Skip to content

Commit 87783b7

Browse files
gkurzgkurz
authored
Merge pull request #470 from gkurz/backport-1.8
Backports for 1.8.0
2 parents dacb45e + 0873796 commit 87783b7

File tree

7 files changed

+585
-3
lines changed

7 files changed

+585
-3
lines changed

‎config/metrics/metrics-prometheus-rules.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: PrometheusRule
3+
metadata:
4+
name: osc-alerts
5+
namespace: openshift-sandboxed-containers-operator
6+
spec:
7+
groups:
8+
- name: osc_alerts
9+
rules:
10+
- alert: KataRemoteWorkloadFailureHigh
11+
expr: kata_remote_workload_failure_ratio > 25
12+
for: 30m
13+
labels:
14+
severity: warning
15+
annotations:
16+
summary: "High Kata Remote Workload Failure Ratio"
17+
description: "The failure ratio of kata-remote workloads is above 25% for more than 30 minutes. This may indicate issues with the runtime or configuration."
18+
19+
- alert: kata_active_instance
20+
expr: vector(1)
21+
labels:
22+
severity: info
23+
purpose: "alive_signal"
24+
annotations:
25+
summary: "Kata instance alive signal"

‎config/peerpods/podvm/lib.sh

+6-3
Original file line numberDiff line numberDiff line change
@@ -246,15 +246,18 @@ function prepare_source_code() {
246246

247247
# Enable image signature check
248248
if [[ "$CONFIDENTIAL_COMPUTE_ENABLED" == "yes" ]]; then
249-
cat<<EOF>"${podvm_dir}"/files/etc/agent-config.toml
249+
local agent_config_file="/etc/agent-config.toml"
250+
251+
cat<<EOF>"${podvm_dir}/files${agent_config_file}"
250252
server_addr = "unix:///run/kata-containers/agent.sock"
251253
guest_components_procs = "none"
252254
image_registry_auth = "file:///run/peerpod/auth.json"
253255
enable_signature_verification = true
254256
image_policy_file = "kbs:///default/security-policy/osc"
255257
EOF
256-
sed -i 's,/run/peerpod/agent-config.toml,/etc/agent-config.toml,' \
257-
"${podvm_dir}"/files/etc/systemd/system/kata-agent.service
258+
sed -i "s,/run/peerpod/agent-config.toml,${agent_config_file},g" \
259+
"${podvm_dir}"/files/etc/systemd/system/kata-agent.service
260+
echo "sudo cp -a /tmp/files${agent_config_file} ${agent_config_file}" >>"${podvm_dir}"/qcow2/copy-files.sh
258261
fi
259262
}
260263

