Skip to content

Commit 23b73d6

Browse files
mythimythi
committed
sgx: add automated DCAP registration using in-cluster PCCS caching
Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
1 parent 791a964 commit 23b73d6

File tree

14 files changed

+380
-0
lines changed

14 files changed

+380
-0
lines changed

‎.github/workflows/lib-build.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ jobs:
3535
- openssl-qat-engine
3636
- sgx-sdk-demo
3737
- sgx-aesmd-demo
38+
- sgx-dcap-infra
39+
- sgx-pccs
3840
- dsa-dpdk-dmadevtest
3941
- intel-npu-demo
4042
builder: [buildah, docker]

‎demo/sgx-dcap-infra/Dockerfile‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
FROM ubuntu:24.04 AS builder
2+
3+
RUN apt-get update && \
4+
env DEBIAN_FRONTEND=noninteractive apt-get install -y \
5+
build-essential \
6+
curl \
7+
libcurl4-openssl-dev
8+
9+
WORKDIR /opt/intel
10+
11+
ARG SGX_SDK_URL=https://download.01.org/intel-sgx/sgx-linux/2.26/distro/ubuntu24.04-server/sgx_linux_x64_sdk_2.26.100.0.bin
12+
13+
RUN curl -sSLfO ${SGX_SDK_URL} \
14+
&& export SGX_SDK_INSTALLER=$(basename $SGX_SDK_URL) \
15+
&& chmod +x $SGX_SDK_INSTALLER \
16+
&& echo "yes" | ./$SGX_SDK_INSTALLER \
17+
&& rm $SGX_SDK_INSTALLER
18+
19+
ARG DCAP_VERSION=DCAP_1.23
20+
ARG DCAP_TARBALL_SHA256="c4567e7bc0a2f0dbb70fa2625a9af492e00b96e83d07fa69b9f4f304a9992495"
21+
22+
RUN curl -sSLfO https://github.com/intel/SGXDataCenterAttestationPrimitives/archive/$DCAP_VERSION.tar.gz && \
23+
echo "$DCAP_TARBALL_SHA256 $DCAP_VERSION.tar.gz" | sha256sum -c - && \
24+
tar xzf $DCAP_VERSION.tar.gz && mv SGXDataCenterAttestationPrimitives* SGXDataCenterAttestationPrimitives
25+
26+
WORKDIR SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool
27+
28+
RUN sed -e 's:sys/firmware/efi:run:g' -i App/utility.cpp \
29+
&& make
30+
31+
FROM ubuntu:24.04
32+
33+
WORKDIR /opt/intel/sgx-pck-id-retrieval-tool/
34+
COPY --from=builder /opt/intel/SGXDataCenterAttestationPrimitives/tools/PCKRetrievalTool/PCKIDRetrievalTool .
35+
36+
RUN ln -sf /lib/x86_64-linux-gnu/libsgx_id_enclave.signed.so.1 && \
37+
ln -sf /lib/x86_64-linux-gnu/libsgx_pce.signed.so.1
38+
39+
ARG SGX_SDK_VERSION=2_26_100
40+
RUN apt update && apt install -y curl gnupg \
41+
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main" | \
42+
tee -a /etc/apt/sources.list.d/intel-sgx.list \
43+
&& curl -s https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | \
44+
gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg \
45+
&& curl -sFLf https://download.01.org/intel-sgx/sgx_repo/ubuntu/apt_preference_files/99sgx_${SGXSDK_VERSION}_noble_custom_version.cfg | \
46+
tee -a /etc/apt/preferences.d/99sgx_sdk \
47+
&& apt update \
48+
&& apt install -y --no-install-recommends \
49+
libcurl4 \
50+
tdx-qgs \
51+
libsgx-ae-pce \
52+
libsgx-ae-id-enclave \
53+
libsgx-ra-uefi \
54+
libsgx-dcap-default-qpl
55+
56+
# BUG: "qgs -p=0" gets overriden by the config file making the parameter useless
57+
RUN sed -e 's/\(^port =\).*/\1 0/g' -i /etc/qgs.conf
58+
59+
COPY dcap-registration-flow /usr/bin
60+
61+
ENTRYPOINT ["/opt/intel/tdx-qgs/qgs", "--no-daemon", "-p=0"]

