anjuna-k8s-cli build

anjuna-k8s-cli build <provider> --cpod-config <config-file> [OPTIONS...]

Builds an Anjuna Confidential Pod disk image for the specified cloud service provider (CSP).

The anjuna-k8s-cli build command wraps the application container images referenced in the Anjuna Confidential Pod Configuration file together with the Kubernetes service image, and then creates a Confidential Pod disk image for the target CSP. The anjuna-k8s-cli build command pulls and unpacks the container images at build time, and then includes them as part of the disk image so they can be measured.

The <provider> argument selects the target CSP and the corresponding Anjuna SEV CLI used to create the disk image:

  • azure builds a disk image for Anjuna Confidential Pods on Azure Kubernetes Service (AKS), using anjuna-azure-cli.

  • gcp builds a disk image for Anjuna Confidential Pods on OpenShift on Google Cloud, using anjuna-gcp-cli.

The anjuna-<provider>-cli for the selected CSP must be installed and available in your PATH.

Confidential Pod configuration file

Every disk image must be built with an Anjuna Confidential Pod Configuration file, which is set using the --cpod-config flag. This configuration file defines the containers that run in the Pod, enforces security aspects of those containers, and declares any secrets to inject using remote attestation.

For a complete description of the file format, see The Confidential Pod Configuration File reference.

Options

Usage

anjuna-k8s-cli build <provider> --cpod-config <config-file> [OPTIONS...]

-c, --cpod-config

(Required) Path to the Anjuna Confidential Pod Configuration file

--container-engine

Container engine to use, either docker or podman (default: docker)

--disk

Path at which to create the disk image (default: disk.vhd for azure, disk.raw for gcp)

--disk-size

Size of the data disk (default: 512M)

--save-measurements

Path to a JSON file at which to save the disk measurements

--signing-key

Path to the signing key, which must be a private RSA SSL key

-h, --help

Displays usage information for the command, then exits

Exit status

  • 0 on success

  • > 0 on error

Examples

To build an Anjuna Confidential Pod disk image, specify the target provider and the Anjuna Confidential Pod Configuration file.

  • AKS

  • OpenShift on Google Cloud

$ anjuna-k8s-cli build azure \
    --disk-size 2G \
    --cpod-config config.yaml
$ anjuna-k8s-cli build gcp \
    --disk-size 2G \
    --cpod-config config.yaml

To build a disk image using podman as the container engine, set the --container-engine flag:

$ anjuna-k8s-cli build azure \
    --container-engine podman \
    --cpod-config config.yaml