feat(container.provider): added container instances enforcement allowlist #5197
Conversation
… enforcement allowlist Signed-off-by: SimoneFiorani <[email protected]>
…nted Signed-off-by: SimoneFiorani <[email protected]>
…signature Signed-off-by: SimoneFiorani <[email protected]>
…s added Signed-off-by: SimoneFiorani <[email protected]>
…ription Signed-off-by: SimoneFiorani <[email protected]>
Co-authored-by: Mattia Dal Ben <[email protected]>
…lidation of already running containers Signed-off-by: SimoneFiorani <[email protected]>
…ing phase Signed-off-by: SimoneFiorani <[email protected]>
…class Signed-off-by: SimoneFiorani <[email protected]>
Signed-off-by: SimoneFiorani <[email protected]>
Signed-off-by: SimoneFiorani <[email protected]>
Signed-off-by: SimoneFiorani <[email protected]>
Signed-off-by: SimoneFiorani <[email protected]>
Signed-off-by: SimoneFiorani <[email protected]>
...ntainer.provider/OSGI-INF/metatype/org.eclipse.kura.container.provider.ContainerInstance.xml
Outdated
Show resolved
Hide resolved
….eclipse.kura.container.provider.ContainerInstance.xml Co-authored-by: Mattia Dal Ben <[email protected]>
|
As per our offline discussion, among other smaller things, we decided to move the ContainerInstance digest allowlist from the Container Orchestrator to the Allowlist Enforcement Monitor for a better logic separation of the concerns. |
...ipse/kura/container/orchestration/provider/impl/enforcement/AllowlistEnforcementMonitor.java
Outdated
Show resolved
Hide resolved
…n/java/org/eclipse/kura/container/orchestration/provider/impl/enforcement/AllowlistEnforcementMonitor.java Co-authored-by: Mattia Dal Ben <[email protected]>
We discarded this since the only object that knows the digest associated with the Container Instances is the Container Orchestrator... it is natural to have it have the list of the digests. |
|
The build succeeds locally but we are facing an issue in the CI connection to Sonar. An issue has been raised few weeks ago to the Eclipse Team: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/4422 Merging as-is for now. |
This PR adds an option to the Container Instances to be compliant with the Enforcement feature added to the Container Orchestration Service in #5162 and it's the second step of building the Container Authenticity feature.
This option allows the user to provide an Enforcement Digest for a specific Container Instance: when a container is enabled with the given option filled, the provided digest is added to the Container Orchestration Service enforcement allowlist. In this way the Container Instance is allowed to run even if in the Orchestration Service allowlist the digest is not included, because is the container instance to provide it.
Related docs is present in #5184 .
Related Issue:
Description of the solution adopted:
Screenshots:
Manual Tests:
Any side note on the changes made: