Fork the multicloud-gitops-sgx-hello-world repository on GitHub.

Clone the forked copy of this repository.

git clone git@github.com:your-username/multicloud-gitops-sgx-hello-world.git

Create a local copy of the secret values file that can safely include credentials for the config-demo application and edit it if you want to customize the secret. If not, the framework generates a random password.

cp values-secret.yaml.template ~/values-secret-multicloud-gitops.yaml

(Optional) You may customize the deployment for your cluster depending on your needs by editing values-global.yaml and values-hub.yaml. To do this run the following commands:

git checkout -b my-branch

vi values-global.yaml

git add values-global.yaml

git commit values-global.yaml

git push origin my-branch

(Optional) Prepare and build hello-world docker image and convert it to secure version using GSC - described below. The sample image is available on Red Hat container registry (quay.io/hybridcloudpatterns/hello-world-sgx:3.12) and is pulled automatically during pattern installation process with default variables.

Deploy the pattern by running ./pattern.sh make install or by using the Validated Patterns Operator - both methods are described below.

Create an empty file named Dockerfile:

$ touch Dockerfile

Using a text editor, copy the following contents to the Dockerfile:

FROM python:3.12
RUN apt update
RUN rm /usr/bin/X11
ENTRYPOINT ["python3", "-c", "print('HelloWorld!')"]

Build the docker image using the following command:

$ docker build -t hello-world .

Clone GSC repo:

$ git clone https://github.com/gramineproject/gsc.git

Copy configuration file from sample template:

$ cd gsc
$ cp config.yaml.template config.yaml

Create a new hello-world.manifest file containing parameters of conversion:

loader.pal_internal_mem_size = "1G"
sgx.enclave_size = "1G"
sgx.thread_num = 1024

Generate the signing key:

$ openssl genrsa -3 -out enclave-key.pem 3072

Build secure image using gsc command:

$ ./gsc build hello-world hello-world.manifest

Sign the graminized docker image:

$ ./gsc sign-image hello-world enclave-key.pem

Push secured container image to the registry which is available on the cluster:

Update the file charts/all/hello-world-sgx/values.yaml with the information about your image in your forked repo with pattern.

Login to your cluster by running the following command:

oc login

export KUBECONFIG=~/<path_to_kubeconfig>

Deploy the pattern to your cluster. Run the following command:

./pattern.sh make install

To verify, in the OpenShift Container Platform web console, navigate to Operators → Installed Operators page.

Check that the following Operators are installed with Succeeded status (Figure 1):

Log in to the Openshift Container Platform web console and select Operators > OperatorHub.

Search for Validated Patterns Operator, open it and click Install.

Figure 2. Install Validated Patterns Operator

Choose default settings for the installation mode, namespaces and update strategy and confirm it by clicking Install.

Select Operators > Installed Operators.

Ensure that Validated Patterns Operator is listed in the openshift-operators project with a status Succeeded.

Set the Name field to multicloud-gitops-sgx-hello-world, and the Cluster Group Name to hub. Values must be the same as in the values-global.yaml file (Figure 3).

As a Git Config > Target Repo value, paste the link to your fork. Under Git Config > Target Revision write the name of your branch (Figure 3).

Click the Create button to create the pattern.

Figure 3. Create Pattern Form

To verify, in the OpenShift Container Platform web console, navigate to Operators → Installed Operators page.

Check that the following Operators are installed with Succeeded status (Figure 1):

Go to Vault service route. URL can be found:

Log into the Vault using root token. Root token can be found by executing command:

oc -n imperative get secrets vaultkeys -ojsonpath='{.data.vault_data_json}' | base64 -d

After login go to secret catalog and clik Create secret and fill all the fields manually (Figure 4):

Figure 4. Create secret