Fill out feature sections

[fitzthum]

The docs now have a section for all the features that CoCo provides. Features refers to primitives like sealed-secrets, encrypted images, protected storage, etc that people can use to put together a confidential workload.

Most of the feature pages are empty at the moment. I need some help to fill them out. We don't need anything too fancy at first, but let's try to give users a foolproof guide to the various pieces. We already have some documentation about features scattered between different repos. You can also take a look at the tests if you forget how exactly something works.

Here are the features we have so far:

• Authenticated Registries
• Encrypted Images (there is info here already but it could be improved)
• Protected Storage
• Sealed Secrets
• Signed Images

also, if I forgot a feature lmk or add it.

Does anyone want to adopt one of these pages for a little while? I'll tag some random people who worked on some of these features. @stevenhorsman @ChengyuZhu6 @wainersm @portersrc @fitzthum @mkulke

[portersrc]

✋ I'll take a look at signed images

[wainersm]

I can take ... hmm... let's see... authenticated registries. If anyone feels more comfortable switching topics, let me know because I think I know a little bit of each topic so we can swap.

[wainersm]

I suggest the following addition to the list of features (feel free to reword them):

• Workload secrets (a.k.a read resources from CDH from the pod)
• Agent policies

[fitzthum]

We now have a sealed secrets page that is probably about 70 percent. We can improve on that in future iterations.

[wainersm]

Hi @fitzthum @Xynnn007 ! While working on authenticated registry documentation I remembered of a discussion I had with @stevenhorsman when we were adding the tests for that feature. So I'd like to double-check with you that registry authentication is not currently confidential.

The fact that users need to create the docker-registry secret for nydus-snapshotter to pull metadata, makes it susceptible for a malicious host to read the authentication credentials, hence breaking confidentiality. Then:

• If it's not the case anymore then we are doing this https://github.com/kata-containers/kata-containers/blob/main/tests/integration/kubernetes/k8s-guest-pull-image-authenticated.bats#L33 unnecessary step on the tests.
• If it's still valid then I will need to make a big warning on the doc. And suggest to users to use encrypted images if they want it confidential

[fitzthum]

is not currently confidential.

That is still the case and we should make sure people understand that.

[wainersm]

is not currently confidential.

That is still the case and we should make sure people understand that.

ok, so I will do my best to explain that situation.