iSulad + Kuasar Confidential Containers Deployment Guide ​

Confidential containers are used to resolve data security issues in cloud native scenarios, meet usage requirements such as data compliance, data privacy protection, protection of innovative IP such as algorithms and models, and data availability without visibility, and resolve the trust dependency problem of cloud vendors.

Environment Preparations ​

Physical Environment Preparation ​

For a better performance experience, kuasar needs to run on a bare metal server. Running kuasar in a VM is not supported currently. Currently, confidential VMs support only TEE suite environments set up on Kunpeng 920 processors of new models. The server currently supports loading a TEE license only in the aarch64 environment to enable TEE suite features, and you can enable TEE features and set the TEE secure memory size through BIOS configuration options.

Software Installation ​

$ yum install iSulad kuasar-cc qemu-system-aarch64

Installing the CNI Plugin ​

$ wget https://github.com/containernetworking/plugins/releases/download/v1.3.0/cni-plugins-linux-arm64-v1.3.0.tgz
$ mkdir -p /opt/cni/bin/
$ tar -zxvf cni-plugins-linux-arm64-v1.3.0.tgz -C /opt/cni/bin/

Modifying the Container Engine and Container Runtime Configuration Files ​

Modifying the iSulad Configuration File ​

vi /etc/isulad/daemon.json

{
    ... ...
    "network-plugin": "cni",
    "default-sandboxer": "cc",
    "enable-cri-v1": true,
    "cri-sandboxers": {
        "cc": {
            "name": "cc", 
            "image-type":"remote",
            "address": "/run/cc-vmm-sandboxer.sock"
        }
    },
    "cri-runtimes": {
        "cc": "io.containerd.cc.v1"
    }
    ... ...
}

cri-sandboxers and cri-runtimes specify the configurations related to starting the sandbox runtime. For details about other parameters, see Installation and Configuration.

Configuring Confidential Container Parameters ​

By default, kuasar can use a common image repository. If you need to use a confidential image repository, you can modify the kernel_params parameter in /var/lib/kuasar/cc-config.toml. Refer to the following table and add the required parameters in the key=value format.

Note that confidential containers need to pull container images in the sandbox. Therefore, ensure that the TLS certificate verification of the image website on the host is successful and the image website can be accessed properly.

After modifying /var/lib/kuasar/cc-config.toml, restart cc-kuasar-vmm.service for the configuration to take effect. The configuration is used when the next confidential sandbox is started.

Preparing Container Configuration Files ​

Adding a CNI Configuration File ​

cat /etc/cni/net.d/mynet.conf 
{
  "cniVersion":"1.0.0",
  "name":"bridge-network",
  "type":"bridge",
  "bridge":"cni0",
  "isGateway":true,
  "ipMasq":true,
  "ipam":{
    "type":"host-local",
    "subnet":"10.244.0.0/16",
    "routes":[
      {"dst":"0.0.0.0/0"}
    ]
  }
}

Pod Configuration File ​

cat pod.json
{
        "annotations": {
        "cri.sandbox.network.setup.v2": "true"
        },
        "hostname": "testhostname",
        "log_directory": "/tmp",
        "linux": {
                "cgroup_parent": "/sys/fs/cgroup",
                "security_context": {
                        "namespace_options": {
                                "network": 0,
                                "pid": 0,
                                "ipc": 0
                        },
                "run_as_user": {
                        "value": 1003
                },
                "readonly_rootfs": true,
                "privileged": false
                }
        },
        "metadata": {
                "attempt": 1,
                "name": "liuxuPod",
                "namespace": "default",
                "uid": "2dishd83djaidwnduwk28baaa"
        }
}

Container Configuration File ​

cat local_container.json
{
    "metadata": {
        "name": "test-busybox"
    },
    "image": {
        "image": "docker.io/library/busybox-aarch64:latest"
    },
    "command": [
        "top"
    ],
    "log_path":"console.log",
    "linux": {
        "security_context": {
            "capabilities": {},
            "namespace_options": {
                "network": 0,
                "pid": 1
            }
        }
    }
}

Starting a Confidential Container ​

Restart the iSulad and kuasar processes.

$systemctl restart cc-kuasar-vmm.service
$systemctl restart isulad.service

Start a confidential container.

$crictl runp --runtime cc pod.json 
8d69fee1179c4b0626230c315f48daf5ae75fcd36f080c4547724cc9aa590db9
$crictl create 8d local_container.json pod.json
e69888c21385facad647e51998c5406092734d73834f9b84842820f8aef9d408
$crictl start e6
e6

When a container is no longer needed, run crictl rm ${container id} to delete the container and crictl rmp ${sandbox id} to delete the sandbox.