feat: OSC 1.13 / Trustee 1.2 support (v0.9.0)

KBS config TOML rewrite for Trustee 1.2:
- New storage paths and plugin config format
- Admin auth removed (DenyAll default)
- tdx-config.yaml deleted (inline in KBS TOML)
- RVPS file_dir_path for LocalJson storage

RVPS format migration:
- v1.1 array → v1.2 object format with migration annotation
- Azure platform config defaults (SNP launch measurement, SMT, ABI)

Attestation policy:
- Fix az-snp-vtpm dash/underscore key mismatch
- Add null guards for query_reference_value() to prevent count(null) crash
- Align Azure SNP/TDX sections with upstream operator defaults
- Skip KBS credential policy on Azure (peer-pods use SA pull secrets)

Additional:
- Sealed secrets JWK signing key ESO
- kbsAuthSecretName dummy secret for Trustee 1.2 operator volume mount
- Chart version bumped to 0.9.0

Breaking: Requires Trustee operator v1.2.0 / OSC v1.13.0.
KBS config TOML not backwards compatible with Trustee 1.1.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: butler54

Chart.yaml

@@ -7,4 +7,4 @@ keywords:
 - confidential-containers
 name: trustee
 # DO NOT EDIT VERSION HERE, IT IS AUTO-GENERATED BY SEMANTIC-RELEASE
-version: 0.8.0
+version: 0.9.0

templates/attestation-policy.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
   default_cpu.rego: |
     package policy
@@ -105,98 +106,74 @@ data:
 
     ##### Azure vTPM SNP
     executables := 3 if {
-      input["az_snp_vtpm"]
-
-      input["az_snp_vtpm"].measurement in query_reference_value("measurement")
-      input["az_snp_vtpm"].tpm.pcr03 in query_reference_value("snp_pcr03")
-      input["az_snp_vtpm"].tpm.pcr08 in query_reference_value("snp_pcr08")
-      input["az_snp_vtpm"].tpm.pcr09 in query_reference_value("snp_pcr09")
-      input["az_snp_vtpm"].tpm.pcr11 in query_reference_value("snp_pcr11")
-      input["az_snp_vtpm"].tpm.pcr12 in query_reference_value("snp_pcr12")
+      input["az-snp-vtpm"]
+
+      # measurement check commented out per upstream default (launch measurement is Azure platform constant)
+      # input["az-snp-vtpm"].measurement in query_reference_value("measurement")
+      input["az-snp-vtpm"].tpm.pcr03 in query_reference_value("snp_pcr03")
+      input["az-snp-vtpm"].tpm.pcr08 in query_reference_value("snp_pcr08")
+      input["az-snp-vtpm"].tpm.pcr09 in query_reference_value("snp_pcr09")
+      input["az-snp-vtpm"].tpm.pcr11 in query_reference_value("snp_pcr11")
+      input["az-snp-vtpm"].tpm.pcr12 in query_reference_value("snp_pcr12")
     }
 
     hardware := 2 if {
-      input["az_snp_vtpm"]
+      input["az-snp-vtpm"]
 
-      # Check the reported TCB to validate the ASP FW
-      count(query_reference_value("tcb_bootloader")) > 0
-      input["az_snp_vtpm"].reported_tcb_bootloader in query_reference_value("tcb_bootloader")
-      input["az_snp_vtpm"].reported_tcb_microcode in query_reference_value("tcb_microcode")
-      input["az_snp_vtpm"].reported_tcb_snp in query_reference_value("tcb_snp")
-      input["az_snp_vtpm"].reported_tcb_tee in query_reference_value("tcb_tee")
-    }
-
-    # Fallback: TCB reference values not collected for Azure yet
-    else := 3 if {
-      input["az_snp_vtpm"]
+      # TCB checks commented out per upstream default — Azure manages TCB validation
+      # input["az-snp-vtpm"].reported_tcb_bootloader in query_reference_value("tcb_bootloader")
+      # input["az-snp-vtpm"].reported_tcb_microcode in query_reference_value("tcb_microcode")
+      # input["az-snp-vtpm"].reported_tcb_snp in query_reference_value("tcb_snp")
+      # input["az-snp-vtpm"].reported_tcb_tee in query_reference_value("tcb_tee")
     }
 
