Open-source container data management
A system may include a memory and a processor in communication with the memory. The processor may be configured to perform operations that include generating a key pair and encrypting a data credential with a public key to make a data credential secret. The operations may further include storing the data credential secret in a cluster on a host and deploying a workload on the cluster. The operations may also include establishing an empty bundle in the host and generating a pod trusted execution environment.
1. A system, said system comprising:
a memory; and
a processor in communication with said memory, said processor being configured to perform operations, said operations comprising:
generating a key pair;
encrypting a data credential with a public key to make a data credential secret;
storing said data credential secret in a cluster on a host;
deploying a workload on said cluster;
establishing an empty bundle in said host;
generating a pod trusted execution environment; and
decrypting, in said pod trusted execution environment, said data credential secret with a private key to generate decrypted data.
2. The system of claim 1 , further comprising:
submitting a data pull request with an encrypted data pull credential.
3. The system of claim 2 , further comprising:
forwarding said data pull request to said pod trusted execution environment with a shim.
4. The system of claim 1 , further comprising:
calling a CRI runtime service to generate a real container bundle; and
launching said real container bundle.
5. The system of claim 1 , further comprising:
receiving a container request; and
receiving a pull data request with said data credential secret.
6. The system of claim 1 , wherein:
said data credential is an image credential.
7. A method, said method comprising:
generating a key pair;
encrypting a data credential with a public key to make a data credential secret;
storing said data credential secret in a cluster on a host;
deploying a workload on said cluster;
establishing an empty bundle in said host;
generating a pod trusted execution environment; and
decrypting, in said pod trusted execution environment, said data credential secret with a private key to generate decrypted data.
8. The method of claim 7 , further comprising:
submitting a data pull request with an encrypted data pull credential.
9. The method of claim 8 , further comprising:
forwarding said data pull request to said pod trusted execution environment with a shim.
10. The method of claim 8 , further comprising:
submitting said decrypted data to a CRI image service within said pod trusted execution environment.
11. The method of claim 7 , further comprising:
calling a CRI runtime service to generate a real container bundle; and
launching said real container bundle.
12. The method of claim 11 , further comprising:
decrypting, in said real container bundle, said data credential secret.
13. The method of claim 7 , further comprising:
receiving a container request; and
receiving a pull data request with said data credential secret.
14. The method of claim 7 , wherein:
said data credential is an image credential.
15. A computer program product, said computer program product comprising a computer readable storage medium having program instructions embodied therewith, said program instructions executable by a processor to cause said processor to perform a function, said function comprising:
generating a key pair;
encrypting a data credential with a public key to make a data credential secret;
storing said data credential secret in a cluster on a host;
deploying a workload on said cluster;
establishing an empty bundle in said host;
generating a pod trusted execution environment; and
decrypting, in said pod trusted execution environment, said data credential secret with a private key to generate decrypted data.
16. The computer program product of claim 15 , further comprising:
submitting a data pull request with an encrypted data pull credential.
17. The computer program product of claim 16 , further comprising:
forwarding said data pull request to said pod trusted execution environment with a shim.
18. The computer program product of claim 15 , further comprising:
calling a CRI runtime service to generate a real container bundle; and
launching said real container bundle.
19. The computer program product of claim 15 , further comprising:
receiving a container request; and
receiving a pull data request with said data credential secret.
20. The computer program product of claim 15 , wherein:
said data credential is an image credential.