feat(policy): Refactor policy release to be AS-aware - #42
Open
shariqahmed-cohere wants to merge 6 commits into
Open
feat(policy): Refactor policy release to be AS-aware#42shariqahmed-cohere wants to merge 6 commits into
shariqahmed-cohere wants to merge 6 commits into
Conversation
With the addition of Trustee in integritee, initdata no longer is expected to have single ITA policy ID
- Updated driver version handling to support multiple NVIDIA driver versions. - Introduced a mechanism to generate an inert policy when no targets match, ensuring the policy remains loadable. - Added checks for supported TEE types in ITA and improved error handling in policy rendering. - Updated policy template to accommodate changes in driver version placeholders.
shariqahmed-cohere
marked this pull request as ready for review
August 26, 2026 16:51
shariqahmed-cohere
requested review from
alhassankhedr-cohere,
cohere-renovate-approve and
yousef-cohere
August 26, 2026 16:51
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6b87cd1. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, Integritee generates and releases policies specifically for ITA for GCP TDX nodes. This PR makes all changes required to support releasing policies for more than one attestation service (e.g. Trustee and ITA) as well as enable routes for other platforms and TEEs (Azure, SNP).
Note
High Risk
Changes the attestation policy generation and release path (measurements, Rego semantics, manifest schema, and ITA upload inputs), which directly controls what confidential workloads can pass attestation.
Overview
Refactors generate-policy from a single ITA-only pipeline into a shared manifest → measure → render flow with pluggable Renderer implementations. ITA logic moves to
ita.py(baselines, firmware, Rego fromita-template.rego);generate.pyowns PodVM pulls, initdata, machine-type resolution, predicate updates, stale-policy cleanup, andGITHUB_OUTPUTreporting.Callers pass
policy-types(e.g.ita) instead ofoutput-policy-file. Policies land undergenerated-policies/; the action returnsita-policy-fileandita-target-count. Release and test workflows consume those outputs and shipita_policy.rego.Hardware facts (
platform,tee,ram_gib) live in onemachine-types.yamlunder generate-policy. Manifest targets no longer carryram_gib; derive, validate, and merge only referencemachine_type. ITA skips targets whose TEE is not TDX (e.g. Azure SNP) before baseline work; non-TDX types can still appear in the manifest for future renderers.ITA Rego adds default deny rules when platform/workload blocks are empty, accepts multiple NVIDIA driver versions per manifest (set membership vs. a single
==), and fails the run only when no requested policy type matched any target.Validation drops the
policy-idinitdata check. CI installs opa so tests compile and evaluate generated policies. Predicate JSON gainstarget_countsper policy type.Reviewed by Cursor Bugbot for commit 1857e33. Bugbot is set up for automated code reviews on this repo. Configure here.