doc: provide a guide for how to install CC with IBM Secure Execution

[BbolroC]

Due to the limitation that a public key used to encrypt a secure image is associated with a machine specific private key, a user cannot install and run a confidential container with IBM Secure Execution from release.

This is to provide a guide for how to achieve the goals above with a custom build.

Signed-off-by: Hyounggyu Choi [email protected]

[BbolroC]

For reviewers, you can find the referred documentation in the section Build a Payload Image via kata-deploy at kata-containers/kata-containers#7146

[stevenhorsman]

This makes sense to me. Thanks!

[wainersm]

Hi @BbolroC !

I don't have a SystemZ to test the guide so I only reviewed the text. I've got two suggestions to you:

• Link this doc to the Prerequisites section in docs/INSTALL.md. Users would need to at least label the worker correctly.
• It uses the kustomize tool but doesn't explain how it can be installed:

$ cd $GOPATH/src/github.com/confidential-containers/operator
$ make kustomize

The binary is found in ./bin

[GabyCT]

@BbolroC overall lgtm but I just found some misspelling in $ kubectl get pods

[BbolroC]

@BbolroC overall lgtm but I just found some misspelling in $ kubectl get pods

Thanks @GabyCT for the feedback. Actually, po is a short name for pod or pods in kubectl. (https://kubernetes.io/docs/reference/kubectl/#resource-types). But I will update the doc due to the readability.

[BbolroC]

Hi @BbolroC !

I don't have a SystemZ to test the guide so I only reviewed the text. I've got two suggestions to you:

• Link this doc to the Prerequisites section in docs/INSTALL.md. Users would need to at least label the worker correctly.
• It uses the kustomize tool but doesn't explain how it can be installed:

$ cd $GOPATH/src/github.com/confidential-containers/operator
$ make kustomize

The binary is found in ./bin

Thanks @wainersm for the feedback. I will reflect it asap. 😉

[hbrueckner]

Thanks a lot Choi!

/LGTM

[wainersm]

Thanks @BbolroC !