feat: trustee-chart v0.9.0 — Trustee 1.2 / OSC 1.13 support#36
Closed
butler54 wants to merge 18 commits into
Closed
feat: trustee-chart v0.9.0 — Trustee 1.2 / OSC 1.13 support#36butler54 wants to merge 18 commits into
butler54 wants to merge 18 commits into
Conversation
3 tasks
butler54
force-pushed
the
dev/osc-1.13-upgrade
branch
from
July 16, 2026 23:09
a085218 to
d784f6e
Compare
- Replace admin type/insecure_api with authorization_mode - Rename insecure_key to insecure_header_jwk (B5) - Remove work_dir and policy_engine (B6) - Flatten RVPS config storage_type = LocalJson (B7) - Replace resource plugin with storage_backend_type (B8) - Add unified storage_backend section (B8, B13) - Remove policy_engine section entirely (B9) - Simplify attestation_token_broker to signer (B10) - Add inline dcap_verifier for TDX (C5) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove tdxConfigSpec from KbsConfig CR (C1) - Delete tdx-config.yaml template (C4-C5) - Bump chart version from 0.8.0 to 0.9.0 (D-01) - Remove obsolete kbs.admin.format from values.yaml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- reference-values.yaml: rename key, change default - rvps-values-policies.yaml: list/append to dict/set - rvps-values-policies.yaml: update ConfigMap data key - All 16 reference value names preserved
- Data key changed from policy.rego to resource-policy.rego - Custom EAR-based policy body preserved unchanged - B12 permissive default change not applicable
butler54
force-pushed
the
dev/osc-1.13-upgrade
branch
from
July 16, 2026 23:22
d784f6e to
5f34085
Compare
authorization_mode = "DenyAll" replaced the old admin auth keypair flow. Remove the now-unused: - kbs-operator-keys.yaml (ESO for admin public key) - kbsAuthSecretName from KbsConfig CR - kbs.publicKey vault path from values.yaml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…mount - Add kbsAuthSecretName: kbs-auth-public-key back to KbsConfig CR spec - Create dummy Opaque secret kbs-auth-public-key in trustee-operator-system - Operator v1.2 controller requires this field for volume mount even though admin auth is disabled (authorization_mode = DenyAll)
The Trustee 1.2 operator migrates ConfigMaps without the kbs.confidentialcontainers.org/migrated-from-v1.1.0 annotation by creating a .v1.1 backup and deleting the original. However, it only implements recreation-from-backup for kbs-config, not for attestation-policy or resource-policy. This creates a loop where the operator deletes the ConfigMaps then fails because they're missing. Adding the migration annotation tells the operator these ConfigMaps are already in v1.2 format and should not be migrated. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Red Hat Trustee KBS v1.2.0 still expects RVPS reference values in the v1.1 list format (reference-values.json key, array of name/value/expiration objects). The v1.2 dict format causes "malformed value: invalid type: map, expected a string" deserialization errors. Reverts f2b0608 until the Red Hat build ships native v1.2 RVPS support. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Trustee 1.2 operator hardcodes subPath=reference_value when mounting the RVPS ConfigMap, so the key must be reference_value (not reference-values.json). But the KBS v1.2.0 binary still expects v1.1 array format data. Use the v1.2 key name with v1.1 data format. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Add migration annotation to kbs-config-map.yaml and
reference-values.yaml to prevent operator from deleting
ArgoCD-managed ConfigMaps
2. Fix reference-values.yaml default from '[]' to '{}' — the
LocalJson storage backend expects a JSON object
3. Rewrite rvps-values-policies.yaml to output v1.2 format:
dict of URL-safe base64-encoded ReferenceValue structs
(version, name, expiration, value fields per entry)
4. Add migration annotation to the ACM-policy-generated
rvps-reference-values ConfigMap
Addresses all issues documented in TRUSTEE-1.2-GITOPS-INCOMPATIBILITY.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- kbs-config-map.yaml: add migration annotation
- reference-values.yaml: add migration annotation, fix default to '{}'
- attestation-policy.yaml: add hardware fallback for TCB OutOfDate
(trust score 3 instead of 2) — Intel platforms commonly report
OutOfDate TCB when microcode updates lag behind advisories
