Add cdh golang client interface

[ChengyuZhu6]

This client interface streamlines the process of connecting to CDH and leveraging its APIs. The Go version is very useful for integrating the CDH with containerd plugins, including NRI and image verifiers, where CDH operates as an independent module.

Note that this PR includes only the interface for UnsealSecret.
I think other interfaces can be implemented in the following PRs.

Fixes: #556

[ChengyuZhu6]

cc @arronwy @Xynnn007

[Xynnn007]

Thanks @ChengyuZhu6 .

I think the pkg in golang for CDH would make great sense to users working in k8s ecosystem. Some comments

[Xynnn007]

Can we reuse the proto already defined in https://github.com/confidential-containers/guest-components/blob/main/confidential-data-hub/hub/protos/api.proto? This could help with so-called "single truth of source".

[ChengyuZhu6]

Done.

[Xynnn007]

Nice to me. One last question is that we'd better have CI to cover this, but I think it is ok to be in a separate PR.

[fitzthum]

So this will be used inside of a guest? I associate Go more with k8s on the host. Can you elaborate on the integrations that you mentioned? I am slightly wary of supporting more languages although overall this PR looks fine (with my modest understanding of Go).

[ChengyuZhu6]

So this will be used inside of a guest? I associate Go more with k8s on the host. Can you elaborate on the integrations that you mentioned? I am slightly wary of supporting more languages although overall this PR looks fine (with my modest understanding of Go).

Ok. I have successfully integrated CDH with NRI plugin in containerd. This allows us to unseal secrets in NRI plugin using the CDH Go client, rather than having to execute CDH binary to get unsealed values.

[ChengyuZhu6]

So this will be used inside of a guest? I associate Go more with k8s on the host. Can you elaborate on the integrations that you mentioned? I am slightly wary of supporting more languages although overall this PR looks fine (with my modest understanding of Go).

I unseal secret with NRI plugin during CreateContainer stage in k8s.

result:

pod yaml:

apiVersion: v1
kind: Pod
metadata:
  name: registry
spec:
  containers:
    - name: registry
      image: quay.io/chengyu_zhu/registry:latest
      command: [ "/bin/sh", "-c", "env && sleep 3000" ]
      env:
        - name: SECRET_USERNAME
          valueFrom:
            secretKeyRef:
              name: secret-sealed
              key: sealed-secret

sealed secret:

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-sealed
type: Opaque
stringData:
  sealed-secret: sealed.fakeheader.ewogICJ2ZXJzaW9uIjogIjAuMS4wIiwKICAidHlwZSI6ICJ2YXVsdCIsCiAgIm5hbWUiOiAia2JzOi8vL2RlZmF1bHQvdHlwZS90YWciLAogICJwcm92aWRlciI6ICJrYnMiLAogICJwcm92aWRlcl9zZXR0aW5ncyI6IHt9LAogICJhbm5vdGF0aW9ucyI6IHt9Cn0K.fakesignature

[fitzthum]

Ok, I'm a bit wary of supporting another language, but I think I understand this use case.

[Xynnn007]

Ok, I'm a bit wary of supporting another language, but I think I understand this use case.

As AA/CDH would be used in more scenarios beyond CoCo, it would make sense to maintain only the client side code of both in some way. Probably guest-components is not the best place, and we might need another repo named something like client-tools-golang.

wdyt?

[fitzthum]

As AA/CDH would be used in more scenarios beyond CoCo, it would make sense to maintain only the client side code of both in some way. Probably guest-components is not the best place, and we might need another repo named something like client-tools-golang.

Yeah in some ways this seems better although there would probably be some synchronization cost.

wdyth @mkulke

[mkulke]

As AA/CDH would be used in more scenarios beyond CoCo, it would make sense to maintain only the client side code of both in some way. Probably guest-components is not the best place, and we might need another repo named something like client-tools-golang.

Yeah in some ways this seems better although there would probably be some synchronization cost.

wdyth @mkulke

I'd agree that it's a valid use case to leverage CDH with existing container tooling, but I'm not sure it should be in guest-components, since I understand this is not a (confidential) guest-component for kata-guests.

[fitzthum]

We do already have some client tools in this repo, such as the secret-cli. (that might be the only one, I forget)

[mkulke]

We do already have some client tools in this repo, such as the secret-cli. (that might be the only one, I forget)

I see, in this case the having golang libraries maintained alongside is fine, I guess.

[Xynnn007]

@fitzthum @mkulke Ok. Let's could move the golang things to a separate repo if needed.

Over all, thanks @ChengyuZhu6 for the work!