Implement KBS API integration for LUKS key and AK management by iroykaufman · Pull Request #242 · trusted-execution-clusters/operator

iroykaufman · 2026-04-16T15:27:58Z

Currently, every time the LUKS key or the AK is updated, the operator patches the trustee deployment, which causes a restart of the pod. This PR introduces a way to avoid this by setting the AK and LUKS using the KBS API.

Core implementation points:

Right before the trustee first deploys the operator, create an auth key for the KBS API and save it as a kube secret.
Replacing the patch mechanism with API calls
Add a reconcile loop that watches for changes in the trustee deployment and sync the AK and LUKS key that was lost.

Tests:

test_luks_key_sync - this test checks that the luks key is first sent to tustee and validates that after trustee restarts, the keys are sent again.
test_attestation_key_sync - The same flow as with the luks key test.

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

- Implemented `send_secret` function in `trustee.rs` to send secrets to the KBS API. - Updated `compute-pcrs-lib` dependency to a specific revision for stability. - Added installation of `perl-FindBin` and `perl-core` and update dependency. for kbs-client building requirements. Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

openshift-ci · 2026-04-16T15:28:02Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-04-16T15:28:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: iroykaufman

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-04-16T15:28:07Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

alicefr · 2026-04-17T08:47:55Z

 # In debug builds, build dependencies to avoid full rebuild.
 RUN if [ "$build_type" = debug ]; then cargo build -p operator; fi

+RUN dnf install -y perl-FindBin perl-core


Why do we need these dependecies?

The openssl-sys fails when this dependency is missing. This is because I bumped all the dependency versions, the upstream uses openssl-sys 0.9.112, and here it is openssl-sys 0.9.113. This is the error message:

cargo:warning=configuring OpenSSL build: 'perl' reported failure with exit status: 2 cargo:warning=openssl-src: failed to build OpenSSL from source --- stderr Can't locate FindBin.pm in @INC (you may need to install the FindBin module) (@INC entries checked: /usr/local/lib64/perl5/5.42 /usr/local/share/perl5/5.42 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at ./Configure line 15. BEGIN failed--compilation aborted at ./Configure line 15.

alicefr · 2026-04-17T08:48:30Z

+        .context("Secret missing root key")?
+        .0
+        .clone();
+    let url = format!("http://{TRUSTEE_SERVICE}:{TRUSTEE_PORT}");


We definitely https here, when #196 is merged, you should test it with it

alicefr · 2026-04-17T09:33:51Z

I would love to see some integration tests here that creates multiple machine and try to restart the trustee pod and see if the secrets are correctly present also after the restart. Also a test where an secret was present before the restart of the trustee pod and that after a secret is dynamicall added and then deleted.

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

alicefr · 2026-04-30T12:22:17Z


 [admin]
 insecure_api = true
+auth_public_key="/key/public.pub"


nit: space between the 2 string and the =

alicefr · 2026-04-30T12:34:45Z

 serde_json.workspace = true
 thiserror = "2.0.18"
 tokio.workspace = true
+kbs-client = {git = "https://github.com/iroykaufman/trustee/", branch = "ak-registration"}


Any reason for using your fork?

Yes, currently registering AK using the KBS API is not supported. I created this PR#1306 to include support.

alicefr · 2026-04-30T12:42:55Z

+        .filter(|secret| {
+            secret.metadata.deletion_timestamp.is_none()
+                && secret
+                    .metadata
+                    .owner_references
+                    .as_ref()
+                    .map(|owners| owners.iter().any(|owner| owner.kind == "Machine"))
+                    .unwrap_or(false)
+        })


Instead of filtering by owner, we can introduce a label and mark the secret owned by a machine. In this way, the filtering is doing by kubernetes api

alicefr · 2026-04-30T13:15:30Z

+            .and_then(|s| s.replicas)
+            .unwrap_or(1);
+        let ready = status.ready_replicas.unwrap_or(0);
+        if ready >= desired && desired > 0 {


why do we need the desired? Cannot we simply evaluate ready > 1 ?

alicefr · 2026-04-30T13:17:20Z

+    let now = Utc::now().to_rfc3339();
+    let patch = json!({
+        "spec": {
+            "template": {
+                "metadata": {
+                    "annotations": {
+                        "kubectl.kubernetes.io/restartedAt": now
+                    }
+                }
+            }
+        }
+    });


cannot we simply delete the kbs pod?

alicefr · 2026-04-30T13:18:45Z

can we also test the deletion of a secret in one of the integration tests

iroykaufman added 4 commits March 26, 2026 15:34

add auth keys for trustee

1d2bffc

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

Add delete secret

dd076ab

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

Migrate the AK registartion to use KBS API

b8f18ac

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

openshift-ci Bot added the do-not-merge/work-in-progress label Apr 16, 2026

openshift-ci Bot added the needs-rebase label Apr 16, 2026

iroykaufman changed the title ~~Implement KBS API integration for LUSK key and AK management~~ Implement KBS API integration for LUKS key and AK management Apr 16, 2026

alicefr reviewed Apr 17, 2026

View reviewed changes

Comment thread operator/src/trustee.rs Outdated

alicefr reviewed Apr 17, 2026

View reviewed changes

Comment thread operator/src/trustee.rs Outdated

alicefr reviewed Apr 17, 2026

View reviewed changes

Comment thread operator/src/main.rs Outdated

Jakob-Naucke reviewed Apr 20, 2026

View reviewed changes

Comment thread operator/src/trustee.rs

Add trustee sync logic and tests

c4b9d73

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

iroykaufman force-pushed the kbs-api branch from 97204a6 to c4b9d73 Compare April 29, 2026 14:45

alicefr reviewed Apr 30, 2026

View reviewed changes

iroykaufman closed this May 4, 2026

Conversation

iroykaufman commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Core implementation points:

Tests:

Uh oh!

openshift-ci Bot commented Apr 16, 2026

Uh oh!

openshift-ci Bot commented Apr 16, 2026

Uh oh!

openshift-ci Bot commented Apr 16, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alicefr commented Apr 17, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alicefr Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alicefr commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iroykaufman commented Apr 16, 2026 •

edited

Loading

alicefr Apr 30, 2026 •

edited

Loading

alicefr commented Apr 30, 2026 •

edited

Loading