User roles
IBM Confidential Computing Containers for Red Hat OpenShift Container Platform (CCCO) distinguishes between different types of users to perform tasks. This section provides a clear understanding of the roles and responsibilities of different users within the IBM CCCO environment.
Environment Operator
Description
The Environment Operator manages the infrastructure for IBM CCCO. This role includes responsibilities as both an IaaS and Kubernetes/OpenShift administrator, or as a Private Cloud Provider. Additionally, the Environment Operator might serve as a Site Reliability Engineer (SRE).
The position can be held by one person covering both roles or by two individuals, each taking on one role. The Environment Operator ensures service availability but does not have access to workload code or data.
Tasks
- Set up the logical partition (LPAR).
- Create the LPAR.
- Deploy Red Hat Enterprise Linux CoreOS (RHCOS).
- Enable the Secure Execution feature.
- Deploy and configure the Red Hat OpenShift Container Platform version 4.20 or later:
- Single-node OpenShift (SNO) cluster: Scheduler, API server, Kubelet, container runtime (CRI-O),etc.
- Install the OpenShift sandboxed container Operator.
- Configure OpenShift sandboxed container components, such as:
- Image config maps.
- Download the IBM Confidential Computing Containers for Red Hat OpenShift Container Platform image from Passport Advantage or EPWT trial website and upload it to a remote registry.
- Ensure the following services and packages are setup on the SNO cluster as part of the OpenShift sandboxed containers configuration:
- Node Feature Discovery (NFD).
-
kata-shim-v2and its configurations.
- Monitor the system health and ensure environment availability.
- Optional. Add storage operators that supports block volumes for the
volumessection (for example, Red Hat OpenShift Data Foundation (ODF) or Fusion Data Foundation(FDF)).
Solution Provider (Workload Owner)
Description
The Solution Provider defines the workload section of the contract and prepares the encrypted workload for deployment. This role is responsible for building, securing, and sharing the workload with the Data Owner and Auditor.
Tasks
- Build Open Container Initiative (OCI) compliant container images.
- Push images to an accessible container registry.
- Add workload image access credentials to the contract.
- Optionally sign container images and include the public key in the contract.
- Define and encode rego policies.
- Provide sealed secrets to protect intellectual property.
- Optional. Add the
volumessection for encrypted block storage. - Download the contract encryption certificate from the image TAR file at the following location: IBM_HPCC_RHOCP_v1.2.2_EN/config/certs.
- Validate contract encryption certificate. For more information, see Validating the certificates.
- Obtain the attestation public key from the auditor and add it to the contract. For more information, see Preparing the Attestation section.
- Optional. Encrypt the workload section.
- Share the encrypted workload section with the Data Owner and Auditor.
Data Owner (Deployer)
Description
The Data Owner defines the environment section of the contract and is responsible for securely deploying workloads in the IBM CCCO environment. A Data Owner might deploy the solution to one or more Red Hat OpenShift Container Platform clusters.
Tasks
- Obtain the encrypted workload section and related documentation.
- Prepare the logging service. For more information, see Logging for IBM Confidential Computing Containers for Red Hat OpenShift Container Platform
- Optional. Manage sealed secrets in collaboration with other Data Owners.
- Optional. Add the
volumessection for encrypted block storage. - Encrypt the environment section using the required configuration.
- Sends the environment and workload sections to Auditor for approval and signing.
- Create
InitDataby combining the encrypted workload, environment sections and signature from the Auditor. - Add
InitDataas an annotation to the deployment YAML file. - Deploy the workload using
runtimeClass=kata-ccand the annotatedInitData. - Manage the sealing key for sealed secrets (can be provided by either the Solution Provider or the Data Owner).
Auditor
Description
The Auditor ensures the integrity of both the workload and environment sections. This role prevents unauthorized combinations of workload and environment configurations.
Tasks
- Obtain the workload section from the Solution Provider and the environment section from the Data Owner.
- Collaborate with the Solution Provider and Data Owner to validate encrypted contract sections.
- Sign both the workload and environment sections.
- Maintain audit trails, manifests, and other security and DevOps artifacts.
- Coordinate with the Data Owner to stop or shut down the workload when there is an issue with the environment.
End user
Description
The End user is the customer who accesses the deployed application through a web browser.
Tasks
- Obtain the certificate from the Solution Provider to connect to the application.
User roles and data flow
The following flow chart illustrates the responsibilities assigned to each user role and the data exchanged between them:
Security responsibilities
You must always follow the following security best practices when using IBM CCCO, which will help you to create a more secure environment.
