github/confidential-containers
1
0
Fork 0
mirror of https://github.com/confidential-containers/confidential-containers.git synced 2025-09-16 07:48:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update SEV quickstart (#71)

Browse Source 
KBS is no longer required for unencrypted images with SEV

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
This commit is contained in:
Tobin Feldman-Fitzthum
2022-11-10 02:36:39 -05:00
committed by GitHub
parent c0d557f55c
commit 47df4e83e9
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
quickstart.md
View File

@@ -398,7 +398,16 @@ The image encryption key and key for SSH access have been attached to the CoCo s
To learn more about creating custom policies, see the section on [Creating a simple-kbs Policy to Verify the SEV Firmware Measurement](#creating-a-simple-kbs-policy-to-verify-the-sev-firmware-measurement).
Currently, the SEV unencrypted image use case also requires the `simple-kbs` to be deployed. This will change in a future CoCo release.
A KBS is not required to run unencrypted containers.
Instead, disable pre-attestation by editing the Kata config file located at `/opt/confidential-containers/share/defaults/kata-containers/configuration-qemu-sev.toml`.
```
guest_pre_attestation = false
```
Image decryption and signature validation will not work if pre-attestation is disabled.
> **Note** It is not recommended to edit the Kata configuration file manually.
These changes might be overwritten by the operator.
`docker-compose` is required to run the `simple-kbs` and its database in docker containers: