TLS client certificates and two-step config fetch for confidential clusters

[travier]

Feature Request

Environment

Confidential Clusters.

Desired Feature

For confidential cluster use cases, we want to deliver the full Ignition config only to nodes that passed attestation against a specific attestation server.

The design would look like the following:

1. Get the config from the cloud metadata

• It contains no secret values
• It includes a new config entry that points to the attestation server (KBS?) to use for attestation
• It includes a merge/replace config that needs mutual TLS to be fetched

2. Ignition would call out to the attestation agent (KBS client?) to perform the attestation.
3. The attestation client will get back a TLS client certificate.
4. Ignition would then use this client certificate to fetch the full config and resume configuration/booting.

Other Information

N/A