aa/cdh: make agent-config path configurable by env #429
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mkulke
force-pushed
the
mkulke/add-agent-config-path-env
branch
3 times, most recently
from
9d36ccc
to
a124e80
Compare
mkulke
added a commit
to mkulke/cloud-api-adaptor
that referenced
this pull request
Jan 9, 2024
fixes: confidential-containers#1637 blocked-by: confidential-containers/guest-components#429 On a podvm using an guest-components build from the PR, `KATA_AGENT_CONFIG_PATH` is set and picked up by attestation-agent and cdh: ```bash $ cat /proc/$(pgrep -i attest)/environ | xargs --null echo LANG=C.UTF-8 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin SYSTEMD_SULOGIN_FORCE=1 INVOCATION_ID=ad04b8c4ff6c4f2c8617dfcfed24c183 JOURNAL_STREAM=8:3090 SYSTEMD_EXEC_PID=552 KATA_AGENT_CONFIG_PATH=/run/peerpod/agent-config.toml RUST_BACKTRACE=full OCICRYPT_KEYPROVIDER_CONFIG=/tmp/ocicrypt_config.json ``` Signed-off-by: Magnus Kulke <[email protected]>
relates-to: confidential-containers/cloud-api-adaptor#1637 Since peerpods will template the agent-config.toml with aa_kbc_params and /etc might be on a read-only volume, we need to make this path configurable. Signed-off-by: Magnus Kulke <[email protected]>
I think we want to look at a consolidated/consistent way of doing configuration in guest-components eventually, but I would wait for the init-data concept to be finalized to start with that. This is more like a band-aid for the moment, since a hardcoded path doesn't work with a setup in which /etc isn't writeable. kata-agent on CCv0 is frozen atm and will be for some months probably, env is a way to pass the configuration from kata-agent to CDH & AA without altering kata-agent itself. |
mkulke
force-pushed
the
mkulke/add-agent-config-path-env
branch
from
a124e80
to
5632b6c
Compare
fitzthum
approved these changes
Jan 11, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
relates-to: confidential-containers/cloud-api-adaptor#1637
Since peerpods will template the agent-config.toml with aa_kbc_params and /etc might be on a read-only volume, we need to make this path configurable.