feat: update operator CSV pins and trustee chartVersion for OSC 1.13 / Trustee 1.2

rhdp/rhdp-cluster-define.py

@@ -78,7 +78,7 @@ def cleanup(pattern_dir: pathlib.Path, cluster_configs: List[Dict]) -> None:
 def validate_dir():
     """Simple validation for directory"""
     assert pathlib.Path("values-global.yaml").exists()
-    assert pathlib.Path("values-simple.yaml").exists()
+    assert pathlib.Path("values-azure.yaml").exists()
 
 
 def setup_install(

rhdp/wrapper.sh

@@ -97,14 +97,14 @@ fi
 # Extract clusterGroupName from values-global.yaml using yq
 CLUSTER_GROUP_NAME=$(yq eval '.main.clusterGroupName' values-global.yaml)
 
-if [ "$CLUSTER_GROUP_NAME" != "simple" ]; then
+if [ "$CLUSTER_GROUP_NAME" != "azure" ]; then
     echo "ERROR: Incorrect clusterGroupName configuration"
-    echo "Expected: simple"
+    echo "Expected: azure"
     echo "Found: $CLUSTER_GROUP_NAME"
     echo ""
     echo "Please update values-global.yaml:"
     echo "  main:"
-    echo "    clusterGroupName: simple"
+    echo "    clusterGroupName: azure"
     exit 1
 fi
 
@@ -189,7 +189,7 @@ bash ./scripts/gen-secrets.sh
 echo "---------------------"
 echo "retrieving PCR measurements"
 echo "---------------------"
-bash ./scripts/collect-firmware-refvals.sh --platform azure
+bash ./scripts/collect-firmware-refvals.sh --platform azure --tee snp
 
 sleep 60
 echo "---------------------"

scripts/collect-firmware-refvals.sh

@@ -28,7 +28,7 @@ PULL_SECRET="${HOME}/pull-secret.json"
 OCP_VERSION=""
 OSC_VERSION=""
 TEE="tdx"
-CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:1.12"
+CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:0.5.1"
 
 # Parse arguments
 while [[ $# -gt 0 ]]; do
@@ -117,7 +117,7 @@ if [ "$PLATFORM" = "azure" ]; then
             OSC_VERSION="latest"
         fi
     fi
-    VERSION_ARGS="--osc-version $OSC_VERSION"
+    VERSION_ARGS="--image-tag $OSC_VERSION"
     VERSION_DISPLAY="OSC $OSC_VERSION"
 else
     if [ -z "$OCP_VERSION" ]; then

scripts/gen-secrets.sh

@@ -4,8 +4,6 @@ echo "Creating secrets as required"
 echo
 
 COCO_SECRETS_DIR="${HOME}/.coco-pattern"
-KBS_PRIVATE_KEY="${COCO_SECRETS_DIR}/kbsPrivateKey"
-KBS_PUBLIC_KEY="${COCO_SECRETS_DIR}/kbsPublicKey"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 VALUES_FILE="${HOME}/values-secret-coco-pattern.yaml"
 
@@ -21,11 +19,20 @@ if [ "${COCO_ENABLE_SSH_DEBUG:-false}" = "true" ]; then
 	fi
 fi
 
-if [ ! -f "${KBS_PRIVATE_KEY}" ]; then
-	echo "Creating kbs keys"
-	rm -f "${KBS_PUBLIC_KEY}"
-	openssl genpkey -algorithm ed25519 >${KBS_PRIVATE_KEY}
-	openssl pkey -in "${KBS_PRIVATE_KEY}" -pubout -out "${KBS_PUBLIC_KEY}"
+## JWK signing key for sealed secrets (P-256 EC key)
+JWK_SIGNING_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing.jwk"
+JWK_PUBLIC_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing-pub.jwk"
+
+if [ ! -f "${JWK_SIGNING_KEY}" ]; then
+	if command -v jose >/dev/null 2>&1; then
+		echo "Creating sealed secrets JWK signing key (P-256 EC) using jose"
+		jose jwk gen -i '{"alg":"ES256","kid":"coco-signing-key","use":"sig"}' -o "${JWK_SIGNING_KEY}"
+		jose jwk pub -i "${JWK_SIGNING_KEY}" -o "${JWK_PUBLIC_KEY}"
+	else
+		echo "ERROR: jose CLI not found. Install with: sudo dnf install jose"
+		echo "The jose package is available in rhel-10-for-x86_64-appstream-rpms"
+		exit 1
+	fi
 fi
 
 ## PCCS secrets for bare metal Intel TDX deployments

values-azure-spoke.yaml

@@ -74,11 +74,17 @@ clusterGroup:
       project: workloads
       path: charts/coco-supported/hello-openshift
 
-    kbs-access:
-      name: kbs-access
+    kbs-access-curl:
+      name: kbs-access-curl
       namespace: kbs-access
       project: workloads
-      path: charts/coco-supported/kbs-access
+      path: charts/coco-supported/kbs-access-curl
+
+    kbs-access-sealed:
+      name: kbs-access-sealed
+      namespace: kbs-access
+      project: workloads
+      path: charts/coco-supported/kbs-access-sealed
 
   imperative:
     jobs:

values-azure.yaml

@@ -36,13 +36,13 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.12.0
+      csv: sandboxed-containers-operator.v1.13.0
     trustee:
       name: trustee-operator
       namespace: trustee-operator-system
       channel: stable
       installPlanApproval: Manual
-      csv: trustee-operator.v1.1.0
+      csv: trustee-operator.v1.2.0
     cert-manager:
       name: openshift-cert-manager-operator
       namespace: cert-manager-operator
@@ -86,8 +86,9 @@ clusterGroup:
       name: trustee
       namespace: trustee-operator-system
       project: trustee
-      chart: trustee
-      chartVersion: 0.8.*
+      repoURL: https://github.com/butler54/trustee-chart.git
+      targetRevision: dev/osc-1.13-upgrade
+      path: .
       extraValueFiles:
         - '/overrides/values-trustee.yaml'
       overrides:
@@ -119,11 +120,20 @@ clusterGroup:
         automated:
           prune: true
 
-    kbs-access:
-      name: kbs-access
+    kbs-access-curl:
+      name: kbs-access-curl
       namespace: kbs-access
       project: workloads
-      path: charts/coco-supported/kbs-access
+      path: charts/coco-supported/kbs-access-curl
+      syncPolicy:
+        automated:
+          prune: true
+
+    kbs-access-sealed:
+      name: kbs-access-sealed
+      namespace: kbs-access
+      project: workloads
+      path: charts/coco-supported/kbs-access-sealed
       syncPolicy:
         automated:
           prune: true

values-baremetal.yaml

@@ -41,15 +41,15 @@ clusterGroup:
       namespace: openshift-sandboxed-containers-operator
       channel: stable
       installPlanApproval: Manual
-      csv: sandboxed-containers-operator.v1.12.0
+      csv: sandboxed-containers-operator.v1.13.0
       annotations:
         argocd.argoproj.io/sync-wave: "10"
     trustee:
       name: trustee-operator
       namespace: trustee-operator-system
       channel: stable
       installPlanApproval: Manual
-      csv: trustee-operator.v1.1.0
+      csv: trustee-operator.v1.2.0
       annotations:
         argocd.argoproj.io/sync-wave: "10"
     cert-manager:
@@ -163,17 +163,16 @@ clusterGroup:
       project: trustee
       annotations:
         argocd.argoproj.io/sync-wave: "20"
-      chart: trustee
-      chartVersion: 0.8.*
+      repoURL: https://github.com/butler54/trustee-chart.git
+      targetRevision: dev/osc-1.13-upgrade
+      path: .
       extraValueFiles:
         - '/overrides/values-trustee.yaml'
       overrides:
         - name: global.coco.secured
           value: "true"
         - name: kbs.tdx.enabled
           value: "true"
-        - name: kbs.tdx.collateralService
-          value: "https://pccs-service.intel-dcap.svc.cluster.local:8042/sgx/certification/v4/"
         - name: kbs.gpu.enabled
           value: "true"
         - name: kbs.baremetal.enabled

values-secret.yaml.template

@@ -11,23 +11,6 @@ secrets:
   # Core KBS Secrets (Always Required)
   # ===================================================================
 
-  # KBS public key - used by workloads to verify KBS identity
-  - name: kbsPublicKey
-    vaultPrefixes:
-    - hub
-    fields:
-    - name: publicKey
-      path: ~/.coco-pattern/kbsPublicKey
-
-  # KBS private key - used by KBS to sign responses
-  # Generated by gen-secrets.sh alongside kbsPublicKey
-  - name: kbsPrivateKey
-    vaultPrefixes:
-    - global
-    fields:
-    - name: privateKey
-      path: ~/.coco-pattern/kbsPrivateKey
-
   # Auto-generated test secrets provided by KBS
   - name: kbsres1
     vaultPrefixes:
@@ -168,6 +151,17 @@ secrets:
           }
         }
 
+  # JWK signing key for sealed secrets
+  # The public key is provisioned to KBS for signature verification.
+  # The private key stays local and is used to create sealed secrets.
+  # Generated by: ./scripts/gen-secrets.sh (requires jose CLI)
+  - name: sealedSecretsSigningKey
+    vaultPrefixes:
+    - hub
+    fields:
+    - name: public
+      path: ~/.coco-pattern/sealed-secrets-signing-pub.jwk
+
   # Sigstore public keys for Red Hat container signature verification
   # Red Hat release key 3 (used for sigstore signatures as of Oct 2024)
   - name: sigstore-keys

values-trusted-hub.yaml

@@ -31,7 +31,7 @@ clusterGroup:
       namespace: trustee-operator-system
       channel: stable
       installPlanApproval: Manual
-      csv: trustee-operator.v1.1.0
+      csv: trustee-operator.v1.2.0
     cert-manager:
       name: openshift-cert-manager-operator
       namespace: cert-manager-operator
@@ -77,7 +77,7 @@ clusterGroup:
       namespace: trustee-operator-system
       project: trustee
       chart: trustee
-      chartVersion: 0.8.*
+      chartVersion: 0.9.*
       extraValueFiles:
         - '/overrides/values-trustee.yaml'
       overrides: