Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-2590

secure podvm configuration using metadata service

XMLWordPrintable

    • Icon: Feature Feature
    • Resolution: Done
    • Icon: Medium Medium
    • None
    • None
    • None
    • None
    • BU Product Work
    • False
    • None
    • False
    • KATA-2603Enhanced protection for data in-use (CoCo)
    • Not Selected
    • 0% To Do, 0% In Progress, 100% Done
    • 0
    • 0

      Currently, cloud-init is used to process the podvm configuration data made available via cloud config (config-drive)

      Cloud Config is a venue to execute arbitrary untrusted code at startup and not recommended in the CoCo model. 

      In upstream for Azure, we have already switched to using metadata service to fetch the config info using a custom program - process-user-data.

      This feature is to enable the upstream feature in the downstream Red Hat builds, this means adding new binaries to the osc-podvm-payload container image

       

      Ref upstream issue: https://github.com/confidential-containers/cloud-api-adaptor/issues/1467

       

            bpradipt Pradipta Banerjee
            jfreiman Jens Freimann
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: