You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+78-23Lines changed: 78 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,51 +11,112 @@ The target operating model has two clusters:
11
11
On the platform a a sample workload is deployed
12
12
13
13
1. Sample hello world applications to allow users to experiment with the policies for CoCo and the KBS (trustee).
14
-
1. This is currently working out of the box (or close to).
14
+
2. A sample application `kbs-access` which presents secrets obtained from trustee to a web service. This is designed to allow users to test locked down environments.
15
15
16
16
Future work includes:
17
17
18
-
2. Red Hat OpenShift AI is deployed where a multi-layer perceptron to predict fraud is deployed as a confidential workload for inference
19
-
2. Enirnonments which will work sucessfully across multiple cloud providers
18
+
1. Supporting a multiple cluster deployment
19
+
2. Supporting multiple infrastructure providers
20
+
3. Supporting a more sophisticated workload such as confidential AI inference with protected GPUs.
20
21
21
22
22
23
## Current constraints and assumptions
23
-
- Only currently is known to work with `azure` as the provider of confidential vms via peer-pods
24
-
- Only known to work today with everything on one cluster. The work to expand this is in flight
25
-
- You must be able to get a lets-encrypt certificate. This means the service credentials in openshift must be able to manipulate the dns zone used by OpenSift.
26
-
-
27
-
- RHOAI data science cluster must be disabled until required components are deployed.
24
+
25
+
- Only currently is known to work with `azure` as the provider of confidential vms via peer-pods.
26
+
- Only known to work today with everything on one cluster. The work to expand this is in flight.
27
+
- If not using ARO you must either provide your own CA signed certs, or use let's encrypt.
28
28
- Must be on 4.16.14 or later.
29
29
30
+
## Major versions
31
+
32
+
### `2.*`
33
+
This is currently the `main` branch for the repository. Version 2.* of the pattern is currently constrained to support:
The pattern has been tested on Azure for two installation methods:
40
+
1. Installing onto an ARO cluster
41
+
2. Self managed OpenShift install using the `openshift-install` CLI. **REQUIRES ADDITIONAL CONFIGURATION**
42
+
43
+
### `1.0.0`
44
+
1.0.0 supports OpenShift Sandboxed containers version `1.8.1` along with Trustee version `0.2.0`.
45
+
46
+
The pattern has been tested on Azure for one installation method:
47
+
1. Self managed OpenShift install using the `openshift-install` CLI
48
+
49
+
30
50
31
51
## validated pattern flavours
32
52
**Today the demo has one flavour**.
33
53
A number are planned based on various different hub cluster-groups.
34
54
You can change between behaviour by configuring [`global.main.clusterGroupName`](https://validatedpatterns.io/learn/values-files/) key in the `values-global.yaml` file.
35
55
36
56
37
-
38
57
`values-simple.yaml`: or the `simple` cluster group is the default for the pattern.
39
58
It deploys a hello-openshift application 3 times:
40
59
- A standard pod
41
60
- A kata container with peer-pods
42
61
- A confidential kata-container
43
62
44
-
`values-ai.yaml`: Is currently a work in progress.
63
+
## Setup instructions
45
64
46
65
66
+
### Default single cluster setup with `values-simple.yaml`
47
67
48
-
## Setup instructions
68
+
The instructions here presume you have a cluster. See further down for provisioning instructions for a cluster.
69
+
70
+
#### Fork and Clone the GitHub repo
71
+
1. Following [standard validated patterns workflow](https://validatedpatterns.io/learn/workflow/) fork the repository and clone to your development enviroment which has `podman` and `git`
72
+
2. If using a particular version (e.g. `1.0.0`) checkout the correct tag.
49
73
50
-
### Default single cluster setup with `values-simple.yaml`
51
74
52
75
#### Configuring required secrets / parameters
53
76
The secrets here secure Trustee and the peer-pod vms. Mostly they are for demonstration purposes.
54
77
This only has to be done once.
55
78
56
79
1. Run `sh scripts/gen-secrets.sh`
57
80
58
-
#### Install on an OCP cluster on azure using Red Hat Demo Platform
81
+
#### Configuring let's encrypt.
82
+
83
+
Trustee requires a trusted CA issued certificate. Let's Encrypt is included for environments without a trusted cert on OpenShift's routes.
84
+
85
+
If you need a Let's Encrypt certificate to be issued the `letsencrypt` application configuration needs to be changed as below.
86
+
```yaml
87
+
88
+
---
89
+
# Default configuration, safe for ARO
90
+
letsencrypt:
91
+
name: letsencrypt
92
+
namespace: letsencrypt
93
+
project: hub
94
+
path: charts/all/letsencrypt
95
+
# Default to 'safe' for ARO
96
+
overrides:
97
+
- name: letsencrypt.enabled
98
+
value: false
99
+
---
100
+
# Explicitly correct configuration for enabling let's encrypt
101
+
letsencrypt:
102
+
name: letsencrypt
103
+
namespace: letsencrypt
104
+
project: hub
105
+
path: charts/all/letsencrypt
106
+
overrides:
107
+
- name: letsencrypt.enabled
108
+
value: true
109
+
```
110
+
111
+
This *must* first be pushed before deploying the pattern onto the cluster
112
+
113
+
#### Installing onto a cluster
114
+
Once you configuration is pushed (if required) `./pattern.sh make install` to provision a cluster.
115
+
116
+
117
+
## Cluster setup (if not already setup)
118
+
119
+
### Single cluster install on an OCP cluster on azure using Red Hat Demo Platform
59
120
60
121
Red Hat a demo platform. This allows easy access for Red Hat associates and partners to ephemeral cloud resources. The pattern is known to work with this setup.
61
122
1. Get the [openshift installer](https://console.redhat.com/openshift/downloads)
@@ -69,12 +130,13 @@ Red Hat a demo platform. This allows easy access for Red Hat associates and part
69
130
export SUBSCRIPTION=
70
131
export RESOURCEGROUP=
71
132
```
133
+
1. Ensure Let's encrypt
72
134
1. Run the wrapper install script
73
135
1. `sh ./rhdp/wrapper.sh`
74
136
1. You *should* be done
75
137
1. You *may* need to recreate the hello world peer-pods depending on timeouts.
76
138
77
-
#### Install azure *not*usign Red Hat Demo platform
139
+
### Single cluster install on plain old azure *not* using Red Hat Demo Platform
78
140
**NOTE: Don't use the default node sizes.. increase the node sizes such as below**
79
141
80
142
@@ -94,19 +156,12 @@ Red Hat a demo platform. This allows easy access for Red Hat associates and part
0 commit comments