keylime-control-plane-image

SHA256

Go to file

Alberto Planas Dominguez dd81777a7b Accepting request 1093326 from home:dimstar:branches:devel:microos:containers - Use keylime-registrar as leading package to set the version number: the python package changes name depending on python version in use. OBS-URL: https://build.opensuse.org/request/show/1093326 OBS-URL: https://build.opensuse.org/package/show/devel:microos:containers/keylime-control-plane-image?expand=0&rev=8		2023-06-15 13:43:49 +00:00
_service	Accepting request 1093326 from home:dimstar:branches:devel:microos:containers	2023-06-15 13:43:49 +00:00
.gitattributes	Accepting request 1029993 from home:aplanas:branches:devel:BCI:Tumbleweed	2022-10-20 08:41:42 +00:00
.gitignore	Accepting request 1029993 from home:aplanas:branches:devel:BCI:Tumbleweed	2022-10-20 08:41:42 +00:00
Dockerfile	Accepting request 1070182 from home:aplanas:branches:devel:microos:containers	2023-03-08 12:59:52 +00:00
keylime-control-plane-image.changes	Accepting request 1093326 from home:dimstar:branches:devel:microos:containers	2023-06-15 13:43:49 +00:00
keylime-control-plane-start.sh	Accepting request 1030208 from home:aplanas:branches:devel:BCI:Tumbleweed	2022-10-20 14:31:39 +00:00
README	Accepting request 1069190 from home:aplanas:branches:devel:microos:containers	2023-03-03 15:16:26 +00:00

README

Keylime control plane
---------------------

This container delivers the control plane service (verifier and
registrar) and command line tool (tenant) for the Keylime project for
remote attestation based on TPM2.

Installation and use
--------------------

The container is already present in the OBS project
devel:microos:containers, and can be pulled directly from it.

podman pull \
registry.opensuse.org/devel/microos/containers/containerfile/opensuse/keylime-control-plane:latest

The different services will require an additional volume to persist
the database and certificates required during the attestation process.
A volume can be created running the "install" label.

podman container runlabel install \
registry.opensuse.org/devel/microos/containers/containerfile/opensuse/keylime-control-plane:latest

This will create the "keylime-control-plane-volume" volume. This
command should be executed only one time.

To launch the services we can execute the "run" label.

podman container runlabel run \
registry.opensuse.org/devel/microos/containers/containerfile/opensuse/keylime-control-plane:latest

This will create the "keylime-control-plane-container" container, and
inside there the Keylime registrar and verifier services will be
configured and executed.

Internally it will expose several ports from the container into the
host, using the default values. Validate the firewall configuration
to allow the access to those ports, and to allow communication
intra-containers, as this will be required later when we execute the
tenant CLI.

We can monitor the status with podman.

podman ps

podman logs keylime-control-plane-container

The first time that this container gets executed, the services will
create a certificate that will be required later by the different
agents. We can extract the certificate with this command:

podman cp \
keylime-control-plane-container:/var/lib/keylime/cv_ca/cacert.crt .

Another possibility is to mount the "keylime-control-plane-volume" and
copy it from there.

The tenant CLI tool is present in the container, and if the host
firewall is properly configured, it can be executed using the same
image.

podman run --rm \
-v keylime-control-plane-container:/var/lib/keylime \
keylime-control-plane:latest \
keylime_tenant -v 10.88.0.1 -r 10.88.0.1 --cert default -c reglist

We can stop the services via the kill command.

podman kill keylime-control-plane-container