Skip to content

Commit 691dfe1

Browse files
mythimythi
committed
sgx: add automated DCAP registration using in-cluster PCCS caching
Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
1 parent 0668037 commit 691dfe1

File tree

12 files changed

+357
-0
lines changed

12 files changed

+357
-0
lines changed

‎.github/workflows/lib-build.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ jobs:
3535
- openssl-qat-engine
3636
- sgx-sdk-demo
3737
- sgx-aesmd-demo
38+
- sgx-dcap-infra
39+
- sgx-pccs
3840
- dsa-dpdk-dmadevtest
3941
- intel-npu-demo
4042
builder: [buildah, docker]

‎demo/sgx-dcap-infra/Dockerfile

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
FROM ubuntu:24.04 AS builder
2+
3+
RUN apt-get update && \
4+
env DEBIAN_FRONTEND=noninteractive apt-get install -y \
5+
build-essential \
6+
curl \
7+
libcurl4-openssl-dev
8+
9+
WORKDIR /opt/intel
10+
11+
ARG SGX_SDK_URL=https://download.01.org/intel-sgx/sgx-linux/2.26/distro/ubuntu24.04-server/sgx_linux_x64_sdk_2.26.100.0.bin
12+
13+
RUN curl -sSLfO ${SGX_SDK_URL} \
14+
&& export SGX_SDK_INSTALLER=$(basename $SGX_SDK_URL) \
15+
&& chmod +x $SGX_SDK_INSTALLER \
16+
&& echo "yes" | ./$SGX_SDK_INSTALLER \
17+
&& rm $SGX_SDK_INSTALLER
18+
19+
ARG DCAP_VERSION=DCAP_1.23
20+
ARG DCAP_TARBALL_SHA256="c4567e7bc0a2f0dbb70fa2625a9af492e00b96e83d07fa69b9f4f304a9992495"
21+
22+
RUN curl -sSLfO https://github.com/intel/SGXDataCenterAttestationPrimitives/archive/$DCAP_VERSION.tar.gz && \
23+
echo "$DCAP_TARBALL_SHA256 $DCAP_VERSION.tar.gz" | sha256sum -c - && \
24+
tar xzf $DCAP_VERSION.tar.gz && mv SGXDataCenterAttestationPrimitives* SGXDataCenterAttestationPrimitives
25+
26+
WORKDIR SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool
27+
28+
RUN sed -e 's:sys/firmware/efi:run:g' -i App/utility.cpp \
29+
&& make
30+
31+
FROM ubuntu:24.04
32+
33+
WORKDIR /opt/intel/sgx-pck-id-retrieval-tool/
34+
COPY --from=builder /opt/intel/SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool/PCKIDRetrievalTool .
35+
36+
RUN ln -sf /lib/x86_64-linux-gnu/libsgx_id_enclave.signed.so.1 && \
37+
ln -sf /lib/x86_64-linux-gnu/libsgx_pce.signed.so.1
38+
39+
ARG SGX_SDK_VERSION=2_26_100
40+
RUN apt update && apt install -y curl gnupg \
41+
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" | \
42+
tee -a /etc/apt/sources.list.d/intel-sgx.list \
43+
&& curl -s https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | \
44+
gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg \
45+
&& curl -sFLf https://download.01.org/intel-sgx/sgx_repo/ubuntu/apt_preference_files/99sgx_${SGXSDK_VERSION}_noble_custom_version.cfg | \
46+
tee -a /etc/apt/preferences.d/99sgx_sdk \
47+
&& apt update \
48+
&& apt install -y --no-install-recommends \
49+
libcurl4 \
50+
tdx-qgs \
51+
libsgx-ae-pce \
52+
libsgx-ae-id-enclave \
53+
libsgx-ra-uefi \
54+
libsgx-dcap-default-qpl
55+
56+
# BUG: "qgs -p=0" gets overriden by the config file making the parameter useless
57+
RUN sed -e 's/\(^port =\).*/\1 0/g' -i /etc/qgs.conf
58+
59+
COPY dcap-registration-flow /usr/bin
60+
61+
ENTRYPOINT ["/opt/intel/tdx-qgs/qgs", "--no-daemon", "-p=0"]

‎demo/sgx-dcap-infra/dcap-registration-flow

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
3+
set -u
4+
5+
if [ ! -x "${PWD}"/PCKIDRetrievalTool ]; then
6+
echo "dcap-registration-flow: PCKIDRetrievalTool must be in the workingDir and executable"
7+
exit 1
8+
fi
9+
10+
echo "Waiting for the PCCS to be ready ..."
11+
12+
if ! curl --retry 20 --retry-delay 30 -k ${PCCS_URL}/sgx/certification/v4/rootcacrl &> /dev/null; then
13+
echo "ERROR: PCCS pod didn't become ready after 20 minutes"
14+
exit 1
15+
fi
16+
17+
echo "PCCS is online, proceeding ..."
18+
19+
ARGS="-user_token ${USER_TOKEN} -url ${PCCS_URL} -use_secure_cert ${SECURE_CERT}"
20+
21+
echo "Calling PCKIDRetrievalTool ..."
22+
23+
# TODO remove before merging
24+
sleep infinity
25+
26+
./PCKIDRetrievalTool ${ARGS}
27+
28+
sleep infinity

‎demo/sgx-pccs/Dockerfile

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
FROM registry.access.redhat.com/ubi9/nodejs-20:latest AS builder
2+
3+
USER root
4+
5+
RUN dnf install -y \
6+
file \
7+
jq \
8+
zip
9+
10+
ARG DCAP_VERSION=DCAP_1.23
11+
12+
RUN git clone -b ${DCAP_VERSION} --depth 1 --recurse-submodules https://github.com/intel/SGXDataCenterAttestationPrimitives.git
13+
14+
WORKDIR SGXDataCenterAttestationPrimitives/tools/PCKCertSelection/
15+
RUN mkdir -p ../../prebuilt/openssl/inc \
16+
&& mkdir -p ../../QuoteGeneration/pccs/lib \
17+
&& make \
18+
&& cp ./out/libPCKCertSelection.so ../../QuoteGeneration/pccs/lib
19+
20+
WORKDIR /opt/app-root/src/SGXDataCenterAttestationPrimitives/QuoteGeneration/pccs
21+
RUN npm config set engine-strict true \
22+
&& npm install \
23+
&& npm audit fix
24+
25+
FROM registry.access.redhat.com/ubi9/nodejs-20-minimal:latest
26+
27+
WORKDIR intel/pccs
28+
COPY --from=builder --chown=1001:users /opt/app-root/src/SGXDataCenterAttestationPrimitives/QuoteGeneration/pccs .
29+
COPY --chown=1001:users default.json config/
30+
COPY --chown=1001:users custom-environment-variables.json config/
31+
32+
ENTRYPOINT ["/usr/bin/node", "pccs_server.js"]

‎demo/sgx-pccs/custom-environment-variables.json

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"ApiKey": "PCS_API_KEY",
3+
"proxy": "CLUSTER_HTTPS_PROXY",
4+
"UserTokenHash": "PCCS_USER_TOKEN_HASH",
5+
"AdminTokenHash": "PCCS_ADMIN_TOKEN_HASH",
6+
"CachingFillMode": "PCCS_FILL_MODE"
7+
}

‎demo/sgx-pccs/default.json

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"HTTPS_PORT": 8042,
3+
"hosts": "0.0.0.0",
4+
"uri": "https://api.trustedservices.intel.com/sgx/certification/v4/",
5+
"ApiKey": "from-env",
6+
"proxy": "from-env",
7+
"RefreshSchedule": "0 0 1 * * *",
8+
"UserTokenHash": "from-env",
9+
"AdminTokenHash": "from-env",
10+
"CachingFillMode": "from-env",
11+
"OPENSSL_FIPS_MODE": false,
12+
"LogLevel": "info",
13+
"DB_CONFIG": "sqlite",
14+
"sqlite": {
15+
"database": "database",
16+
"username": "username",
17+
"password": "password",
18+
"options": {
19+
"host": "localhost",
20+
"dialect": "sqlite",
21+
"pool": {
22+
"max": 5,
23+
"min": 0,
24+
"acquire": 30000,
25+
"idle": 10000
26+
},
27+
"define": {
28+
"freezeTableName": true
29+
},
30+
"logging": true,
31+
"storage": "/run/pccs/pckcache.db"
32+
}
33+
}
34+
}