‎hack/Rvps-Extraction/GetRvps.sh

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
#!/bin/bash
2+
# Getting RVPS Parameters
3+
4+
function install_packages() {
5+
echo "***Installing necessary packages for RVPS values extraction ***"
6+
dnf install -y python3 python3-cryptography kmod
7+
echo "***Installation Finished ***"
8+
}
9+
10+
# Function to mount the image and extract se.img
11+
function mount_and_extract_image() {
12+
local img_path=$1
13+
14+
# Cleanup any previous files and directories
15+
rm -rf se.img /mnt/myvm
16+
mkdir /mnt/myvm
17+
18+
# Load nbd module and mount the image
19+
modprobe nbd
20+
if [ $? -ne 0 ]; then
21+
echo "Error: Failed to load nbd module."
22+
exit 1
23+
fi
24+
25+
qemu-nbd -c /dev/nbd3 $img_path
26+
if [ $? -ne 0 ]; then
27+
echo "Error: Failed to connect to nbd device."
28+
exit 1
29+
fi
30+
31+
32+
mount /dev/nbd3p1 /mnt/myvm
33+
if [ $? -ne 0 ]; then
34+
echo "Error: Failed to mount the image. Retrying..."
35+
sleep 2
36+
mount /dev/nbd3p1 /mnt/myvm
37+
if [ $? -ne 0 ]; then
38+
echo "Retrial for mounting failed. Please rerun the script"
39+
exit 1
40+
else
41+
echo "Mounting on second attempt passed"
42+
fi
43+
fi
44+
# Extract and process image
45+
rm -rf $PWD/output-files
46+
mkdir -p $PWD/output-files
47+
rm -rf se.img
48+
cp /mnt/myvm/se.img ./
49+
mv se.img $PWD/output-files/
50+
51+
umount /mnt/myvm
52+
qemu-nbd -d /dev/nbd3
53+
}
54+
55+
# Function to generate se-sample and ibmse-policy.rego files
56+
function generate_policy_files() {
57+
local se_tag=$1
58+
local se_image_phkh=$2
59+
60+
# Create se-sample file
61+
cat <<EOF > $PWD/output-files/se-sample
62+
{
63+
"se.attestation_phkh": [
64+
"$se_image_phkh"
65+
],
66+
"se.tag": [
67+
"$se_tag"
68+
],
69+
"se.image_phkh": [
70+
"$se_image_phkh"
71+
],
72+
"se.user_data": [
73+
"00"
74+
],
75+
"se.version": [
76+
"256"
77+
]
78+
}
79+
EOF
80+
81+
# Create ibmse-policy.rego file
82+
cat <<EOF > $PWD/output-files/ibmse-policy.rego
83+
package policy
84+
import rego.v1
85+
default allow = false
86+
converted_version := sprintf("%v", [input["se.version"]])
87+
allow if {
88+
input["se.attestation_phkh"] == "$se_image_phkh"
89+
input["se.image_phkh"] == "$se_image_phkh"
90+
input["se.tag"] == "$se_tag"
91+
input["se.user_data"] == "00"
92+
converted_version == "256"
93+
}
94+
EOF
95+
96+
}
97+
98+
# Main function
99+
install_packages
100+
101+
PS3='Please enter your choice: '
102+
options=("Generate the RVPS From Local Image from User pc" "Generate RVPS from Volume" "Quit")
103+
select opt in "${options[@]}"
104+
do
105+
case $opt in
106+
"Generate the RVPS From Local Image from User pc")
107+
echo "Enter the Qcow2 image with Full path"
108+
read -r img_path
109+
110+
mount_and_extract_image $img_path
111+
112+
$PWD/static-files/pvextract-hdr -o $PWD/output-files/hdr.bin $PWD/output-files/se.img
113+
114+
# Extract necessary values
115+
se_tag=$(python3 $PWD/static-files/se_parse_hdr.py $PWD/output-files/hdr.bin $PWD/static-files/HKD.crt | grep se.tag | awk -F ":" '{ print $2 }')
116+
se_image_phkh=$(python3 $PWD/static-files/se_parse_hdr.py $PWD/output-files/hdr.bin $PWD/static-files/HKD.crt | grep se.image_phkh | awk -F ":" '{ print $2 }')
117+
118+
echo "se.tag: $se_tag"
119+
echo "se.image_phkh: $se_image_phkh"
120+
121+
generate_policy_files $se_tag $se_image_phkh
122+
123+
provenance=$(cat $PWD/output-files/se-sample | base64 --wrap=0)
124+
echo "provenance = $provenance"
125+
126+
# Create se-message file
127+
cat <<EOF > $PWD/output-files/se-message
128+
{
129+
"version" : "0.1.0",
130+
"type": "sample",
131+
"payload": "$provenance"
132+
}
133+
EOF
134+
135+
ls -lrt $PWD/output-files/hdr.bin $PWD/output-files/se-message $PWD/output-files/ibmse-policy.rego
136+
;;
137+
138+
"Generate RVPS from Volume")
139+
echo "Enter the Libvirt Pool Name"
140+
read -r LIBVIRT_POOL
141+
echo "Enter the Libvirt URI Name"
142+
read -r LIBVIRT_URI
143+
echo "Enter the Libvirt Volume Name"
144+
read -r LIBVIRT_VOL
145+
146+
# Download the volume
147+
echo "Downloading from PODVM Volume..."
148+
rm -rf $PWD/PODVM-VOL-IMAGE
149+
mkdir -p $PWD/PODVM-VOL-IMAGE
150+
virsh -c $LIBVIRT_URI vol-download --vol $LIBVIRT_VOL --pool $LIBVIRT_POOL --file $PWD/PODVM-VOL-IMAGE/podvm_test.qcow2 --sparse
151+
if [ $? -ne 0 ]; then
152+
echo "Downloading Failed"
153+
exit 1
154+
fi
155+
156+
img_path=$PWD/PODVM-VOL-IMAGE/podvm_test.qcow2
157+
158+
mount_and_extract_image $img_path
159+
160+
$PWD/static-files/pvextract-hdr -o $PWD/output-files/hdr.bin $PWD/output-files/se.img
161+
162+
# Extract necessary values
163+
se_tag=$(python3 $PWD/static-files/se_parse_hdr.py $PWD/output-files/hdr.bin $PWD/static-files/HKD.crt | grep se.tag | awk -F ":" '{ print $2 }')
164+
se_image_phkh=$(python3 $PWD/static-files/se_parse_hdr.py $PWD/output-files/hdr.bin $PWD/static-files/HKD.crt | grep se.image_phkh | awk -F ":" '{ print $2 }')
165+
166+
echo "se.tag: $se_tag"
167+
echo "se.image_phkh: $se_image_phkh"
168+
169+
generate_policy_files $se_tag $se_image_phkh
170+
171+
provenance=$(cat $PWD/output-files/se-sample | base64 --wrap=0)
172+
echo "provenance = $provenance"
173+
174+
# Create se-message file
175+
cat <<EOF > $PWD/output-files/se-message
176+
{
177+
"version" : "0.1.0",
178+
"type": "sample",
179+
"payload": "$provenance"
180+
}
181+
EOF
182+
183+
ls -lrt $PWD/output-files/hdr.bin $PWD/output-files/se-message $PWD/output-files/ibmse-policy.rego
184+
;;
185+
186+
"Quit")
187+
break
188+
;;
189+
190+
*) echo "Invalid option: $REPLY";;
191+
esac
192+
done
193+

