Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-2454

enable fips for peer pod vm during image build

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: High High
    • OSC 1.5.0
    • None
    • None
    • None
    • BU Product Work
    • 3
    • False
    • None
    • False
    • KATA-2435 - FIPS compliance for peerpods
    • Kata Sprint #242, Kata Sprint #243
    • 0
    • 0.000

      We need to switch the vm to fips mode during build of the podvm, as part of the kubernetes job. 

      We need to add an environment variable [here|https://github.com/confidential-containers/cloud-api-adaptor/blob/main/aws/image/rhel/aws-rhel.pkr.hcl) and in the equivalent file for AWS,  that defines if the VM is supposed to be in fips mode or not. Then we can use this env var value in https://github.com/confidential-containers/cloud-api-adaptor/blob/main/azure/image/misc-settings.sh and run the 
      fips-mode-setup --enable
      command in this context. The next time the vm is booted (i.e. when the peer pod is started) it will come up in fips mode.

      So we need upstream changes in cloud-api-adaptor in the provider specific packer files and in the misc-settings.sh shell script. Snir agreed to work on these changes this week so we can get it into this release. 

              ssheribe@redhat.com Snir sheriber
              jfreiman Jens Freimann
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: