Skip to content

Revert moving KMS into CDH#928

Merged
fitzthum merged 1 commit into
confidential-containers:mainfrom
fitzthum:revert-kms
Mar 7, 2025
Merged

Revert moving KMS into CDH#928
fitzthum merged 1 commit into
confidential-containers:mainfrom
fitzthum:revert-kms

Conversation

@fitzthum

Copy link
Copy Markdown
Member

See discussion here

I also included a commit from #922 so that I could successfully rebuild the lock file. I will drop that soon.

I had to massage a few things with the hub Cargo.toml.

I am open to other approaches here, but I am going to use this locally at least to keep moving on the multi-device work, which requires me to bump guest-components in Trustee.

@fitzthum
fitzthum requested a review from a team as a code owner February 25, 2025 19:44
@fitzthum fitzthum changed the title Revert moving KBS into CDH Revert moving KMS into CDH Feb 25, 2025
@mythi

mythi commented Feb 26, 2025

Copy link
Copy Markdown
Contributor

I am open to other approaches here,

This is probably the best approach. I hacked confidential-data-hub a bit to get the dependencies cleaned up for Trustee update but could not get that to work easily. That could be an alternative.

In addition to the revert, we could think about dropping ehsm since the upstream is no longer maintained.

@fitzthum

Copy link
Copy Markdown
Member Author

cc @mkulke

@fitzthum
fitzthum force-pushed the revert-kms branch 2 times, most recently from a7f9fa4 to 96aff63 Compare February 27, 2025 18:27

@portersrc portersrc left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm for now
I had to rebase the mesh PR on this in order to move forward

@mkulke mkulke left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm. retriggered the failing s390x job

@fitzthum

fitzthum commented Mar 7, 2025

Copy link
Copy Markdown
Member Author

Rebasing

We use the KMS crate outside of the guest-components. Specifically, we
use some of this functionality in Trustee as part of resource backends
that use KMSes.

We could potentially adjust Trustee to import the CDH and use the KMSes
from there, but Trustee doesn't need anything else from the CDH.

It probably does make sense to have the KMS logic in its own crate,
hence revert the change that brough it into the CDH.

This reverts commit 3ab8129.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
@fitzthum
fitzthum merged commit 4b8d0d8 into confidential-containers:main Mar 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants