Attestation with Anjuna Policy Manager

In some deployment scenarios, a Pod performs attestation with an APM server using a public IP address. In this scenario, the source IP address of the Pod is the public IP of the Confidential VM (CVM) it is running on.

Currently, CVMs used by the Anjuna Custom Container Runtime do not allocate IP addresses; instead, the cloud service provider (CSP) allocates them dynamically. This may be a challenge if you are using source address-based firewall rules to limit access to the APM server.

You may need to relax those rules to allow for all addresses in a Virtual Private Network (VPC) address pool, or to enable global public access. This approach is a simple solution for less critical development or proof-of-concept deployments.

Alternatively, you can use secure private network tunnels. In these cases, or when the Kubernetes cluster and APM are deployed on the same CSP, you can use local IP routing instead. Further restrict public access to the APM server to authorized clients only. You can also use local hostname-based resolution for private IP routing; the same hostname can appear in the APM TLS certificate.

Refer to the Attestation with the Anjuna Policy Manager documentation to learn more about attestation with Confidential Pods.

Refer to the Anjuna Policy Manager documentation to learn more about deploying and using the APM.