-    # For the 'configuration' trust claim 2 stands for
-    # "The configuration is a known and approved config."
-    #
-    # For this, we compare all the configuration fields.
     configuration := 2 if {
-      input["az_snp_vtpm"]
-
-      count(query_reference_value("smt_enabled")) > 0
-      input["az_snp_vtpm"].platform_smt_enabled in query_reference_value("smt_enabled")
-      input["az_snp_vtpm"].platform_tsme_enabled in query_reference_value("tsme_enabled")
-      input["az_snp_vtpm"].policy_abi_major in query_reference_value("abi_major")
-      input["az_snp_vtpm"].policy_abi_minor in query_reference_value("abi_minor")
-      input["az_snp_vtpm"].policy_single_socket in query_reference_value("single_socket")
-      input["az_snp_vtpm"].policy_smt_allowed in query_reference_value("smt_allowed")
-    }
-
-    # Fallback: configuration reference values not available
-    else := 3 if {
-      input["az_snp_vtpm"]
+      input["az-snp-vtpm"]
+
+      # Config checks commented out per upstream default — Azure platform constants
+      # input["az-snp-vtpm"].platform_smt_enabled in query_reference_value("smt_enabled")
+      # input["az-snp-vtpm"].platform_tsme_enabled in query_reference_value("tsme_enabled")
+      # input["az-snp-vtpm"].policy_abi_major in query_reference_value("abi_major")
+      # input["az-snp-vtpm"].policy_abi_minor in query_reference_value("abi_minor")
+      # input["az-snp-vtpm"].policy_single_socket in query_reference_value("single_socket")
+      # input["az-snp-vtpm"].policy_smt_allowed in query_reference_value("smt_allowed")
     }
 
     ##### Azure vTPM TDX
     executables := 3 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
-      input["az_tdx_vtpm"].tpm.pcr03 in query_reference_value("tdx_pcr03")
-      input["az_tdx_vtpm"].tpm.pcr08 in query_reference_value("tdx_pcr08")
-      input["az_tdx_vtpm"].tpm.pcr09 in query_reference_value("tdx_pcr09")
-      input["az_tdx_vtpm"].tpm.pcr11 in query_reference_value("tdx_pcr11")
-      input["az_tdx_vtpm"].tpm.pcr12 in query_reference_value("tdx_pcr12")
+      input["az-tdx-vtpm"].tpm.pcr03 in query_reference_value("tdx_pcr03")
+      input["az-tdx-vtpm"].tpm.pcr08 in query_reference_value("tdx_pcr08")
+      input["az-tdx-vtpm"].tpm.pcr09 in query_reference_value("tdx_pcr09")
+      input["az-tdx-vtpm"].tpm.pcr11 in query_reference_value("tdx_pcr11")
+      input["az-tdx-vtpm"].tpm.pcr12 in query_reference_value("tdx_pcr12")
     }
 
     hardware := 2 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
       # Check the quote is a TDX quote signed by Intel SGX Quoting Enclave
-      input["az_tdx_vtpm"].quote.header.tee_type == "81000000"
-      input["az_tdx_vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
+      input["az-tdx-vtpm"].quote.header.tee_type == "81000000"
+      input["az-tdx-vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
 
-      # Check OVMF code hash
-      count(query_reference_value("mr_td")) > 0
-      input["az_tdx_vtpm"].quote.body.mr_td in query_reference_value("mr_td")
+      # mr_td and OVMF checks commented out per upstream default
+      # input["az-tdx-vtpm"].quote.body.mr_td in query_reference_value("mr_td")
 
       # Check TCB status (covers quote.body.tcb_svn claim check)
-      input["az_tdx_vtpm"].tcb_status == "UpToDate"
-    }
-
-    # Fallback: mr_td reference values not collected for Azure yet
-    else := 3 if {
-      input["az_tdx_vtpm"]
-
-      input["az_tdx_vtpm"].quote.header.tee_type == "81000000"
-      input["az_tdx_vtpm"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
-      input["az_tdx_vtpm"].tcb_status == "UpToDate"
+      input["az-tdx-vtpm"].tcb_status == "UpToDate"
     }
 
     configuration := 2 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
 
-      count(query_reference_value("xfam")) > 0
-      input["az_tdx_vtpm"].quote.body.xfam in query_reference_value("xfam")
+      # xfam check commented out per upstream default
+      # input["az-tdx-vtpm"].quote.body.xfam in query_reference_value("xfam")
     }
 
     # Fallback: xfam reference values not available
     else := 3 if {
-      input["az_tdx_vtpm"]
+      input["az-tdx-vtpm"]
     }
 
     ##### Bare Metal TDX
@@ -240,6 +217,18 @@ data:
       input["tdx"].collateral_expiration_status == "0"
     }
 
+    # Fallback: TCB OutOfDate — hardware is real TDX but has known advisories
+    else := 3 if {
+      input["tdx"]
+
+      input["tdx"].quote.header.tee_type == "81000000"
+      input["tdx"].quote.header.vendor_id == "939a7233f79c4ca9940a0db3957f0607"
+
+      input["tdx"].quote.body.mr_td in query_reference_value("mr_td")
+
+      input["tdx"].collateral_expiration_status == "0"
+    }
+
     configuration := 2 if {
       input["tdx"]
 

templates/kbs-auth-dummy-secret.yaml

@@ -0,0 +1,14 @@
+# Dummy secret required by Trustee 1.2 operator.
+# The operator controller unconditionally creates a volume from
+# kbsAuthSecretName. Admin auth is disabled (authorization_mode = "DenyAll"),
+# so the content is irrelevant -- only existence matters.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kbs-auth-public-key
+  namespace: trustee-operator-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+type: Opaque
+data:
+  publicKey: ""

templates/kbs-config-map.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
   kbs-config.toml: |
     [http_server]
@@ -15,33 +16,19 @@ data:
     insecure_http = false
     private_key = "/etc/https-key/tls.key"
     certificate = "/etc/https-cert/tls.crt"
-    [admin]
-    {{- if eq (default "v1.0" .Values.kbs.admin.format) "v1.1" }}
-    type = "Simple"
-    insecure_api = false
 
-    [[admin.personas]]
-    id = "admin"
-    public_key_path = "/etc/auth-secret/publicKey"
-    {{- else }}
-    type = "DenyAll"
-    insecure_api = false
-    auth_public_key = "/etc/auth-secret/publicKey"
-    {{- end }}
+    [admin]
+    authorization_mode = "DenyAll"
 
     [attestation_token]
-    insecure_key = false
+    insecure_header_jwk = false
     attestation_token_type = "CoCo"
-    trusted_certs_paths = ["/etc/attestation-cert/tls.crt"] # Check for location in cert (based on key generated)
+    trusted_certs_paths = ["/etc/attestation-cert/tls.crt"]
 
     [attestation_service]
     type = "coco_as_builtin"
-    work_dir = "/opt/confidential-containers/attestation-service"
-    policy_engine = "opa"
 
     [attestation_service.attestation_token_broker]
-    type = "Ear"
-    policy_dir = "/opt/confidential-containers/attestation-service/policies"
 
     [attestation_service.attestation_token_broker.signer]
     key_path = "/etc/attestation-cert/tls.key"
@@ -52,20 +39,28 @@ data:
 
     [attestation_service.rvps_config]
     type = "BuiltIn"
-
-    [attestation_service.rvps_config.storage]
-    type = "LocalJson"
-    file_path = "/opt/confidential-containers/rvps/reference-values/reference-values.json"
+    storage_type = "LocalJson"
+    file_dir_path = "/opt/confidential-containers/storage/local_json"
     {{- if .Values.kbs.gpu.enabled }}
 
     [attestation_service.verifier_config.nvidia_verifier]
     type = "Remote"
     {{- end }}
+    {{- if .Values.kbs.tdx.enabled }}
+
+    [attestation_service.verifier_config.dcap_verifier]
+    collateral_service = "{{ .Values.kbs.tdx.collateralService }}"
+    {{- end }}
 
     [[plugins]]
     name = "resource"
-    type = "LocalFs"
-    dir_path = "/opt/confidential-containers/kbs/repository"
+    storage_backend_type = "kvstorage"
+
+    [storage_backend]
+    storage_type = "LocalFs"
+
+    [storage_backend.backends.local_fs]
+    dir_path = "/opt/confidential-containers/storage"
 
-    [policy_engine]
-    policy_path = "/opt/confidential-containers/opa/policy.rego"
+    [storage_backend.backends.local_json]
+    dir_path = "/opt/confidential-containers/storage/local_json"

templates/kbs.yaml

@@ -22,6 +22,7 @@ spec:
     {{- end }}
     - "security-policy"
     - "attestation-status"
+    - "signing-key"
   kbsHttpsKeySecretName: kbs-https-key
   kbsHttpsCertSecretName: kbs-https-certificate
   kbsResourcePolicyConfigMapName: resource-policy
@@ -30,12 +31,6 @@ spec:
   kbsAttestationKeySecretName: attestation-cert
 
 
-  # TDX specific configuration (optional)
-  {{- if .Values.kbs.tdx.enabled }}
-  tdxConfigSpec:
-    kbsTdxConfigMapName: tdx-config
-  {{- end }}
-
   # IBM SE specific configuration (optional)
   # ibmSEConfigSpec:
   #   certStorePvc: <persistent-volume-claim>

templates/pull-secret-credential-policy.yaml

@@ -1,4 +1,7 @@
-{{ if eq .Values.global.coco.secured  true }}
+{{- if and (eq .Values.global.coco.secured true) (ne .Values.global.clusterPlatform "Azure") }}
+{{- /* On Azure peer-pods, CDH does not fetch registry credentials from KBS.
+       Pull secrets are distributed to workload namespace SAs instead
+       (see sandboxed-policies-chart/pull-secret-distribution.yaml). */ -}}
 ---
 apiVersion: policy.open-cluster-management.io/v1
 kind: Policy

templates/reference-values.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
-  reference-values.json: '[]'
+  reference_value: '{}'
 {{ end }}

templates/resource-policy.yaml

@@ -5,8 +5,9 @@ metadata:
   namespace: trustee-operator-system
   annotations:
     argocd.argoproj.io/sync-wave: "4"
+    kbs.confidentialcontainers.org/migrated-from-v1.1.0: v1.2.0
 data:
-  policy.rego: |
+  resource-policy.rego: |
     package policy
     import rego.v1