mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-09 11:58:16 +00:00
d808cef2fb
Kata Containers has support for both the IBM Secure Execution trusted
execution environment and the IBM Crypto Express hardware security
module (used via the Adjunct Processor bus), but using them together
requires specific steps.
In Secure Execution, the Acceleration and Enterprise PKCS11 modes of
Crypto Express are supported. Both modes require the domain to be
_bound_ in the guest, and the latter also requires the domain to be
_associated_ with a _guest secret_. Guest secrets must be submitted to
the ultravisor from within the guest.
Each EP11 domain has a master key verification pattern (MKVP) that can
be established at HSM setup time. The guest secret and its ID are to
be provided at `/vfio_ap/{mkvp}/secret` and
`/vfio_ap/{mkvp}/secret_id` via a key broker service respectively.
Bind each domain, and for each EP11 domain,
- get the secret and secret ID from the addresses above,
- submit the secret to the ultravisor,
- find the index of the secret corresponding to the ID, and
- associate the domain to the index of this secret.
To bind, add the secret, parse the info about the domain, and
associate, the s390_pv_core crate is used. The code from this crate
also does the AP online check, which can be removed from here.
Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
86 lines
3.1 KiB
Markdown
86 lines
3.1 KiB
Markdown
# Documentation
|
|
|
|
The [Kata Containers](https://github.com/kata-containers)
|
|
documentation repository hosts overall system documentation, with information
|
|
common to multiple components.
|
|
|
|
For details of the other Kata Containers repositories, see the
|
|
[repository summary](https://github.com/kata-containers/kata-containers).
|
|
|
|
## Getting Started
|
|
|
|
* [Installation guides](./install/README.md): Install and run Kata Containers with Docker or Kubernetes
|
|
|
|
## Tracing
|
|
|
|
See the [tracing documentation](tracing.md).
|
|
|
|
## More User Guides
|
|
|
|
* [Upgrading](Upgrading.md): how to upgrade from [Clear Containers](https://github.com/clearcontainers) and [runV](https://github.com/hyperhq/runv) to [Kata Containers](https://github.com/kata-containers) and how to upgrade an existing Kata Containers system to the latest version.
|
|
* [Limitations](Limitations.md): differences and limitations compared with the default [Docker](https://www.docker.com/) runtime,
|
|
[`runc`](https://github.com/opencontainers/runc).
|
|
|
|
### How-to guides
|
|
|
|
See the [how-to documentation](how-to).
|
|
|
|
## Kata Use-Cases
|
|
|
|
* [GPU Passthrough with Kata](./use-cases/GPU-passthrough-and-Kata.md)
|
|
* [SR-IOV with Kata](./use-cases/using-SRIOV-and-kata.md)
|
|
* [Intel QAT with Kata](./use-cases/using-Intel-QAT-and-kata.md)
|
|
* [SPDK vhost-user with Kata](./use-cases/using-SPDK-vhostuser-and-kata.md)
|
|
* [Intel SGX with Kata](./use-cases/using-Intel-SGX-and-kata.md)
|
|
* [IBM Crypto Express passthrough with Confidential Containers](./use-cases/CEX-passthrough-and-coco.md)
|
|
|
|
## Developer Guide
|
|
|
|
Documents that help to understand and contribute to Kata Containers.
|
|
|
|
### Design and Implementations
|
|
|
|
* [Kata Containers Architecture](design/architecture): Architectural overview of Kata Containers
|
|
* [Kata Containers CI](../ci/README.md): Kata Containers CI document
|
|
* [Kata Containers E2E Flow](design/end-to-end-flow.md): The entire end-to-end flow of Kata Containers
|
|
* [Kata Containers design](./design/README.md): More Kata Containers design documents
|
|
* [Kata Containers threat model](./threat-model/threat-model.md): Kata Containers threat model
|
|
|
|
### How to Contribute
|
|
|
|
* [Developer Guide](Developer-Guide.md): Setup the Kata Containers developing environments
|
|
* [How to contribute to Kata Containers](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md)
|
|
* [Code of Conduct](../CODE_OF_CONDUCT.md)
|
|
* [How to submit a blog post](Blog-Post-Submission-Guide.md)
|
|
|
|
## Help Writing a Code PR
|
|
|
|
* [Code PR advice](code-pr-advice.md).
|
|
|
|
## Help Writing Unit Tests
|
|
|
|
* [Unit Test Advice](Unit-Test-Advice.md)
|
|
* [Unit testing presentation](presentations/unit-testing/kata-containers-unit-testing.md)
|
|
|
|
## Help Improving the Documents
|
|
|
|
* [Documentation Requirements](Documentation-Requirements.md)
|
|
|
|
### Code Licensing
|
|
|
|
* [Licensing](Licensing-strategy.md): About the licensing strategy of Kata Containers.
|
|
|
|
### The Release Process
|
|
|
|
* [Release Process](Release-Process.md)
|
|
|
|
## Presentations
|
|
|
|
* [Presentations](presentations)
|
|
|
|
## Website Changes
|
|
|
|
If you have a suggestion for how we can improve the
|
|
[website](https://katacontainers.io), please raise an issue (or a PR) on
|
|
[the repository that holds the source for the website](https://github.com/OpenStackweb/kata-netlify-refresh).
|