‎deployments/sgx_dcap/base/kustomization.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resources:
2+
- node-services.yaml
3+
generatorOptions:
4+
disableNameSuffixHash: true
5+
6+
# required .env.pccs-credentials keys:
7+
# USER_TOKEN=
8+
secretGenerator:
9+
- name: pccs-credentials
10+
envs:
11+
- .env.pccs-credentials

‎deployments/sgx_dcap/base/node-services.yaml

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# TODO
2+
# cert-manager / service-ca certificates
3+
# CURL_CA_BUNDLE once ^ is available
4+
# NFD (TDX) nodeSelector
5+
# cpu and memory resources/limits
6+
apiVersion: apps/v1
7+
kind: DaemonSet
8+
metadata:
9+
name: intel-dcap-node-infra
10+
spec:
11+
selector:
12+
matchLabels:
13+
app: dcap-node-infra
14+
template:
15+
metadata:
16+
annotations:
17+
qcnl-conf: '{"pccs_url": "https://pccs-service:8042/sgx/certification/v4/", "use_secure_cert": false, "pck_cache_expire_hours": 168}'
18+
labels:
19+
app: dcap-node-infra
20+
pccs-secure-cert: 'false'
21+
spec:
22+
automountServiceAccountToken: false
23+
initContainers:
24+
- name: platform-registration
25+
image: intel/sgx-dcap-infra:devel
26+
restartPolicy: Always
27+
workingDir: "/opt/intel/sgx-pck-id-retrieval-tool/"
28+
command: ['/usr/bin/dcap-registration-flow']
29+
env:
30+
- name: PCCS_URL
31+
value: "https://pccs-service:8042"
32+
- name: SECURE_CERT
33+
valueFrom:
34+
fieldRef:
35+
fieldPath: metadata.labels['pccs-secure-cert']
36+
envFrom:
37+
- secretRef:
38+
name: pccs-credentials
39+
securityContext:
40+
readOnlyRootFilesystem: true
41+
allowPrivilegeEscalation: false
42+
capabilities:
43+
drop:
44+
- ALL
45+
add:
46+
- LINUX_IMMUTABLE
47+
resources:
48+
limits:
49+
sgx.intel.com/registration: 1
50+
containers:
51+
- name: tdx-qgs
52+
image: intel/sgx-dcap-infra:devel
53+
securityContext:
54+
readOnlyRootFilesystem: true
55+
allowPrivilegeEscalation: false
56+
capabilities:
57+
drop:
58+
- ALL
59+
resources:
60+
limits:
61+
sgx.intel.com/qe: 1
62+
imagePullPolicy: IfNotPresent
63+
env:
64+
- name: QCNL_CONF_PATH
65+
value: "/run/dcap/qcnl_conf"
66+
- name: XDG_CACHE_HOME
67+
value: "/run/dcap/cache"
68+
volumeMounts:
69+
- name: dcap-qcnl-cache
70+
mountPath: /run/dcap/cache
71+
- name: qgs-socket
72+
mountPath: /var/run/tdx-qgs
73+
- name: qcnl-config
74+
mountPath: /run/dcap/
75+
readOnly: true
76+
volumes:
77+
- name: dcap-qcnl-cache
78+
emptyDir:
79+
sizeLimit: 50Mi
80+
- name: qgs-socket
81+
hostPath:
82+
path: /var/run/tdx-qgs
83+
type: DirectoryOrCreate
84+
- name: qcnl-config
85+
downwardAPI:
86+
items:
87+
- path: "qcnl_conf"
88+
fieldRef:
89+
fieldPath: metadata.annotations['qcnl-conf']

‎deployments/sgx_dcap/kustomization.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
resources:
2+
- base
3+
- pccs

‎deployments/sgx_dcap/pccs/kustomization.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resources:
2+
- pccs.yaml
3+
- service.yaml
4+
generatorOptions:
5+
disableNameSuffixHash: true
6+
7+
# self-signed TLS certs for pccs-tls:
8+
# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout private.pem -out file.crt -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
9+
# required .env.pccs-tokens keys:
10+
# PCS_API_KEY=
11+
# PCCS_USER_TOKEN_HASH=
12+
# PCCS_ADMIN_TOKEN_HASH=
13+
secretGenerator:
14+
- name: pccs-tokens
15+
envs:
16+
- .env.pccs-tokens
17+
- name: pccs-tls
18+
type: "kubernetes.io/tls"
19+
files:
20+
- tls.key=private.pem
21+
- tls.crt=file.crt

0 commit comments

Comments
 (0)