Skip to content

Commit 85d5fe5

Browse files
alicefralicefr
authored
Merge pull request #171 from alicefr/use-secret-kv
Change how to pass ignition to KubeVirt VMs
2 parents 4d27ca9 + 8e871a8 commit 85d5fe5

File tree

9 files changed

+171
-87
lines changed

9 files changed

+171
-87
lines changed

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ COMPUTE_PCRS_IMAGE=$(REGISTRY)/compute-pcrs:$(TAG)
2828
REG_SERVER_IMAGE=$(REGISTRY)/registration-server:$(TAG)
2929
ATTESTATION_KEY_REGISTER_IMAGE=$(REGISTRY)/attestation-key-register:$(TAG)
3030
TRUSTEE_IMAGE ?= quay.io/trusted-execution-clusters/key-broker-service:20260106
31-
# tagged as 2026-01-20-attestation
32-
APPROVED_IMAGE ?= quay.io/trusted-execution-clusters/fedora-coreos@sha256:79a0657399e6c67c7c95b8a09193d18e5675b5aa3cfb4d75ea5c8d4d53b2af74
31+
# tagged as 42.20251012.2.0
32+
APPROVED_IMAGE ?= quay.io/trusted-execution-clusters/fedora-coreos@sha256:6997f51fd27d1be1b5fc2e6cc3ebf16c17eb94d819b5d44ea8d6cf5f826ee773
3333

3434
BUILD_TYPE ?= release
3535
IMAGE_BUILD_OPTION ?=

‎REUSE.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ path = [
1616
"lib/src/vendor_kopium/*",
1717
"must-gather/README.md",
1818
"tests/README.md",
19-
"examples/vm-coreos-ign.yaml",
19+
"examples/*",
2020
"scripts/install-kubevirt.sh"
2121
]
2222
SPDX-FileCopyrightText = [

‎examples/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Examples
2+
3+
The examples directories contains how you can run and attest a [KubeVirt](https://github.com/kubevirt/kubevirt) VM against the Trusted Execution Clusters operator.
4+
5+
## How to use KubeVirt example
6+
7+
Before provisioning the KubeVirt VM, a secret with the ignition configuration needs to be created. You can use the helper script:
8+
```console
9+
examples/create-ignition-secret.sh examples/ignition-coreos.json coreos-ignition-secret
10+
```
11+
12+
The `ignition-coreos.json` contains some basic configuration for the attestation server and the merge request for the clevis pin.
13+
14+
Then, the KubeVirt VM can be deployed:
15+
```console
16+
kubectl apply -f examples/vm-coreos-ign.yaml
17+
```
18+
19+
The example deploys an image build from the [investigations](https://github.com/trusted-execution-clusters/investigations) repository.

‎examples/create-ignition-secret.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
# Script to create a Kubernetes secret from an Ignition configuration file
3+
# Usage: ./create-ignition-secret.sh <ignition-file> <secret-name> [namespace]
4+
5+
set -e
6+
7+
8+
if [ $# -lt 2 ]; then
9+
echo "Usage: $0 <ignition-file> <secret-name> [namespace]"
10+
echo "Example: $0 ignition-coreos.json coreos-ignition-secret trusted-execution-clusters"
11+
exit 1
12+
fi
13+
14+
IGNITION_FILE="$1"
15+
SECRET_NAME="$2"
16+
NAMESPACE="${3:-default}"
17+
18+
if [ ! -f "$IGNITION_FILE" ]; then
19+
echo "Error: Ignition file '$IGNITION_FILE' not found"
20+
exit 1
21+
fi
22+
23+
echo "Creating Kubernetes secret '$SECRET_NAME' in namespace '$NAMESPACE' from '$IGNITION_FILE'..."
24+
kubectl create secret generic "$SECRET_NAME" \
25+
--from-file=userdata="$IGNITION_FILE" \
26+
--namespace="$NAMESPACE" \
27+
--dry-run=client -o yaml | kubectl apply -f -

‎examples/ignition-coreos.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"ignition": {
3+
"config": {
4+
"merge": [
5+
{
6+
"source": "http://register-server.trusted-execution-clusters.svc.cluster.local:8000/ignition-clevis-pin-trustee"
7+
}
8+
]
9+
},
10+
"version": "3.6.0-experimental"
11+
},
12+
"passwd": {
13+
"users": [
14+
{
15+
"name": "core",
16+
"sshAuthorizedKeys": [
17+
"<your-ssh-key>"
18+
]
19+
}
20+
]
21+
},
22+
"storage": {
23+
"files": [
24+
{
25+
"path": "/etc/profile.d/systemd-pager.sh",
26+
"contents": {
27+
"compression": "",
28+
"source": "data:,%23%20Tell%20systemd%20to%20not%20use%20a%20pager%20when%20printing%20information%0Aexport%20SYSTEMD_PAGER%3Dcat%0A"
29+
},
30+
"mode": 420
31+
}
32+
]
33+
},
34+
"systemd": {
35+
"units": [
36+
{
37+
"enabled": false,
38+
"name": "zincati.service"
39+
},
40+
{
41+
"dropins": [
42+
{
43+
"contents": "[Service]\n# Override Execstart in main unit\nExecStart=\n# Add new Execstart with `-` prefix to ignore failure`\nExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM\n",
44+
"name": "autologin-core.conf"
45+
}
46+
],
47+
"name": "[email protected]"
48+
}
49+
]
50+
},
51+
"attestation": {
52+
"attestation_key": {
53+
"registration": {
54+
"url": "http://attestation-key-register.trusted-execution-clusters.svc.cluster.local:8001/register-ak"
55+
}
56+
}
57+
}
58+
}

