coco-pattern/Makefile at main · validatedpatterns/coco-pattern · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Generated by patternizer
# This Makefile includes the common pattern targets from Makefile-common
# You can add custom targets above or below the include line

include Makefile-common

##@ Key Management
.PHONY: cache-keys
cache-keys: ## Download Red Hat signing keys from official sources to ~/.coco-pattern/
	@mkdir -p ~/.coco-pattern
	@echo "Fetching Red Hat sigstore public key (release key 3)..."
	@curl -fsSL https://www.redhat.com/security/data/63405576.txt -o ~/.coco-pattern/SIGSTORE-redhat-release3
	@echo "  Cached at ~/.coco-pattern/SIGSTORE-redhat-release3"
	@echo "Fetching Red Hat GPG public key (release key 2)..."
	@curl -fsSL https://access.redhat.com/security/data/fd431d51.txt -o ~/.coco-pattern/RPM-GPG-KEY-redhat-release
	@echo "  Cached at ~/.coco-pattern/RPM-GPG-KEY-redhat-release"
	@echo "Done. Verify fingerprints at https://access.redhat.com/security/team/key/"


##@ Reference Value Collection
.PHONY: collect-firmware-refvals
collect-firmware-refvals: ## Collect firmware reference values (bare metal, default)
	@scripts/collect-firmware-refvals.sh

.PHONY: collect-azure-refvals
collect-azure-refvals: ## Collect PCR reference values (Azure)
	@scripts/collect-firmware-refvals.sh --platform azure

##@ Hardware Detection
.PHONY: detect-hardware
detect-hardware: ## Detect hardware profile from cluster nodes (requires KUBECONFIG or oc login)
	@echo "Detecting hardware profile from cluster nodes..."
	@echo "---"
	@CPU_VENDOR=$$(oc get nodes -o jsonpath='{.items[0].metadata.labels.feature\.node\.kubernetes\.io/cpu-model\.vendor_id}' 2>/dev/null) && \
	TDX_ENABLED=$$(oc get nodes -o jsonpath='{.items[0].metadata.labels.feature\.node\.kubernetes\.io/cpu-security\.tdx\.enabled}' 2>/dev/null) && \
	SNP_ENABLED=$$(oc get nodes -o jsonpath='{.items[0].metadata.labels.feature\.node\.kubernetes\.io/cpu-security\.sev\.snp}' 2>/dev/null) && \
	GPU_PRESENT=$$(oc get nodes -o jsonpath='{.items[0].metadata.labels.nvidia\.com/gpu\.present}' 2>/dev/null) && \
	echo "CPU Vendor:  $${CPU_VENDOR:-unknown}" && \
	echo "TDX Enabled: $${TDX_ENABLED:-false}" && \
	echo "SNP Enabled: $${SNP_ENABLED:-false}" && \
	echo "GPU Present: $${GPU_PRESENT:-false}" && \
	echo "---" && \
	if [ "$${CPU_VENDOR}" = "Intel" ] && [ "$${TDX_ENABLED}" = "true" ]; then \
		if [ "$${GPU_PRESENT}" = "true" ]; then \
			echo "Recommended profile: intel-tdx-gpu"; \
		else \
			echo "Recommended profile: intel-tdx"; \
		fi; \
	elif [ "$${CPU_VENDOR}" = "AuthenticAMD" ] || [ "$${SNP_ENABLED}" = "true" ]; then \
		if [ "$${GPU_PRESENT}" = "true" ]; then \
			echo "Recommended profile: amd-snp-gpu"; \
		else \
			echo "Recommended profile: amd-snp"; \
		fi; \
	else \
		echo "Could not determine hardware profile."; \
		echo "Ensure NFD operator is running and node labels are populated."; \
		echo "Set global.hardware.profile manually in values-global.yaml"; \
	fi && \
	echo "" && \
	echo "To apply: edit values-global.yaml and set global.hardware.profile to the recommended value."