References for TDX based deployment

[arijit8972]

Hi,

Is there a reference I can use for deploying constellation on a TD on Azure ? Right now, I see the constellation image available in Azure but how do I configure it to run with TDX ? And if this is not supported yet, is there a timeline for it to be available ?

[msanft]

Hey!

This is supported by Constellation. You can create a cluster on Azure TDX infrastructure either with the Constellation Terraform Provider or via the CLI.

For the Terraform provider, you can refer to this example and change the attestation_variant to azure-tdx. After that, you can refer to our general deployment guide for the Terraform provider.

For the CLI, you'll want to follow this guide, but specify the azure-tdx attestation variant during constellation config generate:

constellation config generate -a azure-tdx

Feel free to report back here if any questions arise.

Cheers,
Moritz

[arijit8972]

Thanks a lot Moritz. Will try this out.

Regards,
Arijit

[arijit8972]

Hi Moritz,

Some questions that I had:

1. Could you please provide me with a sample of how the signed attestation report from constellation's verify API looks like?
2. Can the report be extended to have the measurements of workloads like kyverno if we have it inside the cluster?
3. I do not see the support for Azure TDX in the NewReport function, only AzureSevSnp. Can you please confirm if attestation report is supported in Azure TDX?

I am currently trying the deploy the cluster on Azure TDX (WIP) but if you could help me with these questions that would be great.

Thanks,
Arijit