deployment: add kds store config in helm for VCeK caching - #2
Closed
hgowda-amd wants to merge 2 commits into
Closed
Conversation
hgowda-amd
force-pushed
the
helm-snp-offline-vcek-store
branch
2 times, most recently
from
August 15, 2026 01:22
a9079a5 to
f632121
Compare
hgowda-amd
changed the title
hgowda-amd
force-pushed
the
helm-snp-offline-vcek-store
branch
10 times, most recently
from
August 19, 2026 18:05
3792b08 to
3cc7a98
Compare
README.md.gotmpl and values.yaml # -- comments for IBM SE had drifted from the generated README.md. Update the sources to match the existing README wording so a subsequent helm-docs run keeps that shape. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com> Co-authored-by: Cursor <cursoragent@cursor.com>
The SNP verifier resolves a VCEK certificate per attestation report and
defaults to fetching it from AMD KDS, which requires outbound
connectivity from the Attestation Service. The verifier already supports
an OfflineStore source that reads from
/opt/confidential-containers/attestation-service/kds-store, but only the
Docker Compose deployment could populate it. The Helm chart could neither
mount a certificate store nor set snp_verifier.vcek_sources, so
air-gapped clusters had no way to run SNP attestation.
Chart:
- New values as.verifier.snp.{kdsStoreHostPath,nodeName,vcekSources}.
- snp-kds-store-pv.yaml and snp-kds-store-pvc.yaml create a local-type
PV with nodeAffinity pinned to nodeName, plus a ReadWriteOnce PVC
bound through volumeName. This needs no StorageClass object: local is
an in-tree plugin and the binding is static.
- as-deployment.yaml mounts the PVC read-only at the verifier's default
offline store path, so OfflineStore entries require no explicit path.
- _helpers.tpl renders vcekSources into snp_verifier.vcek_sources, and
fails rendering on the two inconsistent combinations: an OfflineStore
source without kdsStoreHostPath and nodeName (nothing is mounted, so
it fails at the first attestation), and kdsStoreHostPath without an
OfflineStore source (the mount is never read). Neither reports itself
usefully at runtime, so both are caught at install time.
vcekSources defaults to [], which omits the snp_verifier block entirely
so SnpVerifierConfig applies its serde default of KDS; existing
deployments render an unchanged AS config. The block is omitted rather
than emitted empty because an explicit vcek_sources: [] deserializes
to an empty source list instead of the default, leaving the verifier
with no way to obtain a certificate.
CI:
- workflow-call-helm-e2e.yml takes optional kind-config and scenario
inputs, forwarded to the helm/kind-action config parameter and to make
as E2E_BASE_SCENARIO. Legs that set neither are unaffected.
- The nightly SNP leg passes e2e/snp/kind-config.yaml, which bind-mounts
the host store into the kind node, and scenarios/snp-nightly-e2e.yaml,
which lists KDS first with OfflineStore as fallback so the leg does
not fail when the runner's certificates are stale. The tradeoff is
that it does not exercise the offline path in isolation. The scenario
sets log_level: debug because the verifier logs per-source VCEK
failures only at debug. Staging the certificates is part of SNP runner
setup, not the workflow.
Docs: README.md.gotmpl gains an SNP section and README.md is regenerated
with helm-docs; amd-offline-certificate-cache.md now covers the Helm
deployment alongside Docker Compose.
Signed-off-by: Harshitha Gowda <hgowda@amd.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Xynnn007
force-pushed
the
helm-snp-offline-vcek-store
branch
from
August 20, 2026 02:11
3cc7a98 to
401a4e4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.