github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-16 17:04:14 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #13374 from BbolroC/update-naming-convention-trustee-as-ibm-sel

Browse Source 
tests: Fix helm key names for IBM SEL and bump Trustee
This commit is contained in:
Hyounggyu Choi
2026-07-15 12:20:59 +02:00
committed by GitHub
parent ffb43bab0b fd98c40aff
commit 5e10d9e62c
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tests/integration/kubernetes/confidential_kbs.sh
View File

@@ -528,14 +528,14 @@ function kbs_k8s_deploy() {
# Handle IBM SE (s390x): the SE verifier runs inside the gRPC Attestation
# Service, so the SE materials are mounted on the AS Pod (not KBS) via the
# chart's as.ibmse.* knobs, which create a node-local PV/PVC pointing at
# chart's as.verifier.se.* knobs, which create a node-local PV/PVC pointing at
# ${IBM_SE_CREDS_DIR} on the target node.
if [[ "${KATA_HYPERVISOR}" == qemu-se* ]]; then
local node_name
node_name=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
prepare_credentials_for_qemu_se
helm_set_args+=(--set "as.ibmse.credsDir=${IBM_SE_CREDS_DIR:-}")
helm_set_args+=(--set "as.ibmse.nodeName=${node_name}")
helm_set_args+=(--set "as.verifier.se.credsDir=${IBM_SE_CREDS_DIR:-}")
helm_set_args+=(--set "as.verifier.se.nodeName=${node_name}")
# fsGroup must match the owning GID of the files under credsDir so the
# non-root AS container (CAP_DAC_OVERRIDE dropped) can read them.
helm_set_args+=(--set "as.podSecurityContext.fsGroup=1000")

10
versions.yaml
View File

@@ -310,16 +310,16 @@ externals:
coco-trustee:
description: "Provides attestation and secret delivery components"
url: "https://github.com/confidential-containers/trustee"
version: "80a3c55e68e7d81fd31730ce9d49031f989e6c72"
version: "b6c8dc2bbb9374e00cb15e51acd8ba99b4febd7a"
# image and image_tag must be in sync
image: "ghcr.io/confidential-containers/staged-images/kbs"
image_tag: "80a3c55e68e7d81fd31730ce9d49031f989e6c72"
image_tag: "b6c8dc2bbb9374e00cb15e51acd8ba99b4febd7a"
toolchain: "1.90.0"
# Helm chart deploys three separate images (kbs, as, rvps)
# yamllint disable rule:line-length
image_kbs: "ghcr.io/confidential-containers/staged-images/kbs-grpc-as:80a3c55e68e7d81fd31730ce9d49031f989e6c72"
image_as: "ghcr.io/confidential-containers/staged-images/coco-as-grpc:80a3c55e68e7d81fd31730ce9d49031f989e6c72"
image_rvps: "ghcr.io/confidential-containers/staged-images/rvps:80a3c55e68e7d81fd31730ce9d49031f989e6c72"
image_kbs: "ghcr.io/confidential-containers/staged-images/kbs-grpc-as:b6c8dc2bbb9374e00cb15e51acd8ba99b4febd7a"
image_as: "ghcr.io/confidential-containers/staged-images/coco-as-grpc:b6c8dc2bbb9374e00cb15e51acd8ba99b4febd7a"
image_rvps: "ghcr.io/confidential-containers/staged-images/rvps:b6c8dc2bbb9374e00cb15e51acd8ba99b4febd7a"
# yamllint enable rule:line-length
containerd: