Run SGX in HW mode in k8s

[csegarragonz]

In this PR I Introduce the necessary changes to allow running SGX functions in hardware mode in a kubernetes cluster. Most importantly, we need to build different image tags for workers with a hardware-mode SGX build.

In addition, when deploying the KNative services we need to: use the new worker docker image, and set the environment variable WASM_VM=sgx for both the upload and worker pods.
For the upload service, we can either use templated deployment files/env. var substitution or have separate deployment files. For the worker service I think we need a different file, as we have to add sgx-specific reources and we may have to add further options in the worker deployment file for attestation.

I have manually checked that with the current setup, and deploying as follows, we can run SGX functions in HW mode in AKS:

cd ~/experiment-base
inv cluster.provision --vm Standard_DC4s_v3 --nodes 4 --location eastus2 --sgx
inv cluster.credentials

cd ~/faasm
inv knative.install # run twice
inv knative.deploy --replicas=4 --sgx

inv upload demo hello <path_to_wasm>
inv invoke demo hello

I also bump the code version to test the new "Release" workflow file.

[csegarragonz]

If FAASM_SGX_MODE is not set, use Simulation, if it is set, use ${FAASM_SGX_MODE}. Link to bash wiki..

[Shillaker]

Usually don't need to link to syntax in a PR unless it's some obscure library that you're introducing.

[csegarragonz]

I always get confused with bash variable's expansion, so added the link and the explanation more for me than for you 🤣

[csegarragonz]

This file is a copy of deploy/k8s/upload.yml with just one extra environment variable.

[Shillaker]

Rather than mixing these in the same directory I feel like having a totally separate deploy/k8s-sgx directory would be cleaner, then we avoid all the filtering logic in Python. Anything that's shared between vanilla and SGX would go into another new directory, deploy/k8s-common.

[csegarragonz]

I agree this is cleaner. We now have: deploy/{k8s-common,k8s-sgx,k8s}.

[Shillaker]

This file is getting quite long and verbose, we could redo this with a matrix build like we do the tests. Doesn't need to be in this PR but will add to the todo list.

[Shillaker]

Rather than mixing these in the same directory I feel like having a totally separate deploy/k8s-sgx directory would be cleaner, then we avoid all the filtering logic in Python. Anything that's shared between vanilla and SGX would go into another new directory, deploy/k8s-common.

[Shillaker]

Usually don't need to link to syntax in a PR unless it's some obscure library that you're introducing.

[Shillaker]

Nice, looks good.

Can you triple check that running inv version.bump still works across all the k8s files? Looks like the task does whatever it finds in deploy, but just want to make sure.

[Shillaker]

@csegarragonz I think this is now a duplicate of what's in upload-lb.yml. Missed it in my review.

[csegarragonz]

good catch, thanks. i copied the file before removing this 😓