coco: update the values-secret template

Signed-off-by: Beraldo Leal <[email protected]>

Author: beraldoleal

values-secret.yaml.template

@@ -87,6 +87,124 @@ secrets:
       onMissingValue: generate
       vaultPolicy: alphaNumericPolicy
 
+  # CoCo (Confidential Containers) secrets
+  - name: sshKey
+    vaultPrefixes:
+    - global
+    fields:
+    - name: id_rsa.pub
+      path: ~/.config/validated-patterns/id_rsa.pub
+    - name: id_rsa
+      path: ~/.config/validated-patterns/id_rsa
+
+  # Container Image Signature Verification Policy
+  # Controls which container images are allowed to run in confidential containers.
+  # The policy is fetched by the TEE via initdata using image_security_policy_uri.
+  #
+  # Three policy variants are provided:
+  #   - insecure: Accept all images (for development/testing only)
+  #   - reject: Reject all images (useful for testing policy enforcement)
+  #   - signed: Only accept images signed with cosign (for production)
+  #
+  # Select policy in initdata:
+  #   image_security_policy_uri = 'kbs:///default/security-policy/insecure'
+  #
+  # TODO: Rename to 'container-image-policy' in trustee-chart to better reflect
+  # that this is about container image signature verification, not general security policy.
+  - name: securityPolicyConfig
+    vaultPrefixes:
+    - hub
+    fields:
+    # Accept all images without verification (INSECURE - dev/testing only)
+    - name: insecure
+      value: |
+        {
+          "default": [{"type": "insecureAcceptAnything"}],
+          "transports": {}
+        }
+    # Reject all images (useful for testing policy enforcement)
+    - name: reject
+      value: |
+        {
+          "default": [{"type": "reject"}],
+          "transports": {}
+        }
+    # Only accept signed images (production)
+    # Edit the transports section to add your signed images.
+    # Each image needs a corresponding cosign public key in cosign-keys secret.
+    - name: signed
+      value: |
+        {
+          "default": [{"type": "reject"}],
+          "transports": {
+            "docker": {
+              "registry.example.com/my-image": [
+                {
+                  "type": "sigstoreSigned",
+                  "keyPath": "kbs:///default/cosign-keys/key-0"
+                }
+              ]
+            }
+          }
+        }
+
+  # Cosign public keys for image signature verification
+  # Required when using the "signed" policy above.
+  # Add your cosign public key files here.
+  # Generate a cosign key pair: cosign generate-key-pair
+  #- name: cosign-keys
+  #  vaultPrefixes:
+  #  - hub
+  #  fields:
+  #  - name: key-0
+  #    path: ~/.config/validated-patterns/trustee/cosign-key-0.pub
+
+  # KBS authentication keys (Ed25519) for Trustee admin API
+  # Generate with:
+  #   mkdir -p ~/.config/validated-patterns/trustee
+  #   openssl genpkey -algorithm ed25519 > ~/.config/validated-patterns/trustee/kbsPrivateKey
+  #   openssl pkey -in ~/.config/validated-patterns/trustee/kbsPrivateKey -pubout -out ~/.config/validated-patterns/trustee/kbsPublicKey
+  #   chmod 600 ~/.config/validated-patterns/trustee/kbsPrivateKey
+  - name: kbsPublicKey
+    vaultPrefixes:
+    - hub
+    fields:
+    - name: publicKey
+      path: ~/.config/validated-patterns/trustee/kbsPublicKey
+
+  - name: kbsPrivateKey
+    vaultPrefixes:
+    - global
+    fields:
+    - name: privateKey
+      path: ~/.config/validated-patterns/trustee/kbsPrivateKey
+
+  - name: kbsres1
+    vaultPrefixes:
+    - hub
+    fields:
+    - name: key1
+      value: ''
+      onMissingValue: generate
+      vaultPolicy: validatedPatternDefaultPolicy
+    - name: key2
+      value: ''
+      onMissingValue: generate
+      vaultPolicy: validatedPatternDefaultPolicy
+    - name: key3
+      value: ''
+      onMissingValue: generate
+      vaultPolicy: validatedPatternDefaultPolicy
+
+  - name: passphrase
+    vaultPrefixes:
+    - hub
+    fields:
+    - name: passphrase
+      value: ''
+      onMissingValue: generate
+      vaultPolicy: validatedPatternDefaultPolicy
+
   # If you use clusterPools you will need to uncomment the following lines
   #- name: aws
   #  fields: