Add attestation key registration service #124
Conversation
|
@Jakob-Naucke I still need to add unit tests and run the test suite, but running the VM from the example, it works. If you have time and what to start to have a look at the code |
Jakob-Naucke
left a comment
Jakob-Naucke
left a comment
There was a problem hiding this comment.
first set of random comments
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: alicefr The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
alicefr
force-pushed
the
register-ak
branch
2 times, most recently
from
ed9f0d0 to
ab836c0
Compare
The attestationkey represents a request for a registration of a trusted attestation key. The key is added to the trusted key, only if there is a machine which corresponds to the IP declared in the AK. Signed-off-by: Alice Frosi <afrosi@redhat.com>
The attestation key registration offers an API to register an attestation key. It creates a corresponding CR and the AttestationKey will be approved and added to the trusted key, if there is a matching machine. Once an attestation key is approved, the corresponding secret is created and added to trustee deployment. In the same way, if a machine owning an attestation key is removed, also the AK and its secrets are removed from the trustee deployment. Signed-off-by: Alice Frosi <afrosi@redhat.com>
Signed-off-by: Alice Frosi <afrosi@redhat.com>
Signed-off-by: Alice Frosi <afrosi@redhat.com>
Signed-off-by: Alice Frosi <afrosi@redhat.com>
If you already have the image cached locally, you can simply load them in the kind cluster, which is much faster then downloaded each cluster creation. Signed-off-by: Alice Frosi <afrosi@redhat.com>
It requires a kubevirt container disk with the latest changes, the igniiton version needs to be set to the 3.0.0-experimental and include the attestation key registration endpoint. Signed-off-by: Alice Frosi <afrosi@redhat.com>
The latest configuration mandate to have the admin.type set. Signed-off-by: Alice Frosi <afrosi@redhat.com>
They contains the latest trustee and attester which are compatible. Signed-off-by: Alice Frosi <afrosi@redhat.com>
We have update the approved image and the reference values have changed. Signed-off-by: Alice Frosi <afrosi@redhat.com>
|
@alicefr: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
The new service allows to add attestation key as trusted keys in trustee