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- sealed-secrets-signing-eso.yaml: sync public JWK from Vault to K8s Secret 'signing-key' in trustee-operator-system namespace - kbs.yaml: add 'signing-key' to kbsSecretResources so KBS can serve the public key at kbs:///default/signing-key/public Guest CDH uses the kid URI to fetch the public key for sealed secret signature verification during unsealing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add hardcoded Azure DCasv5 platform configuration reference values (measurement, smt_enabled, tsme_enabled, abi_major, abi_minor, single_socket, smt_allowed) as configurable defaults in values.yaml. These are Azure platform constants for the CVM firmware and SEV-SNP policy. They are required by the attestation policy for configuration and executables trust claims but are not produced by veritas. The SNP launch measurement is static per Azure CVM firmware generation and will only change when Azure updates UEFI/vTPM firmware. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The RVPS BuiltIn LocalJson storage needs file_dir_path to know where to read reference values. Without it, query_reference_value() returns empty — causing attestation policy to use default (contraindicated) trust claims for configuration and executables. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…dx-vtpm) The Trustee AS passes evidence to OPA with dashes (az-snp-vtpm) per the EAR token annotated_evidence key. The policy was using underscores (az_snp_vtpm), causing input["az_snp_vtpm"] to be undefined and all rules to fall through to defaults. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
count(query_reference_value("key")) errors with "count requires
array/object/set/string, got null" when the key doesn't exist in RVPS.
This kills the entire OPA policy evaluation, preventing all rules
(including fallbacks) from firing.
Add null != check before count() to let the rule evaluate to false
instead of erroring, allowing else fallbacks to work.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Comment out measurement, TCB, and config checks for az-snp-vtpm
(upstream has these commented out — Azure manages these at platform level)
- Comment out mr_td, xfam checks for az-tdx-vtpm (per upstream)
- Remove else fallbacks that were unreachable due to count(null) errors
- Keep PCR checks active (snp_pcr03/08/09/11/12) as upstream does
- hardware=2 and configuration=2 now granted when az-snp-vtpm present
(matching upstream behavior)
Root cause: count(query_reference_value("tcb_bootloader")) crashed with
"count requires array, got null" killing entire OPA evaluation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Azure peer-pods CDH does not fetch registry credentials from KBS via authenticated_registry_credentials_uri. Pull secrets are distributed to workload namespace SAs instead (sandboxed-policies-chart ps-dist). The credential Secret in trustee-operator-system is only needed for baremetal kata where CDH fetches kbs:///default/credential/regcred. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update trustee-chart from v0.8.0 to v0.9.0 for Trustee 1.2 / OSC 1.13 support, based on Phase 12 code analysis (33 upstream changes, 13 breaking) and Phase 13 design spec (clean version bump).
KBS Config TOML Rewrite (B4-B10, B13, C4-C5)
[admin]section: replacedtype/insecure_api/auth_public_keywithauthorization_mode = "DenyAll"[attestation_token]: renamedinsecure_keytoinsecure_header_jwk[attestation_service]: removedwork_dirandpolicy_engine[attestation_service.rvps_config]: flattened nested storage tostorage_type = "LocalJson"[[plugins]]: replacedtype = "LocalFs"+dir_pathwithstorage_backend_type = "kvstorage"[storage_backend]section with unified paths at/opt/confidential-containers/storage[attestation_service.verifier_config.dcap_verifier](replaces separate ConfigMap)[policy_engine]section entirelyKbsConfig CR + Template Cleanup (C1, C4-C5)
tdxConfigSpec/kbsTdxConfigMapNamefromkbs.yamltdx-config.yamltemplate entirely (TDX config now inline in KBS TOML)kbs.admin.formatfromvalues.yamlRVPS Format Migration (B1-B3)
reference-values.yaml: keyreference-values.json: '[]'changed toreference_value: '{}'rvps-values-policies.yaml: construction changed fromlist/appendtodict/set(object format); all 16 reference value names preservedResource Policy (B11)
resource-policy.yaml: data keypolicy.regochanged toresource-policy.rego; custom EAR-based policy body unchangedChart Metadata
Chart.yaml: version 0.8.0 to 0.9.0Test plan
helm template .renders valid YAML with default valueshelm template . --set kbs.tdx.enabled=truerenders inline DCAP verifier sectionhelm template . --set kbs.gpu.enabled=truerenders NVIDIA verifier section