‎hack/Rvps-Extraction/RVPS_Reference.md

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
2+
# RVPS (Reference Value Provider Service) Usage
3+
4+
The RVPS (Reference Value Provider Service) values are used for remote attestation.
5+
6+
It is responsible for verifying, storing, and providing reference values. RVPS receives and verifies inputs from the software supply chain, stores the measurement values, and generates reference value claims for the Attestation Service.
7+
8+
This operation is performed based on the evidence verified by the Attestation Service (AS).
9+
10+
## RVPS Values
11+
12+
The values are:
13+
14+
1. `image_phkh`
15+
2. `image_tag`
16+
3. `se.version`
17+
4. `se.tag`
18+
5. `se.attestation_phk`
19+
20+
## Script Options
21+
22+
The script will help retrieve the RVPS via the following two options:
23+
24+
1. **Calculate the RVPS values based on the SE PODVM image stored locally** on the user’s machine where the script is being executed. The script will expect the absolute path of the SE PODVM image.
25+
26+
2. **Calculate the RVPS values based on the SE PODVM image uploaded to a libvirt volume**. The script will expect the following inputs:
27+
- Libvirt Pool Name
28+
- Libvirt URI Name
29+
- Libvirt Volume Name
30+
31+
## Output
32+
33+
After successful execution, you will get `se-message` and `ibmse-policy.rego` in a directory called `output-files`. These files will contain the RVPS parameters.
34+
35+
## Prerequisites
36+
37+
The user needs to copy the `Rvps-Extraction` folder locally:
38+
39+
```bash
40+
[root@a3elp36 Rvps-Extraction]# ls -lrt
41+
total 8
42+
drwxr-xr-x. 2 root root 65 Oct 19 16:52 static-files
43+
-rwxr-xr-x. 1 root root 6078 Oct 19 16:52 GetRvps.sh
44+
```
45+
46+
Once copied, the script can be executed as follows:
47+
48+
```bash
49+
./GetRvps.sh
50+
```
51+
52+
### Options
53+
1. Generate the RVPS from a local image on the user’s PC
54+
2. Generate RVPS from a volume
55+
3. Quit
56+
57+
Once the script finishes, the output directory will be created, and the files will be copied to the same path where the script is executed. For example:
58+
59+
```bash
60+
-rw-r--r--. 1 root root 640 Oct 9 13:25 /root/gaurav-rvps-test/COCO-1010/output-files/hdr.bin
61+
-rw-r--r--. 1 root root 446 Oct 9 13:25 /root/gaurav-rvps-test/COCO-1010/output-files/ibmse-policy.rego
62+
-rw-r--r--. 1 root root 561 Oct 9 13:25 /root/gaurav-rvps-test/COCO-1010/output-files/se-message
63+
```
64+
65+
## Static Files
66+
67+
Some static files will also be used to generate the RVPS. These include:
68+
69+
- **`pvextract-hdr`**: This is used to extract the SE header from the PODVM SE image (input). It generates an intermediate file, `hdr.bin`, which will be used for further extraction.
70+
- **`se_parse_hdr.py`**: A Python parser used to generate the actual RVPS values.
71+
- **`HKD.crt`**: This certificate will vary between labs. The user needs to copy the same `HKD.crt` used to generate the uploaded PODVM SE image into this path.

