Skip to content

Commit 47748d7

Browse files
butler54butler54
committed
feat: initial drop
Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent 86bd22d commit 47748d7

17 files changed

+342
-5
lines changed

‎.github/workflows/conventional-pr.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Lint PR title"
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
branches:
10+
- 'main'
11+
- 'develop'
12+
jobs:
13+
lint:
14+
if: ${{ github.head_ref != 'develop' }}
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Install dependencies
21+
run: npm install @commitlint/cli @commitlint/config-conventional
22+
23+
- name: Validate PR title
24+
run: |
25+
PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
26+
echo "$PR_TITLE" | npx commitlint --config commitlint.config.js

‎Chart.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
description: A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
33
keywords:
44
- pattern
5-
name: vp-template
5+
- trustee
6+
- confidential-computing
7+
- confidential-containers
8+
name: trustee
69
version: 0.0.1

‎README.md‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
1-
# vp-template
1+
# trustee
22

33
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
A helm chart to deploy trustee into the [coco-pattern](https://github.com/validatedpatterns/coco-pattern) and other charts.
6+
7+
What is needed in addition to the chart to make this work?
8+
1. The [gen-certificate](https://github.com/validatedpatterns/coco-pattern/blob/main/ansible/gen-certificate.yaml) ansible job.
9+
2. A subscription to Red Hat Build of Trustee
10+
3. Creating (at least) a container security policy [as describe here](https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.10/html/deploying_red_hat_build_of_trustee/deploying-trustee_azure-trustee#creating-image-verification-policy_azure-trustee)
611

7-
This chart is used to serve as the template for Validated Patterns Charts
812

913
### Notable changes
1014

‎commitlint.config.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
module.exports = { extends: ['@commitlint/config-conventional'] }

‎templates/.keep‎

Whitespace-only changes.

‎templates/dynamic-eso.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if ne .Values.global.secretStore.backend "none" }}
2+
{{- range .Values.kbs.secretResources }}
3+
---
4+
apiVersion: "external-secrets.io/v1beta1"
5+
kind: ExternalSecret
6+
metadata:
7+
annotations:
8+
argocd.argoproj.io/sync-wave: "1"
9+
name: {{ .name }}-eso
10+
namespace: trustee-operator-system
11+
spec:
12+
refreshInterval: 15s
13+
secretStoreRef:
14+
name: {{ $.Values.secretStore.name }}
15+
kind: {{ $.Values.secretStore.kind }}
16+
target:
17+
name: {{ .name }}
18+
template:
19+
type: Opaque
20+
dataFrom:
21+
- extract:
22+
key: {{ .key }}
23+
{{- end }}
24+
{{- end }}
25+

‎templates/kbs-config-map.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: kbs-config
5+
namespace: trustee-operator-system
6+
data:
7+
kbs-config.toml: |
8+
[http_server]
9+
sockets = ["0.0.0.0:8080"]
10+
insecure_http = false
11+
private_key = "/etc/https-key/tls.key"
12+
certificate = "/etc/https-cert/tls.crt"
13+
[admin]
14+
insecure_api = true
15+
auth_public_key = "/etc/auth-secret/publicKey"
16+
17+
[attestation_token]
18+
insecure_key = true
19+
attestation_token_type = "CoCo"
20+
21+
[attestation_service]
22+
type = "coco_as_builtin"
23+
work_dir = "/opt/confidential-containers/attestation-service"
24+
policy_engine = "opa"
25+
26+
[attestation_service.attestation_token_broker]
27+
type = "Ear"
28+
policy_dir = "/opt/confidential-containers/attestation-service/policies"
29+
30+
[attestation_service.attestation_token_config]
31+
duration_min = 5
32+
33+
[attestation_service.rvps_config]
34+
type = "BuiltIn"
35+
36+
[attestation_service.rvps_config.storage]
37+
type = "LocalJson"
38+
file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
39+
40+
[[plugins]]
41+
name = "resource"
42+
type = "LocalFs"
43+
dir_path = "/opt/confidential-containers/kbs/repository"
44+
45+
[policy_engine]
46+
policy_path = "/opt/confidential-containers/opa/policy.rego"

‎templates/kbs-operator-keys.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if ne .Values.global.secretStore.backend "none" }}
2+
---
3+
apiVersion: "external-secrets.io/v1beta1"
4+
kind: ExternalSecret
5+
metadata:
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "1"
8+
name: kbs-auth-public-key-eso
9+
namespace: trustee-operator-system
10+
spec:
11+
refreshInterval: 15s
12+
secretStoreRef:
13+
name: {{ .Values.secretStore.name }}
14+
kind: {{ .Values.secretStore.kind }}
15+
data:
16+
target:
17+
name: kbs-auth-public-key
18+
template:
19+
type: Opaque
20+
dataFrom:
21+
- extract:
22+
key: {{ .Values.kbs.publicKey }}
23+
{{- end }}

‎templates/kbs-route.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Single cluster deploy don't use the route yet.
2+
---
3+
apiVersion: route.openshift.io/v1
4+
kind: Route
5+
metadata:
6+
name: kbs
7+
namespace: trustee-operator-system
8+
spec:
9+
port:
10+
targetPort: 8080
11+
to:
12+
kind: Service
13+
name: kbs-service
14+
weight: 100
15+
tls:
16+
termination: passthrough

‎templates/kbs.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: confidentialcontainers.org/v1alpha1
2+
kind: KbsConfig
3+
metadata:
4+
name: kbsconfig
5+
namespace: trustee-operator-system
6+
spec:
7+
kbsConfigMapName: kbs-config
8+
kbsAuthSecretName: kbs-auth-public-key
9+
kbsDeploymentType: AllInOneDeployment
10+
kbsRvpsRefValuesConfigMapName: rvps-reference-values
11+
kbsSecretResources:
12+
{{- range .Values.kbs.secretResources }}
13+
- "{{ .name }}"
14+
{{- end }}
15+
- "security-policy"
16+
kbsHttpsKeySecretName: kbs-https-key
17+
kbsHttpsCertSecretName: kbs-https-certificate
18+
kbsResourcePolicyConfigMapName: resource-policy
19+
20+
# TDX specific configuration (optional)
21+
# tdxConfigSpec:
22+
# kbsTdxConfigMapName: tdx-config
23+
24+
# IBM SE specific configuration (optional)
25+
# ibmSEConfigSpec:
26+
# certStorePvc: <persistent-volume-claim>
27+
28+
# Override attestation policy (optional)
29+
# kbsAttestationPolicyConfigMapName: attestation-policy
30+
31+
# Inject environment variables (optional)
32+
# Enable DEBUG logging in trustee pods
33+
KbsEnvVars:
34+
RUST_LOG: debug
35+
36+
# service type (optional, it defaults to ClusterIP)
37+
kbsServiceType: ClusterIP

0 commit comments

Comments
 (0)