baremetal-coco: tdx: Add DCAP deployment

[fidencio]

Please, see each commit message for a better explanation of what's being done.

This is out for early testing, and there are a few things to consider:

• We will NOT require any SELinux changes, as I was able to work that requirement around with an init container
• Tests must be performed on multi-node setup, as so far it's only been tested on single node ones

I will give instructions to @bpradipt, and give him access to a clean SNO cluster, so he can go ahead and give it a try during the time I will be off.

KNOWN ISSUES:

• Registration on a factory reset machine leads to the following error:
  • From the registration pods logs:

  Error: unexpected error occurred while sending data to cache server.
  Error: the data couldn't be sent to cache server!
  
  Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.22.100.3
  
  Warning: platform manifest is not available or current platform is not multi-package platform.
  

  • From the pccs pod logs:

  2024-12-19 19:03:00.253 [info]: Client Request-ID : 27fdde775ad94d3e8274ed805ab4ba8b
  2024-12-19 19:03:00.257 [info]: Executing (default): SELECT `qe_id`, `pce_id`, `platform_manifest`, `enc_ppid`, `fmspc`, `ca`, `created_time`, `updated_time` FROM `platforms` AS `Platforms` WHERE `Platforms`.`qe_id` = '16D27A5828C08A20BAE67D9EA535B88B' AND `Platforms`.`pce_id` = '0000';
  2024-12-19 19:03:00.582 [info]: Request-ID is : 4b80d2c7d79b4357bda779a72422dc89
  2024-12-19 19:03:00.582 [debug]: Request URL https://api.trustedservices.intel.com/sgx/certification/v4/pckcerts
  2024-12-19 19:03:00.583 [error]: Intel PCS server returns error(404).
  2024-12-19 19:03:00.583 [error]: Error: No cache data for this platform.
    at Module.getPckCertFromPCS (file:///opt/intel/pccs/services/logic/commonCacheLogic.js:159:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async LazyCachingMode.registerPlatforms (file:///opt/intel/pccs/services/caching_modes/cachingMode.js:163:7)
    at async Module.registerPlatforms (file:///opt/intel/pccs/services/platformsRegService.js:107:3)
    at async postPlatforms (file:///opt/intel/pccs/controllers/platformsController.js:52:5)
  2024-12-19 19:03:00.586 [info]: 10.128.0.40 - - [19/Dec/2024:19:03:00 +0000] "POST /sgx/certification/v4/platforms HTTP/1.1" 404 32 "-" "-"
  

• registration pod may start before the pccs pod after a reboot

[openshift-ci]

Hi @fidencio. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[fidencio]

Please, pretty please, let's have it properly tested before merged. :-)

[mythi]

minor suggestions

[fidencio]

@bpradipt, this one is finally ready to be reviewed (and hopefully, merged!)

[lmilleri]

does the dcap need to run in a privileged mode?

[fidencio]

Yes, it does, unfortunately.

For this, I think we can just leave it as it is for now, as soon enough we should not need to run DCAP / PCCS / QGS from inside a container, with everything being packaged as part of the virt sig.

[fidencio]

I started testing this version of the PR, as it is ... let's see how it goes ...

[gkurz]

/lgtm

Thanks @fidencio !

I started testing this version of the PR, as it is ... let's see how it goes ...

This PR could potentially skip CI since nothing calls this code but I have no control on that AFAIK. I'll thus start CI when you are done with your testing.

[bpradipt]

/lgtm

[fidencio]

I started testing this version of the PR, as it is ... let's see how it goes ...

Finished the tests on my side, on an environment that's not behind proxies and it works as expected.
I'd consider this good enough to be merged, and any other adjustment can come later on.

[openshift-ci]

@fidencio: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.