Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: add az-tdx-vtpm workflow for e2e tests #323

Conversation

mkulke
Copy link
Contributor

@mkulke mkulke commented Feb 12, 2024

This adds a target for the az-tdx-vtpm TEE.

TDX verifiers need an SGX quoting environment, for this we need to startup a local certificate caching service (PCCS) and point the quoting config to it.

The PCCS itself will need an API key to be able to query certificates from Intel's servers. If the apikey secret is set as a param to the callable workflow, it will install PCCS locally.

We can use intel's collaterals service directly in the dcap configuration, however we need to add the local cert cache, so the endpoint is not hit by too many requests from the CI.

The workflow itself will not be executed in this PR (only after it has been merged) to test whether it works I ran the following on an Azure TDX VM Ubuntu 22.04 vm.

sudo apt-get update
sudo apt-get install make -y
git clone https://github.com/mkulke/kbs.git -b mkulke/add-az-tdx-vtpm-e2e-workflow
cd kbs/kbs/test/
sudo make install-dependencies
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env
wget https://go.dev/dl/go1.22.0.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.22.0.linux-amd64.tar.gz
rm go1.22.0.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
make bins
make generate-attestation-token-signer
sudo make e2e-test

@mkulke mkulke requested a review from sameo as a code owner February 12, 2024 16:40
@mkulke mkulke added the test_e2e Authorize TEE e2e test run label Feb 12, 2024
@mkulke mkulke force-pushed the mkulke/add-az-tdx-vtpm-e2e-workflow branch 3 times, most recently from 138bf1a to 8583671 Compare February 14, 2024 12:03
@mkulke mkulke requested review from fidencio and wainersm February 14, 2024 12:06
@mkulke mkulke force-pushed the mkulke/add-az-tdx-vtpm-e2e-workflow branch 4 times, most recently from 19333aa to bdc9738 Compare February 15, 2024 12:58
@mkulke mkulke requested a review from mythi February 15, 2024 13:03
Copy link
Contributor

@mythi mythi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

This adds a target for the az-tdx-vtpm TEE. TDX verifiers need an SGX
quoting environment, for this we need to configure the dcap
configuration.

Signed-off-by: Magnus Kulke <[email protected]>
Copy link
Member

@fitzthum fitzthum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice

@mkulke mkulke force-pushed the mkulke/add-az-tdx-vtpm-e2e-workflow branch 2 times, most recently from 7079435 to d967ab4 Compare February 16, 2024 08:09
@mkulke mkulke added enhancement New feature or request github_actions Pull requests that update GitHub Actions code labels Feb 16, 2024
@mkulke mkulke merged commit 84432a2 into confidential-containers:main Feb 16, 2024
20 checks passed
@mkulke mkulke deleted the mkulke/add-az-tdx-vtpm-e2e-workflow branch February 16, 2024 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request github_actions Pull requests that update GitHub Actions code test_e2e Authorize TEE e2e test run
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants