Integrate KBS API#2
Open
iroykaufman wants to merge 7 commits into
Open
Conversation
Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
Add kbs-client and sync reference values to KBS using the admin API. Introduce TRUSTEE_RV_MAP ConfigMap, trustee deployment sync controller, and remove file-based RVPS storage. note: 1. Admin access is currently set to insecure, but this will be updated in later commits. This temporary setup simplifies development, as the mechanism changed slightly between v0.17.0 and v0.20.0. 2. The ring dependency will be removed in a future commit when bumping to v0.20.0, as a native TLS version is available. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
Send resource.rego to KBS via the admin API instead of mounting it as a file in the trustee deployment. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
Send tpm.rego to KBS via the admin API. Remove the attestation-policy ConfigMap and its volume mount from the trustee deployment. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
Upgrade Trustee to v0.20.0 with JWT-authenticated admin API. Replace volume-based secret mounting with send_secret/delete_secret, and register attestation keys via the KBS API. note: I removed several irrelevant unit tests, and I will add tests for the new functions in a future commit. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
test_luks_key_sync - verify the initial LUKS key upload, re-sync after trustee restart, and LUKS key deletion on machine removal. test_attestation_key_sync - verify that attestation keys are registered with the KBS and re-registered after trustee restarts. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
Tested functions: - sync_all_machine_luks_key - update_attestation_keys Signed-off-by: Roy Kaufman <rkaufman@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.