tee: Add instructions for configuring DCAP on IBM Cloud

[anzoman]

After testing the SGX support on IBM Cloud we are adding the instructions for configuring DCAP on IBM Cloud.

[netlify]

✅ Deploy Preview for oasisprotocol-docs ready!

Name	Link
🔨 Latest commit	4050d66
🔍 Latest deploy log	https://app.netlify.com/sites/oasisprotocol-docs/deploys/678e4cbd9eeed60008c17dff
😎 Deploy Preview	https://deploy-preview-1047--oasisprotocol-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[gw0]

After testing the SGX support on IBM Cloud

Didn't we confirm that currently SGX DCAP attestation on IBM VMs does not work? It supposedly works only on IBM bare-metal instances, but did we confirm this? If yes, I would expect that this PR adds a note to the list of cloud providers that only bare-metal instances work.

[anzoman]

Didn't we confirm that currently SGX DCAP attestation on IBM VMs does not work?

Not entirely, the IBM Cloud team confirmed it works on their side, and stated the two tools (sgx-detect and attestation tool) are unexpectedly throwing the I/O error. We will probably need to run an actual node to confirm whether it works for real.

Also, this part of the docs never explicitly states that SGX works with IBM Cloud VMs, but just provides links to configure PCCS according to the docs. If we ever want to state that it works only for bare-metal, we should probably do it inside some support metrics (e.g., in https://docs.oasis.io/node/run-your-node/prerequisites/cloud-providers#known-providers where we already have a table with known providers).

[gw0]

We will probably need to run an actual node to confirm whether it works for real.

As far as I know we developed the attestation-tool exactly for this purpose. If the attestation-tool does not work, something is misconfigured and the node should also not work.

this part of the docs never explicitly states that SGX works with IBM Cloud VMs

True, but adding these instructions for IBM Cloud and not mentioning where exactly is this supposed to work, you are implicitly suggesting it works on all IBM Cloud instances. Lets wait until we actually confirmed it works.

[anzoman]

After performing an internal test of running an Oasis client node for Testnet with Sapphire ParaTime, we confirmed that running production enclaves works on the IBM Cloud Virtual Servers for VPC.

The fortanix/rust-sgx#565 issue causing sgx-detect and attestation-tool to fail can then also be seen as valid. I've added an additional commit to our TEE troubleshooting docs.