temporary hack to enable intel tdx

waiting pr on the trustee side

Signed-off-by: Beraldo Leal <bleal@redhat.com>

Author: beraldoleal

overrides/values-trustee.yaml

@@ -12,6 +12,11 @@ secretStore:
   kind: ClusterSecretStore
 
 kbs:
+  # Enable Intel TDX attestation support
+  tdx:
+    enabled: true
+    collateralService: "https://api.trustedservices.intel.com/sgx/certification/v4/"
+
   secretResources:
     - name: "kbsres1"
       key: "secret/data/hub/kbsres1"

values-coco-dev.yaml

@@ -306,10 +306,38 @@ clusterGroup:
       name: trustee
       namespace: trustee-operator-system
       project: hub
-      chart: trustee
-      chartVersion: 0.1.*
-      extraValueFiles:
-        - '$patternref/overrides/values-trustee.yaml'
+      # TEMPORARY: Using Git branch with TDX config until PR merges
+      # Git repo with TDX attestation support
+      repoURL: https://github.com/beraldoleal/trustee-chart.git
+      targetRevision: tdx-fix
+      path: .
+      # TO REVERT after PR merge: Remove repoURL/targetRevision/path and uncomment:
+      # chart: trustee
+      # chartVersion: 0.1.*
+      # extraValueFiles:
+      #   - '$patternref/overrides/values-trustee.yaml'
+      # TEMPORARY: Inline values because $patternref doesn't work with Git repo source
+      # TODO: Move these values back to overrides/values-trustee.yaml once using Helm chart registry
+      # Secret store configuration for External Secrets Operator
+      secretStore:
+        name: vault-backend
+        kind: ClusterSecretStore
+      kbs:
+        # Enable Intel TDX attestation support
+        tdx:
+          enabled: true
+          collateralService: "https://api.trustedservices.intel.com/sgx/certification/v4/"
+        # Secret resources accessible to trustee from Vault
+        secretResources:
+          - name: "kbsres1"
+            key: "secret/data/hub/kbsres1"
+          - name: "passphrase"
+            key: "secret/data/hub/passphrase"
+          # SPIRE x509pop certificates per workload type
+          - name: "spire-cert-qtodo"
+            key: "secret/data/pushsecrets/spire-cert-qtodo"
+          - name: "spire-key-qtodo"
+            key: "secret/data/pushsecrets/spire-key-qtodo"
     sandbox:
       name: sandbox
       namespace: openshift-sandboxed-containers-operator