Preliminary steps

note

Not every Codesphere instance offers confidential compute. Ask your Codesphere administrator whether confidential compute is available on your instance. See Prerequisites.

Every confidential service needs a trustee service that verifies it at startup and releases its secrets. The trustee service runs outside Codesphere and is operated by your trustee provider. Complete the following steps before you deploy a confidential workspace or managed service.

Request a confidential workload

Confidential services that work together run under a shared workload. The trustee provider sets up the workload, so request it from them first.

1. Contact your trustee provider and describe what you want to run, for example:
   • The services that belong to the workload, such as an application and its database
   • The images these services run, referenced by digest or by signing key
   • The Codesphere instance the services run on
2. The trustee provider creates a policy for the workload. The policy decides which images may run under the workload and which secrets they receive.
3. You receive:
   • The workload ID
   • The address of the trustee service
   • Access to a vault in the trustee service for the application secrets of this workload

You enter the trustee service address and the workload ID when you create a confidential workspace or a confidential managed service. Use the same workload ID for every service of the workload.

Manage secrets in the trustee service vault

In a regular workspace, you reference secrets in your ci.yml with the ${{ vault.KEY }} syntax, and Codesphere stores their values in a Codesphere-managed vault. Each workspace either has its own vault or can use a shared vault of its resource group. See Secret management.

Confidential services do not have access to any Codesphere vault, because it is part of the untrusted platform. Their application secrets are stored in the vault of the trustee service instead. The trustee service releases them to a service only after that service passes attestation. See Secret distribution.

Analogous to the concept of shared vaults, all confidential services of the same workload share one namespace in the trustee service's vault. If you deploy multiple services for the same workload, watch out for unintended name collisions.

If a secret does not exist yet, the trustee service generates a random value for it. This works well for secrets used only inside the workload, such as the database credentials shared by an application and its database.

Write a secret to the vault yourself if it must follow a specific format or comes from a third party. Store it under this path:

buckypaper/<workloadId>/app-secrets/<vaultPath>

A confidential service references its secrets the same way as a regular service. Codesphere does not fetch them from its own vault at deploy time. The trustee service resolves them after attestation.

run:
  backend:
    env:
      DATABASE_PASSWORD: ${{ vault.DATABASE_PASSWORD }}

With this configuration, a regular workspace reads DATABASE_PASSWORD from the Codesphere vault. A confidential workspace reads it from the trustee service vault under buckypaper/<workloadId>/app-secrets/DATABASE_PASSWORD. You do not need to change the ci.yml.

warning

Do not put sensitive values into plain environment variables in your ci.yml. They are visible to the platform.