From 5632b6ceb3408a90ca9251549a9ffe9cced2aa2b Mon Sep 17 00:00:00 2001 From: Magnus Kulke Date: Mon, 8 Jan 2024 17:08:33 +0100 Subject: [PATCH] aa/cdh: make agent-config path configurable by env relates-to: https://github.com/confidential-containers/cloud-api-adaptor/issues/1637 Since peerpods will template the agent-config.toml with aa_kbc_params and /etc might be on a read-only volume, we need to make this path configurable. Signed-off-by: Magnus Kulke --- attestation-agent/lib/src/token.rs | 28 +++++++++----- .../kms/src/plugins/kbs/mod.rs | 37 ++++++++++++------- 2 files changed, 42 insertions(+), 23 deletions(-) diff --git a/attestation-agent/lib/src/token.rs b/attestation-agent/lib/src/token.rs index 0001c57ea..0b206c0ca 100644 --- a/attestation-agent/lib/src/token.rs +++ b/attestation-agent/lib/src/token.rs @@ -3,10 +3,13 @@ // SPDX-License-Identifier: Apache-2.0 // -use anyhow::{anyhow, Result}; +use anyhow::{anyhow, Context, Result}; use kbs_protocol::{evidence_provider::NativeEvidenceProvider, KbsClientBuilder}; +use log::debug; use serde::{Deserialize, Serialize}; +use std::env; use std::path::Path; +use std::sync::OnceLock; use tokio::fs; const PEER_POD_CONFIG_PATH: &str = "/run/peerpod/daemon.json"; @@ -17,6 +20,8 @@ struct Message { tee_keypair: String, } +static KATA_AGENT_CONFIG_PATH: OnceLock = OnceLock::new(); + pub(crate) async fn get_kbs_token() -> Result> { let evidence_provider = Box::new(NativeEvidenceProvider::new()?); @@ -73,15 +78,20 @@ pub(crate) async fn get_kbc_params_from_config_file() -> Result { aa_kbc_params: Option, } - // Hard-code agent config path to "/etc/agent-config.toml" as a workaround - let agent_config_str = fs::read_to_string("/etc/agent-config.toml") + // check env for KATA_AGENT_CONFIG_PATH, fall back to default path + let path: &String = KATA_AGENT_CONFIG_PATH.get_or_init(|| { + env::var("KATA_AGENT_CONFIG_PATH").unwrap_or_else(|_| "/etc/agent-config.toml".into()) + }); + + debug!("reading agent config from {}", path); + let agent_config_str = fs::read_to_string(path) .await - .map_err(|e| anyhow!("Failed to read /etc/agent-config.toml file: {e}"))?; + .context(format!("Failed to read {path}"))?; - let agent_config: AgentConfig = toml::from_str(&agent_config_str) - .map_err(|e| anyhow!("Failed to deserialize /etc/agent-config.toml: {e}"))?; + let agent_config: AgentConfig = + toml::from_str(&agent_config_str).context(format!("Failed to deserialize {path}"))?; - agent_config.aa_kbc_params.ok_or(anyhow!( - "no `aa_kbc_params` found in /etc/agent-config.toml!", - )) + agent_config + .aa_kbc_params + .ok_or(anyhow!("no `aa_kbc_params` found in {path}!")) } diff --git a/confidential-data-hub/kms/src/plugins/kbs/mod.rs b/confidential-data-hub/kms/src/plugins/kbs/mod.rs index 3c7c5e9ec..f25577866 100644 --- a/confidential-data-hub/kms/src/plugins/kbs/mod.rs +++ b/confidential-data-hub/kms/src/plugins/kbs/mod.rs @@ -17,16 +17,20 @@ use std::sync::Arc; use async_trait::async_trait; use lazy_static::lazy_static; +use log::debug; pub use resource_uri::ResourceUri; use serde::Deserialize; -use std::fs; use std::path::Path; +use std::sync::OnceLock; +use std::{env, fs}; use tokio::sync::Mutex; use crate::{Annotations, Error, Getter, Result}; const PEER_POD_CONFIG_PATH: &str = "/run/peerpod/daemon.json"; +static KATA_AGENT_CONFIG_PATH: OnceLock = OnceLock::new(); + enum RealClient { #[cfg(feature = "kbs")] Cc(cc_kbc::CcKbc), @@ -145,25 +149,30 @@ async fn get_aa_params_from_config_file() -> Result<(String, String)> { aa_kbc_params: Option, } - // Hard-code agent config path to "/etc/agent-config.toml" as a workaround - let agent_config_str = fs::read_to_string("/etc/agent-config.toml").map_err(|e| { - Error::KbsClientError(format!("Failed to read /etc/agent-config.toml file: {e}")) - })?; + // check env for KATA_AGENT_CONFIG_PATH, fall back to default path + let path: &String = KATA_AGENT_CONFIG_PATH.get_or_init(|| { + env::var("KATA_AGENT_CONFIG_PATH").unwrap_or_else(|_| "/etc/agent-config.toml".into()) + }); + + debug!("reading agent config from {}", path); + let agent_config_str = fs::read_to_string(path) + .map_err(|e| Error::KbsClientError(format!("Failed to read {path} file: {e}")))?; - let agent_config: AgentConfig = toml::from_str(&agent_config_str).map_err(|e| { - Error::KbsClientError(format!("Failed to deserialize /etc/agent-config.toml: {e}")) - })?; + let agent_config: AgentConfig = toml::from_str(&agent_config_str) + .map_err(|e| Error::KbsClientError(format!("Failed to deserialize {path}: {e}")))?; - let aa_kbc_params = agent_config.aa_kbc_params.ok_or(Error::KbsClientError( - "no `aa_kbc_params` found in /etc/agent-config.toml".into(), - ))?; + let aa_kbc_params = agent_config + .aa_kbc_params + .ok_or(Error::KbsClientError(format!( + "no `aa_kbc_params` found in {path}" + )))?; let aa_kbc_params_vec = aa_kbc_params.split("::").collect::>(); if aa_kbc_params_vec.len() != 2 { - return Err(Error::KbsClientError( - "Illegal `aa_kbc_params` format provided in /etc/agent-config.toml.".to_string(), - )); + return Err(Error::KbsClientError(format!( + "Illegal `aa_kbc_params` format provided in {path}." + ))); } Ok((