The table below outlines the additional security responsibilities along with the corresponding personas:
| Security responsibilities | User |
|---|---|
| Ensure that you update the environment - including the operating system, software, container runtime, and OpenShift Container Platform, to ensure it has the latest security fixes. | Environment Operator |
| Implement Role-Based Access Control (RBAC) that helps you (OpenShift Container Platform administrators) to restrict access to the Kubernetes API and other important parts by giving users only the permissions they need. | Environment Operator |
| You must apply RBAC to restrict access to ConfigMaps, avoid storing sensitive data in them and set ConfigMaps as immutable where applicable to prevent tampering. | Environment Operator or Solution Provider |
| Implement a four-eyes principle for container image creation and approval, ensuring that all images are reviewed by at least two authorized individuals. This helps prevent unauthorized or malicious changes. | Solution Provider |
| Use Resource Quotas to implement quotas and limit ranges in Red Hat OpenShift Container Platform to prevent excessive requests and resource exhaustion. | Environment Operator |
| Use Load Balancer to implement load balancing to ensure high availability and mitigate the risk of denial-of-service under high request volumes. | Environment Operator |
| Enable multifactor Authentication (MFA) for all the OpenShift Container Platform administrators to include an additional layer of security. | Environment Operator |
| Enable audit logging and monitor the logs for critical components to detect suspicious activities. | Environment Operator |
| Improper configuration of permissions in the OpenShift Container Platform cluster could allow unauthorized users to access or set up encrypted contracts in workloads. This misconfiguration could potentially bypass intended security policies and lead to security risks. | Environment Operator |
| Use OpenShift Vault to store and manage sensitive information such as API keys and passwords securely. Implement regular key rotation policies to reduce the risk of prolonged key exposure or misuse. | Data Owner or Solution Provider |
| Perform regular backups of the critical data and ensure the backups are encrypted and stored securely. | Data Owner |
| Take the required actions on regular security notifications from IBM. | Auditor and Data Owner |
| Ensure only trusted or known users are allowed access to the environment and virtual servers. | Data Owner and Solution Provider |
| Employ the principle of least privilege where it is essential for minimizing security risks for your containers within an Openshift environment. | Solution Provider |
| It is recommended that all container images used are signed and the cosign section in the contract is used to provide the public keys to allow IBM CCCO to verify the signatures and ensure that there is no tampering of these images. | Solution Provider |
| To ensure the integrity of the contract, it is recommended that you sign the contract. | Auditor |
| Regularly audit Kubelet and CRIO configuration files using integrity checks to detect unauthorized changes. | Environment Operator |
| Keep the copy of the contract that you created safe to prevent inadvertent security risks because you won't be able to retrieve it once it is lost. | Solution Provider and Data Owner |
| Provide strict data validation methods and minimize data exposure through access controls. | Solution provider or Data Owner |
| Validate the contract using the attestation record. | Auditor |
| Validate the certificates used for contract encryption and attestation during the initial setup or integration process. | Solution Provider and Auditor |
| You must apply the provided Rego policies without modification unless necessary and must test the policies thoroughly before deployment to prevent unauthorized access due to misconfigurations. | Solution Provider |
| Secure the host operating system login by enforcing strong authentication, disabling root SSH access, and monitoring login activity regularly. | Environment Operator |
| Ensure that all software you define in the contract is from trusted sources. | Solution Provider and Data Owner |
| Always have different personas for creating the contract and for deploying the workload to avoid the same person being allowed to define the policy and encrypt the contract with policy in it and while bringing up the workload if the person decided to relax the policy rules like allowing exec in the contract previously they could log in to the pod which is a security threat. | Solution Provider and Data Owner |
| Error messages are designed to avoid revealing sensitive details. For securing logs in the customer’s environment, it is the customer’s responsibility to implement security measures such as access controls, encryption at rest, and secure storage solutions. Ensure that logs containing sensitive information are protected against unauthorized access. | Data Owner |
| Enforce strong authentication (eg., mutual TLS, OAuth2) on all custom workloads or APIs being deployed. | Solution Provider |
| Ensure TLS is enforced between Kubelet and API server and might configure stronger encryption algorithms (for example, TLS 1.2) supported by OpenShift. | Environment Operator |
| Restrict access to the Kata Shim using appropriate RBAC or node-level controls. | Environment Operator |
| Red Hat OpenShift Container Platform provides the base control plane, you harden it by disabling unused services and restricting admin access. | Environment Operator |
| Red Hat OpenShift Container Platform supports Kubernetes Network Policies, you define and apply them to restrict pod communication. | Environment Operator or Solution Provider |
| Audit Red Hat OpenShift Container Platform control plane settings regularly to ensure secure configuration. | Auditor or Solution Provider |
| Review Red Hat OpenShift Container Platform admin role bindings periodically to avoid privilege escalation risks. | Auditor or Solution Provider |
Validate the integrity of the deployed container by comparing the SHA value in
/var/hyperprotect/checksum.txt with the expected checksum. This ensures the
solution has not been tampered with and is running on a trusted CCCO environment. |
Auditor or Solution Provider |
| Red Hat OpenShift Container Platform supports Kubernetes secrets, you must ensure to use Sealed Secrets feature to enable sensitive data fields. | Environment Operator or Solution Provider |
| Ensure that the seeds you use in the contract are not easy to guess. For more information about seeds, see . | Solution Provider and Data Owner |
Note: For more information about security best practices, see
OpenShift Container Platform security and compliance.
Note: Security Notices are published via IBM Z and IBM LinuxONE Security Portal. You can register to
the Security Portal using this link here. Take the necessary action in your environment after you
read the Security Notice.