From 7d19e7c579e81e420e184682da0ef62dcba17810 Mon Sep 17 00:00:00 2001 From: David Hadas Date: Sun, 29 Sep 2024 06:01:40 -0500 Subject: [PATCH] SecureComms: Align to changes in other component 1. Trustee Operator had changed the namespace 2. CAA had removed the SecureComms default kbs address Use InitData to set the kbs address instead Signed-off-by: David Hadas --- .../cmd/cloud-api-adaptor/main.go | 2 +- src/cloud-api-adaptor/docs/SecureComms.md | 55 ++++++++++++++++--- 2 files changed, 49 insertions(+), 8 deletions(-) diff --git a/src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go b/src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go index c6bd3db9a..6bdbadd63 100644 --- a/src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go +++ b/src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go @@ -114,7 +114,7 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) { flags.BoolVar(&secureComms, "secure-comms", false, "Use SSH to secure communication between cluster and peer pods") flags.StringVar(&secureCommsInbounds, "secure-comms-inbounds", "", "Inbound tags for secure communication tunnels") flags.StringVar(&secureCommsOutbounds, "secure-comms-outbounds", "", "Outbound tags for secure communication tunnels") - flags.StringVar(&secureCommsKbsAddr, "secure-comms-kbs", "kbs-service.kbs-operator-system:8080", "Address of a KBS Service for Secure-Comms") + flags.StringVar(&secureCommsKbsAddr, "secure-comms-kbs", "kbs-service.trustee-operator-system:8080", "Address of a Trustee Service for Secure-Comms") flags.DurationVar(&cfg.serverConfig.ProxyTimeout, "proxy-timeout", proxy.DefaultProxyTimeout, "Maximum timeout in minutes for establishing agent proxy connection") flags.StringVar(&cfg.networkConfig.TunnelType, "tunnel-type", podnetwork.DefaultTunnelType, "Tunnel provider") diff --git a/src/cloud-api-adaptor/docs/SecureComms.md b/src/cloud-api-adaptor/docs/SecureComms.md index 38ac81bf9..e9737dd8d 100644 --- a/src/cloud-api-adaptor/docs/SecureComms.md +++ b/src/cloud-api-adaptor/docs/SecureComms.md @@ -35,21 +35,28 @@ Use any of the option for installing CAA depending on the cloud driver used. ### Deploy Trustee-Operator Deploy Trustee-Operator by following instructions at [trustee Operator Getting Started](https://github.com/confidential-containers/trustee-operator?tab=readme-ov-file#getting-started). -Make sure to uncomment the secret generation as recommended for both public and private key (`kbs-auth-public-key` and `kbs-client` secrets). +Make sure to uncomment the secret generation as recommended for both public and private key (`kbs-auth-public-key` and `kbs-client` secrets). After this installation step you should now have the following secrets in the `trustee-operator-system` namespace: -Copy the kbs-client secret from the `kbs-operator-system` namespace to the `confidential-containers-system` ns. This can be done using: +```sh +kubectl get secrets -n trustee-operator-system +NAME TYPE DATA AGE +kbs-auth-public-key Opaque 1 28h +kbs-client Opaque 1 28h +``` + +Now, you should copy the kbs-client secret from the `trustee-operator-system` namespace to the `confidential-containers-system` namespace. This can be done using: ```sh -kubectl get secret kbs-client -n kbs-operator-system -o json|jq --arg ns "confidential-containers-system" 'del(.metadata["creationTimestamp","resourceVersion","selfLink","uid","annotations"]) | .metadata.namespace |= $ns' |kubectl apply -f - +kubectl get secret kbs-client -n trustee-operator-system -o json|jq --arg ns "confidential-containers-system" 'del(.metadata["creationTimestamp","resourceVersion","selfLink","uid","annotations"]) | .metadata.namespace |= $ns' |kubectl apply -f - ``` For a testing environment, you may need to change the policy of the KBS and AS using the KBS Client to allow all or fit your own policy. One way to do that is: ```sh -kubectl -n kbs-operator-system exec deployment/trustee-deployment --container as -it -- /bin/bash +kubectl -n trustee-operator-system exec deployment/trustee-deployment --container as -it -- /bin/bash sed -i.bak 's/^default allow = false/default allow = true/' /opt/confidential-containers/attestation-service/opa/default.rego -kubectl -n kbs-operator-system get cm resource-policy -o yaml | sed "s/default allow = false/default allow = true/"|kubectl apply -f - +kubectl -n trustee-operator-system get cm resource-policy -o yaml | sed "s/default allow = false/default allow = true/"|kubectl apply -f - ``` ### Build a podvm that enforces Secure-Comms @@ -74,16 +81,50 @@ data: ... ``` +Set InitData to point KBC services to IP address 127.0.0.1 +```sh +cat < /tmp/initdata.txt +algorithm = "sha384" +version = "0.1.0" +[data] +"aa.toml" = ''' +[token_configs] +[token_configs.coco_as] +url = 'http://127.0.0.1:8080' + +[token_configs.kbs] +url = 'http://127.0.0.1:8080' +''' +"cdh.toml" = ''' +socket = 'unix:///run/confidential-containers/cdh.sock' +credentials = [] +[kbc] +name = 'cc_kbc' +url = 'http://127.0.0.1:8080' +''' +EOF +export INITDATA=`base64 -w 0 /tmp/initdata.txt` +kubectl -n confidential-containers-system get cm peer-pods-cm -o yaml | sed 's/^\s*INITDATA: .*/ INITDATA: '$INITDATA'/'|kubectl apply -f - + +``` + You may also include additional Inbounds and Outbounds configurations to the Adaptor using the `SECURE_COMMS_INBOUNDS` and `SECURE_COMMS_OUTBOUNDS` config points. See more details regarding Inbounds and Outbounds below. You may also set the KBS address using the `SECURE_COMMS_KBS_ADDR` config point. +> [!NOTE] +> After changing peer-pods-cm ConfigMap, reload the CAA damonset using: +> ``` +> kubectl rollout restart daemonset cloud-api-adaptor-daemonset -n confidential-containers-system +> ``` +> + ### Adding named tunnels to the SSH channel Named tunnels can be added to the SSH channel. Adding a named tunnel requires adding an Inbound at one of the SSH channel peers and an Outbound at the other SSH channel peer. The Inbound and Outbound both carry the name of the tunnel being created. - |---------Tunnel----------| -Client->Inbound----------->Outbound->Server + |---------Tunnel----------| + Client->Inbound----------->Outbound->Server Inbounds and Outbounds take the form of a comma separated inbound/outbound tags such that Inbounds are formed as "InboundTag1,InboundTag2,InboundTag3,..." and Outbounds are formed as "OutboundTag1,OutboundTag2,outboundTag3,..."