Trust Zone Provisioning Overview

This section describes how to provision Trust Zones and deploy Cofide SPIRE servers backing them.

Define Trust Boundaries

First, decide on one or more sensible trust zones for your organization. Each one will require a Kubernetes cluster to host the trust zone’s Cofide SPIRE server deployment, and each node (i.e. workload host) in the trust zone will run a Cofide SPIRE agent.

In the simplest case, a trust zone may consist of a single Kubernetes cluster hosting Cofide SPIRE components and all workloads. In a more complex environment, a single trust zone could contain multiple clusters, as well as public cloud provider VMs and on-premise bare-metal nodes.

Interacting with the Connect API

The Cofide Connect platform offers a number of different tools for interacting with the Connect API. These include:

• The cofidectl command line interface.
• The official Cofide Terraform provider.
• The Cofide API SDK for direct, low-level gRPC calls.
• The Connect Dashboard.

The following guides use cofidectl commands for simplicity. The Terraform provider supports the same resources and is generally a better choice for production use cases, since it fits an Infrastructure as Code process. The Cofide API SDK allows Connect users to build their own custom tooling around the API if required.

In general, some resources such as trust zones and clusters are likely to be fairly static, while others such as attestation policies may be more dynamic and follow workload life cycles.

Choose a deployment path

Pick the guide based on whether this trust zone will ever need more than one Kubernetes cluster. These two guides are alternatives, not sequential steps: follow one of them start to finish, not both.

• Single cluster: a simpler setup, for a trust zone that will only ever run on one Kubernetes cluster. See Deploy Cofide SPIRE (single cluster).
• Multiple clusters: works whether the trust zone has one Kubernetes cluster today or several, and avoids extra migration steps if you add clusters later. See Deploy Cofide SPIRE (multiple clusters).

Note

Before setting up your first Trust Zone, you must be granted access to the Cofide container image repository which contains the required Cofide SPIRE images. Please contact the Cofide team to arrange access.