From 0b865026c8a2ddbe5cae00cd80e0aa797c228c3b Mon Sep 17 00:00:00 2001 From: Antonia Avramova Date: Thu, 23 Nov 2023 11:16:34 +0200 Subject: [PATCH 1/4] [#292] Add missing TLS flags for the local communication (#294) Signed-off-by: Antonia Avramova --- .../references/connectivity/suite-connector-config.md | 2 +- .../content/docs/references/software-update-config.md | 7 +++++++ .../content/docs/references/system-metrics-config.md | 9 ++++++++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/web/site/content/docs/references/connectivity/suite-connector-config.md b/web/site/content/docs/references/connectivity/suite-connector-config.md index 56d8dffb..b82543ed 100644 --- a/web/site/content/docs/references/connectivity/suite-connector-config.md +++ b/web/site/content/docs/references/connectivity/suite-connector-config.md @@ -77,7 +77,6 @@ Be aware that some combinations may be incompatible { "provisioningFile": "provisioning.json", "address": "mqtts://mqtt.bosch-iot-hub.com:8883", - "alpn" : [], "deviceId": "", "authId": "", "tenantId": "", @@ -85,6 +84,7 @@ Be aware that some combinations may be incompatible "username": "", "clientId": "", "policyId": "", + "alpn" : [], "caCert": "iothub.crt", "cert": "", "key": "", diff --git a/web/site/content/docs/references/software-update-config.md b/web/site/content/docs/references/software-update-config.md index 993cf4b2..d0abf059 100644 --- a/web/site/content/docs/references/software-update-config.md +++ b/web/site/content/docs/references/software-update-config.md @@ -28,6 +28,10 @@ To control all aspects of the software update behavior. | broker | string | tcp://localhost:1883 | Address of the MQTT server/broker that the software update will connect for the local communication, the format is: `scheme://host:port` | | username | string | | Username that is a part of the credentials | | password | string | | Password that is a part of the credentials | +| **Local connectivity - TLS** | | | | +| caCert | string | | PEM encoded CA certificates file | +| cert | string | | PEM encoded certificate file to authenticate to the MQTT server/broker | +| key | string | | PEM encoded unencrypted private key file to authenticate to the MQTT server/broker | | **Logging** | | | | | logFile | string | log/software-update.log | Path to the file where log messages are written | | logLevel | string | INFO | All log messages at this or higher level will be logged, the log levels in descending order are: ERROR, WARN, INFO, DEBUG and TRACE | @@ -67,6 +71,9 @@ The following template illustrates all possible properties with their default va "broker": "tcp://localhost:1883", "username": "", "password": "", + "caCert": "", + "cert": "", + "key": "", "logFile": "log/software-update.log", "logLevel": "INFO", "logFileCount": 5, diff --git a/web/site/content/docs/references/system-metrics-config.md b/web/site/content/docs/references/system-metrics-config.md index f27381b2..004d1b1f 100644 --- a/web/site/content/docs/references/system-metrics-config.md +++ b/web/site/content/docs/references/system-metrics-config.md @@ -17,6 +17,10 @@ To control all aspects of the system metrics behavior. | broker | string | tcp://localhost:1883 | Address of the MQTT server/broker that the system metrics will connect for the local communication, the format is: `scheme://host:port` | | username | string | | Username that is a part of the credentials | | password | string | | Password that is a part of the credentials | +| **Local connectivity - TLS** | | | | +| caCert | string | | PEM encoded CA certificates file | +| clientCert | string | | PEM encoded certificate file to authenticate to the MQTT server/broker | +| clientKey | string | | PEM encoded unencrypted private key file to authenticate to the MQTT server/broker | | **Logging** | | | | | logFile | string | log/system-metrics.log | Path to the file where log messages are written | | logLevel | string | INFO | All log messages at this or higher level will be logged, the log levels in descending order are: ERROR, WARN, INFO, DEBUG and TRACE | @@ -42,10 +46,13 @@ The following template illustrates all possible properties with their default va ```json { - "frequency" : "" + "frequency" : "", "broker": "tcp://localhost:1883", "username": "", "password": "", + "caCert": "", + "clientCert": "", + "cleintKey": "", "logFile": "log/system-metrics.log", "logLevel": "INFO", "logFileCount": 5, From 6be64789711d16f48410968855bbc2fb0482234d Mon Sep 17 00:00:00 2001 From: Dimitar Dimitrov Date: Thu, 4 Jan 2024 10:34:36 +0200 Subject: [PATCH 2/4] [#306] Update container manager reference guide in regards to the signed container images support (#308) Signed-off-by: Dimitar Dimitrov Date: Wed, 17 Jan 2024 13:49:38 +0200 Subject: [PATCH 3/4] [#311] Update default_ctrs_stop_timeout in Container Management reference guide (#312) * [#311] Update default_ctrs_stop_timeout in Container Management reference guide --------- Signed-off-by: Dimitar Dimitrov --- .../docs/references/containers/container-manager-config.