docs: provide a guide for how to use IBM Secure Execution #7146

BbolroC · 2023-06-20T11:44:37Z

This PR is to add a document for how to run kata containers under IBM Secure Execution environment.

Signed-off-by: Hyounggyu Choi Hyounggyu.Choi@ibm.com

stevenhorsman · 2023-06-20T15:52:46Z

Hey Choi this is failing with the error:
ERROR: Document docs/how-to/how-to-run-kata-containers-with-SE-VMs.md is not referenced, so I would suggest adding a link to the doc in docs/how-to/README.md

stevenhorsman

Just a thought - I wonder if the CoCo operator section would be better off in the coco documentation. Maybe as a new entry in https://github.com/confidential-containers/documentation/tree/main/guides like sev has? It might be more appropriate to document/link to the kata-deploy in this doc?

BbolroC · 2023-06-20T17:56:35Z

Just a thought - I wonder if the CoCo operator section would be better off in the coco documentation. Maybe as a new entry in https://github.com/confidential-containers/documentation/tree/main/guides like sev has? It might be more appropriate to document/link to the kata-deploy in this doc?

Yeah, I will let you know after discussing what you mentioned with @hbrueckner . Thanks! 😉

BbolroC · 2023-06-21T06:17:41Z

@hbrueckner I have relocated the section for CC operator in confidential-containers/documentation#133 and made this document refer to the kata-deploy.

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

hbrueckner

Hi @BbolroC ,

thanks for this excellent documentation. I have only a few edits and remarks to follow-up. Thanks a lot!

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

NicoBoehrIBM

Besides one small nit, LGTM

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

hbrueckner

just two minor edits

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

wainersm

Hi @BbolroC, this doc helped me to understand some decisions you took on #6755 so helped me on the review too!

BbolroC · 2024-01-22T09:01:14Z

For reviewers, you can find the referred documentation in the section Using Kata-Deploy with Confidential Containers Operator at confidential-containers/operator#329

stevenhorsman · 2024-01-22T11:41:26Z

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

+metadata:
+  name: nginx-kata
+spec:
+  runtimeClassName: kata-qemu


Hi Choi, this is probably a stupid question, but where does kata-qemu-se runtimeClass come into use over kata-qemu. Is it just when using kata-deploy rather than the manual approach as the other runtime class hasn't been created?

The document starts with an assumption that kata container is installed. It would be good to have how to generate a new runtime class like kata-qemu-se to the doc, but I just wanted to make it focus on explaining how to run a kata container on IBM Z SE based on the basic setup.

And yes, you are right, a runtime class kata-qemu-se is introduced in the doc for confidential containers. 😉

BbolroC · 2024-01-22T13:46:49Z

https://github.com/kata-containers/kata-containers/actions/runs/7585438489/job/20661329265?pr=7146 will be resolved when confidential-containers/operator#329 is merged.

stevenhorsman

I don't have a spare z16 LPAR to test on, but I've read through the documentation and it looks good to me. Thanks!

hbrueckner · 2024-01-23T13:32:16Z

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

+If any of the results are not identifiable, please reach out to the responsible cloud
+provider to enable the Secure Execution capability. Alternatively, if you possess
+administrative privileges and the facility bit is set, you can enable the Secure Execution
+capability by adding `prot_virt=1` to the kernel parameters and performing a system reboot with:


minor: ...performing a system reboot_, for example,_ with:....

The example is using the zipl.conf directly... there are meanwhile zipl support for BLS which need to be differently configured. So just make this as an example, as distros might vary.

Thanks for the feedback. The document has been updated.

hbrueckner · 2024-01-23T13:39:27Z

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

+resource `ccruntime` for confidential containers, enabling the operator to install Kata
+binary artifacts such as kernel, shim-v2, and more.
+
+In this section, we will specifically guide you on building a payload image


minor: remove "we" and use "you will learn" or "This section explains how" / "This section guides you through....."

Thanks for the feedback. The document has been updated.

hbrueckner · 2024-01-23T13:41:14Z

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md

+## Considerations for CI
+
+If you intend to integrate the aforementioned procedure with a CI system, it is
+recommended to configure the following setup for an environment variable.


minor: remove "it is recommended" and simply use "configure"

Thanks for the feedback. The document has been updated.

hbrueckner

Hi Choi,
thanks a lot for pulling this excellent guide together. I have only really minor remarks/edits that should not hold back any approval.

/approve

This PR is to add a document for how to run kata containers under IBM Secure Execution environment. Fixes: kata-containers#7025 Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>

BbolroC · 2024-01-23T21:06:05Z

/test

BbolroC requested a review from a team as a code owner June 20, 2023 11:44

BbolroC added the no-backport-needed label Jun 20, 2023

katacontainersbot added the size/large Task of significant size label Jun 20, 2023

stevenhorsman reviewed Jun 20, 2023

View reviewed changes

BbolroC force-pushed the ibm-se-howto-doc branch from 16e74af to bcc1487 Compare June 21, 2023 06:14

BbolroC force-pushed the ibm-se-howto-doc branch from bcc1487 to 5819968 Compare June 21, 2023 08:45

zvonkok reviewed Jun 21, 2023

View reviewed changes

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

BbolroC force-pushed the ibm-se-howto-doc branch from 5819968 to aca7d7b Compare June 21, 2023 17:09

hbrueckner reviewed Jun 22, 2023

View reviewed changes

BbolroC force-pushed the ibm-se-howto-doc branch from aca7d7b to 5cb8fec Compare June 22, 2023 11:21

BbolroC changed the title ~~WIP docs: provide a guide for how to use IBM SE~~ WIP docs: provide a guide for how to use IBM Secure Execution Jun 22, 2023

BbolroC force-pushed the ibm-se-howto-doc branch from 5cb8fec to 9ecd65d Compare June 22, 2023 14:37

katacontainersbot added size/tiny Smallest and simplest task and removed size/large Task of significant size labels Jun 22, 2023

hbrueckner reviewed Jun 22, 2023

View reviewed changes

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

BbolroC force-pushed the ibm-se-howto-doc branch from 9ecd65d to db8d18d Compare June 22, 2023 15:23

katacontainersbot added size/large Task of significant size and removed size/tiny Smallest and simplest task labels Jun 22, 2023

NicoBoehrIBM reviewed Jun 23, 2023

View reviewed changes

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Show resolved Hide resolved

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

BbolroC force-pushed the ibm-se-howto-doc branch from db8d18d to 174ad9c Compare June 23, 2023 15:09

BbolroC mentioned this pull request Jun 26, 2023

WIP docs: Add a guide for IBM SE confidential-containers/confidential-containers#101

Open

BbolroC force-pushed the ibm-se-howto-doc branch from 174ad9c to 4fe283e Compare June 26, 2023 10:43

katacontainersbot added size/tiny Smallest and simplest task and removed size/large Task of significant size labels Jun 26, 2023

BbolroC force-pushed the ibm-se-howto-doc branch from 4fe283e to 76d723a Compare June 26, 2023 10:44

NicoBoehrIBM reviewed Jun 26, 2023

View reviewed changes

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Show resolved Hide resolved

hbrueckner reviewed Jun 26, 2023

View reviewed changes

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

docs/how-to/how-to-run-kata-containers-with-SE-VMs.md Outdated Show resolved Hide resolved

BbolroC force-pushed the ibm-se-howto-doc branch 5 times, most recently from 9943080 to 9ff825a Compare June 27, 2023 05:36

BbolroC changed the title ~~WIP docs: provide a guide for how to use IBM Secure Execution~~ docs: provide a guide for how to use IBM Secure Execution Oct 23, 2023

BbolroC mentioned this pull request Oct 23, 2023

packaging: Add IBM Z SE artifacts to main #6755

Merged

wainersm approved these changes Dec 7, 2023

View reviewed changes

BbolroC mentioned this pull request Dec 18, 2023

runtime: Empty string for initrd not allowed for IBM Z Secure Execution #8692

Closed

BbolroC force-pushed the ibm-se-howto-doc branch from 9ff825a to d88af8e Compare January 19, 2024 14:44

katacontainersbot added size/large Task of significant size and removed size/tiny Smallest and simplest task labels Jan 19, 2024

BbolroC force-pushed the ibm-se-howto-doc branch from d88af8e to 88d1b01 Compare January 19, 2024 14:58

BbolroC mentioned this pull request Jan 22, 2024

doc: provide a guide for how to install CC with IBM Secure Execution confidential-containers/operator#329

Merged

stevenhorsman reviewed Jan 22, 2024

View reviewed changes

stevenhorsman approved these changes Jan 22, 2024

View reviewed changes

hbrueckner reviewed Jan 23, 2024

View reviewed changes

hbrueckner approved these changes Jan 23, 2024

View reviewed changes

BbolroC force-pushed the ibm-se-howto-doc branch 2 times, most recently from 3c5e691 to 3d8c07e Compare January 23, 2024 17:38

docs: provide a guide for how to use IBM Secure Execution

25ecca9

This PR is to add a document for how to run kata containers under IBM Secure Execution environment. Fixes: kata-containers#7025 Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>

BbolroC force-pushed the ibm-se-howto-doc branch from 3d8c07e to 25ecca9 Compare January 23, 2024 17:58

BbolroC added the ok-to-test label Jan 23, 2024

BbolroC merged commit f429068 into kata-containers:main Jan 23, 2024
286 of 295 checks passed

BbolroC deleted the ibm-se-howto-doc branch January 23, 2024 21:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: provide a guide for how to use IBM Secure Execution #7146

docs: provide a guide for how to use IBM Secure Execution #7146

BbolroC commented Jun 20, 2023 •

edited

stevenhorsman commented Jun 20, 2023

stevenhorsman left a comment

BbolroC commented Jun 20, 2023

BbolroC commented Jun 21, 2023

hbrueckner left a comment

NicoBoehrIBM left a comment

hbrueckner left a comment

wainersm left a comment

BbolroC commented Jan 22, 2024

stevenhorsman Jan 22, 2024

BbolroC Jan 22, 2024

BbolroC commented Jan 22, 2024

stevenhorsman left a comment

hbrueckner Jan 23, 2024

BbolroC Jan 23, 2024

hbrueckner Jan 23, 2024

BbolroC Jan 23, 2024

hbrueckner Jan 23, 2024

BbolroC Jan 23, 2024

hbrueckner left a comment

BbolroC commented Jan 23, 2024

docs: provide a guide for how to use IBM Secure Execution #7146

docs: provide a guide for how to use IBM Secure Execution #7146

Conversation

BbolroC commented Jun 20, 2023 • edited

stevenhorsman commented Jun 20, 2023

stevenhorsman left a comment

Choose a reason for hiding this comment

BbolroC commented Jun 20, 2023

BbolroC commented Jun 21, 2023

hbrueckner left a comment

Choose a reason for hiding this comment

NicoBoehrIBM left a comment

Choose a reason for hiding this comment

hbrueckner left a comment

Choose a reason for hiding this comment

wainersm left a comment

Choose a reason for hiding this comment

BbolroC commented Jan 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

BbolroC commented Jan 22, 2024

stevenhorsman left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hbrueckner left a comment

Choose a reason for hiding this comment

BbolroC commented Jan 23, 2024

BbolroC commented Jun 20, 2023 •

edited