search

confidential-containers / operator

Operator to deploy confidential containers runtime
Apache License 2.0
113 stars 60 forks source link

doc: provide a guide for how to install CC with IBM Secure Execution #329

Closed BbolroC closed 10 months ago

BbolroC commented 10 months ago

Due to the limitation that a public key used to encrypt a secure image is associated with a machine specific private key, a user cannot install and run a confidential container with IBM Secure Execution from release.

This is to provide a guide for how to achieve the goals above with a custom build.

Signed-off-by: Hyounggyu Choi Hyounggyu.Choi@ibm.com

BbolroC commented 10 months ago

For reviewers, you can find the referred documentation in the section Build a Payload Image via kata-deploy at https://github.com/kata-containers/kata-containers/pull/7146

wainersm commented 10 months ago

Hi @BbolroC !

I don't have a SystemZ to test the guide so I only reviewed the text. I've got two suggestions to you:

GabyCT commented 10 months ago

@BbolroC overall lgtm but I just found some misspelling in $ kubectl get pods

BbolroC commented 10 months ago

@BbolroC overall lgtm but I just found some misspelling in $ kubectl get pods

Thanks @GabyCT for the feedback. Actually, po is a short name for pod or pods in kubectl. (https://kubernetes.io/docs/reference/kubectl/#resource-types). But I will update the doc due to the readability.

BbolroC commented 10 months ago

Hi @BbolroC !

I don't have a SystemZ to test the guide so I only reviewed the text. I've got two suggestions to you:

  • Link this doc to the Prerequisites section in docs/INSTALL.md. Users would need to at least label the worker correctly.
  • It uses the kustomize tool but doesn't explain how it can be installed:
$ cd $GOPATH/src/github.com/confidential-containers/operator
$ make kustomize

The binary is found in ./bin

Thanks @wainersm for the feedback. I will reflect it asap. 😉