Epic Goal

• Confidential Container able to retrieve secret after proving that it's running inside a TEE

Why is this important?

• When using CoCo, the basic expectation is that the secret will be delivered inside the TEE post verification of the authenticity and integrity of the TEE

Scenarios

1. User deploying a pod and retrieving a secret to decrypt data
2.  
3. ...

Acceptance Criteria 

(The Epic is complete when...)

1. Downstream builds of the required pod vm components are available
2. Able to retrieve a secret from Trustee. 
3.  
4. ..

Additional context:

The required pod vm components

1. attestation agent built with cc_kbc
2. confidential-data-hub
3. api-server-rest
4. process-user-data

The CoCo steps are same for ARO or self-managed Azure OpenShift cluster. The steps for Trustee deployment as well as secure key retrieval will be documented in the following internal guide - https://docs.google.com/document/d/1GFSC1-CEq-V0gqBaIDPU1lb7t4HE8hnF5vqwGjVz8xY/edit#heading=h.z1exffbz0ipo