cli/generate: automatic cryptsetup configuration #1223
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
burgerdev
reviewed
Feb 11, 2025
| Functionally the initializer will act as a sidecar container which serves to set up a secure mount inside an `emptyDir` mount shared with the main container. | ||
| Applications can set up trusted storage on top of an untrusted block device based on the workload secret using the `contrast.edgeless.systems/secure-pv` annotation. | ||
| This annotation enables `contrast generate` to configure the Initializer to set up a LUKS-encrypted volume at the specified device and mount it to a specified volume. | ||
| Configure any resource with the following annotation: |
There was a problem hiding this comment.
Suggested change
| Configure any resource with the following annotation: | |
| Configure any pod-generating resource with the following annotation: |
... not sure whether this is readable, but it's more specific.
| @@ -49,11 +49,38 @@ If the data owner fully trusts the seed share owner (when they're the same entit | |||
| ### Secure persistence | |||
|
|
|||
| Remember that persistent volumes from the cloud provider are untrusted. | |||
| Using the built-in `cryptsetup` subcommand of the initializer, applications can set up trusted storage on top of untrusted block devices based on the workload secret. | |||
| Functionally the initializer will act as a sidecar container which serves to set up a secure mount inside an `emptyDir` mount shared with the main container. | |||
| Applications can set up trusted storage on top of an untrusted block device based on the workload secret using the `contrast.edgeless.systems/secure-pv` annotation. | |||
There was a problem hiding this comment.
Maybe remove based on the workload secret from here and add a standalone sentence along the lines of
The volume is encrypted using the workload secret introduced in the last section.
Comment on lines
+67
to
+79
| ```yaml | ||
| spec: # v1.PodSpec | ||
| containers: | ||
| - name: my-container | ||
| image: "my-image@sha256:..." | ||
| volumeMounts: | ||
| - mountPath: /secure | ||
| mountPropagation: HostToContainer | ||
| name: secure | ||
| volumes: | ||
| - name: secure | ||
| emptyDir: {} | ||
| ``` |
There was a problem hiding this comment.
I think this example is confusing:
- It declares the emptyDir volume although that should not be necessary.
- It does not use the annotation, which might help clarify which names go where.
- It does not have a block device volume.
Comment on lines
+89
to
+90
| signalChan := make(chan os.Signal, 1) | ||
| signal.Notify(signalChan, syscall.SIGTERM, syscall.SIGINT) |
There was a problem hiding this comment.
Can we move signal handling closer to main, use signal.NotifyContext and wait for the context to expire at the end of this function?
| } | ||
| } | ||
| } | ||
| return fmt.Errorf("device %s not found", volumeName) |
There was a problem hiding this comment.
Suggested change
| return fmt.Errorf("device %s not found", volumeName) | |
| return fmt.Errorf("device %q not found", volumeName) |
Comment on lines
+217
to
+220
| if volume.EmptyDir != nil { | ||
| return fmt.Errorf("device %s cannot be of type EmptyDir", *volume.Name) | ||
| } | ||
| return nil |
There was a problem hiding this comment.
We might be able to exclude more invalid configurations here, because there are not many volume types that can be block devices.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This implements RFC 009 and automatically adds the necessary configuration to set up an encrypted mount using the
contrast.edgeless.systems/secure-pvannotation, which translates to a configured Initializer oncontrast generate.A successful run for the
volumestatefulsettest can be found here.