Kubernetes Pod specification

This section describes the changes you need to make to a Kubernetes Pod specification in order to instruct the Anjuna Nitro Kubernetes software to run the specified application in an AWS Nitro Enclave.

In this section, some code blocks are shortened to emphasize only the relevant configuration. A line with <snip>… indicates that some lines have been removed from the full configuration.

Enabling Running in an AWS Nitro Enclave

To indicate that a Pod should be running in an AWS Nitro Enclave, set the label nitro.k8s.anjuna.io/managed to yes in the Pod specification:

1  apiVersion: v1
2  kind: Pod
3  metadata:
4    name: nginx-pod
5    labels:
6      name: nginx-pod
7      nitro.k8s.anjuna.io/managed: "yes"
8  <snip>...

Setting this label to yes instructs the Anjuna Nitro Webhook to intercept the creation of that Pod, and automatically convert it into an AWS Nitro Enclave.

Controlling the resources allocated to the AWS Nitro Enclave

Use the standard Kubernetes Pod specification attributes to control the vCPUs and memory reserved for the enclave:

spec.containers[].resources.limits.cpu
spec.containers[].resources.limits.memory

spec.containers[].resources.limits.cpu MUST be an integer when used in the context of an AWS Nitro Enclave (a regular Kubernetes Pod supports fractional vCPU values). The number of vCPU cores must be an even number due to hyperthreading.

This is an example Pod configuration that reserves 2GB of memory and 2 vCPUs for an AWS Nitro Enclave (see lines 14-16):

 1  apiVersion: v1
 2  kind: Pod
 3  metadata:
 4    name: nginx-pod
 5    labels:
 6      name: nginx-pod
 7      nitro.k8s.anjuna.io/managed: "yes"
 8  spec:
 9    containers:
10    - name: nginx-pod
11      image: nginx:latest
12      imagePullPolicy: Always
13      resources:
14        limits:
15          memory: "2048Mi"
16          cpu: "2"
17      ports:
18        - containerPort: 80
19  <snip>...

Passing parameters to the Anjuna Nitro Runtime

When a Pod is launched in an AWS Nitro Enclave, the Anjuna Nitro Runtime is used to build, configure and run the AWS Nitro Enclave.

The following environment variable is used to control how the Anjuna Nitro Runtime behaves:

ANJ_ENCLAVE_DEBUG_MODE: Set this variable to “yes” to create a debug enclave. If not defined or set, the Anjuna Nitro Kubernetes will start the AWS Nitro Enclave in production mode.

Downloading an EIF instead of building it on the fly

The Anjuna Nitro Kubernetes tools can create the Enclave Image File automatically from the Pod specification. However, you also have the option to pre-create an EIF and instruct the Anjuna Nitro Kubernetes to download the EIF from an S3 bucket by using the nitro.k8s.anjuna.io/imageLocation annotation:

 1  apiVersion: v1
 2  kind: Pod
 3  metadata:
 4    name: secure-eif-pod
 5    labels:
 6      name: secure-eif-pod
 7      nitro.k8s.anjuna.io/managed: "yes"
 8    annotations:
 9      nitro.k8s.anjuna.io/imageLocation: "s3://your-eif-bucket/your-eif-file"
10      <snip>...

When using this option, the container image in the Pod specification is ignored, although the Kubernetes Pod specification requires a value. You can simply leave the container image used in the original Pod specification.

Controlling the resources assigned to the Anjuna Nitro Pod

You have the ability to control the resources assigned to the Anjuna Nitro Pod by specifying the following annotations:

nitro.k8s.anjuna.io/launcherCPU: The limit for the number of vCPUs for the Pod.
nitro.k8s.anjuna.io/launcherMemory: The limit for the amount of memory for the Pod.

The values for these annotations are in the same format than the limits properties (memory/cpu) for a Pod specification:

<snip>
annotations:
  <snip>...
  nitro.k8s.anjuna.io/launcherMemory: "4Gi"
  nitro.k8s.anjuna.io/launcherCPU: "750m"
  <snip>...

If you don’t specify these annotations, no resource limits are set on the launcher Pod. This is particularly useful when creating Enclave Image Files (EIF) automatically, which is a memory-intensive process. Once the EIF has been created, the resource requirements for the launcher Pod are minimal.

Licensing the Anjuna Nitro Runtime for an Anjuna Nitro Pod

A license is required to run an Anjuna Nitro Pod. See the Licensing page for instructions on how to download the license from the Anjuna Resource Center.

This license file must be mounted to each Pod as a Kubernetes secret.

The Kubernetes secret is expected to be named anjuna-license. The key license.yaml contains the contents of the license file downloaded earlier. Run the following command to create the secret:

$ kubectl create secret generic anjuna-license --from-file=license.yaml=anjuna-license.yaml

Mount the secret as a volume to each container in the Pod.

<snip>...
spec:
  containers:
  - name: nginx-pod
    <snip>...
    volumeMounts:
    - name: anjuna-license
      mountPath: "/opt/anjuna"  # ignored - this will be overridden by the webhook
      readOnly: true
  volumes:
  - name: anjuna-license
    secret: # Prereq: user should run `kubectl create secret generic anjuna-license --from-file=license.yaml=anjuna-license.yaml`
      secretName: anjuna-license

Example

The following Pod specification creates an AWS Nitro Enclave for the Nginx web server.

 1  apiVersion: v1
 2  kind: Pod
 3  metadata:
 4    name: nginx-pod
 5    labels:
 6      name: nginx-pod
 7      nitro.k8s.anjuna.io/managed: "yes"
 8  spec:
 9    containers:
10    - name: nginx-pod
11      image: nginx:latest
12      imagePullPolicy: Always
13      env:
14        - name: ANJ_ENCLAVE_DEBUG_MODE
15          value: "yes"
16      resources:
17        limits:
18          memory: "2048Mi"
19          cpu: "2"
20      ports:
21        - containerPort: 80
22      volumeMounts:
23      - name: anjuna-license
24        mountPath: "/opt/anjuna"  # ignored - this will be overridden by the webhook
25        readOnly: true
26    volumes:
27    - name: anjuna-license
28      secret: # Prereq: user should run `kubectl create secret generic anjuna-license --from-file=license.yaml=anjuna-license.yaml`
29        secretName: anjuna-license