feat: Added Initdata Support for CCCO Baremetal Solution

[Rohit-Singh43-1]

• Added Flg for providing the encoded sehdrbin in initdata flg

Description

initdata flag is enhanced to support annotation creation for CCCO baremetal Solution

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Code refactor

Testing

Tested the functionality of initdata flg against CCCO baremetal solution .

Checklist

• My code follows the project's coding standards
• I have performed a self-review of my code
• I have commented my code where necessary
• I have updated the documentation
• I have added tests that prove my fix/feature works
• All new and existing tests pass

[Rohit-Singh43-1]

./contract-cli-s390x --help
Contract CLI automates contract generation and management for IBM Confidential Computing services.Supports:
  - IBM Confidential Computing Container Runtime
  - IBM Confidential Computing Container Runtime for Red Hat Virtualization Solutions
  - IBM Confidential Computing Containers for Red Hat OpenShift Container PlatformDocumentation: https://ibm-hyper-protect.github.io/contract-cli/Usage:
  contract-cli [flags]
  contract-cli [command]Available Commands:
  base64                          Encode input as Base64
  base64-tgz                      Create Base64 tar archive of container configurations
  decrypt-attestation             Decrypt encrypted attestation records
  download-certificate            Download encryption certificates
  encrypt                         Generate signed and encrypted contract
  encrypt-string                  Encrypt string in IBM Confidential Computing format
  get-certificate                 Extract specific certificate version from download output
  help                            Help about any command
  image                           Get IBM Confidential Computing Container Runtime image details from IBM Cloud
  initdata                        Gzip and Encoded initdata annotation
  list-encryptioncert-versions    List available encryption certificate versions
  sealed-secret                   Generate sealed secret for CCCO
  sign-contract                   Sign an encrypted contract
  validate-contract               Validate contract schema
  validate-encryption-certificate Validate encryption certificate
  validate-network                Validate network configuration schemaFlags:
  -h, --help      help for contract-cli
  -v, --version   version for contract-cliUse "contract-cli [command] --help" for more information about a command.
[root@mystack1 test_sealed]# ./contract-cli-s390x initdata --help
Usage:
  contract-cli initdata [flags]Mandatory Flags:
  --in        Path of Signed and Encrypted contract (use '-' for standard input)Optional Flags:
  --help      help for initdata
  --out       Path to save Gzipped and encoded initdata value
  --sehdrbin  Path to SE header binary file (.bin) for baremetal solution (optional)
[root@mystack1 test_sealed]# ./contract-cli-s390x initdata --in anj-plain.yaml --sehdrbin se-hdr.bin --out gzipped_initdata
Successfully generated gzipped initdata annotation for baremetal solution 

./contract-cli-s390x initdata --in anj-enc.yaml --sehdrbin se-hdr.bin --out gzipped_initdataenc
Successfully generated gzipped initdata annotation for baremetal solution
[root@mystack1 test_sealed]#
[root@mystack1 test_sealed]#
[root@mystack1 test_sealed]# cat gzipped_initdataenc
H4sIAAAAAAAA/xybtQ7GhoKs+zxFlOYU1omZrpTC/JsZr7YwM7OffpVtp57RfM33RzrU89YezfjnP3/+tTcpSmF//XGV297O078R9Df8N/TXH3/8/yI90v/54698no4tzY+/33Qc/vrznz//85//lNP1//5s3qXc/rts81Hmx3+zdG/zv9uSlK1kHj1m8bHrWxH1MGl25yxoj19j3sR6lE7+/HXIS55Am590YT+4IE6ITNdptArNQqSv+8ApZaUusnw2AoqxvB1mzNp7yk0IvHbBPgLkI1OUy5O99eWcVmiaT5fbQ63exiEeNd4PC7NHyR7m4QvJYAg6tVTjGisRofl3jAzi9FmK9m05YwCbvG+FtW1sWkX6/BPclLfPMLntzXSZQ6JXJkxNj+QLVLf7VdVw1XaCeY6uOX8MIDsAalmCak7yjllrTHsLXZvbIuH8tJNZGWeoEOuwx0LTyiUADKmcGf/sKNE8hA5QuzOKe6UPhY17v26QMG76j4OSx6wnLmGxb9BUL7dj647rr/TZEqehGr+PLSvDR5q1erITkBU2LxBUnXLNpzxqQ/2iku3GX/eJ9UIBmkqdT0fSrMPASpLl1XeOeU5XqPJFmSXVtQyFfQ2VxfogIyfDYdPGvXXPCpGmAetmTYt5GBOC7IHu6yT0D5A/QJbEvg9gexiKImR8Xb2oc9914/UezKoBSjpMA6IItNwML2k9Gxw8v69nEHVtQOKd/Q0RfzV+BV+cd+9w6tceA64sCPM5mrXIB7+DgWfe2UM9UcnmglVoiIQWbw/PwOGMHdtptvr8tJlilZ/iKws08sX+cyJvfmz4wwGIAczuiTbZDsD1BU/gh2uqmkKXlYSFHP/zt4+IeyEFfQTTPY9uL/JTA0hHWJSvDk5b2f0doxm3JXsA1nOc66hfyop/OYmOLdCAjkLjBkx6N+AAL2YU6g61pJgXJIxW5oNEHJFcEBzjS4LdDIgfqIpercXsNcJKdlIQDTbXq0DthbfYokTdyUvcVhaYTssPVz3C3S4sBcsZr 

oc create -f test4.yaml
deployment.apps/app-deployment-rego1 created
[root@bastion-cmn173vv masking_poc]# oc get pods
No resources found in coco-pp-e2e-test-ede73026 namespace.
[root@bastion-cmn173vv masking_poc]# oc get pods -n default
NAME                                    READY   STATUS    RESTARTS   AGE
app-deployment-rego1-67c8ff5495-795vf   1/1     Running   0          32s
[root@bastion-cmn173vv masking_poc]# 

[Sashwat-K]

Looks good to me @Rohit-Singh43-1 ! Thank you for the feature!

[vikas-sharma24]

as per above heading this example is for baremetal solution we need to mention about sehdr flag here?
or can you mention this is for peer pod for better understanding?

1. Create initdata for Baremetal solution with SE header binary
2. Create initdata for Peer pod solution without SE header binary

[vikas-sharma24]

as in line 995 there is one example of peer pod.
Check and update accordingly

[github-actions]

🎉 This PR is included in version 1.26.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