‎examples/vm-coreos-ign.yaml‎

Lines changed: 8 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -5,67 +5,6 @@ metadata:
55
spec:
66
runStrategy: Always
77
template:
8-
metadata:
9-
annotations:
10-
kubevirt.io/ignitiondata: |
11-
{
12-
"ignition": {
13-
"config": {
14-
"merge": [
15-
{
16-
"source": "http://register-server.trusted-execution-clusters.svc.cluster.local:8000/ignition-clevis-pin-trustee"
17-
}
18-
]
19-
},
20-
"version": "3.6.0-experimental"
21-
},
22-
"passwd": {
23-
"users": [
24-
{
25-
"name": "core",
26-
"sshAuthorizedKeys": [
27-
"<your-ssh-key>"
28-
]
29-
}
30-
]
31-
},
32-
"storage": {
33-
"files": [
34-
{
35-
"path": "/etc/profile.d/systemd-pager.sh",
36-
"contents": {
37-
"compression": "",
38-
"source": "data:,%23%20Tell%20systemd%20to%20not%20use%20a%20pager%20when%20printing%20information%0Aexport%20SYSTEMD_PAGER%3Dcat%0A"
39-
},
40-
"mode": 420
41-
}
42-
]
43-
},
44-
"systemd": {
45-
"units": [
46-
{
47-
"enabled": false,
48-
"name": "zincati.service"
49-
},
50-
{
51-
"dropins": [
52-
{
53-
"contents": "[Service]\n# Override Execstart in main unit\nExecStart=\n# Add new Execstart with `-` prefix to ignore failure`\nExecStart=-/usr/sbin/agetty --autologin core --noclear %I $TERM\n",
54-
"name": "autologin-core.conf"
55-
}
56-
],
57-
"name": "[email protected]"
58-
}
59-
]
60-
},
61-
"attestation": {
62-
"attestation_key": {
63-
"registration": {
64-
"url": "http://attestation-key-register.trusted-execution-clusters.svc.cluster.local:8001/register-ak"
65-
}
66-
}
67-
}
68-
}
698
spec:
709
domain:
7110
features:
@@ -82,12 +21,19 @@ spec:
8221
- name: containerdisk
8322
disk:
8423
bus: virtio
24+
- name: cloudinitdisk
25+
disk:
26+
bus: virtio
8527
rng: {}
8628
resources:
8729
requests:
8830
memory: 4096M
8931
volumes:
9032
- name: containerdisk
9133
containerDisk:
92-
image: "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:2026-14-01"
34+
image: "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:20260129"
9335
imagePullPolicy: Always
36+
- name: cloudinitdisk
37+
cloudInitConfigDrive:
38+
secretRef:
39+
name: coreos-ignition-secret

‎scripts/pre-pull-images.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ IMAGES=(
1212
"quay.io/kubevirt/virt-controller:${KV_VERSION}"
1313
"quay.io/kubevirt/virt-operator:${KV_VERSION}"
1414
"$TRUSTEE_IMAGE"
15-
"$APPROVED_IMAGE"
1615
"quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:2026-14-01"
1716
)
1817

‎test_utils/src/virt.rs‎

Lines changed: 54 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -168,11 +168,27 @@ pub async fn create_kubevirt_vm(
168168
register_server_url: &str,
169169
image: &str,
170170
) -> anyhow::Result<()> {
171+
use k8s_openapi::api::core::v1::Secret;
171172
use kube::Api;
172173

173174
let ignition_config = generate_ignition_config(ssh_public_key, register_server_url, namespace);
174175
let ignition_json = serde_json::to_string(&ignition_config)?;
175176

