Skip to main content

OBLV Client

Generating Configurations

The OBLV Client validates enclave services based on their manifests conforming to the expectations of the client, as set out in a configuration file. The configuration file is essentially a distillation of the manifest into a compact representation via a one-to-one mapping.

This means that for any given service manifest, the client can generate the configuration file locally and validate they are connecting to the service they are expecting, without any third-party reliance. This is our take on what you see is what you get validation and assurance (WYSIWYG).

In this guide, we will walk through how to generate a configuration file from an OBLV Deploy manifest and how to use it to validate an enclave deployment.

Components of a Configuration File

The table below details the various components that are found in a configuration file used by the OBLV Client.

CategoryFieldDescription
Tooling VersionVersionThe version of the oblv tooling/api.
Platform ConfigurationPCR CodesThe Platform Configuration Register (PCR) codes, which can be fetched from a file or dynamically from a PCR server.
Container ImagesImage NameThe name of the container image used by the application.
Image DigestThe digest of the container image.
Application PortsThe ports that the user application uses.
PluginsPlugin NameName of the plugin used by the enclave.
Config File NameConfiguration file name for the plugin.
Config File HashHash of the plugin configuration file.
AuthenticationAuth Server URLURL of the auth server.
Client IDClient identifier for authentication.
Client SecretSecret key for client authentication.
Grant TypeAuthorisation grant type.
ScopeAuthorisation Scope.
CLI OperationLog LevelLogging level (e.g., INFO, ERROR).
Log Retention PeriodLog rotation period in days.
Log File Max SizeMaximum size of a single log file in Mb.
TimeoutTimeout in seconds for health-check and attestation requests.
Max RetriesMaximum number of retries for health-check and attestation in case of failure.

An example configuration file can be found below:

Example configuration file
oblvVersion: 0.1.0
usePCRServer: false
manifestDigest: sha256:ee199a79e58f7f96159a522085edb43e07487a8df25f0d52adc5ffbd2196f572
enclave:
pcrs:
- PCR0:e78d5cf2fa3c6a75e72d0241c81db9560d9886773f3ccca4824b646679a8ca314486298e22001b6fd3eca75c489c39d9
- PCR1:e13ab034d10392c6bf876e5bcd08d2ea5ea41b17cd5b89632470f167b7b1e78bfe22c213b06cc3524308822440b07434
- PCR2:2c84413e5b57b1d94b8b509ab4657993980b45d59e96987fef399f19469efaeaa01e1d6a9bb58c3ed73b085887f5e367
- PCR16:134a6ed89e41dfbd5d6bfbf23b9e35df55b7239ed3b96e0bc469b8504382181fdc33f90c07a60c2e740919a8ee675ddb
pcrCheck: false
pcrServer: ''
images:
- image: acme/sample-fastapi-app-pvt:1.0
digest: sha256:5adb8754823ba1cc18308dac0d116a4809ujfnhdjuna921e60ca0f7df98cf850
name: fastapi
userAppPorts:
- 8001
configs: []
outboundConnections:
- fqdn: auth.docker.io
redirects: false
port: 443
tls: true
- fqdn: production.cloudflare.docker.com
redirects: false
port: 443
tls: true
- fqdn: index.docker.io
redirects: false
port: 443
tls: true
specDigest: sha256:dd8f57b74638edd3be54ffac29c7941b9681ee67f6029f5da72967f01b461437
plugins:
fluent-bit-logging-plugin:
image: docker.io/fluent/fluent-bit:2.1.10
digest: sha256:5766d881ddb1fdacd9c5b24c9f28371ae22d44faaf3f7a510e5e86e37fd6244f
name: fluent-bit-logging-plugin
namespace: default
outboundConnections: []
securityContext:
capabilities:
add:
- SYS_PTRACE
- SYS_ADMIN
configs:
- name: fluent-bit.yaml
digest: sha256:37e3c0aaa422c9245fe5a39b223f056f023e14dbc855ced8979ea066516148b1
specDigest: sha256:4cd186ecfa9c48573a378d9e1390e3e04b32fab3e5e7ca5bd79332dc8c64aab5
oauthkeeper-auth-plugin:
image: oryd/oathkeeper:v0.38.6
digest: sha256:80ac597442d75f8059e6ade47bb42b01bcebbc4f6d1a61237a4402547f6f5f82
name: oauthkeeper-auth-plugin
namespace: default
outboundConnections:
- fqdn: ec2-18-222-109-15.us-east-2.compute.amazonaws.com
redirects: false
port: 4444
tls: false
configs:
- name: config.yaml
digest: sha256:bc2a7a8a395af60d28911a0a95f6563463d9d269682e96d9205769bb0eb70587
- name: rules.json
digest: sha256:87e880caf5ac4bc6cd0a52790ee3436b3e64f471483ac1becc7b67cf8b259b26
specDigest: sha256:2beaec9b8086482bb1135e701baed517bcddcea654d9b83009abe77ab8d28056
telemetry-plugin:
image: public.ecr.aws/oblivious-ai/oblv-telemetry-dev:latest
digest: sha256:36a5a637b3d5178a5742d4c46fa2ae0ea2cf71305fdc1652f7526b8afedb44e7
name: telemetry-plugin
namespace: default
outboundConnections:
- fqdn: ec2-18-117-159-153.us-east-2.compute.amazonaws.com
redirects: false
port: 4318
tls: false
- fqdn: public.ecr.aws
redirects: false
port: 443
tls: true
- fqdn: d2glxqk2uabbnd.cloudfront.net
redirects: false
port: 443
tls: true
configs:
- name: config.yaml
digest: sha256:15698935ea2f06c3cbdb9ac329759de699f0500c34790a90d051830e85b222d1
specDigest: sha256:0e56bbc6e66302d0b619a2830aaad0a0b56c400b4212f5503af46e465207cf8a
creds:
authCreds:
clientId: '8jf9dj8fu-09de-8v36-b095-dijfhyn8d'
clientSecret: 'wsdfjZjf9fhng8jmkd~9ijmhn4'
url: 'http://auth.acme.com:4444/oauth2/token'
grantType: 'client_credentials'
scope: 'competitor'
maxRetries: 0
retryTimeout: 5
log:
logLevel: info
maxSizeInMb: 5
retaintionPeriodInDays: 7

Configuration Files from Manifests

The OBLV Client can be used to generate these configuration files from manifests directly via the following command:

oblv get-config --manifest <path-to-manifest-file> --config <path-to-config-file>

An example manifest and resulting configuration file can be examined below:

Example manifest file
apiVersion: k8s.oblv.com/v1alpha1
kind: NitroEnclaveDeployment
metadata:
name: hello-fastapi
namespace: default
spec:
userPlugins:
- name: fastapi
image: public.ecr.aws/oblivious-ai/oblv-sample-fastapi:latest
ports:
- containerPort: 8001
hostPort: 4455
command:
- "python"
- "/app/uvicorn_runner.py"
replicas: 1
serviceAccount: enclave-pod
hugepages-1Gi: 12Gi
enclaveCpuCount: 2
ingress:
enabled: true
internetFacing: true
dnsHostName: fastapi-hello.oblv.com
ingressTlsCertificate: my-ingress-tls
ports:
- port: 4455
targetPort: 4455
caCertDetails:
enclaveCertType: ENCLAVE_GENERATED
Resulting configuration file
oblvVersion: 1.2.0
usePCRServer: false
manifestDigest: ec1782953a5f0f55b4813f7cceb05b943d6fc3d6ed98db9bf7d700077c3285b4b3bf111377d1aa96b3357a26bfa8a65b
enclave:
pcrs:
- PCR16:dd1ec020d0dc7322a2dab5c0a16504fba650090832fdc8737de462f83cf7070dbe8567c7e07b0f6a6ae88bc1d68674c6
- PCR0:820e16f5bddddc5f4cb3f89cb07c47d1628434ba7d065da82b67b1dd31b7c6ecb547a20c6d7495e3e012bfc462d020bb
- PCR1:ed7a111c47728b2d104652e9cc885e80e9de93ae5a64afafb34ee5c96ef15d4ea69604b15fa9df830fc7a68be9a4948d
- PCR2:6986ffef628c6a786a2b27ab851f87943d20ba86090f995acda049a886e3fc5d17d458e8e499a514615c3b8626465835
pcrCheck: true
pcrServer: ''
images:
- image: public.ecr.aws/oblivious-ai/oblv-sample-fastapi:latest
digest: sha256:5adb8754823ba1cc18308dac0d116a48019dc6afe2ea921e60ca0f7df98cf850
name: fastapi
userAppPorts:
- 8001
configs: []
outboundConnections:
- fqdn: d2glxqk2uabbnd.cloudfront.net
port: 443
- fqdn: public.ecr.aws
port: 443
specDigest: sha256:0618d44a25490528b19511a78b19c0750dbf3cb286b1069eb1f83546a372c478
plugins: {}
creds:
authCreds:
clientId: ''
clientSecret: ''
url: ''
grantType: ''
scope: ''
maxRetries: 20
retryTimeout: 10
log:
logLevel: info
maxSizeInMb: 5
retaintionPeriodInDays: 7
Note on Placeholders

The generated configuration contains empty fields for Auth credentials and PCR codes, as these are not automatically provided. Update these sections using the OBLV Client in the following guides.