Skip to content

Commit 64d83c6

Browse files
mythimythi
committed
sgx: add automated DCAP registration using in-cluster PCCS caching
Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
1 parent 92a1030 commit 64d83c6

File tree

11 files changed

+297
-0
lines changed

11 files changed

+297
-0
lines changed

‎.github/workflows/lib-build.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ jobs:
3535
- openssl-qat-engine
3636
- sgx-sdk-demo
3737
- sgx-aesmd-demo
38+
- sgx-dcap-infra
3839
- dsa-dpdk-dmadevtest
3940
- intel-npu-demo
4041
builder: [buildah, docker]

‎demo/sgx-dcap-infra/Dockerfile‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
FROM ubuntu:24.04 AS builder
2+
3+
RUN apt update && \
4+
env DEBIAN_FRONTEND=noninteractive apt install -y \
5+
build-essential \
6+
curl \
7+
libcurl4-openssl-dev
8+
9+
WORKDIR /opt/intel
10+
11+
ARG SGX_SDK_URL=https://download.01.org/intel-sgx/sgx-linux/2.27/distro/ubuntu24.04-server/sgx_linux_x64_sdk_2.27.100.1.bin
12+
13+
RUN curl -sSLfO ${SGX_SDK_URL} \
14+
&& export SGX_SDK_INSTALLER=$(basename $SGX_SDK_URL) \
15+
&& chmod +x $SGX_SDK_INSTALLER \
16+
&& ./$SGX_SDK_INSTALLER --prefix /opt/intel \
17+
&& rm $SGX_SDK_INSTALLER
18+
19+
ARG DCAP_VERSION=DCAP_1.24
20+
ARG DCAP_TARBALL_SHA256="c9295f5fd3f489b2fbd5f0d33836b09420976506ac834bc9c9a401f4a6a1204a"
21+
22+
RUN curl -sSLfO https://github.com/intel/confidential-computing.tee.dcap/archive/$DCAP_VERSION.tar.gz && \
23+
echo "$DCAP_TARBALL_SHA256 $DCAP_VERSION.tar.gz" | sha256sum -c - && \
24+
tar xzf $DCAP_VERSION.tar.gz && mv confidential-computing.tee.dcap-* SGXDataCenterAttestationPrimitives
25+
26+
WORKDIR SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool
27+
28+
RUN sed -e 's:sys/firmware/efi:run:g' -i App/utility.cpp \
29+
&& make
30+
31+
FROM ubuntu:24.04
32+
33+
WORKDIR /opt/intel/sgx-pck-id-retrieval-tool/
34+
COPY --from=builder /opt/intel/SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool/PCKIDRetrievalTool .
35+
36+
RUN ln -sf /lib/x86_64-linux-gnu/libsgx_id_enclave.signed.so.1 && \
37+
ln -sf /lib/x86_64-linux-gnu/libsgx_pce.signed.so.1
38+
39+
ARG SGX_SDK_VERSION=2_27_100
40+
RUN apt update && apt install -y --no-install-recommends curl ca-certificates gpg \
41+
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" | \
42+
tee -a /etc/apt/sources.list.d/intel-sgx.list \
43+
&& curl -s https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | \
44+
gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg \
45+
&& curl -sSLf https://download.01.org/intel-sgx/sgx_repo/ubuntu/apt_preference_files/99sgx_${SGXSDK_VERSION}_noble_custom_version.cfg | \
46+
tee -a /etc/apt/preferences.d/99sgx_sdk \
47+
&& apt update \
48+
&& apt install -y --no-install-recommends \
49+
tdx-qgs \
50+
libsgx-ae-pce \
51+
libsgx-ae-id-enclave \
52+
libsgx-ra-uefi \
53+
libsgx-dcap-default-qpl
54+
55+
RUN rm /etc/qgs.conf
56+
57+
COPY dcap-registration-flow /usr/bin
58+
59+
ENTRYPOINT ["/opt/intel/tdx-qgs/qgs", "--no-daemon", "-n=4"]

