From 4acb3d2cb57146daa470c0d57008af4887aa4808 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 22:36:32 +0000 Subject: [PATCH 1/4] feat(14-03): update operator CSV pins and trustee chartVersion for OSC 1.13 / Trustee 1.2 - Bump sandboxed-containers-operator CSV from v1.12.0 to v1.13.0 (baremetal, azure) - Bump trustee-operator CSV from v1.1.0 to v1.2.0 (baremetal, azure, trusted-hub) - Update trustee chartVersion from 0.8.* to 0.9.* across all topologies - Add targetRevision: dev/osc-1.13-upgrade to baremetal trustee application for testing - Preserve sandbox/policies chartVersion at 0.2.* (D-10, D-11) - Preserve workload chart paths unchanged (D-12) --- values-azure.yaml | 6 +++--- values-baremetal.yaml | 7 ++++--- values-trusted-hub.yaml | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/values-azure.yaml b/values-azure.yaml index 48c5d703..46cd037b 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -36,13 +36,13 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 trustee: name: trustee-operator namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -87,7 +87,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: diff --git a/values-baremetal.yaml b/values-baremetal.yaml index 0d037ace..f23e70a2 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -41,7 +41,7 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 annotations: argocd.argoproj.io/sync-wave: "10" trustee: @@ -49,7 +49,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 annotations: argocd.argoproj.io/sync-wave: "10" cert-manager: @@ -164,7 +164,8 @@ clusterGroup: annotations: argocd.argoproj.io/sync-wave: "20" chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* + targetRevision: dev/osc-1.13-upgrade extraValueFiles: - '/overrides/values-trustee.yaml' overrides: diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml index a54f1a48..4037e9af 100644 --- a/values-trusted-hub.yaml +++ b/values-trusted-hub.yaml @@ -31,7 +31,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -77,7 +77,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: From 08c6537a1585b75d3436b8afa505e025f7495180 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 23:43:09 +0000 Subject: [PATCH 2/4] fix: remove dead admin auth keypair generation and secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trustee 1.2 uses authorization_mode = "DenyAll" — no admin API access exists. Remove the now-unused: - kbsPublicKey and kbsPrivateKey from values-secret template - ed25519 keypair generation from gen-secrets.sh Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/gen-secrets.sh | 9 --------- values-secret.yaml.template | 17 ----------------- 2 files changed, 26 deletions(-) diff --git a/scripts/gen-secrets.sh b/scripts/gen-secrets.sh index 16c35807..adeeb636 100755 --- a/scripts/gen-secrets.sh +++ b/scripts/gen-secrets.sh @@ -4,8 +4,6 @@ echo "Creating secrets as required" echo COCO_SECRETS_DIR="${HOME}/.coco-pattern" -KBS_PRIVATE_KEY="${COCO_SECRETS_DIR}/kbsPrivateKey" -KBS_PUBLIC_KEY="${COCO_SECRETS_DIR}/kbsPublicKey" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" VALUES_FILE="${HOME}/values-secret-coco-pattern.yaml" @@ -21,13 +19,6 @@ if [ "${COCO_ENABLE_SSH_DEBUG:-false}" = "true" ]; then fi fi -if [ ! -f "${KBS_PRIVATE_KEY}" ]; then - echo "Creating kbs keys" - rm -f "${KBS_PUBLIC_KEY}" - openssl genpkey -algorithm ed25519 >${KBS_PRIVATE_KEY} - openssl pkey -in "${KBS_PRIVATE_KEY}" -pubout -out "${KBS_PUBLIC_KEY}" -fi - ## PCCS secrets for bare metal Intel TDX deployments PCCS_PRIVATE_KEY="${COCO_SECRETS_DIR}/pccs_private.pem" PCCS_CERTIFICATE="${COCO_SECRETS_DIR}/pccs_certificate.pem" diff --git a/values-secret.yaml.template b/values-secret.yaml.template index 1afb92d0..732728fb 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -11,23 +11,6 @@ secrets: # Core KBS Secrets (Always Required) # =================================================================== - # KBS public key - used by workloads to verify KBS identity - - name: kbsPublicKey - vaultPrefixes: - - hub - fields: - - name: publicKey - path: ~/.coco-pattern/kbsPublicKey - - # KBS private key - used by KBS to sign responses - # Generated by gen-secrets.sh alongside kbsPublicKey - - name: kbsPrivateKey - vaultPrefixes: - - global - fields: - - name: privateKey - path: ~/.coco-pattern/kbsPrivateKey - # Auto-generated test secrets provided by KBS - name: kbsres1 vaultPrefixes: From 2569c166573a2f86a8ae9667893496c2c878cd10 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 17 Jul 2026 01:25:49 +0000 Subject: [PATCH 3/4] fix: remove PCCS collateralService override for direct Intel attestation (D-01) - Remove kbs.tdx.collateralService override pointing to local PCCS - Chart default (api.trustedservices.intel.com) takes effect per D-01 --- values-baremetal.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/values-baremetal.yaml b/values-baremetal.yaml index f23e70a2..fc8c0077 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -173,8 +173,6 @@ clusterGroup: value: "true" - name: kbs.tdx.enabled value: "true" - - name: kbs.tdx.collateralService - value: "https://pccs-service.intel-dcap.svc.cluster.local:8042/sgx/certification/v4/" - name: kbs.gpu.enabled value: "true" - name: kbs.baremetal.enabled From 0201af87f35ec4e0c9d3bf1aa958cf116af74a36 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 17 Jul 2026 04:55:45 +0000 Subject: [PATCH 4/4] fix: switch trustee chart to git-based ref for dev testing Trustee chart 0.9.0 not yet published to charts.validatedpatterns.io (latest is 0.8.0). Switch from chart/chartVersion to repoURL/path pointing at butler54/trustee-chart dev/osc-1.13-upgrade branch, same pattern used during Milestone 1 testing (f228913). Co-Authored-By: Claude Opus 4.6 (1M context) --- values-baremetal.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/values-baremetal.yaml b/values-baremetal.yaml index fc8c0077..d9f45f9a 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -163,9 +163,9 @@ clusterGroup: project: trustee annotations: argocd.argoproj.io/sync-wave: "20" - chart: trustee - chartVersion: 0.9.* + repoURL: https://github.com/butler54/trustee-chart.git targetRevision: dev/osc-1.13-upgrade + path: . extraValueFiles: - '/overrides/values-trustee.yaml' overrides: