Rolling Software Updates
Rolling updates of confidential services – what needs to be touched?
SCONE supports the rolling update of services and applications. Updates are a three-step process:
- Update the security policy of the application: add the new
MrEnclavefor the updated service / application.
- trigger a rolling update with Kubernetes /
- Update the security policy of the application: remove the old
MrEnclaves of the service / application
For each service, one can specify a sequence of
MrEnclaves. This might look as follows:
services: - name: application mrenclaves: [0239...]
and we want to update to a new version that has
0239.... If the service support
horizontal scaling, we might want a rolling update, e.g., we gradually replace old service instances
by new instances. This means there is some time interval in which both old instances as well as new
instances a running concurrently.
Consider that you want to update
application to a new version with a new
MrEnclave of, say,
4759.... In this case, you
would update your policy as follows:
services: - name: application mrenclaves: [0239..., 4759...]
Now you can upgrade your application with the help of
helm. You might trigger a rolling update as follows:
helm upgrade application .
You need to check that all your service instances have been upgraded.
We now ensure that the old version of the service / application cannot run anymore by removing
MrEnclave from the policy:
services: - name: application mrenclaves: [4759...]