‎demo/sgx-dcap-infra/dcap-registration-flow‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
set -u
4+
5+
if [ ! -x "${PWD}"/PCKIDRetrievalTool ]; then
6+
echo "dcap-registration-flow: PCKIDRetrievalTool must be in the workingDir and executable"
7+
exit 1
8+
fi
9+
10+
echo "Waiting for the PCCS to be ready ..."
11+
12+
if ! curl --retry 20 --retry-delay 30 -k ${PCCS_URL}/sgx/certification/v4/rootcacrl &> /dev/null; then
13+
echo "ERROR: PCCS pod didn't become ready after 20 minutes"
14+
exit 1
15+
fi
16+
17+
echo "PCCS is online, proceeding ..."
18+
19+
ARGS="-user_token ${USER_TOKEN} -url ${PCCS_URL} -use_secure_cert ${SECURE_CERT}"
20+
21+
echo "Calling PCKIDRetrievalTool ..."
22+
23+
./PCKIDRetrievalTool ${ARGS}
24+
25+
sleep infinity

‎deployments/sgx_dcap/base/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resources:
2+
- node-services.yaml
3+
generatorOptions:
4+
disableNameSuffixHash: true
5+
6+
# required .env.pccs-credentials keys:
7+
# USER_TOKEN=
8+
secretGenerator:
9+
- name: pccs-credentials
10+
envs:
11+
- .env.pccs-credentials

‎deployments/sgx_dcap/base/node-services.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# TODO
2+
# cert-manager / service-ca certificates
3+
# CURL_CA_BUNDLE once ^ is available
4+
# NFD (TDX) nodeSelector
5+
# cpu and memory resources/limits
6+
# split service name and port (PCCS URL)
7+
apiVersion: apps/v1
8+
kind: DaemonSet
9+
metadata:
10+
name: intel-dcap-node-infra
11+
spec:
12+
selector:
13+
matchLabels:
14+
app: dcap-node-infra
15+
template:
16+
metadata:
17+
annotations:
18+
qcnl-conf: '{"pccs_url": "https://pccs-service:8042/sgx/certification/v4/", "use_secure_cert": false, "pck_cache_expire_hours": 168}'
19+
labels:
20+
app: dcap-node-infra
21+
pccs-secure-cert: 'false'
22+
spec:
23+
automountServiceAccountToken: false
24+
initContainers:
25+
- name: platform-registration
26+
image: intel/sgx-dcap-infra:devel
27+
restartPolicy: Always
28+
workingDir: "/opt/intel/sgx-pck-id-retrieval-tool/"
29+
command: ['/usr/bin/dcap-registration-flow']
30+
env:
31+
- name: PCCS_URL
32+
value: "https://pccs-service:8042"
33+
- name: SECURE_CERT
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: metadata.labels['pccs-secure-cert']
37+
envFrom:
38+
- secretRef:
39+
name: pccs-credentials
40+
securityContext:
41+
readOnlyRootFilesystem: true
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop:
45+
- ALL
46+
add:
47+
- LINUX_IMMUTABLE
48+
resources:
49+
limits:
50+
sgx.intel.com/registration: 1
51+
containers:
52+
- name: tdx-qgs
53+
image: intel/sgx-dcap-infra:devel
54+
securityContext:
55+
readOnlyRootFilesystem: true
56+
allowPrivilegeEscalation: false
57+
capabilities:
58+
drop:
59+
- ALL
60+
resources:
61+
limits:
62+
sgx.intel.com/qe: 1
63+
imagePullPolicy: IfNotPresent
64+
env:
65+
- name: QCNL_CONF_PATH
66+
value: "/run/dcap/qcnl_conf"
67+
- name: XDG_CACHE_HOME
68+
value: "/run/dcap/cache"
69+
volumeMounts:
70+
- name: dcap-qcnl-cache
71+
mountPath: /run/dcap/cache
72+
- name: qgs-socket
73+
mountPath: /var/run/tdx-qgs
74+
- name: qcnl-config
75+
mountPath: /run/dcap/
76+
readOnly: true
77+
volumes:
78+
- name: dcap-qcnl-cache
79+
emptyDir:
80+
sizeLimit: 50Mi
81+
- name: qgs-socket
82+
hostPath:
83+
path: /var/run/tdx-qgs
84+
type: DirectoryOrCreate
85+
- name: qcnl-config
86+
downwardAPI:
87+
items:
88+
- path: "qcnl_conf"
89+
fieldRef:
90+
fieldPath: metadata.annotations['qcnl-conf']

