kbs:///default/credential/regcred' ''' diff --git a/rhdp/rhdp-cluster-define.py b/rhdp/rhdp-cluster-define.py index b65cb4b3..ddc9ed00 100644 --- a/rhdp/rhdp-cluster-define.py +++ b/rhdp/rhdp-cluster-define.py @@ -78,7 +78,7 @@ def cleanup(pattern_dir: pathlib.Path, cluster_configs: List[Dict]) -> None: def validate_dir(): """Simple validation for directory""" assert pathlib.Path("values-global.yaml").exists() - assert pathlib.Path("values-simple.yaml").exists() + assert pathlib.Path("values-azure.yaml").exists() def setup_install( diff --git a/rhdp/wrapper.sh b/rhdp/wrapper.sh index 6c6cc539..1016174c 100755 --- a/rhdp/wrapper.sh +++ b/rhdp/wrapper.sh @@ -97,14 +97,14 @@ fi # Extract clusterGroupName from values-global.yaml using yq CLUSTER_GROUP_NAME=$(yq eval '.main.clusterGroupName' values-global.yaml) -if [ "$CLUSTER_GROUP_NAME" != "simple" ]; then +if [ "$CLUSTER_GROUP_NAME" != "azure" ]; then echo "ERROR: Incorrect clusterGroupName configuration" - echo "Expected: simple" + echo "Expected: azure" echo "Found: $CLUSTER_GROUP_NAME" echo "" echo "Please update values-global.yaml:" echo " main:" - echo " clusterGroupName: simple" + echo " clusterGroupName: azure" exit 1 fi @@ -189,7 +189,7 @@ bash ./scripts/gen-secrets.sh echo "---------------------" echo "retrieving PCR measurements" echo "---------------------" -bash ./scripts/collect-firmware-refvals.sh --platform azure +bash ./scripts/collect-firmware-refvals.sh --platform azure --tee snp sleep 60 echo "---------------------" diff --git a/scripts/collect-firmware-refvals.sh b/scripts/collect-firmware-refvals.sh index 708cf40d..d4356cde 100755 --- a/scripts/collect-firmware-refvals.sh +++ b/scripts/collect-firmware-refvals.sh @@ -28,7 +28,7 @@ PULL_SECRET="${HOME}/pull-secret.json" OCP_VERSION="" OSC_VERSION="" TEE="tdx" -CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:1.12" +CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:0.5.1" # Parse arguments while [[ $# -gt 0 ]]; do @@ -117,7 +117,7 @@ if [ "$PLATFORM" = "azure" ]; then OSC_VERSION="latest" fi fi - VERSION_ARGS="--osc-version $OSC_VERSION" + VERSION_ARGS="--image-tag $OSC_VERSION" VERSION_DISPLAY="OSC $OSC_VERSION" else if [ -z "$OCP_VERSION" ]; then diff --git a/scripts/gen-secrets.sh b/scripts/gen-secrets.sh index 16c35807..32d04187 100755 --- a/scripts/gen-secrets.sh +++ b/scripts/gen-secrets.sh @@ -4,8 +4,6 @@ echo "Creating secrets as required" echo COCO_SECRETS_DIR="${HOME}/.coco-pattern" -KBS_PRIVATE_KEY="${COCO_SECRETS_DIR}/kbsPrivateKey" -KBS_PUBLIC_KEY="${COCO_SECRETS_DIR}/kbsPublicKey" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" VALUES_FILE="${HOME}/values-secret-coco-pattern.yaml" @@ -21,11 +19,20 @@ if [ "${COCO_ENABLE_SSH_DEBUG:-false}" = "true" ]; then fi fi -if [ ! -f "${KBS_PRIVATE_KEY}" ]; then - echo "Creating kbs keys" - rm -f "${KBS_PUBLIC_KEY}" - openssl genpkey -algorithm ed25519 >${KBS_PRIVATE_KEY} - openssl pkey -in "${KBS_PRIVATE_KEY}" -pubout -out "${KBS_PUBLIC_KEY}" +## JWK signing key for sealed secrets (P-256 EC key) +JWK_SIGNING_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing.jwk" +JWK_PUBLIC_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing-pub.jwk" + +if [ ! -f "${JWK_SIGNING_KEY}" ]; then + if command -v jose >/dev/null 2>&1; then + echo "Creating sealed secrets JWK signing key (P-256 EC) using jose" + jose jwk gen -i '{"alg":"ES256","kid":"coco-signing-key","use":"sig"}' -o "${JWK_SIGNING_KEY}" + jose jwk pub -i "${JWK_SIGNING_KEY}" -o "${JWK_PUBLIC_KEY}" + else + echo "ERROR: jose CLI not found. Install with: sudo dnf install jose" + echo "The jose package is available in rhel-10-for-x86_64-appstream-rpms" + exit 1 + fi fi ## PCCS secrets for bare metal Intel TDX deployments diff --git a/values-azure-spoke.yaml b/values-azure-spoke.yaml index 43cd34d9..ceb6252f 100644 --- a/values-azure-spoke.yaml +++ b/values-azure-spoke.yaml @@ -74,11 +74,17 @@ clusterGroup: project: workloads path: charts/coco-supported/hello-openshift - kbs-access: - name: kbs-access + kbs-access-curl: + name: kbs-access-curl namespace: kbs-access project: workloads - path: charts/coco-supported/kbs-access + path: charts/coco-supported/kbs-access-curl + + kbs-access-sealed: + name: kbs-access-sealed + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-sealed imperative: jobs: diff --git a/values-azure.yaml b/values-azure.yaml index 48c5d703..9bf6ffa5 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -36,13 +36,13 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 trustee: name: trustee-operator namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -87,7 +87,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: @@ -104,7 +104,7 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator project: sandbox chart: sandboxed-policies - chartVersion: 0.2.* + chartVersion: 0.3.* overrides: - name: global.coco.azure.tags value: "key1=value1,key2=value2" @@ -119,11 +119,20 @@ clusterGroup: automated: prune: true - kbs-access: - name: kbs-access + kbs-access-curl: + name: kbs-access-curl + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-curl + syncPolicy: + automated: + prune: true + + kbs-access-sealed: + name: kbs-access-sealed namespace: kbs-access project: workloads - path: charts/coco-supported/kbs-access + path: charts/coco-supported/kbs-access-sealed syncPolicy: automated: prune: true diff --git a/values-baremetal.yaml b/values-baremetal.yaml index 0d037ace..9d984cac 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -41,7 +41,7 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 annotations: argocd.argoproj.io/sync-wave: "10" trustee: @@ -49,7 +49,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 annotations: argocd.argoproj.io/sync-wave: "10" cert-manager: @@ -164,7 +164,7 @@ clusterGroup: annotations: argocd.argoproj.io/sync-wave: "20" chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: @@ -172,8 +172,6 @@ clusterGroup: value: "true" - name: kbs.tdx.enabled value: "true" - - name: kbs.tdx.collateralService - value: "https://pccs-service.intel-dcap.svc.cluster.local:8042/sgx/certification/v4/" - name: kbs.gpu.enabled value: "true" - name: kbs.baremetal.enabled diff --git a/values-secret.yaml.template b/values-secret.yaml.template index 1afb92d0..a0671453 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -11,23 +11,6 @@ secrets: # Core KBS Secrets (Always Required) # =================================================================== - # KBS public key - used by workloads to verify KBS identity - - name: kbsPublicKey - vaultPrefixes: - - hub - fields: - - name: publicKey - path: ~/.coco-pattern/kbsPublicKey - - # KBS private key - used by KBS to sign responses - # Generated by gen-secrets.sh alongside kbsPublicKey - - name: kbsPrivateKey - vaultPrefixes: - - global - fields: - - name: privateKey - path: ~/.coco-pattern/kbsPrivateKey - # Auto-generated test secrets provided by KBS - name: kbsres1 vaultPrefixes: @@ -168,6 +151,17 @@ secrets: } } + # JWK signing key for sealed secrets + # The public key is provisioned to KBS for signature verification. + # The private key stays local and is used to create sealed secrets. + # Generated by: ./scripts/gen-secrets.sh (requires jose CLI) + - name: sealedSecretsSigningKey + vaultPrefixes: + - hub + fields: + - name: public + path: ~/.coco-pattern/sealed-secrets-signing-pub.jwk + # Sigstore public keys for Red Hat container signature verification # Red Hat release key 3 (used for sigstore signatures as of Oct 2024) - name: sigstore-keys diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml index a54f1a48..4037e9af 100644 --- a/values-trusted-hub.yaml +++ b/values-trusted-hub.yaml @@ -31,7 +31,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -77,7 +77,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: