Kbs update - #59
Merged
Merged
Kbs update#59
Conversation
CoCo v0.22.0 ships Trustee v0.21.0. The previous default image (built-in-as-v0.17.0) predates the rework of the KBS configuration schema, so it cannot consume the new config format generated by the following commits. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
There was a problem hiding this comment.
Pull request overview
Updates the Trustee/KBS integration to align with Trustee v0.21.0 (as shipped with CoCo v0.22.0), including the updated KBS configuration schema and admin authentication model, and adjusts tests/docs accordingly.
Changes:
- Update Trustee deployment manifests and auth Secret layout for KBS v0.21.0 (new admin JWT + regex ACL config, unified storage backend, new key mount path).
- Add/adjust tests validating the v0.21.0 ConfigMap/KBS manifest expectations and JWT role claim handling.
- Refresh evaluation workflow expectations and internal architecture documentation to reflect the new storage location and admin HTTP API flow.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/trustee/trustee.go | Updates KBS ConfigMap/Deployment generation for v0.21.0 schema and admin auth key mount expectations. |
| pkg/trustee/trustee_test.go | Expands/updates tests to validate the v0.21.0 config schema and mount paths. |
| pkg/kbsclient/jwt.go | Adds role: "admin" claim required by v0.21.0 authorization. |
| pkg/kbsclient/client_test.go | Extends JWT claims test to assert the new role claim. |
| pkg/config/config.go | Bumps default KBS image tag to v0.21.0 and updates config comments. |
| eval/tier2_cluster_test.go | Updates on-disk verification paths for resources under the unified LocalFs backend. |
| CLAUDE.md | Updates internal documentation to reflect the new KBS deployment/auth/schema and upload flow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Trustee v0.21.0 reworked its configuration: insecure_key was renamed to insecure_header_jwk, the per-plugin LocalFs repository was replaced by a unified [storage_backend] plus a kvstorage resource plugin, the resource policy is embedded at startup instead of an OPA policy path, and built-in RVPS reads reference values from the storage backend rather than a mounted file. The Intel DCAP verifier no longer reads sgx_default_qcnl.conf, so the PCCS URL moves into attestation_service.verifier_config.dcap_verifier and the separate dcap-attestation-conf ConfigMap is dropped. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
CoCo v0.22.0 ships a reworked admin authentication framework in Trustee, and InsecureAllowAll no longer matches the upstream default. Mount the admin public key Secret at /kbs so the key lands at /kbs/kbs.pem where the bearer JWT identity provider reads it, and add the admin role claim to the admin token that the regex ACL requires to authorize requests. Unauthenticated requests and tokens signed with foreign keys are now rejected with 401. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
Trustee v0.21.0 persists resources through the unified LocalFs storage backend instead of the plain repository tree, and escapes the key's slash separators as \x2F in file names. Point the eval checks at storage/repository with the new layout so uploaded resources can be found inside the pod. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
Keep the documented deployment internals aligned with the v0.21.0 schema and admin API flow so future work starts from an accurate picture of how cococtl talks to the KBS. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.