cmds/

Package allowlist implements the `c8s allowlist` operator CLI for reading and mutating the CDS-served image allowlist that nri-image-policy enforces on every node.

Package allowlistproxy implements the loopback proxy used by tls-lb to publish CDS's allowlist API.

Package attestproxy implements the node-local front door to the attestation-api.

Package cds implements the Certificate Distribution Service subcommand: the c8s trust root (attestation, EAR issuance, mesh CA, leaf signing).

Package cdsattest implements the tls-lb attestation + over-encryption sidecar: the *dynamic* client-facing endpoints of the c8s-verify protocol.

Package cdsconn builds what an operator CLI needs to reach CDS: an HTTP client that has verified the endpoint's attestation, and the operator credential that signs a write.

Package cmdsutil holds tiny helpers shared across the c8s subcommand packages under internal/cmds/.

Package credrelease implements the in-guest credential-release service (B4 of the operator-key design).

Package getcert implements the get-cert subcommand: it requests a TLS certificate from CDS by proving the caller runs inside a TEE.

Package getkubeconfig implements the operator-side client (B4 client) that obtains a kube credential from a measured CVM: it attests the node, confirms the full measured identity — on TDX the image tuple (MRTD, RTMR[1], RTMR[2]) plus the RTMR[3] chain seeded by the operator's key and extended by the expected workload images; on SEV-SNP the pinned per-SMP launch digest plus the operator-key HOSTDATA binding — then exchanges a CSR for a short-lived kube client cert over the cred-release endpoint and assembles a kubeconfig.

Package getsecret implements the get-secret subcommand: the sidecar that fetches a workload's secrets from CDS and writes them into the pod.

Package getvolume implements the get-volume subcommand: the sidecar that fetches a volume's key blob from CDS and hands it to the node's volumed, which opens the device and mounts it into this pod.

Package katameasure implements `c8s kata measure`: the offline predictor for a kata confidential guest's launch measurement, on SEV-SNP and on TDX.

Package measurements implements the `c8s measurements` command group: deriving a measurements config from built images, and checking one.

Package nriimagepolicy is an NRI plugin that validates container images against a digest allowlist.

Package policymonitor implements the in-VM container-digest enforcement daemon baked into kata-guest-base.

Package probefile implements the probe-file subcommand: a tiny file-existence helper for distroless containers.

Package rtmr3measurer is the in-VM workload measurer: it scans kata-agent's container bundles under /run/kata-containers and extends TDX RTMR[3] with each deployed workload's image digest, binding WHICH container ran into the guest's attestation — dynamically, for any image, with no baked allowlist.

Package secrets implements the `c8s secrets` operator CLI for the CDS secret store.

Package sidecar holds the CDS-release plumbing shared by the get-secret and get-volume sidecars: the config they render from the webhook, the mTLS client bound to the pod's leaf, the challenge/sandbox-token dance around each store request, and the retry loop that turns "not released yet" into bounded patience.

Package volume implements the `c8s volume` operator CLI: building an encrypted block image and putting its key into the CDS secret store.

Package volumed implements the node agent that opens encrypted volumes for the pods on it.