feat: add firmware reference values ESO and RVPS integration#27
Merged
butler54 merged 1 commit intoMay 28, 2026
Merged
Conversation
Enable bare metal attestation policy enforcement using firmware measurements (Intel TDX / AMD SEV-SNP) collected via veritas and stored in Vault. **New template:** - templates/firmware-refvals-eso.yaml: ExternalSecret (gated on kbs.baremetal.enabled) Pulls from secret/data/hub/firmwareReferenceValues into firmware-reference-values secret in trustee-operator-system namespace **Modified template:** - templates/rvps-values-policies.yaml: Add firmware reference value block Reads firmware-reference-values secret and appends to RVPS ConfigMap: - mr_td: TDX initial TD measurement (SHA-384) - rtmr_1: TDX firmware + bootloader (SHA-384) - rtmr_2: TDX kernel + initrd (SHA-384) - snp_launch_measurement: SNP initial memory measurement (SHA-384) - xfam: TDX extended feature mask (hex) Each value is an array (supports multi-version via merged values) Conditionally appends only if key exists in secret **New value:** - kbs.baremetal.enabled: false (default off, enabled per-profile) Controls firmware ESO creation and enables bare metal-specific features **Integration:** - Firmware values pushed to Vault via coco-pattern scripts/collect-firmware-refvals.sh - ESO syncs from Vault to firmware-reference-values secret (sync-wave 1) - RVPS policy reads secret and builds ConfigMap (sync-wave 6) - Attestation policy (PR 2C) will enforce firmware checks using RVPS values **Backwards compatible:** - ESO only created when kbs.baremetal.enabled=true - RVPS block conditionally appends if secret exists - No functional change when disabled Part of Wave 2 (firmware hardening) from bare metal attestation plan. This is PR 2B - requires PR 2A (coco-pattern workflow) for value collection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Enable bare metal attestation policy enforcement using firmware measurements (Intel TDX / AMD SEV-SNP) collected via veritas and stored in Vault.
This is PR 2B of Wave 2 (firmware hardening) from the bare metal attestation hardening plan.
Changes
New Template
📦 templates/firmware-refvals-eso.yaml - ExternalSecret (gated on
kbs.baremetal.enabled)secret/data/hub/firmwareReferenceValuesin Vaultfirmware-reference-valuessecret intrustee-operator-systemModified Template
🔄 templates/rvps-values-policies.yaml - Add firmware reference value block
Reads
firmware-reference-valuessecret and appends to RVPS ConfigMap:Each value is an array (supports multi-version via merged values). Conditionally appends only if key exists in secret.
New Value
⚙️ kbs.baremetal.enabled:
false(default off, enabled per-profile)Integration Flow
veritasand pushed to Vault (coco-patternPR 2A workflow)firmware-reference-valuessecret (sync-wave 1)rvps-reference-valuesConfigMap (sync-wave 6)Backwards Compatibility
✅ Fully backwards compatible:
kbs.baremetal.enabled=trueTesting
Tested on bare metal cluster with:
secret/data/hub/firmwareReferenceValuesDependencies
Related
Part of Wave 2 (firmware hardening) from the bare metal attestation hardening roadmap.