routing-setup.sh

The routing-setup.sh script MUST be run at least once (without any command-line parameters) to setup the necessary routing rules to communicate with the enclave. This step is required for a client running on the AWS EC2 parent instance to have the ability to communicate with the Nitro enclave:

In this basic setup, the Nitro Enclave and the EC2 parent instance are on the same virtual interface (named anjuna0), each with a separate IP address.

This setup allows the Nitro Enclave and the parent host to communicate with each other. For example, the Nitro Enclave can ping that Nitro parent instance with the following command:

Similarly, the Nitro parent instance can ping the Nitro Enclave with the following command:

On the other hand, if the Nitro Enclave needs to be reachable from other hosts, the routing-setup.sh script should be invoked to expose specific ports to the external network interface.

For example, if you are running Nginx in the Nitro Enclave, you can expose it to external hosts with the following command (assuming Nginx is configured to listen on port 80):

After this command is executed, you can reach Nginx in the enclave using the EC2 instance IP address (from a different host):

or

The routing-setup.sh script MUST be invoked as root, which means that Kubernetes pods that create Nitro enclaves MUST run as privileged containers.

The Anjuna Nitro Kubernetes tools automatically sets up the permissions on the pods that create and launch Nitro Enclaves.