Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-4140

[Doc] Document initrd and customizations

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Medium Medium
    • None
    • None
    • Documentation
    • None
    • 0

      1. Update the CoCo guide with modules for customizing environment by creating initrd.
      2. Update Trustee guide with parameters for initrd customizations in attestation policy.

      Use cases (from parent epic):

      1. As a Security Officer, I need the initrd build process to generate a measurement hash so this can be used in attestation policies to ensure the integrity of the guest environment.
      2. As a Security Officer, I want the default CoCo guest environment to have a restrictive policy (e.g., no exec access) to minimize the attack surface.
      3. As a Developer, I want to enable a debug mode for a specific CoCo pod so I can troubleshoot issues inside the guest.
      4. As a DevOps Engineer, I need a container image with all the necessary tools (kata-osbuilder, etc.) so I can build a custom initrd with my company's CA certificates.
      5. As a DevOps Engineer, I want to be able to add custom entries to the /etc/hosts file within the initrd to resolve internal service names.

      Suggested modules for CoCo guide:

      • About initrd (concept) - What it is, why the user would want to create it, what the user can accomplish with initrd. Describe the use cases
      • Creating initrd (procedure)

      Update for Trustee guide: attestation policy.

      POC: bpradipt  clcarval 

              gnecasov@redhat.com Gabriela Necasova
              apinnick@redhat.com Avital Pinnick
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: