feat: enable firmware reference values in bare metal profiles#90
Merged
butler54 merged 2 commits intoMay 28, 2026
Merged
Conversation
Wire firmware reference value enforcement into bare metal profiles by enabling kbs.baremetal.enabled and updating to trustee-chart v0.5.*. **Changes:** - values-baremetal.yaml: - Add kbs.baremetal.enabled: "true" override - Update trustee chartVersion: 0.4.* → 0.5.* - values-baremetal-gpu.yaml: - Add kbs.baremetal.enabled: "true" override - Update trustee chartVersion: 0.4.* → 0.5.* **Effect:** When deploying bare metal profiles, trustee-chart will now: 1. Create firmware-refvals-eso ExternalSecret (PR 2B) 2. Sync firmware reference values from Vault to cluster 3. Add firmware values to RVPS ConfigMap (PR 2B) 4. Enforce firmware measurements in attestation policy (PR 2C) **Prerequisites:** - Firmware values must be collected via veritas (PR 2A workflow) - Values must be pushed to Vault: `make push-firmware-refvals REFVALS_FILE=./refvals.json` - trustee-chart v0.5.0 must be released (includes PRs 2B, 2C) **Backwards compatibility:** If firmware values not pushed to Vault, attestation policy falls back to init_data-only verification (no breaking change). Part of Wave 2 (firmware hardening). Final PR to wire all pieces together.
Update chartVersion from 0.5.* to 0.6.* to align with trustee-chart PR validatedpatterns#30 which introduces BREAKING CHANGE: firmware reference values consumed as single JSON blob instead of multi-key secret. Both profiles already have kbs.baremetal.enabled: "true" set, enabling firmware reference value enforcement when values are present in Vault. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Wire firmware reference value enforcement into bare metal profiles by updating to trustee-chart v0.6.*.
This is PR 2D (final) of Wave 2 (firmware hardening) from the bare metal attestation hardening plan.
Changes
values-baremetal.yaml
chartVersion: 0.5.*→0.6.*kbs.baremetal.enabled: "true"overridevalues-baremetal-gpu.yaml
chartVersion: 0.5.*→0.6.*kbs.baremetal.enabled: "true"overrideEffect
When deploying bare metal profiles, trustee-chart v0.6.0 will now:
Create firmware-refvals-eso ExternalSecret
secret/data/hub/firmwareReferenceValuesin Vaultfirmware-reference-valuessecret in clusterAdd firmware values to RVPS
Enforce firmware measurements
Collection Workflow (PR 2A)
Backwards Compatibility
✅ Fully backwards compatible:
If firmware values NOT pushed to Vault:
If firmware values pushed to Vault:
Testing Plan
After all Wave 2 PRs merge and v0.6.0 releases:
clusterGroupName: baremetalmake collect-firmware-refvalsmake load-secretsDependencies
Related
Part of Wave 2 (firmware hardening) from the bare metal attestation hardening roadmap.
Wave 2 PR sequence:
After this merges, Wave 2 is complete and ready for E2E testing.