First steps with MarbleRun
The following steps guide you through the process of deploying MarbleRun in your cluster and deploying a sample app. This example assumes that you have successfully installed MarbleRun, and have access to a Kubernetes cluster.
A working SGX DCAP environment is required for MarbleRun. For ease of exploring and testing, we provide a simulation mode with --simulation
that runs without SGX hardware.
Depending on your setup, you may follow the quickstart for SGX-enabled clusters. Alternatively, if your setup doesn't support SGX, you can follow the quickstart in simulation mode by selecting the respective tabs.
Step 0: Clone the demo repository
To get a feel for how MarbleRun would work for one of your services, you can install a demo application. The emojivoto application is a standalone Kubernetes application that uses a mix of gRPC and HTTP calls to allow users to vote on their favorite emojis. Created as a demo application for the popular Linkerd service mesh, we've made a confidential variant that uses a confidential service mesh for all gRPC and HTTP connections. Clone the demo application's repository from GitHub by running the following:
git clone https://github.com/edgelesssys/emojivoto.git && cd emojivoto
Step 1: Install the control plane onto your cluster
Install MarbleRun's Coordinator control plane by running:
- With SGX
- In simulation mode
marblerun install
The marblerun install
command generates a Kubernetes manifest with all the necessary control plane resources.
This includes a deployment for the Coordinator and for MarbleRun's admission controller.
marblerun install --simulation
The marblerun install
command generates a Kubernetes manifest with all the necessary control plane resources.
This includes a deployment for the Coordinator and for MarbleRun's admission controller.
The simulation flag tells MarbleRun that real SGX hardware might not be present and the SGX layer should be emulated.
Wait for the control plane to finish installing:
marblerun check
This command will wait until all components of MarbleRun are ready to be used or return an error after a timeout period is reached.
Port forward the Coordinator's Client API:
kubectl -n marblerun port-forward svc/coordinator-client-api 4433:4433 --address localhost >/dev/null &
export MARBLERUN=localhost:4433