Trustee Operator
Categories:
Use the Trustee Operator if you are running Kubernetes and want a managed installation that follows the Kubernetes operator pattern. The operator handles the Trustee lifecycle (install, upgrade, configuration) through a custom resource, making it a good fit for teams already using operators in their cluster. The entire Kubernetes cluster must be trusted.
Install the operator
The operator (release v0.17.0 at the time of writing) is available in the Operator Hub.
Please follow the installation steps detailed here.
Verify that the controller is running.
kubectl get pods -n operators --watch
The operator controller should be running.
NAME READY STATUS RESTARTS AGE
trustee-operator-controller-manager-77cb448dc-7vxck 1/1 Running 0 11m
How to override the Trustee image
First of all we need to know which Trustee image is running:
kubectl get csv -n operators trustee-operator.v0.17.0 -o json | jq '.spec.install.spec.deployments[0].spec.template.spec.containers[0].env[1].value'
"ghcr.io/confidential-containers/key-broker-service:built-in-as-v0.16.0"
The default image can be replaced with an updated version, for example Trustee v0.17.0:
NEW_IMAGE=ghcr.io/confidential-containers/key-broker-service:built-in-as-v0.17.0
kubectl patch csv -n operators trustee-operator.v0.17.0 --type='json' -p="[{'op': 'replace', 'path': '/spec/install/spec/deployments/0/spec/template/spec/containers/0/env/1/value', 'value':$NEW_IMAGE}]"
Deploy Trustee
An example on how to configure Trustee is provided in this blog.
After the last configuration step, check that the Trustee deployment is running.
kubectl get pods -n operators --selector=app=kbs
The Trustee deployment should be running.
NAME READY STATUS RESTARTS AGE
trustee-deployment-f97fb74d6-w5qsm 1/1 Running 0 25m
Uninstall
Remove the Trustee CRD.
CR_NAME=$(kubectl get kbsconfig -n operators -o=jsonpath='{.items[0].metadata.name}') && kubectl delete KbsConfig $CR_NAME -n operators
Remove the controller.
kubectl delete Subscription -n operators my-trustee-operator
kubectl delete csv -n operators trustee-operator.v0.3.0