Confidential Computing

Confidential Computing is a technology which allows protection of data in use by using hardware-based Trusted Execution Environment (TEE), the type of environments that provide increased level of security for data integrity, data confidentiality, and code integrity.

1. Confidential Computing with Uyuni

The trustworthiness of the TEE is checked with the attestation process. Uyuni can be used as an attestation server for the systems registered to it. It generates a report page for the systems which run in this mode. These systems need to be attested and checked on regular base. The history of the past checks is also stored and available per request.

Confidential Computing Attestation depends on the used hardware and environment where the attested systems are running on.

Confidential Computing Attestation is only available when Uyuni is running on x86-64 architecture.

2. Requirements

Confidential Computing can be set up in an environment with the following characteristics:

  • Attested system (virtual machine) is bootstrapped to Uyuni and runs on one of the following systems:

    • SUSE Linux Enterprise 15 SP6

    • SUSE Linux Enterprise 15 SP7

    • SUSE Linux Enterprise 16

    • openSUSE Leap 15 SP6

    • openSUSE Leap 15 SP7

    • openSUSE Leap 16

  • Hardware must have one of the following CPUs:

    • AMD EPYC Milan

    • AMD EPYC Genoa

    • AMD EPYC Bergamo

    • AMD EPYC Siena

    • AMD EPYC Turin

    • IBM z16

    • IBM z17

  • BIOS must be configured to allow Confidential Computing attestation

  • Host OS and the virtualization software (KVM and libvirt) must support Confidential Computing

  • For information about required URLs when performing confidential computing attestation for IBM, see see Required URLs.

3. Limitations

Secure boot is attested. However, currently KVM secure boot and AMD attestation tool snpguest are not working together.

4. Use Confidential Computing in Uyuni

For the exact steps for setting up and configuring Confidential Computing on your host, refer to the OS Vendor documentation.
Procedure: Enabling Attestation Container During the Uyuni Installation

  1. The attestation container is enabled during the installation of Uyuni with mgradm install.

  2. Add the following to file mgradm.yaml.

    coco:
    replicas: 1
Procedure: Enabling Attestation Container After the Uyuni Installation

  1. To enable the attestation container after the installation, use the command line parameter mgradm.

  2. Run the command

    mgradm scale uyuni-server-attestation --replicas 1
Procedure: Disabling Attestation Container After the Uyuni Installation

  1. To disable the already enabled attestation container, run the command:

    mgradm scale uyuni-server-attestation --replicas 0
Procedure: Enabling Attestation

  1. For the selected system, go to tab Audit  Confidential Computing  Settings.

  2. Enable the attestation by selecting the toggle button.

  3. In the field Environment Type select the correct option from the drop-down list.

  4. If the field Environment Type is set to one of the IBM z-series CPU values, two more settings are required, Host Key Document and Secure Execution Header.

    Host Key Document is a public key certificate of the IBM hypervisor server instance where the attested system is going to run.

    Secure Execution Header is a binary file needed to build the IBM secure VM image of the attested system.

    Both files should be requested by the administrator creating the attested system VM running on the IBM hypervisor.

    Host Key Document and Secure Execution Header are not security sensitive, therefore it is safe to store them on the Uyuni server.

  5. Click button Save to save the changes.

Procedure: Scheduling New Attestation

  1. For the selected system, go to tab Audit  Confidential Computing  List Attestations.

  2. Click Schedule Attestation. The new form opens.

  3. In the field Earliest select the time of running the attestation.

  4. If needed, add the newly created attestation to the action chain by selecting Add to option.

  5. Click button Schedule to save and schedule the new attestation execution.

Procedure: Viewing Attestation Reports from System Details

  1. For the selected system, go to tab Audit  Confidential Computing  List Attestations.

  2. Find and select the report you want to view.

  3. After clicking the selected attestation report tab Overview will open.

    1. If the selected CPU is AMD you will be shown additional tabs SEV-SNP and Secure boot.

    2. If the selected CPU is IBM you will be shown additional tab IBM SELPVATTEST.

Procedure: Viewing Attestation Reports from Audit

  1. From the navigation bar, select Audit  Confidential Computing.

  2. The list of all attestations will be shown in the main panel.

  3. Find and select the report you want to view.

4.1. Report Statuses

Attestation reports can have one of the following statuses:

Pending

This is the default status of the scheduled attestation. The report is still not available, either because the process has not yet started or completed.

Successful

When the scheduled attestation creates a report which can be viewed, the status of the process is Successful.

Failed

When the scheduled fails and does not create a report as a result, the status of the process is Failed.

5. Related Topics

For more information about Confidential Computing, see here.