Skip to content

Commit 2a19bb0

Browse files
rojkovrojkov
authored
Merge pull request #488 from mythi/sgx-screencast
add SGX screencast script
2 parents 662f48f + 461977a commit 2a19bb0

File tree

3 files changed

+188
-3
lines changed

3 files changed

+188
-3
lines changed

‎README.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,13 +127,17 @@ platforms with SGX Flexible Launch Control enabled, e.g.,:
127127

128128
The SGX plugin comes in three parts.
129129

130-
- the [SGX device plugin](#sgx-device-plugin)
130+
- the [SGX plugin](#sgx-plugin)
131131
- the [SGX admission webhook](#sgx-admission-webhook)
132132
- the [SGX EPC memory registration](#sgx-epc-memory-registration)
133133

134-
Brief overviews of the sub-components are given below.
134+
The demo subdirectory contains a [video](demo#intel-sgx-device-plugin-demo-video) showing the deployment
135+
and use of the SGX device plugin. Sources relating to the demo can be found in the
136+
[sgx-sdk-demo](demo/sgx-sdk-demo) and [sgx-aesmd-demo](demo/sgx-aesmd-demo) subdirectories.
135137

136-
#### SGX Device plugin
138+
Brief overviews of the SGX sub-components are given below.
139+
140+
#### SGX plugin
137141

138142
The [SGX device plugin](cmd/sgx_plugin/README.md) is responsible for discovering and reporting SGX
139143
device nodes to `kubelet`.

‎demo/readme.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ Table of Contents
55
- [Demo overview](#demo-overview)
66
- [Intel® GPU Device Plugin demo video](#intel-gpu-device-plugin-demo-video)
77
- [Intel® FPGA Device Plugin demo videos](#intel-fpga-device-plugin-demo-videos)
8+
- [Intel® SGX Device Plugin demo videos](#intel-sgx-device-plugin-demo-videos)
89
- [Intel® QuickAssist Technology Device Plugin OpenSSL demo video](#intel-quickassist-technology-device-plugin-openssl-demo-video)
910
- [Intel® QuickAssist Technology Device Plugin with DPDK demo video](#intel-quickassist-technology-device-plugin-with-dpdk-demo-video)
1011

@@ -108,6 +109,33 @@ The demos begin with a fully [configured Kubernetes cluster](https://kubernetes.
108109

109110
[<img src="https://asciinema.org/a/344184.svg" width="700">](https://asciinema.org/a/344184)
110111

112+
## Intel® SGX Device Plugin demo videos
113+
114+
This video demonstrates the Intel® Software Guard Extensions ECDSA Quote Generation in Kubernetes*
115+
116+
- Hardware
117+
- 1-node, 3rd Generation Intel® Xeon® Scalable Platform, code-named “Ice Lake”
118+
- Software
119+
- 18.04.5 LTS
120+
- Kubernetes* 1.19
121+
- containerd 1.3.3
122+
- Intel® SGX Device Plugin built from master branch
123+
- Intel® SGX SDK 2.12 and DCAP 1.9
124+
- node-feature-discovery 0.6.0
125+
126+
### Demo steps
127+
128+
1. Validate the status of the [Kubernetes cluster](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/).
129+
2. Provision [node-feature-discovery](https://github.com/kubernetes-sigs/node-feature-discovery).
130+
3. Provision the [Intel® SGX Device Plugin](https://github.com/intel/intel-device-plugins-for-kubernetes/blob/master/cmd/sgx_plugin/README.md) using [Intel® Device Plugin Operator](https://github.com/intel/intel-device-plugins-for-kubernetes/blob/master/cmd/operator/README.md).
131+
4. Check the SGX resources and labels are correctly registered.
132+
5. Run Intel® SGX DCAP ECDSA Quote Generation in both "out-of-proc" and "in-proc" modes.
133+
134+
### Screencasts
135+
136+
Intel® SGX Device Plugin and SGX DCAP ECDSA Quote Generation demo
137+
[<img src="https://asciinema.org/a/0xa888OjktVyz6xf0RSQ6Pi0w.svg" width="700">](https://asciinema.org/a/0xa888OjktVyz6xf0RSQ6Pi0w)
138+
111139
## Intel® QuickAssist Technology Device Plugin OpenSSL demo video
112140