177+
// Create the secret with the ignition configuration
178+
let secret_name = format!("{}-ignition-secret", vm_name);
179+
let secret = Secret {
180+
metadata: ObjectMeta {
181+
name: Some(secret_name.clone()),
182+
namespace: Some(namespace.to_string()),
183+
..Default::default()
184+
},
185+
string_data: Some(BTreeMap::from([("userdata".to_string(), ignition_json)])),
186+
..Default::default()
187+
};
188+
189+
let secrets: Api<Secret> = Api::namespaced(client.clone(), namespace);
190+
secrets.create(&Default::default(), &secret).await?;
191+
176192
let vm = VirtualMachine {
177193
metadata: ObjectMeta {
178194
name: Some(vm_name.to_string()),
@@ -182,10 +198,7 @@ pub async fn create_kubevirt_vm(
182198
spec: VirtualMachineSpec {
183199
run_strategy: Some("Always".to_string()),
184200
template: VirtualMachineTemplate {
185-
metadata: Some(BTreeMap::from([(
186-
"annotations".to_string(),
187-
serde_json::json!({"kubevirt.io/ignitiondata": ignition_json}),
188-
)])),
201+
metadata: None,
189202
spec: Some(VirtualMachineTemplateSpec {
190203
domain: VirtualMachineTemplateSpecDomain {
191204
features: Some(VirtualMachineTemplateSpecDomainFeatures {
@@ -205,14 +218,24 @@ pub async fn create_kubevirt_vm(
205218
..Default::default()
206219
}),
207220
devices: VirtualMachineTemplateSpecDomainDevices {
208-
disks: Some(vec![VirtualMachineTemplateSpecDomainDevicesDisks {
209-
name: "containerdisk".to_string(),
210-
disk: Some(VirtualMachineTemplateSpecDomainDevicesDisksDisk {
211-
bus: Some("virtio".to_string()),
221+
disks: Some(vec![
222+
VirtualMachineTemplateSpecDomainDevicesDisks {
223+
name: "containerdisk".to_string(),
224+
disk: Some(VirtualMachineTemplateSpecDomainDevicesDisksDisk {
225+
bus: Some("virtio".to_string()),
226+
..Default::default()
227+
}),
212228
..Default::default()
213-
}),
214-
..Default::default()
215-
}]),
229+
},
230+
VirtualMachineTemplateSpecDomainDevicesDisks {
231+
name: "cloudinitdisk".to_string(),
232+
disk: Some(VirtualMachineTemplateSpecDomainDevicesDisksDisk {
233+
bus: Some("virtio".to_string()),
234+
..Default::default()
235+
}),
236+
..Default::default()
237+
},
238+
]),
216239
tpm: Some(VirtualMachineTemplateSpecDomainDevicesTpm {
217240
persistent: Some(true),
218241
..Default::default()
@@ -232,15 +255,27 @@ pub async fn create_kubevirt_vm(
232255
}),
233256
..Default::default()
234257
},
235-
volumes: Some(vec![VirtualMachineTemplateSpecVolumes {
236-
name: "containerdisk".to_string(),
237-
container_disk: Some(VirtualMachineTemplateSpecVolumesContainerDisk {
238-
image: image.to_string(),
239-
image_pull_policy: Some("Always".to_string()),
258+
volumes: Some(vec![
259+
VirtualMachineTemplateSpecVolumes {
260+
name: "containerdisk".to_string(),
261+
container_disk: Some(VirtualMachineTemplateSpecVolumesContainerDisk {
262+
image: image.to_string(),
263+
image_pull_policy: Some("Always".to_string()),
264+
..Default::default()
265+
}),
240266
..Default::default()
241-
}),
242-
..Default::default()
243-
}]),
267+
},
268+
VirtualMachineTemplateSpecVolumes {
269+
name: "cloudinitdisk".to_string(),
270+
cloud_init_config_drive: Some(VirtualMachineTemplateSpecVolumesCloudInitConfigDrive {
271+
secret_ref: Some(VirtualMachineTemplateSpecVolumesCloudInitConfigDriveSecretRef {
272+
name: Some(secret_name),
273+
}),
274+
..Default::default()
275+
}),
276+
..Default::default()
277+
},
278+
]),
244279
..Default::default()
245280
}),
246281
},

‎tests/attestation.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ impl SingleAttestationContext {
5454
"http://register-server.{}.svc.cluster.local:8000/ignition-clevis-pin-trustee",
5555
namespace
5656
);
57-
let image = "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:2026-14-01";
57+
let image = "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:20260129";
5858

5959
test_ctx.info(format!("Creating VM: {}", vm_name));
6060
virt::create_kubevirt_vm(
@@ -127,7 +127,7 @@ async fn test_parallel_vm_attestation() -> anyhow::Result<()> {
127127
"http://register-server.{}.svc.cluster.local:8000/ignition-clevis-pin-trustee",
128128
namespace
129129
);
130-
let image = "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:2026-14-01";
130+
let image = "quay.io/trusted-execution-clusters/fedora-coreos-kubevirt:20260129";
131131

132132
// Launch both VMs in parallel
133133
let vm1_name = "test-coreos-vm1";

0 commit comments

Comments
 (0)