《云原生机密计算最佳实践白皮书》——06运行时底座——AMD SEV机密容器（4） https://developer.aliyun.com/article/1231026?groupCode=aliyun_linux
基于online KBC运行机密容器
• 请下载支持online sev kbc 的 initrd：
wget https://mirrors.openanolis.cn/inclavare-containers/confifidential-containers-demo/bin/ ccv3-sev/initrd.run.online-sev.img -O /opt/confifidential-containers/share/kata-containers/ kata-containers-initrd-sev.img
• 自定义 policy ，请参考附录部分。
• 编辑 kata 配置文件：
kbs_ip="$(ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p')" sed -i 's/agent.enable_signature_verifification=false /&agent.aa_kbc_params=online_sev_kb c::'$kbs_ip':44444/' /opt/confifidential-containers/share/defaults/kata-containers/ confifiguration-qemu-sev.toml
• 启动 Pod
cat <<-EOF | kubectl apply -f - apiVersion: v1 kind: Pod metadata: labels: run: test-en-online name: test-en-online spec: containers: - image: docker.io/haosanzi/busybox-v1:encrypted name: test-en-online imagePullPolicy: Always dnsPolicy: ClusterFirst restartPolicy: Never runtimeClassName: kata-qemu-sev EOF
查看 pod 是否启动成功：
kubectl get po
预期结果如下：
NAME READY STATUS RESTARTS AGE test-en-online 1/1 Running 0 146m
基于offlfflffline KBC运行加密容器
• 请下载支持offlfflffline KBC的initrd。
wget https://mirrors.openanolis.cn/inclavare-containers/confifidential-containers-demo/bin/ ccv3-sev/initrd.run.online-sev.img -O /opt/confifidential-containers/share/kata-containers/ kata-containers-initrd-sev.img
• 编辑 kata 配置文件：
kbs_ip="$(ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p')" sed -i 's/agent.enable_signature_verifification=false /&agent.aa_kbc_params=online_sev_kb c::'$kbs_ip':44444/' /opt/confifidential-containers/share/defaults/kata-containers/
• 自定义 policy ，请参考附录部分。
• 启动 Pod
cat <<-EOF | kubectl apply -f - apiVersion: v1 kind: Pod metadata: labels: run: test-en-offlfflffline name: test-en-offlfflffline spec: containers: - image: docker.io/haosanzi/busybox-v1:encrypted name: test-en-offlfflffline imagePullPolicy: Always dnsPolicy: ClusterFirst restartPolicy: Never runtimeClassName: kata-qemu-sev EOF
查看 pod 是否启动成功：
kubectl get po
预期结果如下：
NAME READY STATUS RESTARTS AGE test-en-offlfflffline 1/1 Running 0 31h
《云原生机密计算最佳实践白皮书》——06运行时底座——AMD SEV机密容器（6） https://developer.aliyun.com/article/1231023?groupCode=aliyun_linux