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/site/content/docs/references/containers/container-manager-config.md b/web/site/content/docs/references/containers/container-manager-config.md index 6b8cba5d..b58bc0e4 100644 --- a/web/site/content/docs/references/containers/container-manager-config.md +++ b/web/site/content/docs/references/containers/container-manager-config.md @@ -16,7 +16,8 @@ To control all aspects of the container manager behavior. | exec_root_dir | string | /var/run/container-management | Root directory for the container manager's executable artifacts | | container_client_sid | string | container-management.service.local.v1.service-containerd-client | Unique identifier that is used for an interaction with the runtime | | network_manager_sid | string | container-management.service.local.v1.service-libnetwork-manager | Unique identifier that is used for networking | -| default_ctrs_stop_timeout | int | 30 | Timeout in seconds for a container to stop gracefully, otherwise its root process will be force stopped | +| default_ctrs_stop_timeout | int | 30 | (Deprecated since v0.1.0-M4, type changed to string) Timeout in seconds for a container to stop gracefully, otherwise its root process will be forcefully stopped | +| default_ctrs_stop_timeout | string | 30s | Timeout for a container to stop gracefully in duration string format (e.g. 1h2m3s5ms), otherwise its root process will be forcefully stopped | | **Runtime** | | | | | default_ns | string | kanto-cm | Namespace that is used by the runtime for isolation | | address_path | string | /run/containerd/containerd.sock | Path to the runtime's communication endpoint | From 41ed73f314bcf5c5a3684835cdc44e3581f91d70 Mon Sep 17 00:00:00 2001 From: Dimitar Dimitrov Date: Wed, 24 Jan 2024 09:35:14 +0200 Subject: [PATCH 4/4] Provide how to guide for verifying signed container images (#309) --------- Signed-off-by: Dimitar Dimitrov --- .../verify-signed-container-images.md | 153 ++++++++++++++++++ .../containers/container-manager-config.md | 9 +- 2 files changed, 158 insertions(+), 4 deletions(-) create mode 100644 web/site/content/docs/how-to-guides/verify-signed-container-images.md diff --git a/web/site/content/docs/how-to-guides/verify-signed-container-images.md b/web/site/content/docs/how-to-guides/verify-signed-container-images.md new file mode 100644 index 00000000..cbf7e56a --- /dev/null +++ b/web/site/content/docs/how-to-guides/verify-signed-container-images.md @@ -0,0 +1,153 @@ +--- +title: "Verify signed container images" +type: docs +description: > + Verify that container image is signed when creating a container from it in Kanto Container Management. +weight: 5 +--- + +By following the steps below, you will sign a container image and push it to a local registry using a{{% refn "https://github.com/notaryproject/notation" %}}`notation`{{% /refn %}}. Then a notation trust policy and the Kanto Container Management service will be configured in a way that running containers from the signed image via kanto-cm CLI will be successful, while running containers from unsigned images will fail. + +### Before you begin + +To ensure that your edge device is capable to execute the steps in this guide, you need: + +* If you don't have an installed and running Eclipse Kanto, follow {{% relrefn "install" %}} Install Eclipse Kanto {{% /relrefn %}} +* Installed {{% refn "https://notaryproject.dev/docs/user-guides/installation/cli/" %}} Notation CLI {{% /refn %}} +* Installed and running {{% refn "https://www.docker.com/products/docker-desktop/" %}} Docker {{% /refn %}} + +### Create an image and push it to a local registry using docker and than sign it with notation + +Create and run a local container registry: +```shell +sudo kanto-cm create --ports 5000:5000 --e REGISTRY_STORAGE_DELETE_ENABLED=true --name registry docker.io/library/registry:latest +sudo kanto-cm start -n registry +``` + +Build a dummy hello world image and push it to the registry: +```shell +cat <