Skip to content

Latest commit

 

History

History
54 lines (34 loc) · 2.23 KB

eaa_verdictd.md

File metadata and controls

54 lines (34 loc) · 2.23 KB
Raw

EAA Verdictd Guide

EAA/Verdictd support has been deprecated in Confidential Containers

EAA is used to perform attestation at runtime and provide guest with confidential resources such as keys. It is based on rats-tls.

Verdictd is the Key Broker Service and Attestation Service of EAA. The EAA KBC is an optional module in the attestation-agent at compile time, which can be used to communicate with Verdictd. The communication is established on the encrypted channel provided by rats-tls.

EAA can now be used on Intel TDX and Intel SGX platforms.

Create encrypted image

Before build encrypted image, you need to make sure Skopeo and Verdictd(EAA KBS) have been installed:

  • Skopeo: the command line utility to perform encryption operations.
  • Verdictd: EAA Key Broker Service and Attestation Service.
  1. Pull unencrypted image.

Here use alpine:latest for example:

${SKOPEO_HOME}/bin/skopeo copy --insecure-policy　docker://docker.io/library/alpine:latest oci:busybox

  1. Follow the Verdictd README #Generate encrypted container image to encrypt the image.

  2. Publish the encrypted image to your registry.

Deploy encrypted image

  1. Build rootfs with EAA component:

Specify AA_KBC=eaa_kbc parameters when using kata-containers rootfs.sh scripts to create rootfs.

  1. Launch Verdictd

Verdictd performs remote attestation at runtime and provides the key needed to decrypt the image. It is actually both Key Broker Service and Attestation Service of EAA. So when deploy the encrypted image, Verdictd is needed to be launched:

verdictd --listen <$ip>:<$port> --mutual

Note The communication between Verdictd and EAA KBC is based on rats-tls, so you need to confirm that rats-tls has been correctly installed in your running environment.

  1. Agent Configuration

Add configuration aa_kbc_params= 'eaa_kbc::<$IP>:<$PORT>' to agent config file, the IP and PORT should be consistent with verdictd.