Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-2590

secure podvm configuration using metadata service

XMLWordPrintable

    • Icon: Feature Feature
    • Resolution: Done
    • Icon: Medium Medium
    • None
    • None
    • None
    • None
    • Product / Portfolio Work
    • False
    • Hide

      None

      Show
      None
    • False
    • Not Selected
    • OCPSTRAT-2027OpenShift Confidential Containers
    • 0

      Currently, cloud-init is used to process the podvm configuration data made available via cloud config (config-drive)

      Cloud Config is a venue to execute arbitrary untrusted code at startup and not recommended in the CoCo model. 

      In upstream for Azure, we have already switched to using metadata service to fetch the config info using a custom program - process-user-data.

      This feature is to enable the upstream feature in the downstream Red Hat builds, this means adding new binaries to the osc-podvm-payload container image

       

      Ref upstream issue: https://github.com/confidential-containers/cloud-api-adaptor/issues/1467

       

              bpradipt Pradipta Banerjee
              jfreiman Jens Freimann
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: