Pluggable policy engine for attestation server about kbs HOT 4 CLOSED

Currently the attestation server is tightly couple with Open Policy Agent (OPA). It would be useful to make it modular and enable usage of alternative policy engines like kyverno.

@bpradipt It will be easy to realize the modularization of the policy engine (only need to do some additional encapsulation for the policy verification part), but we may need to redesign the message format of AS interacting with the policy engine to make it universal enough to support various policy engines. In the subsequent PR, perhaps we can achieve this.

from kbs.

@bpradipt Hi, after confidential-containers/attestation-service#24 be merged, I will raise a new PR to pluggable policy engine :)

from kbs.

@bpradipt Hi, after confidential-containers/attestation-service#24 be merged, I will raise a new PR to pluggable policy engine :)

awesome @jialez0 :-)

from kbs.

Hi, @bpradipt , I have raise the PR confidential-containers/attestation-service#25 to solve this issue. Now you can review it.

from kbs.