Instance security configuration

As a cloud administrator, you can configure the following security features for the instances that run on your cloud:

  • UEFI Secure boot: You can create a UEFI Secure Boot flavor with the property key os:secure_boot enabled. Cloud users can use this flavor to create instances that are protected with UEFI Secure Boot.
  • Emulated virtual Trusted Platform Module (vTPM): You can provide cloud users the ability to create instances that have emulated vTPM devices.
  • SEV: Use to enable your cloud users to create instances that use memory encryption.

Enable vTPM device support on Compute nodes
Copy link

To enable cloud users to create instances with vTPM devices, you must configure the Compute nodes to enable vTPM support.

Before you begin
Copy link

  • The oc command line tool is installed on your workstation.
  • You are logged in to Red Hat OpenStack Services on OpenShift (RHOSO) as a user with cluster-admin privileges.
  • You have selected the OpenStackDataPlaneNodeSet CR that defines the nodes you want to configure vTPM support on. For more information about creating an OpenStackDataPlaneNodeSet CR, see Create a pre-provisioned node set for dynamic routing.

About this task
Copy link

Warning
You can configure only whole node sets, not a subset of the nodes in a node set. To reconfigure a subset of nodes in a node set, you must scale the node set down and create a new node set from the nodes that you remove.

Procedure
Copy link

  1. Create or update the ConfigMap CR named nova-extra-config.yaml and enable vTPM support: 
    apiVersion: v1
kind: ConfigMap
metadata:
  name: nova-extra-config
  namespace: openstack
data:
  30-nova-vtpm.conf: |
    [libvirt]
    swtpm_enabled = true
  2. Create a new OpenStackDataPlaneDeployment CR to configure the services on the data plane nodes and deploy the data plane, and save it to a file named compute_vtpm_deploy.yaml on your workstation: 
    apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: openstack-edpm-vtpm
  3. In the compute_vtpm_deploy.yaml, specify nodeSets to include all the OpenStackDataPlaneNodeSet CRs that you want to deploy. Ensure that you include the OpenStackDataPlaneNodeSet CR that you selected as a prerequisite. This OpenStackDataPlaneNodeSet CR defines the nodes you want to configure for vTPM support.
    Warning

    If your deployment has more than one node set, changes to the nova-extra-config.yamlConfigMap can affect more than one node set, depending on how the NodeSets and the DataPlaneServices are configured. You can check if a node set uses the nova-extra-config.yamlConfigMap which causes reconfiguration to affect more than one node set:

    1. Check the services list of the node set and find the name of the DataPlaneService that points to nova.
    2. Ensure that the value of the edpmServiceType field of the DataPlaneService is set to nova.

      If the dataSources list of the DataPlaneService contains a configMapRef named nova-extra-config, then this node set uses this ConfigMap and therefore will be affected by the configuration changes in this ConfigMap. If some of the node sets that are affected should not be reconfigured, you must create a new DataPlaneService pointing to a separate ConfigMap for these node sets.

     
    apiVersion: dataplane.openstack.org/v1beta1
kind: OpenStackDataPlaneDeployment
metadata:
  name: openstack-vtpm
spec:
  nodeSets:
    - openstack-edpm
    - <nodeSet_name>
    • Replace <nodeSet_name> with the names of the OpenStackDataPlaneNodeSet CRs that you want to include in your data plane deployment.
  4. Save the compute_vtpm_deploy.yaml deployment file.
  5. Deploy the data plane: 
    $ oc create -f compute_vtpm_deploy.yaml
  6. Verify that the data plane is deployed: 
    $ oc get openstackdataplanenodeset
NAME           STATUS   MESSAGE
openstack-vtpm True     Deployed
  7. Access the remote shell for openstackclient and verify that the deployed Compute nodes are present on the control plane: 
    $ oc rsh -n openstack openstackclient
$ openstack hypervisor list

Create an image for vTPM devices
Copy link

When vTPM support is enabled, you can create an instance image with vTPM properties that cloud users can use to launch instances with vTPM devices.

About this task
Copy link

Note
The scheduling fails if you do not specify the same TPM device model in the flavor and the image.

Procedure
Copy link

  1. Create a new image for vTPM devices: 
     $ openstack image create ...  \
 --property hw_tpm_version=2.0 vtpm-image
    Note
    TPM version 1.2 is not supported.
  2. Optional: Specify the TPM model to use: 
     $ openstack image set \
 --property hw_tpm_model=<tpm_model> \
 vtpm-image
    • Replace <tpm_model> with the model of TPM device to use. Set to one of the following valid values:
      • tpm-tis: (Default) TPM Interface Specification.
      • tpm-crb: Command-Response Buffer.
    Note
    The Compute service ignores the configuration of the hw_tpm_model property if the hw_tpm_version property is not set.

Results
Copy link

  1. Create an instance by using the vTPM image: 
     $ openstack server create --flavor m1.small \
 --image vtpm-image vtpm-instance
  2. Log in to the instance as a cloud user.
  3. To verify that the instance has access to a vTPM device, enter the following command from the instance: 
    $ dmesg | grep -i tpm

Create a flavor for vTPM devices
Copy link

When vTPM support is enabled, you can create one or more flavors with vTPM properties that cloud users can use to launch instances with vTPM devices.

About this task
Copy link

Note
A vTPM device flavor is necessary only when the hw_tpm_model and hw_tpm_version properties are not set on an image. If both the flavor and the image specify a TPM device model and the two values do not match, scheduling fails.

Procedure
Copy link

  1. Create a flavor for vTPM devices: 
     $ openstack --os-compute-api=2.86 flavor create --vcpus 1 --ram 512 --disk 2  \
 --property hw:tpm_version=2.0 \
 vtpm-flavor
    Note
    TPM version 1.2 is not supported.
  2. Optional: Specify the TPM model to use: 
     $ openstack --os-compute-api=2.86 flavor set \
 --property hw:tpm_model=<tpm_model> \
 vtpm-flavor
    • Replace <tpm_model> with the model of TPM device to use. Set to one of the following valid values:
      • tpm-tis: (Default) TPM Interface Specification.
      • tpm-crb: Command-Response Buffer. Compatible only with TPM version 2.0. Note
        The Compute service ignores the configuration of the hw:tpm_model property if the hw:tpm_version property is not set.

Results
Copy link

  1. Create an instance by using the vTPM flavor: 
     $ openstack server create --flavor vtpm-flavor \
 --image rhel-image vtpm-instance
  2. Log in to the instance as a cloud user.
  3. To verify that the instance has access to a vTPM device, enter the following command from the instance: 
    $ dmesg | grep -i tpm