‎hack/Rvps-Extraction/static-files/HKD.crt

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIID7jCCAdagAwIBAgIJBFlsRgUYzLtIMA0GCSqGSIb3DQEBDQUAMGMxCzAJBgNV
3+
BAYTAlVTMQwwCgYDVQQKDANJQk0xEDAOBgNVBAsMB1Rlc3RpbmcxDDAKBgNVBAcM
4+
A1BPSzELMAkGA1UECAwCTlkxGTAXBgNVBAMMEFFTYWZlIEhLIHNpZ25pbmcwHhcN
5+
MjQwMjI4MTAzNjE4WhcNMjUwMjI3MTAzNjE4WjBbMQswCQYDVQQGEwJVUzEMMAoG
6+
A1UECgwDSUJNMRAwDgYDVQQLDAdUZXN0aW5nMQwwCgYDVQQHDANQT0sxCzAJBgNV
7+
BAgMAk5ZMREwDwYDVQQDDAhRc2FmZSBISzCBmzAQBgcqhkjOPQIBBgUrgQQAIwOB
8+
hgAEAIs8F4mItSnho7Wx/ngnZTfsQ9LtSchfKvc1r6Op5vNKGOuiuJ30GTOZUoZD
9+
M/MqioakC4EB0cpSTllh6qrYuxz2AUHgstGQNAFctkCKE3GqMEuFrcgazUvbV4JD
10+
NXSl/KB6uaKCgAeOuxw37+WkWaUpNOvpsh/dCjZ3pJeWYjv92r6BozUwMzAOBgNV
11+
HQ8BAf8EBAMCAwgwIQYDVR0fBBowGDAWoBSgEoYQaHR0cDovL3NvbWV3aGVyZTAN
12+
BgkqhkiG9w0BAQ0FAAOCAgEAas/Vg/xdwA3BqroBY+aRAfd6hwMNdVjbooYjga9M
13+
WeM6zDW+JOPuVYWij/yWGvRzKrmxwdpDrlEwQNFvh9uiwZorv6PCMnrF0Qprdwyl
14+
rvUzwXV28xrRgJtCpU5PDw2NSXZse7nsZD9zxtEYu8RywhtVO6LnXViAeTZLn1jK
15+
LMc+P1FlEA/+aVmNT3hr+sfFTDKn1oP4RbYJy4T9cbIGRgtRWpMyQaSqEX1bPytW
16+
ZjdK+LU55bZceAIrfR0um+gGSB+rRdyDQU0g9BS0dDXxVhDkzKVrD/UG2dqXd106
17+
Q3JeuROVwdd55dvwD5b+UmSS52oRlmTff1uJg6BF6tHWP7zh5rqLJdH3ds5AfITb
18+
2tHK3M1KhwIivbtBzogWH+LaxEF3n5V2FCc8bx92zB81IhKycSLnmE9OZ602d/0j
19+
BCU0hkh8BZS7o6A3sTHZHFh65jjFwRMQSDY43MLeNBWhdX8ymOcuiwVPWsHrrIBK
20+
w01nAbpR4IedQgwc0SJtExsqWKGS6OEyaDV5QcZh97/PA8ddBmsaJyZESJuwj1hp
21+
hq6jU/NtOT/J33vnoO0UWX8FaX58+4MCG638/fatMsdCUmt1OTw1b9Qry/p7pn56
22+
53FvYE30z1G7Arsu7LzTaz8EfLzQ57MVKb9cj2/NKzqhh5PMIb+9SdznQGuDqj5F
23+
++c=
24+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)