‎deployments/sgx_dcap/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
resources:
2+
- base
3+
- pccs

‎deployments/sgx_dcap/pccs/kustomization.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resources:
2+
- pccs.yaml
3+
- service.yaml
4+
generatorOptions:
5+
disableNameSuffixHash: true
6+
7+
# self-signed TLS certs for pccs-tls:
8+
# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout private.pem -out file.crt -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
9+
# token hashesh follow (with 'helloworld' changed to the desired secret tokens):
10+
# echo -n helloworld | sha512sum | tr -d '[:space:]-'
11+
# where helloworld is then used as the USER_TOKEN in intel-dcap-node-infra deployment:
12+
#
13+
# required .env.pccs-tokens keys:
14+
# PCS_API_KEY=
15+
# PCCS_USER_TOKEN_HASH=
16+
# PCCS_ADMIN_TOKEN_HASH=
17+
secretGenerator:
18+
- name: pccs-tokens
19+
envs:
20+
- .env.pccs-tokens
21+
- name: pccs-tls
22+
type: "kubernetes.io/tls"
23+
files:
24+
- tls.key=private.pem
25+
- tls.crt=file.crt

‎deployments/sgx_dcap/pccs/pccs.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# TODO
2+
# cert-manager / service-ca certificates
3+
# add PCCS nodeSelector
4+
# cpu and memory resources/limits
5+
# make HTTPS_PORT configurable via env
6+
# fix proxy setting label
7+
apiVersion: apps/v1
8+
kind: Deployment
9+
metadata:
10+
name: intel-dcap-pccs
11+
spec:
12+
replicas: 1
13+
selector:
14+
matchLabels:
15+
app: pccs
16+
template:
17+
metadata:
18+
labels:
19+
app: pccs
20+
trustedservices.intel.com/cache: pccs
21+
spec:
22+
containers:
23+
- name: pccs
24+
image: quay.io/redhat-user-workloads/ose-osc-tenant/osc-pccs@sha256:de64fc7b13aaa7e466e825d62207f77e7c63a4f9da98663c3ab06abc45f2334d
25+
ports:
26+
- containerPort: 8042
27+
name: pccs-port
28+
volumeMounts:
29+
- name: pccs-cache
30+
mountPath: /run/pccs
31+
- name: pccs-tls
32+
mountPath: /opt/app-root/src/intel/pccs/ssl_key
33+
readOnly: true
34+
env:
35+
- name: PCCS_FILL_MODE
36+
value: "REQ"
37+
- name: CLUSTER_HTTPS_PROXY
38+
value: ""
39+
envFrom:
40+
- secretRef:
41+
name: pccs-tokens
42+
volumes:
43+
- name: pccs-cache
44+
emptyDir:
45+
sizeLimit: 50Mi
46+
- name: pccs-tls
47+
secret:
48+
secretName: pccs-tls
49+
items:
50+
- key: tls.key
51+
path: private.pem
52+
- key: tls.crt
53+
path: file.crt

‎deployments/sgx_dcap/pccs/service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: pccs-service
5+
spec:
6+
selector:
7+
trustedservices.intel.com/cache: pccs
8+
ports:
9+
- name: pccs
10+
protocol: TCP
11+
port: 8042
12+
targetPort: pccs-port

‎deployments/sgx_plugin/overlays/dcap-infra-resources/add-args.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: intel-sgx-plugin
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: intel-sgx-plugin
10+
args:
11+
- "-dcap-infra-resources"

0 commit comments

Comments
 (0)