Confidential Containers
v0.22.0SecurityConfidential Containers v0.22.0 is a feature release introducing Trustee admin token authentication (replacing admin private keys), removing several CAA and RVPS components, and adding new capabilities across verifiers, storage backends, and health monitoring.
breakingTrustee admin authentication now requires admin token
KBS now requires an admin token rather than an admin private key for Trustee admin authentication. v0.22.0 removes support for the admin private key method. Any KBS client invoking Trustee admin operations must transition to token-based authentication before or upon upgrading.
breakingCAA docker provider removed
The CAA docker provider has been removed in v0.22.0. Deployments relying on this provider must switch to alternative container image sources or attestation methods.
breakingFedora-based CAA podvm image removed
The Fedora-based mkosi-built CAA podvm image has been removed in v0.22.0. Deployments using this image must migrate to an alternative podvm image.
breakingPacker-built CAA podvm image removed
The packer-built CAA podvm image has been removed in v0.22.0. Deployments using this image must migrate to an alternative podvm image.
breakingCAA csi-wrapper component removed
The CAA csi-wrapper component has been removed in v0.22.0. Any deployment or configuration depending on this component must be updated.
breakingIn-toto reference value extractor removed from RVPS
The in-toto reference value extractor has been removed from RVPS in v0.22.0. Workflows relying on in-toto reference value extraction must be reconfigured or replaced.
Key changes (8)
- Breaking: Trustee admin authentication now uses admin tokens instead of admin private keys.
- Breaking: CAA docker provider, csi-wrapper component, and both mkosi-built and packer-built CAA podvm images removed.
- Breaking: In-toto reference value extractor removed from RVPS.
- Trustee Helm Chart introduced for simplified deployment.
- Intel verifier adds offline/air-gapped verification collateral support; QCNL library dependency dropped.
- Redis/Valkey storage backend and AWS Secrets Manager resource backend added to Trustee.
- New gRPC Health and /healthz endpoints across RVPS, AS, and KBS; attestation tokens now include issuer claim and signing keys exposed via JWKS.
- Hygon DCU verifier now supports multiple devices; s390x verifier switched to SHA-512 for report data.
A weekly email arrives when a release needs action. Like the breaking changes in this release.