References for TDX based deployment

[arijit8972]

Hi,

Is there a reference I can use for deploying constellation on a TD on Azure ? Right now, I see the constellation image available in Azure but how do I configure it to run with TDX ? And if this is not supported yet, is there a timeline for it to be available ?

[msanft]

Hey!

This is supported by Constellation. You can create a cluster on Azure TDX infrastructure either with the Constellation Terraform Provider or via the CLI.

For the Terraform provider, you can refer to this example and change the attestation_variant to azure-tdx. After that, you can refer to our general deployment guide for the Terraform provider.

For the CLI, you'll want to follow this guide, but specify the azure-tdx attestation variant during constellation config generate:

constellation config generate -a azure-tdx

Feel free to report back here if any questions arise.

Cheers,
Moritz

[arijit8972]

Thanks a lot Moritz. Will try this out.

Regards,
Arijit

[arijit8972]

Hi Moritz,

Some questions that I had:

1. Could you please provide me with a sample of how the signed attestation report from constellation's verify API looks like?
2. Can the report be extended to have the measurements of workloads like kyverno if we have it inside the cluster?
3. I do not see the support for Azure TDX in the NewReport function, only AzureSevSnp. Can you please confirm if attestation report is supported in Azure TDX?

I am currently trying the deploy the cluster on Azure TDX (WIP) but if you could help me with these questions that would be great.

Thanks,
Arijit

[msanft]

Hey @arijit8972,

1. See the TDX report here, the TPM report (PCRs) here.
2. You can extend the TPM PCRs at runtime, but you need to do that from either the Kubernetes node, or mount the TPM device into the container you want to do it from.
3. See 1.

Let me know if anything else should be unclear.

Cheers,
Moritz

[arijit8972]

Hi Moritz,

Sorry for too many questions. I am currently trying to deploy constellation on Azure TDX but facing issues
{"time":"2025-01-21T16:17:50.925850445Z","level":"DEBUG","source":{"function":"github.com/edgelesssys/constellation/v2/internal/constellation.(*Applier).Init.func1","file":"internal/constellation/applyinit.go","line":88},"msg":"Encountered error (retriable: true): "init call: rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial tcp 20.7.186.111:9000: i/o timeout\"""}

The failure seems to be happening here:

// Create a wrapper function that allows logging any returned error from the retrier before checking if it's the expected retriable one.
serviceIsUnavailable := func(err error) bool {
isServiceUnavailable := grpcRetry.ServiceIsUnavailable(err)
a.log.Debug(fmt.Sprintf("Encountered error (retriable: %t): %q", isServiceUnavailable, err))
return isServiceUnavailable
}

I presume it's some kind of connectivity/proxy issue from my end, which I am trying to debug. Is it possible to deploy constellation on an existing Azure TD instead of bringing up new nodes through the CLI (constellation apply)? Can you please share the steps if possible ?

[msanft]

Hey Arjit,

I am currently trying to deploy constellation on Azure TDX but facing issues

This is an "expected" error in that it's likely to occur while the cluster is being spun up. The nodes are unresponsive while booting (which can take several minutes depending on the disk size, as they're wiped on first boot to be encrypted). You will have to allow 10-20 minutes for a cluster with 30GB disks. You can also see that happening in the tests I've linked.

Is it possible to deploy constellation on an existing Azure TD instead of bringing up new nodes through the CLI (constellation apply)?

You can in theory. See the self-managed infrastructure section in our Documentation.

Best,
Moritz

[arijit8972]

So is there a way to increase the timeout from constellation config. Right now, the cluster creation fails after some time specifying a connection timeout from CLI.

[msanft]

The default timeout should be sufficient. Would you mind sharing your configuration file?

[arijit8972]

I think this is an internal network issue. One last question before I close this discussion. Is constellation supported with managed AKS ?

[msanft]

No, please take a look at Contrast if you aim to run on managed AKS.