Add AKV Dockerfile templates for signing with gsc #20

svenkata9 · 2022-12-09T13:13:53Z

Signed-off-by: Sankaranarayanan Venkatasubramanian [email protected]

These templates can be used after this PR Enable --template option to use with sign-image (for use with HSMs, for example) by svenkata9 · Pull Request #112 · gramineproject/gsc (github.com) in GSC repo gets merged.

This change is

Signed-off-by: Sankaranarayanan Venkatasubramanian <[email protected]>

dimakuv

Reviewed 3 of 3 files at r1, all commit messages.
Reviewable status: all files reviewed, 16 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ), "fixup! " found in commit messages' one-liners (waiting on @svenkata9)

-- commits line 3 at r1:
gsc -> GSC

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 1 at r1 (raw file):

FROM {{image}} as unsigned_image

Could you add a top-level comment that this template is derived from a generic https://github.com/gramineproject/gsc/blob/master/templates/Dockerfile.common.sign.template

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 16 at r1 (raw file):

RUN dnf install -y https://packages.microsoft.com/config/rhel/8/packages-microsoft-prod.rpm
RUN dnf install -y azure-cli
{% endblock %}

Actually, why do you need these {% block ... %} in these Dockerfiles? These Dockerfiles are already "custom" and they don't need to reflect the GSC's template structure.

I think you can:

safely remove block install
copy block path contents from https://github.com/gramineproject/gsc/blob/dbc17b6a118d0fb13411d3acd1f1dfc032b77b83/templates/centos/Dockerfile.sign.template#L3

And in the companion PR gramineproject/gsc#112, you won't need that those templates/centos/Dockerfile.sign.user.template at all!

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 17 at r1 (raw file):

RUN dnf install -y azure-cli
{% endblock %}

You should switch back to original user:

# Switch back to original app_image user
USER {{app_user}}

Otherwise you'll end up with entrypoing.manifest.sgx being accessible only by root, and the whole thing will fail for non-root Docker images.

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 26 at r1 (raw file):

RUN {% block path %}{% endblock %} /gramine/app_files/gramine-sgx-akv-sign \
      --url <akv_mhsm_url> \
      --key <akv_sign_key> \

As I mentioned in the PR gramineproject/gsc#112, you could reuse ARG key and then --key $key

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 29 at r1 (raw file):

      --manifest /gramine/app_files/entrypoint.manifest \
      --output /gramine/app_files/entrypoint.manifest.sgx

Aren't you supposed to do something like RUN az logout for sanity?

Integrations/azure/akv-sign/Dockerfile.sign.akv.centos.template line 35 at r1 (raw file):

COPY --from=unsigned_image /gramine/app_files/*.sig /gramine/app_files/
COPY --from=unsigned_image /gramine/app_files/*.sgx /gramine/app_files/

Remove empty line

Integrations/azure/akv-sign/Dockerfile.sign.akv.debian.template line 1 at r1 (raw file):

FROM {{image}} as unsigned_image

Please apply all the same comments as in the file above.

Integrations/azure/akv-sign/README.md line 7 at r1 (raw file):

deployments, you should use a key secured in a Hardware Security Module (HSM).

This directory contains the plugin to Gramine tools and templates that enable

Maybe and templates -> , as well as Dockerfile templates?

Otherwise it reads a bit weird, as if there is one plugin to "Gramine tools and templates".

Integrations/azure/akv-sign/README.md line 37 at r1 (raw file):

## Templates for use with Gramine Shielded Containers (GSC)

Please start with a sentence like This directory contains two Dockerfile templates, intended for use with GSC's sign-image command.

Integrations/azure/akv-sign/README.md line 39 at r1 (raw file):

GSC `sign-image` command can take in a user supplied Dockerfile
as an argument to `--template` and sign the graminized docker image. These

and sign -> to sign

Integrations/azure/akv-sign/README.md line 40 at r1 (raw file):

GSC `sign-image` command can take in a user supplied Dockerfile
as an argument to `--template` and sign the graminized docker image. These
templates can be used when a HSM is needed for signing. This directory has

These templates can be used ... -- this sentence looks redundant, just remove it.

Integrations/azure/akv-sign/README.md line 41 at r1 (raw file):

as an argument to `--template` and sign the graminized docker image. These
templates can be used when a HSM is needed for signing. This directory has
templates for using AKV to sign the graminized docker image. Please

This directory has ... -- with my proposed first sentence, this sentence becomes redundant. I'd remove it.

Integrations/azure/akv-sign/README.md line 42 at r1 (raw file):

templates can be used when a HSM is needed for signing. This directory has
templates for using AKV to sign the graminized docker image. Please
note that these are templates and the users will need to update the template

the users will need -> users need

Integrations/azure/akv-sign/README.md line 43 at r1 (raw file):

templates for using AKV to sign the graminized docker image. Please
note that these are templates and the users will need to update the template
with the required details to make it a 'self-contained' Dockerfile before

No need for ' around self-contained

Integrations/azure/akv-sign/README.md line 44 at r1 (raw file):

note that these are templates and the users will need to update the template
with the required details to make it a 'self-contained' Dockerfile before
passing it to `sign-image` command.

sign-image -> gsc sign-image

svenkata9

Reviewable status: 0 of 3 files reviewed, 16 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ), "fixup! " found in commit messages' one-liners (waiting on @dimakuv)

-- commits line 3 at r1: