This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Installation

Installing Trustee

Trustee can be deployed in several different configurations. Either way, Trustee should be deployed in a trusted environment. This could be a local server, some trusted third party, or even another enclave. Official support for deploying Trustee inside of Confidential Containers is being developed.

1 - Trustee Operator

Installing Trustee on Kubernetes

Trustee can be installed on Kubernetes using the Trustee operator. When running Trustee in Kubernetes with the operator, the cluster must be Trusted.

Install the operator

First, clone the Trustee operator.

git clone https://github.com/confidential-containers/trustee-operator.git

Install the operator.

make deploy IMG=quay.io/confidential-containers/trustee-operator:latest

Verify that the controller is running.

kubectl get pods -n trustee-operator-system --watch

The operator controller should be running.

NAME                                                   READY   STATUS    RESTARTS   AGE
trustee-operator-controller-manager-6fb5bb5bd9-22wd6   2/2     Running   0          25s

Deploy Trustee

A simple configuration is provided. You will need to generate an authentication key.

cd config/samples/microservices
# or config/samples/all-in-one for the integrated mode

# create authentication keys
openssl genpkey -algorithm ed25519 > privateKey
openssl pkey -in privateKey -pubout -out kbs.pem

# create all the needed resources
kubectl apply -k .

Check that the Trustee deployment is running.

kubectl get pods -n trustee-operator-system --selector=app=kbs

The Trustee deployment should be running.

NAME                                  READY   STATUS    RESTARTS   AGE
trustee-deployment-78bd97f6d4-nxsbb   3/3     Running   0          4m3s

Uninstall

Remove the Trustee CRD.

make uninstall

Remove the controller.

make undeploy

2 - Trustee in Docker

Installing Trustee on Kubernetes

Trustee can be installed using Docker Compose.

Installation

Clone the Trustee repo.

git clone https://github.com/confidential-containers/trustee.git

Setup authentication keys.

openssl genpkey -algorithm ed25519 > kbs/config/private.key
openssl pkey -in kbs/config/private.key -pubout -out kbs/config/public.pub

Run Trustee.

docker compose up -d

Uninstall

Stop Trustee.

docker compose down