Deploy Nginx as an Anjuna Confidential Pod

To deploy Nginx as an Anjuna Confidential Pod (Confidential Pod), create a Kubernetes Deployment specification:

The image specified in the Pod specification should match the image specified via .pod.containers.image in the Confidential Pod Configuration, which is set at build time. If they do not match, the Confidential Pod emits a warning and uses the measured, build-time image instead.

The cluster must have access to your container image as well, otherwise the Confidential Pod might fail to start with image pull errors. For private images, provide credentials to the cluster via an image pull secret or other means.

The .spec.containers[0].name field of the Pod (or .spec.template.spec.containers[0].name of a Deployment) must match the container name that you provided via .pod.containers.name in the Confidential Pod Configuration, which is set at build time.

 
$ cat <<EOF > nginx.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: default
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx
        # use the Anjuna Custom Container Runtime
        # to run this Pod as a Confidential Pod
        anjuna.io/run-confidential: "yes"
      annotations:
        # reference the Confidential Pod image ID
        cvm.anjuna.io/image: "${ANJUNA_NGINX_IMAGE_NAME}"
    spec:
      containers:
      - name: nginx
        image: docker.io/library/nginx:latest
        ports:
        - containerPort: 80
        imagePullPolicy: Always
EOF

To leverage the confidentiality of AMD SEV through Anjuna’s Kubernetes offering, the following are required:

  • Specify the anjuna.io/run-confidential: "yes" label in the Pod deployment metadata labels (line 18 above).

  • Point to the measured Confidential Pod image that was built earlier, through the cvm.anjuna.io/image annotation.

The anjuna.io/run-confidential: "yes" label achieves the following:

  • Tells Kubernetes to use the Anjuna Kubernetes Toolset to launch the Pod as a Confidential Pod in Google Cloud with AMD SEV.

  • Tells the webhook to mutate the Nginx specification to ensure consistent resource allocation in the Node.

Start the Nginx Pod

To start the Confidential Pod, run the following command:

$ oc apply -f nginx.yaml

This command applies the Deployment spec to the cluster, launching a new Confidential Pod that runs the Nginx application.

Use the following command to check the status of the Nginx Pod:

$ oc get pod -l app=nginx

When the Pod status is Running, run the following commands to confirm that Nginx was started successfully. These commands will create a temporary curl Pod and send a request to the Nginx Pod IP.

$ NGINX_IP=$(oc get $(oc get pods -l app=nginx -oname) --template '{{.status.podIP}}')
$ oc run -it --rm --restart=Never --image curlimages/curl curl -- -s ${NGINX_IP}:80

You should see an HTML result similar to the following:

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

Nginx is running as a Confidential Pod, and it benefits from the same security protections as Anjuna Confidential Containers: data is protected in use from outside threats and untrusted parties.

Furthermore, you can integrate this Confidential Pod with the Anjuna Policy Manager (APM) to automatically and securely distribute secrets to your unmodified application.

You can configure your Confidential Pod to fetch secrets from an APM instance. Secrets will be provided to your application only after its measurements are verified by the APM through a remote attestation process.

Refer to the Anjuna Policy Manager documentation to see how to configure an APM integration for your Confidential Pod.

After you create a Confidential Pod Configuration file that specifies an APM connection, use the file when building the Confidential Pod disk image. Pass the file to the anjuna-k8s-cli build command by using the --cpod-config <config-file> flag.

Stop the Nginx Pod

To stop and delete the Confidential Pod, run the following command:

$ oc delete -f nginx.yaml

The Confidential VM (CVM) that was created to run this Confidential Pod will also be deleted in Google Cloud.