harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 07:03:56 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: add Kubernetes pod spec for vault-unseal and update docs

Browse source 
- Add `vault-unseal-pod-*.yaml` for Kubernetes deployment.
- Update `README.md` to reflect changes in unseal and sign commands.
- Add `vault` to the `shells/teepot/default.nix` package list.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer 2024-08-06 09:38:03 +02:00
parent 4ed311a16a
commit eae8b860a9
Signed by: harald
GPG key ID: F519A1143B3FBE32
5 changed files with 125 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
examples/README.md
View file

@ -30,7 +30,8 @@ $ docker compose up
2023-08-23T14:48:07.278090Z INFO vault_unseal: Got Response: {"unseal_keys":["wcDMA9FaOxXbOhL7AQv7BoGfG5K+78RHV6LGqT5k/M1e8GP3pvBHTeY1lReCo2bkLmm4k4KBxdqNLSE8lV4urN5iWTAt74jCoC+uuAeA2OSL7AidX+HcftzcAXhJp2INtkyqsL8xGaPgpZxXj77fJ/Z7HW1mUlAxJowdZudvA5DmJls6u8VK6YtY3deLGbMRVygXFG+NGabNrRQ0nnFMMMCPXZ39ETitJyfFX6x4BizVQixagN9IqkozXLiupoHD4N0LOESDIm2MuqPnGAk0X6YgyZhFZc8uCrN9W/zNkXQ7eJxIamsLysVnPGaNQ92VQlz4aFAJLKrMCvGrtrxQJk9N+P47EArGCl9bP2hXfg783arXF6Bp/YgGgpvJRFZ04nMNDlIcIFuV5QBfiJX1hNIXg0MVlqmzVeGDVHlys+2mOvOO8seIBG1p4FGRQr6YWI4KxaN6sVA5DNclvITWiH/6H50SUJqXQ5M6rfEoBajYenpzZwYXb0oGzVHrUg5AnfPSuYRT0p8dAPz3/9vE0nEBzNeNVedEwwbgHP1aSPK8J3pPgoRVMyiq7gXzJEXoG5PLJEq4poQ1QwevAVTNv5Pu/TvTacDkJfVcBL5fukB9fj/WJktxEXmznEK3GMBBmvIAVLkgCEl+dH17CxvKq2ik6AfAHVdmEPcNw0ViNCZj1Q=="]}
{"unseal_keys":["wcDMA9FaOxXbOhL7AQv7BoGfG5K+78RHV6LGqT5k/M1e8GP3pvBHTeY1lReCo2bkLmm4k4KBxdqNLSE8lV4urN5iWTAt74jCoC+uuAeA2OSL7AidX+HcftzcAXhJp2INtkyqsL8xGaPgpZxXj77fJ/Z7HW1mUlAxJowdZudvA5DmJls6u8VK6YtY3deLGbMRVygXFG+NGabNrRQ0nnFMMMCPXZ39ETitJyfFX6x4BizVQixagN9IqkozXLiupoHD4N0LOESDIm2MuqPnGAk0X6YgyZhFZc8uCrN9W/zNkXQ7eJxIamsLysVnPGaNQ92VQlz4aFAJLKrMCvGrtrxQJk9N+P47EArGCl9bP2hXfg783arXF6Bp/YgGgpvJRFZ04nMNDlIcIFuV5QBfiJX1hNIXg0MVlqmzVeGDVHlys+2mOvOO8seIBG1p4FGRQr6YWI4KxaN6sVA5DNclvITWiH/6H50SUJqXQ5M6rfEoBajYenpzZwYXb0oGzVHrUg5AnfPSuYRT0p8dAPz3/9vE0nEBzNeNVedEwwbgHP1aSPK8J3pPgoRVMyiq7gXzJEXoG5PLJEq4poQ1QwevAVTNv5Pu/TvTacDkJfVcBL5fukB9fj/WJktxEXmznEK3GMBBmvIAVLkgCEl+dH17CxvKq2ik6AfAHVdmEPcNw0ViNCZj1Q=="]}
❯ echo wcDMA9FaOxXbOhL7AQv7BoGfG5K+78RHV6LGqT5k/M1e8GP3pvBHTeY1lReCo2bkLmm4k4KBxdqNLSE8lV4urN5iWTAt74jCoC+uuAeA2OSL7AidX+HcftzcAXhJp2INtkyqsL8xGaPgpZxXj77fJ/Z7HW1mUlAxJowdZudvA5DmJls6u8VK6YtY3deLGbMRVygXFG+NGabNrRQ0nnFMMMCPXZ39ETitJyfFX6x4BizVQixagN9IqkozXLiupoHD4N0LOESDIm2MuqPnGAk0X6YgyZhFZc8uCrN9W/zNkXQ7eJxIamsLysVnPGaNQ92VQlz4aFAJLKrMCvGrtrxQJk9N+P47EArGCl9bP2hXfg783arXF6Bp/YgGgpvJRFZ04nMNDlIcIFuV5QBfiJX1hNIXg0MVlqmzVeGDVHlys+2mOvOO8seIBG1p4FGRQr6YWI4KxaN6sVA5DNclvITWiH/6H50SUJqXQ5M6rfEoBajYenpzZwYXb0oGzVHrUg5AnfPSuYRT0p8dAPz3/9vE0nEBzNeNVedEwwbgHP1aSPK8J3pPgoRVMyiq7gXzJEXoG5PLJEq4poQ1QwevAVTNv5Pu/TvTacDkJfVcBL5fukB9fj/WJktxEXmznEK3GMBBmvIAVLkgCEl+dH17CxvKq2ik6AfAHVdmEPcNw0ViNCZj1Q== | base64 --decode | gpg -dq | RUST_LOG=info cargo run -p vault-unseal -- --sgx-mrsigner c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d --sgx-allowed-tcb-levels SwHardeningNeeded --server https://20.172.154.218:8443 unseal
❯ echo wcDMA9FaOxXbOhL7AQv7BoGfG5K+78RHV6LGqT5k/M1e8GP3pvBHTeY1lReCo2bkLmm4k4KBxdqNLSE8lV4urN5iWTAt74jCoC+uuAeA2OSL7AidX+HcftzcAXhJp2INtkyqsL8xGaPgpZxXj77fJ/Z7HW1mUlAxJowdZudvA5DmJls6u8VK6YtY3deLGbMRVygXFG+NGabNrRQ0nnFMMMCPXZ39ETitJyfFX6x4BizVQixagN9IqkozXLiupoHD4N0LOESDIm2MuqPnGAk0X6YgyZhFZc8uCrN9W/zNkXQ7eJxIamsLysVnPGaNQ92VQlz4aFAJLKrMCvGrtrxQJk9N+P47EArGCl9bP2hXfg783arXF6Bp/YgGgpvJRFZ04nMNDlIcIFuV5QBfiJX1hNIXg0MVlqmzVeGDVHlys+2mOvOO8seIBG1p4FGRQr6YWI4KxaN6sVA5DNclvITWiH/6H50SUJqXQ5M6rfEoBajYenpzZwYXb0oGzVHrUg5AnfPSuYRT0p8dAPz3/9vE0nEBzNeNVedEwwbgHP1aSPK8J3pPgoRVMyiq7gXzJEXoG5PLJEq4poQ1QwevAVTNv5Pu/TvTacDkJfVcBL5fukB9fj/WJktxEXmznEK3GMBBmvIAVLkgCEl+dH17CxvKq2ik6AfAHVdmEPcNw0ViNCZj1Q==
| base64 --decode | gpg -dq | RUST_LOG=info cargo run -p vault-unseal -- --sgx-mrsigner c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d --sgx-allowed-tcb-levels SwHardeningNeeded --server https://20.172.154.218:8443 unseal
Finished dev [unoptimized + debuginfo] target(s) in 0.09s
Running `target/debug/vault-unseal --sgx-mrsigner c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d --sgx-allowed-tcb-levels SwHardeningNeeded --server 'https://20.172.154.218:8443' unseal`
2023-08-23T14:48:20.735605Z INFO tee_client: Getting attestation report
@ -54,7 +55,7 @@ to sign the admin tee:
```bash
❯ (id=$(docker create teepot-vault-admin-sgx-azure); docker cp $id:/app/teepot-vault-admin-sgx-azure.sig ~/teepot-vault-admin-sgx-azure.sig; docker rm -v $id)
❯ cargo run -p vault-admin -- create-sign-request --tee-name admin ~/teepot-vault-admin-sgx-azure.sig > ~/sign_admin_tee.json
❯ vim sign_admin_tee.json
❯ vim ~/sign_admin_tee.json
❯ gpg --local-user test@example.com --detach-sign --armor ~/sign_admin_tee.json
❯ RUST_LOG=info cargo run -p vault-admin -- \
sign-tee \

40
examples/k8s/vault-unseal-pod-0.yaml Normal file
View file

@ -0,0 +1,40 @@
apiVersion: v1
kind: Pod
metadata:
labels:
app: teepot-vault-unseal-0
name: teepot-vault-unseal-0
namespace: stage2
spec:
tolerations:
- key: sgx.intel.com/provision
operator: Exists
effect: NoSchedule
containers:
- image: matterlabsrobot/teepot-vault-unseal-sgx-azure:latest
name: vault-unseal
imagePullPolicy: Always
env:
- name: VAULT_ADDR
value: "https://teepot-vault-0.teepot-vault:8210"
- name: ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
- name: VAULT_SGX_ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
# - name: VAULT_SGX_MRENCLAVE
# value: "7754423259719411a536d3a11d0bf764b0910e44a9e15721d879d763a5f3fa39"
- name: VAULT_SGX_MRSIGNER
value: "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d"
ports:
- containerPort: 8443
name: https
protocol: TCP
resources:
limits:
sgx.intel.com/epc: "10Mi"
requests:
sgx.intel.com/epc: "10Mi"
securityContext:
privileged: true
restartPolicy: Never
status: { }

40
examples/k8s/vault-unseal-pod-1.yaml Normal file
View file

@ -0,0 +1,40 @@
apiVersion: v1
kind: Pod
metadata:
labels:
app: teepot-vault-unseal-1
name: teepot-vault-unseal-1
namespace: stage2
spec:
tolerations:
- key: sgx.intel.com/provision
operator: Exists
effect: NoSchedule
containers:
- image: matterlabsrobot/teepot-vault-unseal-sgx-azure:latest
name: vault-unseal
imagePullPolicy: Always
env:
- name: VAULT_ADDR
value: "https://teepot-vault-1.teepot-vault:8210"
- name: ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
- name: VAULT_SGX_ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
# - name: VAULT_SGX_MRENCLAVE
# value: "7754423259719411a536d3a11d0bf764b0910e44a9e15721d879d763a5f3fa39"
- name: VAULT_SGX_MRSIGNER
value: "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d"
ports:
- containerPort: 8443
name: https
protocol: TCP
resources:
limits:
sgx.intel.com/epc: "10Mi"
requests:
sgx.intel.com/epc: "10Mi"
securityContext:
privileged: true
restartPolicy: Never
status: { }

40
examples/k8s/vault-unseal-pod-2.yaml Normal file
View file

@ -0,0 +1,40 @@
apiVersion: v1
kind: Pod
metadata:
labels:
app: teepot-vault-unseal-2
name: teepot-vault-unseal-2
namespace: stage2
spec:
tolerations:
- key: sgx.intel.com/provision
operator: Exists
effect: NoSchedule
containers:
- image: matterlabsrobot/teepot-vault-unseal-sgx-azure:latest
name: vault-unseal
imagePullPolicy: Always
env:
- name: VAULT_ADDR
value: "https://teepot-vault-2.teepot-vault:8210"
- name: ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
- name: VAULT_SGX_ALLOWED_TCB_LEVELS
value: "SwHardeningNeeded"
# - name: VAULT_SGX_MRENCLAVE
# value: "7754423259719411a536d3a11d0bf764b0910e44a9e15721d879d763a5f3fa39"
- name: VAULT_SGX_MRSIGNER
value: "c5591a72b8b86e0d8814d6e8750e3efe66aea2d102b8ba2405365559b858697d"
ports:
- containerPort: 8443
name: https
protocol: TCP
resources:
limits:
sgx.intel.com/epc: "10Mi"
requests:
sgx.intel.com/epc: "10Mi"
securityContext:
privileged: true
restartPolicy: Never
status: { }