113141
The screencast demonstrates the deployment of the [Intel® QAT Device Plugin](https://github.com/intel/intel-device-plugins-for-kubernetes/blob/master/cmd/qat_plugin/README.md) for

‎demo/screencast-sgx.sh

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
#!/bin/bash -e
2+
3+
PV='pv -qL'
4+
5+
command()
6+
{
7+
speed=$2
8+
[ -z "$speed" ] && speed=10
9+
10+
echo "> $1" | $PV $speed
11+
sh -c "$1"
12+
echo | $PV $speed
13+
}
14+
15+
out()
16+
{
17+
speed=$2
18+
[ -z "$speed" ] && speed=10
19+
20+
echo "$1" | $PV $speed
21+
echo | $PV $speed
22+
}
23+
24+
cleanup()
25+
{
26+
clear
27+
out 'Cleanup demo artifacts' 20
28+
out 'delete node-feature-discovery deployment:' 20
29+
command 'kubectl delete -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_nfd?ref=master || true' 20
30+
out 'delete SGX Device Plugin deployment:' 20
31+
command 'kubectl delete sgxdeviceplugin sgxdeviceplugin-sample -n sgx-ecdsa-quote || true' 20
32+
out 'delete Intel Device Plugin Operator deployment:' 20
33+
command 'kubectl delete -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/operator/default?ref=master || true' 20
34+
out "delete the demo namespace"
35+
command "kubectl delete ns sgx-ecdsa-quote"
36+
}
37+
38+
record()
39+
{
40+
clear
41+
out 'Record this screencast'
42+
command 'asciinema rec -t "Intel SGX Device Plugin for Kubernetes - Intel(R) SGX DCAP ECDSA Quote Generation Demo" Intel-SGX-Device-Plugin-for-Kubernetes-SGX-DCAP-ECDSA-Quote-Generation-Demo.cast -c "./screencast-sgx.sh play"'
43+
}
44+
45+
screen1()
46+
{
47+
clear
48+
out "This video demonstrates the Intel(R) Software Guard Extensions ECDSA Quote Generation in Kubernetes*"
49+
out "The key building blocks are:"
50+
out "* Intel(R) Software Guard Extensions (SGX) Flexible Launch Control capable system (registered)"
51+
out "* Intel(R) SGX driver (RFC v41) for the host kernel"
52+
out "* Intel(R) SGX PCKID Certificate Caching Service configured"
53+
out "Let's get started!"
54+
}
55+
56+
screen2()
57+
{
58+
clear
59+
out "1. Check the Kubernetes cluster is in good shape"
60+
command "kubectl get nodes"
61+
command "kubectl get pods --all-namespaces"
62+
out "Create the demo namespace"
63+
command "kubectl create ns sgx-ecdsa-quote"
64+
out "Pull :devel images and tag them as :0.19.0 (temporary until the release is out)"
65+
command "sudo ctr -n k8s.io i pull docker.io/intel/intel-sgx-plugin:devel"
66+
command "sudo ctr -n k8s.io i pull docker.io/intel/intel-sgx-initcontainer:devel"
67+
command "sudo ctr -n k8s.io i tag docker.io/intel/intel-sgx-plugin:devel docker.io/intel/intel-sgx-plugin:0.19.0"
68+
command "sudo ctr -n k8s.io i tag docker.io/intel/intel-sgx-initcontainer:devel docker.io/intel/intel-sgx-initcontainer:0.19.0"
69+
}
70+
71+
screen3()
72+
{
73+
clear
74+
out "2. Deploy node-feature-discovery for Kubernetes"
75+
out "It's used to label SGX capable nodes and register SGX EPC as an extended resource"
76+
command "kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_nfd?ref=master"
77+
out "Check its pod is running"
78+
command "kubectl wait --for=condition=Ready pod/$(kubectl get --no-headers -l app=nfd-worker -o=jsonpath='{.items[0].metadata.name}' pods -n node-feature-discovery) -n node-feature-discovery"
79+
}
80+
81+
screen4()
82+
{
83+
clear
84+
out "3. Deploy Intel Device Plugin Operator"
85+
command "kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/operator/default?ref=master"
86+
out "Create SgxDevicePlugin custom resource managed by the Operator"
87+
command "kubectl apply -f https://raw.githubusercontent.com/intel/intel-device-plugins-for-kubernetes/master/deployments/operator/samples/deviceplugin_v1_sgxdeviceplugin.yaml -n sgx-ecdsa-quote"
88+
out "Check the SGX Device Plugin is running"
89+
command "kubectl get pods -n sgx-ecdsa-quote"
90+
}
91+
92+
screen5()
93+
{
94+
clear
95+
out "4. Verify node resources"
96+
command "kubectl get nodes -o json | jq .items[].status.allocatable | grep -i sgx"
97+
command "kubectl get nodes -o json | jq .items[].metadata.labels | grep SGX"
98+
out "Both node labels and resources for SGX are in place"
99+
}
100+
101+
screen6()
102+
{
103+
clear
104+
out "5. Run Intel(R) SGX DCAP ECDSA Quote Generation (out-of-proc)"
105+
out "Make the pre-built images available (from docker save)"
106+
command "sudo ctr -n k8s.io i import sgx-aesmd.tar"
107+
command "sudo ctr -n k8s.io i import sgx-demo.tar"
108+
out "Deploy Intel(R) AESMD"
109+
command "kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_aesmd?ref=master -n sgx-ecdsa-quote"
110+
out "Deploy Intel(R) SGX DCAP ECDSA Quote Generation"
111+
command "kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_enclave_apps/overlays/sgx_ecdsa_aesmd_quote?ref=master -n sgx-ecdsa-quote"
112+
command "kubectl logs $(kubectl get --no-headers -l job-name=ecdsa-quote-intelsgx-demo-job -o=jsonpath='{.items[0].metadata.name}' pods -n sgx-ecdsa-quote) -n sgx-ecdsa-quote"
113+
out "Intel(R) SGX DCAP QuoteGenerationSample successfully requested a quote from Intel(R) AESMD"
114+
out "Delete the deployment"
115+
command "kubectl delete -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_aesmd?ref=master -n sgx-ecdsa-quote"
116+
command "kubectl delete -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_enclave_apps/overlays/sgx_ecdsa_aesmd_quote?ref=master -n sgx-ecdsa-quote"
117+
}
118+
119+
screen7()
120+
{
121+
clear
122+
out "6. Run Intel(R) SGX DCAP ECDSA Quote Generation (in-proc)"
123+
out "Deploy Intel(R) SGX DCAP ECDSA Quote Generation"
124+
command "kubectl apply -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_enclave_apps/overlays/sgx_ecdsa_inproc_quote?ref=master -n sgx-ecdsa-quote"
125+
command "kubectl logs $(kubectl get --no-headers -l job-name=inproc-ecdsa-quote-intelsgx-demo-job -o=jsonpath='{.items[0].metadata.name}' pods -n sgx-ecdsa-quote) -n sgx-ecdsa-quote"
126+
out "Intel(R) SGX DCAP QuoteGenerationSample successfully generated a quote using DCAP Quote Provider Library"
127+
out "Delete the deployment"
128+
command "kubectl delete -k https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/sgx_enclave_apps/overlays/sgx_ecdsa_inproc_quote?ref=master -n sgx-ecdsa-quote"
129+
}
130+
131+
screen8()
132+
{
133+
clear
134+
out "This video demonstrated the Intel(R) Software Guard Extensions in Kubernetes*"
135+
out "The following topics were covered:"
136+
out "* SGX Kubernetes* Device Plugin deployment with an Operator"
137+
out "* Intel(R) SGX node resource and feature label registration to Kubernetes*"
138+
out "* Intel(R) SGX DCAP ECDSA Quote Generation (out-of-proc and in-proc)"
139+
}
140+
141+
if [ "$1" == 'play' ] ; then
142+
if [ -n "$2" ] ; then
143+
screen$2
144+
else
145+
for n in $(seq 8) ; do screen$n ; sleep 3; done
146+
fi
147+
elif [ "$1" == 'cleanup' ] ; then
148+
cleanup
149+
elif [ "$1" == 'record' ] ; then
150+
record
151+
else
152+
echo 'Usage: screencast-sgx.sh [--help|help|-h] | [play [<screen number>]] | [cleanup] | [record]'
153+
fi

0 commit comments

Comments
 (0)