aa: let the KBC select attestation policies by id - #1604
Open
Xynnn007 wants to merge 1 commit into
Open
Conversation
Xynnn007
marked this pull request as ready for review
July 29, 2026 01:46
Member
Author
|
Related to confidential-containers/trustee#282 |
Trustee gained a policy_selector_map, with which an administrator maps a policy_selector that a client names in the RCAR Request to the Attestation Service policies that evaluate its evidence. Give the KBC a way to name such a policy_selector, so that a deployment can have different guests evaluated against different policies without running separate KBS instances. kbs_protocol carries the policy_selector from `KbsClientBuilder::set_policy_selector` into the extra-params of the auth Request. AA takes it from the new policy_selector field of the `[token_configs.kbs]` section, which is empty by default. An empty policy_selector is not sent at all: KBS falls back to a default policy for a Request without a policy_selector, but rejects the handshake of a client that sends a policy_selector the deployment does not declare. Configuring a policy_selector therefore only works against a KBS that maps it, which is why it stays opt-in and why the empty string, rather than an Option, expresses "not configured" in the config. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com> Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trustee gained a policy_id_map, with which an administrator maps an id that a client names in the RCAR Request to the Attestation Service policies that evaluate its evidence. Give the KBC a way to name such an id, so that a deployment can have different guests evaluated against different policies without running separate KBS instances.
kbs_protocol carries the id from
KbsClientBuilder::set_idinto theextra-paramsof the auth Request. AA takes it from the newidfield of the[token_configs.kbs]section, which is empty by default.An empty id is not sent at all: KBS falls back to a default policy for a Request without an id, but rejects the handshake of a client that sends an id the deployment does not declare. Configuring an id therefore only works against a KBS that maps it, which is why it stays opt-in and why the empty string, rather than an
Option, expresses "not configured" in the config.See also confidential-containers/trustee#1521