Implement Confidential Computing #650
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Problem: The server don't have a directory to save the platform certificates generated by sevctl. Solution: Set that directory field on settings class and ensure to create the folder on initialization step. * Problem: The aren't an endpoint to be able to get the confidential platform certificates to start the VM key exchange. Solution: Create that endpoint and return the platform certificates generated by the `sevctl` command. * Fix: Solved code quality issues. * Fix: Added 2 test cases for that endpoint. * Fix: Added PR suggestions. * Fix: Modified test mock to let the tests work * Problem: Now isn't possible as a VM operator to get the client session certificates to initialize a confidential VM. Solution: Create an operator start endpoint that receive the confidential session files and starts the qemu VM to continue with the certificate exchange methods. * Fix: Remove useless aiofiles import * Fix: Solve test issues after code quality fixes * Fix: Solve code quality issues. * Fix: Solve code quality issues. * Fix: Write file in sync mode to avoid adding a new dependency. Files to write should be so small, so any blocking issue should be here. * Fix: Solved PR comments and wrong conditionals. * Fix: Solved more PR comments. * Fix: Removed unexisting import * Fix: Added useless command requested on the PR review. * Fix: Changed endpoint path and added automatic tests for that endpoint. * Fix: Solved settings singleton issue with testing, adding an `initialize_settings` method. * Fix: Just disable the setting that is failing and remove previous method to initialize the singleton.
When there were multiple Droplets with the same name, cleanup using doctl compute droplet delete -f $NAME would not work. Error: There are 3 Droplets with the name "aleph-vm-ci-XXX"; please provide a specific Droplet ID. [425559566, 425702949, 425703724] (cherry picked from commit b824503)
because of deps problem. Solution : upgrade aiohttp version
Co-authored-by: nesitor <[email protected]>
* Rename confidential endpoints * Rename the function too and reorder * isort
but still works with -e
ensure the setuid bit stay preserved when copying the file"
…ey instances. Solution: Use new aleph-message version that includes that data schema and implement it on the qemu confidential resources.
* Problem: If a user wants to manage different operations for a different CRNs, they have to sign a new pubkey token for every CRN, and this is so bad for the user experience. Solution: Move the `domain` field to the operation token payload instead the pubkey one, just to improve the user experience and maintain the security integrity. * Fix: Solved test error message failing. --------- Co-authored-by: Andres D. Molins <[email protected]>
due to merge problem
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #650 +/- ##
==========================================
+ Coverage 61.25% 61.74% +0.48%
==========================================
Files 65 68 +3
Lines 5603 5949 +346
Branches 596 624 +28
==========================================
+ Hits 3432 3673 +241
- Misses 2023 2124 +101
- Partials 148 152 +4 ☔ View full report in Codecov by Sentry. |
olethanh
force-pushed
the
dev-confidential
branch
from
c74e59d to
d63bc6d
Compare
olethanh
force-pushed
the
dev-confidential
branch
from
7e8fadb to
a814e74
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.