‎demo/sgx-dcap-infra/dcap-registration-flow‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
set -u
4+
5+
if [ ! -x "${PWD}"/PCKIDRetrievalTool ]; then
6+
echo "dcap-registration-flow: PCKIDRetrievalTool must be in the workingDir and executable"
7+
exit 1
8+
fi
9+
10+
echo "Waiting for the PCCS to be ready ..."
11+
12+
if ! curl --retry 20 --retry-delay 30 -k ${PCCS_URL}/sgx/certification/v4/rootcacrl &> /dev/null; then
13+
echo "ERROR: PCCS pod didn't become ready after 20 minutes"
14+
exit 1
15+
fi
16+
17+
echo "PCCS is online, proceeding ..."
18+
19+
ARGS="-user_token ${USER_TOKEN} -url ${PCCS_URL} -use_secure_cert ${SECURE_CERT}"
20+
21+
echo "Calling PCKIDRetrievalTool ..."
22+
23+
./PCKIDRetrievalTool ${ARGS}
24+
25+
sleep infinity

‎demo/sgx-pccs/Dockerfile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
FROM registry.access.redhat.com/ubi9/nodejs-20:latest AS builder
2+
3+
USER root
4+
5+
RUN dnf install -y \
6+
file \
7+
jq \
8+
zip
9+
10+
ARG DCAP_VERSION=DCAP_1.23
11+
12+
RUN git clone -b ${DCAP_VERSION} --depth 1 --recurse-submodules https://github.com/intel/SGXDataCenterAttestationPrimitives.git
13+
14+
WORKDIR SGXDataCenterAttestationPrimitives/tools/PCKCertSelection/
15+
RUN mkdir -p ../../prebuilt/openssl/inc \
16+
&& mkdir -p ../../QuoteGeneration/pccs/lib \
17+
&& make \
18+
&& cp ./out/libPCKCertSelection.so ../../QuoteGeneration/pccs/lib
19+
20+
WORKDIR /opt/app-root/src/SGXDataCenterAttestationPrimitives/QuoteGeneration/pccs
21+
RUN npm config set engine-strict true \
22+
&& npm install \
23+
&& npm audit fix
24+
25+
FROM registry.access.redhat.com/ubi9/nodejs-20-minimal:latest
26+
27+
WORKDIR intel/pccs
28+
COPY --from=builder --chown=1001:users /opt/app-root/src/SGXDataCenterAttestationPrimitives/QuoteGeneration/pccs .
29+
COPY --chown=1001:users default.json config/
30+
COPY --chown=1001:users custom-environment-variables.json config/
31+
32+
ENTRYPOINT ["/usr/bin/node", "pccs_server.js"]

‎demo/sgx-pccs/custom-environment-variables.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{
2+
"ApiKey": "PCS_API_KEY",
3+
"proxy": "CLUSTER_HTTPS_PROXY",
4+
"UserTokenHash": "PCCS_USER_TOKEN_HASH",
5+
"AdminTokenHash": "PCCS_ADMIN_TOKEN_HASH",
6+
"CachingFillMode": "PCCS_FILL_MODE"
7+
}

‎demo/sgx-pccs/default.json‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
"HTTPS_PORT": 8042,
3+
"hosts": "0.0.0.0",
4+
"uri": "https://api.trustedservices.intel.com/sgx/certification/v4/",
5+
"ApiKey": "from-env",
6+
"proxy": "from-env",
7+
"RefreshSchedule": "0 0 1 * * *",
8+
"UserTokenHash": "from-env",
9+
"AdminTokenHash": "from-env",
10+
"CachingFillMode": "from-env",
11+
"OPENSSL_FIPS_MODE": false,
12+
"LogLevel": "info",
13+
"DB_CONFIG": "sqlite",
14+
"sqlite": {
15+
"database": "database",
16+
"username": "username",
17+
"password": "password",
18+
"options": {
19+
"host": "localhost",
20+
"dialect": "sqlite",
21+
"pool": {
22+
"max": 5,
23+
"min": 0,
24+
"acquire": 30000,
25+
"idle": 10000
26+
},
27+
"define": {
28+
"freezeTableName": true
29+
},
30+
"logging": true,
31+
"storage": "/run/pccs/pckcache.db"
32+
}
33+
}
34+
}

‎deployments/sgx_dcap/base/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
resources:
2+
- node-services.yaml
3+
generatorOptions:
4+
disableNameSuffixHash: true
5+
6+
# required .env.pccs-credentials keys:
7+
# USER_TOKEN=
8+
secretGenerator:
9+
- name: pccs-credentials
10+
envs:
11+
- .env.pccs-credentials

