Open Stack

Hi All,

Last week we quickly reviewed our v0 proposal [1], and then started our initial discussions around attestation.

Thanks to Haidong for presenting an initial, high level proposal for doing remote attestation with Kata.
This triggered quite a bit of conversation, that could be summarized into:

* Regardless of how the attestation agent talks back to the relying party (vsock or virtio-net directly), the interaction
between it and ocicrypt would happen through the keyprovider interface [2].
* An attestation agent that could dynamically support several hardware implementations (SEV, TDX, SE, etc) would allow for
building single initrd images supporting heterogeneous clusters.
* Some folks on the call already have internal implementations for doing remote attestation with Kata. There is a need
to create a repo where those implementation could be contributed into, as hardware specific implementations/plugins. To that
purpose, we created the attestation-agent repo in the containers github organisation [3].

Next week, many folks in the US will be unable to attend due to the 4th of July holiday. I propose that we cancel this session
and resume on July 8th, at 3pm UTC. Please let us know if there's anything urgent that need to be discussed on July 1st or if
it's ok for everyone to cancel.

Cheers,
Samuel.

[1] https://docs.google.com/presentation/d/1469nSRFtlHMSDDDWVLj0i21dR9M_3SO76ehQsyVSTUk/edit#slide=id.gdf4979010c_0_22
[2] https://github.com/containers/ocicrypt/blob/main/docs/keyprovider.md
[3] https://github.com/containers/attestation-agent