External Dependencies

Remote Attestation

KDCL relies on remote attestation for trusted environment measurement. To deploy remote attestation, see the deployment guide.
Ensure that the scheduled challenge task is enabled. Configure the execution time of the scheduled task under the schedulers field in the /etc/attestation_agent/agent_config.yaml file. For configuration details, see the configuration guide.
Enable the image key.
KDCL uses the image key component to obtain a key derived from the Kunpeng hardware to protect service private data.

For details about how to use the image key, see this document.
Configure the NTP service.
The KDCL trusted time service relies on an NTP service time source. Administrators must configure NTP clock synchronization on a confidential virtual machine (cVM) where kdc_agent is deployed. The configuration steps are as follows.
1. Install and enable chrony.
```
sudo dnf install -y chrony
```
2. Modify the configuration file. Edit the /etc/chrony.conf file and replace the default servers with available public NTP servers.
```
server 0.cn.pool.ntp.org iburst
server 1.cn.pool.ntp.org iburst
```
3. Start the chronyd service.
```
systemctl start chronyd
systemctl enable chronyd # Enable startup on boot
```
4. Disable the default system NTP synchronization.
```
timedatectl set-ntp no # Avoid conflict with chronyd
```
5. Check the synchronization status.
```
timedatectl status
chronyc sources -v
chronyc tracking
# If System clock synchronized: yes is displayed, or an upstream source marked with an asterisk (*) appears in the chrony output, the time synchronization is functioning normally.
```

Parent topic: Deployment and Installation