DOCSEARCHbyAlgolia
Submit Docs

MarbleRun

repository·master·Indexed 42 days ago

https://github.com/edgelesssys/marblerun

A framework for orchestrating distributed confidential-computing applications on Kubernetes. MarbleRun uses JSON Manifests to define application topology, manages secrets and certificates, and provides cluster-wide remote attestation for secure microservices. It supports runtimes including EGo, Gramine, Occlum, and Edgeless RT, and can be deployed via Helm on SGX-enabled clusters or in simulation mode.

Tokens
74.1K
Snippets
262
Records
364
Agent score
52%

What's inside MarbleRun

  1. What is MarbleRun

    master

    MarbleRun is a framework designed for creating and deploying distributed confidential-computing applications. It allows you to build confidential microservices, distribute them via Kubernetes on SGX-enabled clusters, and manage the complexities of secure distributed systems.

    Key capabilities include:

    • Topology Enforcement: Ensures your distributed app adheres to a topology defined in a JSON Manifest.
    • Integrity & Authentication: Verifies the integrity of services and bootstraps them securely.
    • Secure Connectivity: Automatically sets up encrypted connections between microservices.
    • Secrets & Configuration: Manages secrets, certificates, and parameters for your microservices.
    • Resilience: Seamlessly substitutes nodes that fail based on the rules defined in your Manifest.
    • Cluster Attestation: Issues a single, concise remote attestation statement for the entire distributed application, allowing anyone to verify the integrity of the whole cluster.

  3. Key features of MarbleRun

    master

    MarbleRun provides the following core capabilities for confidential computing:

    • Authentication and Integrity Verification: Ensures microservices adhere to the specified manifest.
    • Secrets Management: Securely manages secrets for confidential microservices.
    • Provisioning: Handles the provisioning of certificates, configurations, and parameters.
    • Remote Attestation: Provides attestation for the entire deployment.
    • RBAC and Governance: Includes Role-Based Access Control (RBAC), support for verifiable updates, and multi-stakeholder support (e.g., enforcing four-eyes principles).

  6. What is a MarbleRun manifest?

    master

    A manifest is a JSON document that defines the essential properties of a MarbleRun deployment. It serves as the source of truth for:

    • Allowed software packages
    • Secrets
    • Access control
    • Update policies

    The manifest contains all information required by the Coordinator to verify the confidentiality and integrity of a newly spawned Marble. Once the Coordinator successfully verifies the manifest, it provisions the Marble with the necessary configuration and secrets.

  7. What is Confidential Computing in MarbleRun

    master
    Confidential computing protects data in use by performing computations within hardware-based secure enclaves (such as Intel SGX). These enclaves prevent unauthorized access or modification of applications and data while they are being processed, providing high security assurances for sensitive or regulated data.

  8. What is the Coordinator in MarbleRun

    master

    The Coordinator serves as MarbleRun's control plane and acts as a trusted controller within a confidential deployment. Its primary responsibilities include:

    • State Management: Securely holding the deployment's manifest and defined secrets.
    • Authentication: Using remote attestation to authenticate application enclaves based on the manifest.
    • Communication: Acting as the bridge between the data plane (via gRPC) and clients (via an HTTP REST interface).

    In Kubernetes environments, the Coordinator can be scaled to multiple instances to increase availability and minimize the need for manual recovery.

  9. How MarbleRun differs from traditional Service Meshes

    master

    Traditional service meshes (like Istio, Consul, or Linkerd) typically use a sidecar pattern (e.g., Envoy proxies) injected into pods to manage network communication. These sidecars act as a data plane, while a control plane manages them, primarily focusing on protecting data in transit.

    MarbleRun takes a different approach designed for distributed confidential applications:

    1. Integrated Data Plane: Instead of separate sidecars, MarbleRun injects data-plane logic directly into the application logic running inside secure enclaves. These enclave-running containers are called Marbles.
    2. Enclave Termination: Because the logic is coupled with the application, secure connections always terminate inside the secure enclaves.
    3. Integrity Verification: Before bootstrapping, MarbleRun verifies the integrity of Marbles using Intel SGX remote attestation primitives. This ensures the distributed app's topology adheres to the cluster's effective manifest.
    4. Cluster-wide Attestation: MarbleRun acts as a certificate authority for all Marble-based services and issues a single, concise remote attestation statement for the entire cluster, allowing external parties to verify the integrity of the distributed confidential app.

  10. Handle out-of-process attestation for Gramine

    master

    While Marbles built with Ego use in-process attestation, frameworks like Gramine require out-of-process attestation. This requires the Intel SGX Architectural Enclave Service Manager (AESM) to be running on the host system.

    To use out-of-process attestation in Kubernetes, you must expose the AESM device to your container. For Azure users, follow the AKS guide to enable AESM for quote generation. Ensure your Kubernetes nodes have the AESM service installed.

  11. Understand Attested TLS (aTLS)

    master

    Attested TLS (aTLS) allows parties to establish secure connections by binding a TLS certificate to an SGX remote attestation statement. Instead of relying solely on a traditional CA, trust is established by verifying that the certificate's public key is embedded within a valid attestation statement. This can be used for:

    • Client-to-server verification
    • Server-to-client verification
    • Mutual verification (mutual aTLS)

  12. Configure authentication and credentials for Transparent TLS

    master

    When using Transparent TLS, MarbleRun handles authentication in two ways:

    1. Automatic Configuration (Default): By default, Marble credentials are automatically configured, and connections between two Marbles are mutually authenticated.
    2. Custom Credentials: You can use custom credentials defined in the manifest's secrets section. This is useful for scenarios such as connecting from outside the cluster or when you need to ensure a specific certificate is always served.