2.16. 更新 RVPS 配置映射
您可以使用可信执行环境的平台配置寄存器(PCR) 8 值,使用预期的测量更新 Reference Value Provider Service (RVPS)配置映射。红帽构建的 Trustee 使用这些测量来验证证据。
工作负载集群管理员通过在配置或策略文件(如 initdata )上执行 SHA256 哈希来计算 PCR8 值:
$ hash=$(sha256sum <config_file> | cut -d' ' -f1)
$ initial_pcr=0000000000000000000000000000000000000000000000000000000000000000
$ PCR8_HASH=$(echo -n "$initial_pcr$hash" | xxd -r -p | sha256sum | cut -d' ' -f1)
先决条件
- PCR8 值、过期和算法,由工作负载集群管理员创建
流程
创建
rvps-configmap-update.yaml清单文件:apiVersion: v1 kind: ConfigMap metadata: name: rvps-reference-values namespace: trustee-operator-system data: reference-values.json: | [ { "name": "pcr03", "expiration": "2025-12-12T00:00:00Z", "hash-value": [ { "alg": "sha256", "value": "3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969" } ] }, { "name": "pcr08", "expiration": "2025-12-12T00:00:00Z", "hash-value": [ { "alg": "sha256", "value": "<PCR8_HASH>" } ] }, { "name": "pcr09", "expiration": "2025-12-12T00:00:00Z", "hash-value": [ { "alg": "sha256", "value": "22e306eac888c8393203858a8b4b7b8f36f3d1434fc4dd044e6b20c6fa43c4d9" } ] }, { "name": "pcr11", "expiration": "2025-12-12T00:00:00Z", "hash-value": [ { "alg": "sha256", "value": "53e58bd6ebb6103c18fd19093cb1bcd0a9235685ad642a6d0981ce8314f5e81d" } ] }, { "name": "pcr12", "expiration": "2025-12-12T00:00:00Z", "hash-value": [ { "alg": "sha256", "value": "267c5142db5118a15e5bd98011bf49bb21e72405ece1d9b1ca7fb27de95ee5b3" } ] } ]- <PCR8_HASH>
-
指定
PCR8_HASH值。
运行以下命令来更新 RVPS 配置映射:
$ oc apply -f rvps-configmap-update.yaml