Local deployment with Trustee and AK registration #50
Conversation
There was a problem hiding this comment.
Thank you for your work, both here and in repositories referenced here! I got it to work but I think it has a couple of rough edges. Boot was also 110s on my machine which is a little rough but maybe it is the only way.
edit: testing again, was 45 seconds. don't know what that was.
test-server-ak/Containerfile
Outdated
|
|
||
| COPY server.py . | ||
|
|
||
| EXPOSE 5000 |
There was a problem hiding this comment.
what about one that isn't also the Kind container registry?
trustee.yaml
Outdated
| type: Directory | ||
| containers: | ||
| - name: register-ak | ||
| image: quay.io/confidential-clusters/test-sever-ak:latest |
There was a problem hiding this comment.
I know it's just test but perhaps
| image: quay.io/confidential-clusters/test-sever-ak:latest | |
| image: quay.io/confidential-clusters/test-server-ak:latest |
There was a problem hiding this comment.
populate-trustee-kbs.sh regenerates the PIN Ignition config, which you probably want to share? I had an outdated one which has some very subtle implications (Ignition used old protocol version when the Clevis PIN is only implemented for v3.6).
There was a problem hiding this comment.
I put it in a common script to be sourced
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
…support Signed-off-by: Alice Frosi <[email protected]>
- Increase the memory to 4GB otherwise, the VM might fails with LUKS. - Use the ignition with the attestation support - Specify the trustee address in the script. This helps if trustee is deployed on the host for example Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
Signed-off-by: Alice Frosi <[email protected]>
|
LGTM, I'll leave it up to you if the CI is blocking |
|
Not sure why the ci is still pulling the old coreos tag, I have bumped it to the new one |
Signed-off-by: Alice Frosi <[email protected]>
|
This commit should hopefully solve the CI issue: 82ad862 |
|
Merging since the CI is green now |
2 participants
Setup to create a Trustee deployment with podman kube play and the AK registration for testing