From 727ed7f3f4a43e29f8a67de03897bde2455bebd2 Mon Sep 17 00:00:00 2001 From: Uri Lublin Date: Mon, 2 Feb 2026 08:50:21 +0200 Subject: [PATCH 1/3] config (v3_5): backport attestation to v3.5 The attestation includes the fields necessary to attest the machine. For example, in confidential clusters. The registration of the attestation key enables to extract the AK of the TPM and register it before using it to sign the TPM quote. Signed-off-by: Alice Frosi Signed-off-by: Uri Lublin --- config/v3_5/translate/translate.go | 6 +++++- config/v3_5/types/schema.go | 14 ++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/config/v3_5/translate/translate.go b/config/v3_5/translate/translate.go index bc13973fc..5a04dc54e 100644 --- a/config/v3_5/translate/translate.go +++ b/config/v3_5/translate/translate.go @@ -54,6 +54,10 @@ func Translate(old old_types.Config) (ret types.Config) { tr := translate.NewTranslator() tr.AddCustomTranslator(translateIgnition) tr.AddCustomTranslator(translateLuks) - tr.Translate(&old, &ret) + tr.Translate(&old.Ignition, &ret.Ignition) + tr.Translate(&old.KernelArguments, &ret.KernelArguments) + tr.Translate(&old.Passwd, &ret.Passwd) + tr.Translate(&old.Storage, &ret.Storage) + tr.Translate(&old.Systemd, &ret.Systemd) return } diff --git a/config/v3_5/types/schema.go b/config/v3_5/types/schema.go index 6c8c42f57..0aaf5eb5b 100644 --- a/config/v3_5/types/schema.go +++ b/config/v3_5/types/schema.go @@ -25,6 +25,7 @@ type Config struct { Passwd Passwd `json:"passwd,omitempty"` Storage Storage `json:"storage,omitempty"` Systemd Systemd `json:"systemd,omitempty"` + Attestation Attestation `json:"attestation,omitempty"` } type Device string @@ -262,3 +263,16 @@ type Unit struct { type Verification struct { Hash *string `json:"hash,omitempty"` } + +type Attestation struct { + AttestationKey AttestationKey `json:"attestation_key,omitempty"` +} + +type AttestationKey struct { + Registration Registration `json:"registration,omitempty"` +} + +type Registration struct { + Url *string `json:"url,omitempty"` + Certificate *string `json:"certificat,omitempty"` +} From 11d1ec945dc7c76b319ebcf7e864321a75af2a08 Mon Sep 17 00:00:00 2001 From: Uri Lublin Date: Tue, 3 Feb 2026 17:59:46 +0200 Subject: [PATCH 2/3] Add Containerfile.ignition Optionally, BASE build-arg can be quay.io/centos/centos:stream9 Signed-off-by: Uri Lublin --- Containerfile.ignition | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 Containerfile.ignition diff --git a/Containerfile.ignition b/Containerfile.ignition new file mode 100644 index 000000000..b87665eb3 --- /dev/null +++ b/Containerfile.ignition @@ -0,0 +1,13 @@ +ARG BASE=fedora:f43 +FROM $BASE AS builder + +RUN dnf install -y golang git-core libblkid-devel make + +WORKDIR /usr/src/ignition +COPY . . + +RUN ./build + +FROM scratch +COPY --from=builder /usr/src/ignition/bin/amd64/ignition /usr/bin/ignition + From e6933bab44a7ed4a5efa60764c3a39dbb06d3b20 Mon Sep 17 00:00:00 2001 From: Uri Lublin Date: Tue, 3 Feb 2026 18:36:11 +0200 Subject: [PATCH 3/3] Add a workflow to build ignition container images Also push the image to quay if 1. even is push (to main branch) 2. in trusted-execution-clusters organization 3. quay credentials are available Images are tagged twice with - and latest Assisted-by: Claude Code Signed-off-by: Uri Lublin --- .github/workflows/container-ignition.yml | 55 ++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 .github/workflows/container-ignition.yml diff --git a/.github/workflows/container-ignition.yml b/.github/workflows/container-ignition.yml new file mode 100644 index 000000000..aeb88390a --- /dev/null +++ b/.github/workflows/container-ignition.yml @@ -0,0 +1,55 @@ +# Build ignition container images for f43 and c9s + +name: Build Ignition Container Images + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +# avoid races when pushing containers built from main +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + +jobs: + build-container: + name: Build container image (${{ matrix.base-name }}) + runs-on: ubuntu-latest + strategy: + matrix: + include: + - base-name: fedora + base-image: fedora:latest + image-suffix: -f43 + - base-name: centos-stream-9 + base-image: quay.io/centos/centos:stream9 + image-suffix: -c9s + steps: + - name: Check out repository + uses: actions/checkout@v5 + with: + # fetch tags too + # https://github.com/actions/checkout/issues/290 + fetch-depth: 0 + - name: Fix actions/checkout synthetic tag + run: git fetch --tags --force + - name: Generate tags + id: tags + run: | + DATE=$(date +%Y%m%d) + SHORT_SHA=$(git rev-parse --short=7 HEAD) + echo "tags=latest ${DATE}-${SHORT_SHA}" >> $GITHUB_OUTPUT + - name: Build and push container + uses: coreos/actions-lib/build-container@main + with: + credentials: ${{ secrets.QUAY_AUTH }} + file: Containerfile.ignition + push: ${{ github.event_name == 'push' && github.repository_owner == 'trusted-execution-clusters' && format('quay.io/trusted-execution-clusters/ignition{0}', matrix.image-suffix) || '' }} + arches: amd64 + build-args: BASE=${{ matrix.base-image }} + tags: ${{ steps.tags.outputs.tags }}