What's new in version 1.2.2

Edit online

New features and enhancements in version 1.2.2, including masking and mounting, registry mapping, Rego v1.0, Contract CLI, and dynamic registry references.

Masking and mounting feature for enhanced security
Automatic protection of confidential data through masking and secure mounting:
  • Confidential values in the decrypted contract are automatically masked after use.
  • The masked contract is mounted with read-only permissions to /var/hyperprotect in the container namespace.
  • Files that contain sensitive data are automatically removed from the IBM Confidential Computing Containers for Red Hat OpenShift Container Platform VM after use.
  • Supports both Bare Metal and Peer Pod deployment models.
Note: For more information, see Masking and mounting.
Registry mapping support

Registry mapping enables you to specify registry transformations in the contract so that workloads can reference public placeholder registries on the host while pulling images from private registries in the guest.

This feature addresses the CRI-O host pull limitation, where CRI-O downloads the entire image on both the host and the guest, requiring the imagePullSecret to be revealed to the Open Shift Container Platform admin. Registry mapping decouples host-side image references from guest-side image sources, enabling workloads to reference public placeholder registries on the host while pulling images from private registries in the guest. It supports prefix-based and exact image mappings, preserves tags and digests during transformation, and keeps private registry credentials inside the guest environment.

Note: For more information, see Registry mapping.
Rego v1.0 policy upgrade

Open Policy Agent (OPA) adopts Rego v1.0 as the default syntax, delivering clearer, more consistent policy authoring. This allows stricter syntax that catches authoring errors at parse time, reducing policy misconfiguration. This also removes ambiguity scenarios that might occur with v0 syntax.

Important: You must upgrade your Rego policies to Rego v1.0. Policies that use v0 syntax fail to parse. For more information, see Rego policy rules and snippets.
Contract CLI

A new command-line tool that automates contract generation and management for IBM Confidential Computing services, including IBM Confidential Computing Containers for Red Hat OpenShift Container Platform. It simplifies workflows that previously required manual OpenSSL scripting and separate binary tools, with support for encrypting contract sections, signing contracts, generating sealed secrets, and creating initdata annotations for both Bare Metal and Peer Pod deployments.

Note: For more information, see Contract CLI.
Dynamic registry reference

Support for dynamic registry references allows workload providers to defer the specification of a container registry until deployment time. Instead of embedding a fixed registry URL in the pre-encrypted workload section, the workload provider can define a placeholder that the deployer overrides with a registry mirror or private container registry, along with the associated pull credentials.

Note: For more information, see Using a dynamic registry reference.
Certificate expiry notification extended to Bare Metal deployments
Warning logs for upcoming and expired encryption and attestation certificates are now generated for Bare Metal deployments in addition to Peer Pod deployments. For more information, see Encryption and Attestation certificate expiry warning logs.
Update to certificate expiry dates
The certificate expiry dates has been updated. For more information, see Certificate expiry dates.
Updated image

The version 1.2.2 image is based on RHEL 9.8. You can get the latest IBM Confidential Computing Containers for Red Hat OpenShift Container Platform image from Passport Advantage. For more information, see Downloading the IBM Confidential Computing Containers for Red Hat OpenShift Container Platform image and uploading it to the remote registry.

Security and stability improvements

This release includes important security fixes that address potential vulnerabilities, bug fixes that improve system stability and performance