diff --git a/README.md b/README.md index 4a6ece1b..7b5a532d 100644 --- a/README.md +++ b/README.md @@ -89,7 +89,7 @@ For air-gapped bare metal environments, see [`airgap/DEPLOY-RUNBOOK.md`](airgap/ **Common:** - Tools on your workstation: `podman`, `yq`, `jq`, `skopeo` -- OpenShift pull secret saved at `~/pull-secret.json` (download from [console.redhat.com](https://console.redhat.com/openshift/downloads)) +- OpenShift pull secret saved at `~/pull-secret.json` (download from [console.redhat.com](https://console.redhat.com/openshift/downloads)), or point elsewhere via the `PULL_SECRET` environment variable - Fork the repository — ArgoCD reconciles cluster state against your fork, so changes must be pushed to your remote ### Secrets and reference value setup @@ -97,7 +97,7 @@ For air-gapped bare metal environments, see [`airgap/DEPLOY-RUNBOOK.md`](airgap/ These scripts generate the cryptographic material and attestation reference values needed by Trustee. Run them once before your first deployment. 1. `make gen-secrets` — generates KBS key pairs, sealed-secrets signing keys, and copies `values-secret.yaml.template` to `~/values-secret-coco-pattern.yaml` -2. Collect attestation reference values (requires `veritas` — `pip install "osc-veritas[snp]==0.1.3rc1"` —, `cosign` >= 2.0 for Azure, `yq`, `jq`, and `~/pull-secret.json`). By default this collects and merges reference values for **both TDX and SNP**: +2. Collect attestation reference values (requires `veritas` — `pip install "osc-veritas[snp]==0.1.3rc1"` —, `cosign` >= 2.0 for Azure, `yq`, `jq`, and `~/pull-secret.json` or `PULL_SECRET`). By default this collects and merges reference values for **both TDX and SNP**: - **Azure:** `make collect-azure-refvals` — pulls PCR measurements from the dm-verity image via veritas. Saves to `~/.coco-pattern/measurements.json`. - **Bare metal:** `make collect-firmware-refvals` — computes firmware measurements from OCP release artifacts via veritas. Saves to `~/.coco-pattern/firmware-reference-values.json`. `pcrStash` and `firmwareReferenceValues` are both enabled by default in `~/values-secret-coco-pattern.yaml`, so nothing needs to be uncommented — the collection script automatically writes an empty `{}` placeholder for the platform you're not using. - See [docs/firmware-reference-values.md](docs/firmware-reference-values.md) for detailed workflow and options. diff --git a/docs/firmware-reference-values.md b/docs/firmware-reference-values.md index bb4e135d..ccb50a4f 100644 --- a/docs/firmware-reference-values.md +++ b/docs/firmware-reference-values.md @@ -22,7 +22,7 @@ By default, `collect-firmware-refvals.sh` collects reference values for **both T - `veritas` installed on the host: `pip install "osc-veritas[snp]==0.1.3rc1"` - `cosign` >= 2.0 — Azure only, used by veritas to verify the Red Hat dm-verity image signature: - `yq` and `jq` installed -- OpenShift pull secret at `~/pull-secret.json` +- OpenShift pull secret at `~/pull-secret.json` (override the location with the `PULL_SECRET` environment variable or `--pull-secret`) - For bare metal: OCP version of your cluster (auto-detected if `oc` is logged in) - For bare metal TDX: `tdx-measure` (`cargo install --git https://github.com/virtee/tdx-measure tdx-measure-cli`) — collection continues with a warning if absent, but TDX RTMR values will be incomplete @@ -71,7 +71,8 @@ Veritas resolves the kata-containers and edk2-ovmf RPMs from the OCP release pay Options: --platform Platform: baremetal (default) or azure -o, --output Override output path - -p, --pull-secret Pull secret file (default: ~/pull-secret.json) + -p, --pull-secret Pull secret file (default: ~/pull-secret.json, + override via PULL_SECRET env var) -v, --ocp-version OCP version (baremetal; default: auto-detect) --osc-version OSC operator version (azure; default: auto-detect) -t, --tee TEE type (default: both -- collects and merges both) diff --git a/rhdp/wrapper.sh b/rhdp/wrapper.sh index 1bc6ba16..79b06d74 100755 --- a/rhdp/wrapper.sh +++ b/rhdp/wrapper.sh @@ -189,7 +189,7 @@ bash ./scripts/gen-secrets.sh echo "---------------------" echo "retrieving PCR measurements" echo "---------------------" -bash ./scripts/collect-firmware-refvals.sh --platform azure --tee snp +bash ./scripts/collect-firmware-refvals.sh --platform azure --tee snp --pull-secret "${PULL_SECRET:-$HOME/pull-secret.json}" sleep 60 echo "---------------------" diff --git a/scripts/collect-firmware-refvals.sh b/scripts/collect-firmware-refvals.sh index 95bc0cc3..69c56f02 100755 --- a/scripts/collect-firmware-refvals.sh +++ b/scripts/collect-firmware-refvals.sh @@ -28,7 +28,8 @@ # Options: # --platform Platform: baremetal (default) or azure # -o, --output Override output path -# -p, --pull-secret Pull secret file (default: ~/pull-secret.json) +# -p, --pull-secret Pull secret file (default: ~/pull-secret.json, +# override via PULL_SECRET env var) # -v, --ocp-version OCP version (baremetal; default: auto-detect) # --osc-version OSC operator version (azure; default: auto-detect) # -t, --tee TEE type (default: both -- collects and merges both) @@ -43,7 +44,7 @@ set -euo pipefail # Defaults PLATFORM="baremetal" OUTPUT_FILE="" -PULL_SECRET="${HOME}/pull-secret.json" +PULL_SECRET="${PULL_SECRET:-${HOME}/pull-secret.json}" OCP_VERSION="" OSC_VERSION="" TEE="both" @@ -82,7 +83,7 @@ while [[ $# -gt 0 ]]; do shift ;; -h|--help) - sed -n '2,39p' "$0" | sed 's/^# \?//' + sed -n '2,40p' "$0" | sed 's/^# \?//' exit 0 ;; *) @@ -148,7 +149,7 @@ fi # Check pull secret exists if [ ! -f "$PULL_SECRET" ]; then echo "Error: Pull secret not found at $PULL_SECRET" >&2 - echo "Provide path via --pull-secret or create ~/pull-secret.json" >&2 + echo "Provide path via --pull-secret, the PULL_SECRET environment variable, or create ~/pull-secret.json" >&2 exit 1 fi