피드 구독

With the release of Red Hat Enterprise Linux 9.2 (RHEL), it's possible to run the Technology Preview of RHEL on an Azure confidential virtual machine (CVM). In a previous article, I provided the high-level requirements for a Linux operating system to support a CVM use-case, as well as the changes made to the RHEL 9.2 operating system to support the features provided by Azure CVMs to ensure data confidentiality. In this article, I focus on how to get access to the CVM Preview image, and how to launch an Azure CVM using that image.

Get the CVM Preview image

In May 2023, Microsoft announced the availability of a RHEL 9.2 Preview confidential image tailored for AMD SEV-SNP CVMs on Azure. The support for Azure CVMs is a Technology Preview feature of Red Hat Enterprise Linux 9.2, developed in close collaboration between Red Hat and Microsoft. The "Technology Preview" status of the feature means that at this moment it's not suitable for production environments, but you can use it for non-production workloads. This gives you the opportunity to provide invaluable feedback and suggestions. The main goal of the Technology Preview is to verify that the feature works well for customer use-cases when it becomes fully supported in a future Red Hat Enterprise Linux release.

Running Azure CVM with RHEL 9.2 Preview confidential image

Once you've signed up for access to the RHEL 9.2 Preview confidential image, you can get the image using this direct link.

Screenshot of creating a RHEL Confidential VM

When creating a new Confidential VM using Azure Portal, make sure you set Security type to Confidential virtual machines, using one of the SEV-SNP CVM instance types (DCasv5, ECasv5) for Size setting.

Screenshot of creating a virtual machine on Azure Portal

To ensure data protection at rest, full disk encryption at the guest's side must be enabled. To do that, enable Confidential compute encryption in the Disks tab:

Screenshot of enabling Confidential computer encryption in the Disks tab

CVM instances may not be available in all Azure regions.

VM configuration

As a CVM owner, verify that your guest is running inside a genuine AMD SEV-SNP virtual machine. Microsoft provides documentation on Azure Confidential VM attestation. With RHEL 9.2 CVM Preview image, the basic test can be performed with the following sequence:

  1. In the guest, install the required packages:
$ sudo yum -y install jq
  1. Get the VCEK certificate from the metadata endpoint:
$ curl -H Metadata:true http://169.254.169.254/metadata/THIM/amd/certification > vcek
$ cat ./vcek | jq -r '.vcekCert ' > ./vcek.pem
  1. Get get SNP report from the vTPM NVRAM
$ sudo tpm2_nvread -C o 0x01400001 > ./snp_report.bin
$ sudo dd skip=32 bs=1 count=1184 if=./snp_report.bin of=./guest_report.bin
  1. Copy the vcek.pem and guest_report.bin files to a trusted environment, which can be, for instance, an on-premises RHEL 9 installation. In this example, files are placed in the ~/cvm_data directory on the target host.
  2. Install the snpguest tool:
(trusted)$ sudo yum -y git cargo rust
(trusted)$ git clone https://github.com/virtee/snpguest.git
(trusted)$ cd snpguest
(trusted)$ cargo build
  1. Validate the VCEK certificate:
(trusted)$ target/debug/snpguest fetch ca Milan ~/cvm_data/
(trusted)$ target/debug/snpguest verify certs ~/cvm_data/
The AMD ARK was self-signed!
The AMD ASK was signed by the AMD ARK!
The VCEK was signed by the AMD ASK!
  1. Validate guest report:
(trusted)$ target/debug/snpguest verify signature ~/cvm_data/ \
-a ~/cvm_data/guest_report.bin

VCEK signed the Attestation Report!

(trusted)$ target/debug/snpguest verify tcb ~/cvm_data/ \
-a ~/cvm_data/guest_report.bin
Reported TCB Boot Loader from certificate matches the attestation report.
Reported TCB TEE from certificate matches the attestation report.
Reported TCB SNP from certificate matches the attestation report.
Reported TCB Microcode from certificate matches the attestation report.
Chip ID from certificate matches the attestation report.

This is a simplified procedure and may, in some cases, require modification. In particular, there's no verification that the provided guest report was generated for this particular instance and not somewhere else. For the additional information on Azure Attestation, refer to the documentation provided by Microsoft. 

Conclusion

The RHEL 9.2 Preview confidential image is currently a Technology Preview in RHEL 9, and not yet meant for production workloads, but it's an important indication of the future of cloud computing. If you're interested in Confidential VM technology, try it out and give us feedback on what you find. Let us know whether the image works for your use cases and what you would like to see in the future RHEL releases!


저자 소개

채널별 검색

automation icon

오토메이션

기술, 팀, 인프라를 위한 IT 자동화 최신 동향

AI icon

인공지능

고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트

open hybrid cloud icon

오픈 하이브리드 클라우드

하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요

security icon

보안

환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보

edge icon

엣지 컴퓨팅

엣지에서의 운영을 단순화하는 플랫폼 업데이트

Infrastructure icon

인프라

세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보

application development icon

애플리케이션

복잡한 애플리케이션에 대한 솔루션 더 보기

Original series icon

오리지널 쇼

엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리