Confidential Containers on ARO

Configure your OpenShift deployments on Azure 
to make use of confidential computing

Confidential containers on ARO

Deploying and configuring a Trustee

Overview · Cluster · Azure Red Hat OpenShift

OperatorHub · Azure Red Hat OpenShift

Red Hat
Red Hat build of Trustee
provided by Red Hat
Remote attestation operator for confidential containers

Operator Installation · Azure Red Hat OpenShift

Installing Operator · Azure Red Hat OpenShift

trustee-operator.v0.4.2 · Cluster Service Version · Details · Azure Red Hat OpenShift

attestation-token · Secret · Details · Azure Red Hat OpenShift

ConfigMaps · Azure Red Hat OpenShift

Create ConfigMap · Azure Red Hat OpenShift

kbs-config-cm · ConfigMap · Details · Azure Red Hat OpenShift

rvps-reference-values · ConfigMap · Details · Azure Red Hat OpenShift

resource-policy · ConfigMap · Details · Azure Red Hat OpenShift

attestation-policy · ConfigMap · Details · Azure Red Hat OpenShift

Secrets · Azure Red Hat OpenShift

Installed Operators · Azure Red Hat OpenShift

trustee-operator.v0.4.2 · Cluster Service Version · Kbs Config · Azure Red Hat OpenShift

Create KbsConfig · Azure Red Hat OpenShift

kbsConfigMapName
KbsConfigMapName is the name of the configmap that contains the KBS configuration

kbsHttpsKeySecretName
KbsHttpsKeySecretName is the name of the secret that contains the KBS https private key

kbsHttpsCertSecretName
KbsHttpsCertSecretName is the name of the secret that contains the KBS https certificate

kbsRvpsRefValuesConfigMapName
kbsRvpsRefValuesConfigMapName is the name of the configmap that contains the RVPS reference values

kbsAttestationPolicyConfigMapName
KbsAttestationPolicyConfigMapName is the name of the configmap that contains the Attestation Policy

kbsAuthSecretName
KbsAuthSecretName is the name of the secret that contains the KBS auth secret

Pods · Azure Red Hat OpenShift

Configuring confidential containers

Red Hat
OpenShift sandboxed containers Operator
provided by Red Hat
OpenShift sandboxed containers, based on the Kata Containers open source project, provides an Open Container Initiative (OCI) compliant container runtime using lightweight virtual machines, running your workloads in their own isolated kernel and therefore contributing an additional layer of isolation back to OpenShift's Defense-in-Depth strategy. Click [this link](https://catalog.redhat.com/software/operators/detail/5ee0d499fdbe7cddc2c91cf5) for more information. # Requirements Your cluster must be installed on bare metal infrastructure with Red Hat Enterprise Linux CoreOS workers. # Features & benefits - **Isolated Developer Environments & Privileges Scoping** As a developer working on debugging an application using state-of-the-art tooling you might need elevated privileges such as `CAP_ADMIN` or `CAP_BPF`. With OpenShift sandboxed containers, any impact will be limited to a separate dedicated kernel. - **Legacy Containerized Workload Isolation** You are mid-way in converting a containerized monolith into cloud-native microservices. However, the monolith still runs on your cluster unpatched and unmaintained. OpenShift sandboxed containers helps isolate it in its own kernel to reduce risk. - **Safe Multi-tenancy & Resource Sharing (CI/CD Jobs, CNFs, ..)** If you are providing a service to multiple tenants, it could mean that the service workloads are sharing the same resources (e.g., worker node). By deploying in a dedicated kernel, the impact of these workloads have on one another is greatly reduced. - **Additional Isolation with Native Kubernetes User Experience** OpenShift sandboxed containers is used as a compliant OCI runtime. Therefore, many operational patterns used with normal containers are still preserved including but not limited to image scanning, GitOps, Imagestreams, and so on. # How to install Read the information about the Operator and click Install. On the Install Operator page: - Select `candidate` from the list of available Update Channel options. This ensures that you install the latest version of OpenShift sandboxed containers that is compatible with your OpenShift Container Platform version. - For Installed Namespace, ensure that the Operator recommended namespace option is selected. This installs the Operator in the mandatory `openshift-sandboxed-containers-operator` namespace, which is automatically created if it does not exist. Attempting to install the OpenShift sandboxed containers Operator in a namespace other than `openshift-sandboxed-containers-operator` causes the installation to fail. - For Approval Strategy, ensure that Automatic, which is the default value, is selected. OpenShift sandboxed containers automatically updates when a new z-stream release is available. - Click Install to make the Operator available to the OpenShift sandboxed containers namespace. - The OpenShift sandboxed containers Operator is now installed on your cluster. You can trigger the Operator by enabling the runtime on your cluster. You can do this by creating a `KataConfig` CustomResourceDefinition(CRD) instance. For this click on "create instance" on the operator overview page. # Documentation See the [OpenShift sandboxed containers documentation](https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/).

Confidential containers on ARO

Configure your OpenShift deployments on Azure to make use of confidential computing

Confidential Containers on ARO

Configure your OpenShift deployments on Azure
to make use of confidential computing