‎deployments/sgx_dcap/base/node-services.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# TODO
2+
# cert-manager / service-ca certificates
3+
# CURL_CA_BUNDLE once ^ is available
4+
# NFD (TDX) nodeSelector
5+
# cpu and memory resources/limits
6+
# split service name and port (PCCS URL)
7+
apiVersion: apps/v1
8+
kind: DaemonSet
9+
metadata:
10+
name: intel-dcap-node-infra
11+
spec:
12+
selector:
13+
matchLabels:
14+
app: dcap-node-infra
15+
template:
16+
metadata:
17+
annotations:
18+
qcnl-conf: '{"pccs_url": "https://pccs-service:8042/sgx/certification/v4/", "use_secure_cert": false, "pck_cache_expire_hours": 168}'
19+
labels:
20+
app: dcap-node-infra
21+
pccs-secure-cert: 'false'
22+
spec:
23+
automountServiceAccountToken: false
24+
initContainers:
25+
- name: platform-registration
26+
image: intel/sgx-dcap-infra:devel
27+
restartPolicy: Always
28+
workingDir: "/opt/intel/sgx-pck-id-retrieval-tool/"
29+
command: ['/usr/bin/dcap-registration-flow']
30+
env:
31+
- name: PCCS_URL
32+
value: "https://pccs-service:8042"
33+
- name: SECURE_CERT
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: metadata.labels['pccs-secure-cert']
37+
envFrom:
38+
- secretRef:
39+
name: pccs-credentials
40+
securityContext:
41+
readOnlyRootFilesystem: true
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop:
45+
- ALL
46+
add:
47+
- LINUX_IMMUTABLE
48+
resources:
49+
limits:
50+
sgx.intel.com/registration: 1
51+
containers:
52+
- name: tdx-qgs
53+
image: intel/sgx-dcap-infra:devel
54+
securityContext:
55+
readOnlyRootFilesystem: true
56+
allowPrivilegeEscalation: false
57+
capabilities:
58+
drop:
59+
- ALL
60+
resources:
61+
limits:
62+
sgx.intel.com/qe: 1
63+
imagePullPolicy: IfNotPresent
64+
env:
65+
- name: QCNL_CONF_PATH
66+
value: "/run/dcap/qcnl_conf"
67+
- name: XDG_CACHE_HOME
68+
value: "/run/dcap/cache"
69+
volumeMounts:
70+
- name: dcap-qcnl-cache
71+
mountPath: /run/dcap/cache
72+
- name: qgs-socket
73+
mountPath: /var/run/tdx-qgs
74+
- name: qcnl-config
75+
mountPath: /run/dcap/
76+
readOnly: true
77+
volumes:
78+
- name: dcap-qcnl-cache
79+
emptyDir:
80+
sizeLimit: 50Mi
81+
- name: qgs-socket
82+
hostPath:
83+
path: /var/run/tdx-qgs
84+
type: DirectoryOrCreate
85+
- name: qcnl-config
86+
downwardAPI:
87+
items:
88+
- path: "qcnl_conf"
89+
fieldRef:
90+
fieldPath: metadata.annotations['qcnl-conf']

‎deployments/sgx_dcap/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
resources:
2+
- base
3+
- pccs

‎deployments/sgx_dcap/pccs/kustomization.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resources:
2+
- pccs.yaml
3+
- service.yaml
4+
generatorOptions:
5+
disableNameSuffixHash: true
6+
7+
# self-signed TLS certs for pccs-tls:
8+
# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout private.pem -out file.crt -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
9+
# token hashesh follow (with 'hellworld' changed to the desired secret tokens):
10+
# echo -n helloworld | sha512sum | tr -d '[:space:]-'
11+
# where helloworld is then used as the USER_TOKEN in intel-dcap-node-infra deployment:
12+
#
13+
# required .env.pccs-tokens keys:
14+
# PCS_API_KEY=
15+
# PCCS_USER_TOKEN_HASH=
16+
# PCCS_ADMIN_TOKEN_HASH=
17+
secretGenerator:
18+
- name: pccs-tokens
19+
envs:
20+
- .env.pccs-tokens
21+
- name: pccs-tls
22+
type: "kubernetes.io/tls"
23+
files:
24+
- tls.key=private.pem
25+
- tls.crt=file.crt

0 commit comments

Comments
 (0)