https://kairos.io/assets/js/264809fe.bdf57942.js

1"use strict";(self.webpackChunkkairos_docs=self.webpackChunkkairos_docs||[]).push([["37314"],{45888(e,n,i){i.r(n),i.d(n,{metadata:()=>t,default:()=>h,frontMatter:()=>a,contentTitle:()=>r,toc:()=>c,assets:()=>d});var t=JSON.parse('{"id":"advanced/coco","title":"Confidential computing setup","description":"Kairos works with Confidential Containers on AMD SEV-SNP hardware today, using non-Hadron Kairos flavors (Ubuntu and other glibc-based bases).","source":"@site/versioned_docs/version-v4.2.0/advanced/coco.md","sourceDirName":"advanced","slug":"/advanced/coco","permalink":"/docs/v4.2.0/advanced/coco","draft":false,"unlisted":false,"editUrl":"https://github.com/kairos-io/kairos-docs/tree/main/versioned_docs/version-v4.2.0/advanced/coco.md","tags":[],"version":"v4.2.0","lastUpdatedBy":"github-actions[bot]","lastUpdatedAt":1787082255000,"sidebarPosition":9,"frontMatter":{"title":"Confidential computing setup","sidebar_label":"Confidential Computing","sidebar_position":9},"sidebar":"tutorialSidebar","previous":{"title":"Encrypting User Data with Kairos","permalink":"/docs/v4.2.0/advanced/partition_encryption"},"next":{"title":"Revoking secure boot access","permalink":"/docs/v4.2.0/advanced/revoking-secureboot-access"}}'),o=i(74848),s=i(28453);let a={title:"Confidential computing setup",sidebar_label:"Confidential Computing",sidebar_position:9},r,d={},c=[{value:"Create a Kairos cluster",id:"create-a-kairos-cluster",level:2},{value:"Additional steps",id:"additional-steps",level:2},{value:"Known limitations",id:"known-limitations",level:2}];function l(e){let n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsxs)(n.admonition,{title:"Confidential Containers on Kairos (non-Hadron)",type:"info",children:[(0,o.jsxs)(n.p,{children:["Kairos works with ",(0,o.jsx)(n.a,{href:"https://confidentialcontainers.org/",children:"Confidential Containers"})," on AMD SEV-SNP hardware today, using non-Hadron Kairos flavors (Ubuntu and other glibc-based bases)."]}),(0,o.jsxs)(n.p,{children:["As long as the necessary virtualization and memory-encryption options are enabled on your hardware (e.g. SEV / SEV-SNP / SNP Memory Coverage in BIOS on AMD platforms, or the equivalent TDX settings on Intel), the upstream Confidential Containers project can be installed on a Kairos cluster the same way it is on any Kubernetes distribution (see the ",(0,o.jsx)(n.a,{href:"https://confidentialcontainers.org/docs/getting-started/installation/",children:"upstream installation guide"}),"), and workloads then opt in by selecting the appropriate ",(0,o.jsx)(n.a,{href:"https://confidentialcontainers.org/docs/getting-started/workload/",children:"runtime class"}),"."]}),(0,o.jsx)(n.p,{children:"Because Kairos no longer ships prebuilt Ubuntu images by default, you'll want to build your own Kairos image with the kernel command-line flags and any vendor packages (Intel TDX/SGX attestation libraries, container image decryption tooling, etc.) that your scenario needs. See:"}),(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.a,{href:"/docs/reference/byoi/",children:"Bring Your Own Image (BYOI)"}),": the recommended path for Ubuntu and other non-Hadron bases."]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.a,{href:"/docs/reference/kairos-factory/",children:"The Kairos Factory"}),": how to turn a customized base image into a Kairos-ready artifact."]}),"\n"]})]}),"\n",(0,o.jsxs)(n.admonition,{title:"Hadron is not yet supported",type:"warning",children:[(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.a,{href:"https://github.com/kairos-io/hadron",children:"Hadron"})," is musl-only, and the Kata Containers host binaries shipped by the Confidential Containers operator (",(0,o.jsx)(n.code,{children:"kata-runtime"}),", ",(0,o.jsx)(n.code,{children:"kata-monitor"}),", ",(0,o.jsx)(n.code,{children:"containerd-shim-kata-v2"}),", ",(0,o.jsx)(n.code,{children:"containerd-nydus-grpc"}),") are still dynamically linked against glibc, so they fail to ",(0,o.jsx)(n.code,{children:"execve"})," on a Hadron node and the pod sandbox never comes up."]}),(0,o.jsxs)(n.p,{children:["Upstream Kata has added an opt-in static build (",(0,o.jsx)(n.a,{href:"https://github.com/kata-containers/kata-containers/pull/13243",children:"kata-containers#13243"}),"), and Kata 4.0.0 additionally ships a static-pie Rust shim (",(0,o.jsx)(n.code,{children:"runtime-rs"}),"), but no released Kata payload yet builds the full host-binary set statically. This page will be updated once such a release is available so the standard Confidential Containers install works on Hadron unchanged."]})]}),"\n",(0,o.jsx)(n.admonition,{title:"Warning",type:"warning",children:(0,o.jsxs)(n.p,{children:["The remainder of this page describes an earlier, experimental integration based on ",(0,o.jsx)(n.a,{href:"https://github.com/confidential-containers/enclave-cc",children:(0,o.jsx)(n.code,{children:"enclave-cc"})})," and the ",(0,o.jsx)(n.code,{children:"coco"})," community bundle. It is kept for historical reference and does not reflect the current recommended approach described above."]})}),"\n",(0,o.jsx)(n.p,{children:"Confidential computing is a type of secure computing that allows users to encrypt and decrypt data on a secure, isolated computing environment.\nIt works by encrypting the data before it is sent to the cloud or other computing resources. This allows users to keep their data private and secure, even if it is accessed by unauthorized parties.\nThis makes it useful for sensitive data such as financial information, health records, and other confidential data."}),"\n",(0,o.jsxs)(n.p,{children:["One important aspect of Confidential Computing is the ability to encrypt data even in-memory. This document describes how to setup Kairos to use ",(0,o.jsx)(n.a,{href:"https://github.com/confidential-containers/enclave-cc",children:(0,o.jsx)(n.code,{children:"enclave-cc"})}),"\nin order to run confidential workloads."]}),"\n",(0,o.jsx)(n.h2,{id:"create-a-kairos-cluster",children:"Create a Kairos cluster"}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.a,{href:"https://github.com/kairos-io/community-bundles/tree/main/coco",children:(0,o.jsx)(n.code,{children:"coco community bundle"})})," is supported since Kairos version ",(0,o.jsx)(n.code,{children:"v2.0.0-alpha3"}),' ("coco" stands for "',(0,o.jsx)(n.strong,{children:"Co"}),"nfidential ",(0,o.jsx)(n.strong,{children:"Co"}),'mputing").']}),"\n",(0,o.jsxs)(n.p,{children:["A configuration file like the following should be used (see the ",(0,o.jsx)(n.code,{children:"bundles"})," section):"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"#cloud-config\nbundles:\n    - targets:\n        - run://quay.io/kairos/community-bundles:cert-manager_latest\n        - run://quay.io/kairos/community-bundles:kairos_latest\n        - run://quay.io/kairos/community-bundles:coco_latest\n\ninstall:\n    auto: true\n    device: auto\n    reboot: true\n\nk3s:\n    enabled: true\n\nusers:\n    - name: kairos\n      passwd: kairos\n      groups:\n          - admin\n"})}),"\n",(0,o.jsxs)(n.p,{children:["The bundle is making some changes on the host's filesystem (installs a customized containerd binary among other things) and a restart of the node is needed in order for the changes to be applied fully.\nWhen this file appears, reboot the node: ",(0,o.jsx)(n.code,{children:"/etc/containerd/.sentinel"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"additional-steps",children:"Additional steps"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.a,{href:"https://github.com/confidential-containers/documentation/blob/main/quickstart.md#prerequisites",children:"Label our node"}),":"]}),"\n"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"  kubectl label --overwrite node $(kubectl get nodes -o jsonpath='{.items[].metadata.name}') node-role.kubernetes.io/worker=\"\"\n"})}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:(0,o.jsx)(n.a,{href:"https://github.com/confidential-containers/documentation/blob/main/quickstart.md#deploy-the-the-operator",children:"Deploy the operator"})}),"\n"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"  kubectl apply -k github.com/confidential-containers/operator/config/release?ref=v0.4.0\n"})}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["[Deploy the ",(0,o.jsx)(n.code,{children:"ccruntime"})," resource]"]}),"\n"]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"  kubectl apply -k github.com/confidential-containers/operator/config/samples/ccruntime/ssh-demo?ref=v0.4.0\n"})}),"\n",(0,o.jsxs)(n.p,{children:["(wait until they are all running: ",(0,o.jsx)(n.code,{children:"kubectl get pods -n confidential-containers-system --watch"}),")"]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.a,{href:"https://github.com/confidential-containers/documentation/blob/main/quickstart.md#test-creating-a-workload-from-the-sample-encrypted-image",children:"Deploy a workload"})}),"\n",(0,o.jsx)(n.p,{children:"The last part with the verification will only work from within a Pod because the IP address is internal:"}

1),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.code,{children:'ssh -i ccv0-ssh root@$(kubectl get service ccv0-ssh -o jsonpath="{.spec.clusterIP}")'})}),"\n",(0,o.jsx)(n.p,{children:"You can create a Pod like this:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:'apiVersion: v1\nkind: Pod\nmetadata:\n  name: kubectl\nspec:\n  containers:\n  - name: kubectl\n    image: opensuse/leap\n    command: ["/bin/sh", "-ec", "trap : TERM INT; sleep infinity & wait"]\n'})}),"\n",(0,o.jsxs)(n.p,{children:["Get a shell to it and run the verification commands (You will need to install ",(0,o.jsx)(n.code,{children:"ssh"})," in the Pod first)."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"known-limitations",children:"Known limitations"}),"\n",(0,o.jsx)(n.p,{children:"The above solution has some known limitations that might be addressed in future releases of Kairos. Namely:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["After a Kairos upgrade, the above process has to be repeated in order to install the customized ",(0,o.jsx)(n.code,{children:"containerd"})," and the relevant configuration."]}),"\n",(0,o.jsxs)(n.li,{children:["There is no simple way to upgrade to newer versions of the bundle (",(0,o.jsx)(n.a,{href:"https://github.com/kairos-io/kairos/issues/974",children:"this is a general bundles limitation"}),")."]}),"\n"]})]})}function h(e={}){let{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},28453(e,n,i){i.d(n,{R:()=>a,x:()=>r});var t=i(96540);let o={},s=t.createContext(o);function a(e){let n=t.useContext(s);return t.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]);