Skip to content

feat: osc 1.13 / trustee 1.2 support (v0.9.0)#37

Merged
butler54 merged 2 commits into
validatedpatterns:mainfrom
butler54:pr/osc-1.13-trustee-1.2
Jul 21, 2026
Merged

feat: osc 1.13 / trustee 1.2 support (v0.9.0)#37
butler54 merged 2 commits into
validatedpatterns:mainfrom
butler54:pr/osc-1.13-trustee-1.2

Conversation

@butler54

Copy link
Copy Markdown
Collaborator

Supersedes #36 with squashed commit for commitlint compliance.

Summary

  • KBS config TOML rewrite for Trustee 1.2
  • RVPS format migration (v1.1 → v1.2 object, file_dir_path)
  • Attestation policy: az-snp-vtpm dashes, null guards, upstream alignment
  • Azure platform config defaults (measurement, SMT, ABI)
  • KBS credential policy: skip on Azure peer-pods
  • Sealed secrets JWK ESO, kbsAuthSecretName dummy secret
  • Chart version 0.9.0

Breaking Changes

  • Requires Trustee v1.2.0 / OSC v1.13.0

Test Plan

  • Baremetal TDX attestation (APAC lab node-02)
  • Azure SEV-SNP peer-pods attestation (eastasia)
  • 5 baremetal + 3 Azure deploy cycles

@butler54 butler54 changed the title feat: OSC 1.13 / Trustee 1.2 support (v0.9.0) feat: osc 1.13 / trustee 1.2 support (v0.9.0) Jul 21, 2026
kbs config toml rewrite for trustee 1.2:
- new storage paths and plugin config format
- admin auth removed (DenyAll default)
- tdx-config.yaml deleted (inline in KBS TOML)
- rvps file_dir_path for LocalJson storage

rvps format migration:
- v1.1 array to v1.2 object format with migration annotation
- azure platform config defaults (snp launch measurement, smt, abi)

attestation policy:
- fix az-snp-vtpm dash/underscore key mismatch
- add null guards for query_reference_value()
- align azure snp/tdx sections with upstream operator defaults
- skip kbs credential policy on azure peer-pods

additional:
- sealed secrets jwk signing key eso
- kbsAuthSecretName dummy secret for trustee 1.2 operator

breaking: requires trustee operator v1.2.0 / osc v1.13.0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@butler54
butler54 force-pushed the pr/osc-1.13-trustee-1.2 branch from aa4e4fd to 84865de Compare July 21, 2026 04:53
Signed-off-by: Chris Butler <chris.butler@redhat.com>
@butler54
butler54 merged commit 112599a into validatedpatterns:main Jul 21, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant