Skip to content

Commit 1ad25ec

Browse files
jldohmannjldohmann
authored
Merge pull request #52661 from SNiemann15/ibmz_secure_execution
[MULTIARCH-1424] Add new IBM Secure Execution feature
2 parents 412e90c + f015bbe commit 1ad25ec

File tree

4 files changed

+126
-0
lines changed

4 files changed

+126
-0
lines changed

‎installing/installing_ibm_z/installing-ibm-z-kvm.adoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,16 @@ include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[lev
8585

8686
include::modules/installation-ibm-z-kvm-user-infra-installing-rhcos.adoc[leveloffset=+1]
8787

88+
include::modules/ibm-z-secure-execution.adoc[leveloffset=+2]
89+
90+
[role="_additional-resources"]
91+
[id="additional-resources_Linux-as-an-IBM-Secure-Execution-host-or-guest"]
92+
.Additional resources
93+
94+
* link:https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-secure-execution[Introducing IBM Secure Execution for Linux]
95+
96+
* link:https://www.ibm.com/docs/en/linux-on-systems?topic=ibmz-secure-execution[Linux as an IBM Secure Execution host or guest]
97+
8898
include::modules/installation-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]
8999

90100
include::modules/installation-full-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]

‎installing/installing_ibm_z/installing-restricted-networks-ibm-z-kvm.adoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,16 @@ include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[lev
9292

9393
include::modules/installation-ibm-z-kvm-user-infra-installing-rhcos.adoc[leveloffset=+1]
9494

95+
include::modules/ibm-z-secure-execution.adoc[leveloffset=+2]
96+
97+
[role="_additional-resources"]
98+
[id="additional-resources_Linux-as-an-IBM-Secure-Execution-host-or-guest-restricted"]
99+
.Additional resources
100+
101+
* link:https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-secure-execution[Introducing IBM Secure Execution for Linux]
102+
103+
* link:https://www.ibm.com/docs/en/linux-on-systems?topic=ibmz-secure-execution[Linux as an IBM Secure Execution host or guest]
104+
95105
include::modules/installation-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]
96106

97107
include::modules/installation-full-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]

‎modules/ibm-z-secure-execution.adoc

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_ibm_z/installing-ibm-z-kvm.adoc
4+
// * installing/installing_ibm_z/installing-restricted-networks-ibm-z-kvm.adoc
5+
6+
:_content-type: PROCEDURE
7+
[id="installing-rhcos-using-ibm-secure-execution_{context}"]
8+
= Installing {op-system} using IBM Secure Execution
9+
10+
Before you install {op-system} using IBM Secure Execution, you must prepare the underlying infrastructure.
11+
12+
:FeatureName: Installing {op-system} using IBM Secure Execution
13+
include::snippets/technology-preview.adoc[]
14+
15+
.Prerequisites
16+
17+
* IBM z15 or later, or IBM LinuxONE III or later.
18+
* {op-system-base-full} 8 or later.
19+
* You have a bootstrap Ignition file. The file is not protected, enabling others to view and edit it.
20+
* You have verified that the boot image has not been altered after installation.
21+
* You must run all your nodes as IBM Secure Execution guests.
22+
23+
.Procedure
24+
25+
. Prepare your {op-system-base} KVM host to support IBM Secure Execution.
26+
27+
** By default, KVM hosts do not support guests in IBM Secure Execution mode. To support guests in IBM Secure Execution mode, KVM hosts must boot in LPAR mode with the kernel parameter specification `prot_virt=1`. To enable `prot_virt=1` on {op-system-base} 8, follow these steps:
28+
29+
.. Navigate to `/boot/loader/entries/` to modify your bootloader configuration file `*.conf`.
30+
.. Add the kernel command line parameter `prot_virt=1`.
31+
.. Run the `zipl` command and reboot your system.
32+
+
33+
KVM hosts that successfully start with support for IBM Secure Execution for Linux issue the following kernel message:
34+
+
35+
[source,terminal]
36+
----
37+
prot_virt: Reserving <amount>MB as ultravisor base storage.
38+
----
39+
.. To verify that the KVM host now supports IBM Secure Execution, run the following command:
40+
+
41+
[source,terminal]
42+
----
43+
# cat /sys/firmware/uv/prot_virt_host
44+
----
45+
+
46+
.Example output
47+
+
48+
[source,terminal]
49+
----
50+
1
51+
----
52+
The value of this attribute is 1 for Linux instances that detect their environment as consistent with that of a secure host. For other instances, the value is 0.
53+
54+
. Add your host keys to the KVM guest via Ignition.
55+
+
56+
During the first boot, {op-system} looks for your host keys to re-encrypt itself with them. {op-system} searches for files starting with `ibm-z-hostkey-` in the `/etc/se-hostkeys` directory. All host keys, for each machine the cluster is running on, must be loaded into the directory by the administrator. After first boot, you cannot run the VM on any other machines.
57+
+
58+
[NOTE]
59+
====
60+
You need to prepare your Ignition file on a safe system. For example, another IBM Secure Execution guest.
61+
====
62+
+
63+
For example:
64+
+
65+
[source,terminal]
66+
----
67+
{
68+
"ignition": { "version": "3.0.0" },
69+
"storage": {
70+
"files": [
71+
{
72+
"path": "/etc/se-hostkeys/ibm-z-hostkey-<your-hostkey>.crt",
73+
"contents": {
74+
"source": "data:;base64,<base64 encoded hostkey document>"
75+
},
76+
"mode": 420
77+
},
78+
{
79+
"path": "/etc/se-hostkeys/ibm-z-hostkey-<your-hostkey>.crt",
80+
"contents": {
81+
"source": "data:;base64,<base64 encoded hostkey document>"
82+
},
83+
"mode": 420
84+
}
85+
]
86+
}
87+
}
88+
```
89+
----
90+
+
91+
[NOTE]
92+
====
93+
You can add as many host keys as required if you want your node to be able to run on multiple {ibmzProductName} machines.
94+
====
95+
. To generate the Base64 encoded string, run the following command:
96+
+
97+
[source,terminal]
98+
----
99+
base64 <your-hostkey>.crt
100+
----
101+
+
102+
Compared to guests not running IBM Secure Execution, the first boot of the machine is longer because the entire image is encrypted with a randomly generated LUKS passphrase before the Ignition phase.
103+
104+
. Follow the fast-track installation procedure to install nodes using the IBM Secure Exection QCOW image.

‎modules/installation-ibm-z-kvm-user-infra-installing-rhcos.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@
1010
To install {product-title} on IBM Z infrastructure that you provision, you must install {op-system-first} as {op-system-base-full} guest virtual machines. When you install {op-system}, you must provide the Ignition config file that was generated by the {product-title} installation program for the type of machine you are installing. If you have configured suitable networking, DNS, and load balancing infrastructure, the {product-title} bootstrap process begins automatically after the {op-system} machines have rebooted.
1111

1212
You can perform a fast-track installation of {op-system} that uses a prepackaged QEMU copy-on-write (QCOW2) disk image. Alternatively, you can perform a full installation on a new QCOW2 disk image.
13+
14+
To add further security to your system, you can optionally install {op-system} using IBM Secure Execution before proceeding to the fast-track installation.

0 commit comments

Comments
 (0)