SlideShare a Scribd company logo
© FIDO Alliance 2024 Confidential
1
How Red Hat Uses
FDO in Device
Lifecycle
Vitaliy Emporopulo & Costin Gamenţ, Red Hat
Device Lifecycle
Space for a two-line
subhead here
Day 0: Device
onboarding
· Red Hat implementation
of FDO for secure device
onboarding.
· FDO is included in Red Hat
Enterprise Linux starting
with 8.6 (today 9.3).
Wrap short
subheads
Day 1: Device
customization
· OSTree for switching to a
custom operating system
tailored for a particular
device role.
· Utilize the FDO
onboarding process to
Adjust lower text
blocks up or down
Day 2: Device
management
· Ansible Automation
Platform (AAP) for
managing configuration,
updates, etc.
· Utilize the FDO
onboarding process to add
FDO at Red Hat
FDO Components
Red Hat Implementation
Manufacturing
Server
Rendezvous
Server
Onboarding
Server
ServiceInfo
API
Server
Initialization
& Onboarding
Clients
Red Hat Implementation of FDO
● Manufacturing server
● Rendezvous server
● Onboarding server
● ServiceInfo API server
● Initialization (manufacturing) client
● Onboarding client
In addition
● Administrator CLI tool
● Owner CLI tool
Included in Red Hat Enterprise Linux starting version 8.6.
Open source, written in Rust, under active development.
Red Hat FDO Components
The FDO Operator
FDO Operator for OpenShift
Red Hat's primary platform for running containerized
applications is OpenShift Container Platform. It is based
on Kubernetes with additional enterprise features for
enhanced security, observability, etc.
An operator is a method of packaging, deploying, and
managing a Kubernetes application.
The FDO Operator allows for easy deployment and
management of FDO services on OpenShift.
Installing the FDO Operator
Example Configuration
service_info:
files:
- path: /etc/containers/registries.conf.d/003-rhel4edge.conf # image registry for ostree
source_path: /etc/fdo/service_info/003-rhel4edge.conf
- path: /var/rebase-ostree.sh # script for swapping the operating system (ostree)
source_path: /etc/fdo/service_info/rebase-ostree.sh
- path: /var/register-with-aap.sh # script for registering with Ansible
source_path: /etc/fdo/service_info/register-with-aap.sh
commands:
- command: /bin/bash
args:
- /var/rebase-ostree.sh # replace operating system (ostree) image
- ostree-image-signed:docker://registry.acme.com:5000/rhel4edge:base #ostree image
- command: /bin/bash
args:
- /var/register-with-aap.sh # register with Ansible Automation Platform (AAP)
- https://aap-registration.svc.acme.com # AAP API endpoint
- <registration-token> # AAP API key
Operating System as a
Container Image
Red Hat Enterprise Linux for Edge
Red Hat Enterprise Linux is the leading OS for servers,
but what do we need at the edge?
● customizable operating system images
● edge management and scalable deployment
● efficient over-the-air (OTA) updates
● intelligent rollbacks
And that is Red Hat Enterprise Linux for Edge.
(lib)OSTree
Dry definition:
“libostree is both a shared library
and suite of command line tools
that combines a "git-like" model
for committing and downloading
bootable filesystem trees, along
with a layer for deploying them
and managing the bootloader
configuration.”
Reality:
·Immutable operating system
·Very easy updates, upgrades
and rollback (the rollbacks can
even be completely automatic!)
·Minimal bandwidth usage for
updates
·Dead simple operating system
change procedure
rpm-ostree
So, how can I change my operating system with one
command?
rpm-ostree rebase ostree-image-
signed:docker://registry.acme.com:5000/rhel4edge:base
Device Management with
Ansible
Ansible Automation Platform (AAP)
· Based on Ansible
configuration
management tool
· Agentless
· Runs on OpenShift
as an operator
Ansible Inventory
OpenShift Installation on Bare
Metal
OpenShift Assisted Installer
Another interesting use
case is combining FDO
with the Assisted
Installer.
The Assisted Installer
allows installing clusters
on bare metal by
booting into a discovery
ISO that runs an
installation agent, and
following a UI wizard.
FDO and Assisted Installer
● FDO is used to verify cluster nodes and start the installer
agent.
● Storing all sensitive data on the FDO server also removes
the need to embed it into the discovery ISO.
● Easy late binding of a device to a cluster/customer.
Assisted Installer with and without FDO
Generated ISO
Assisted
Installer
Service
Device
Installer
agent
Installation
credentials
1
2
3
Assisted
Installer
Service
Generated ISO
Device
FDO client
Installer
agent
FDO
onboarding
server
FDO
ServiceInfo API
server
Installatio
n
credential
s
1
2
1
3
4
5
FDO
manufacturi
ng
0
Resources
· FDO Implementation https://github.com/fdo-rs/fido-device-onboard-rs
· FDO Operator https://github.com/fdo-rs/fdo-operator
· FDO Ansible collection https://github.com/fdo-rs/ansible.community.fdo
· Red Hat Ansible Automation Platform Operator Installation Guide
https://access.redhat.com/documentation/en-
us/red_hat_ansible_automation_platform/2.1/html/red_hat_ansible_auto
mation_platform_operator_installation_guide/index
· libOSTree https://ostreedev.github.io/ostree/
· Installing an on-premise cluster using the Assisted Installer
https://docs.openshift.com/container-
platform/4.15/installing/installing_on_prem_assisted/installing-on-prem-
assisted.html
© FIDO Alliance 2024 Confidential
24
Thank you

More Related Content

Similar to How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf

CNCF Meetup - OpenShift Overview
CNCF Meetup - OpenShift OverviewCNCF Meetup - OpenShift Overview
CNCF Meetup - OpenShift Overview
Sumit Shatwara
 
Red Hat for IBM System z Update v5
Red Hat for IBM System z Update v5Red Hat for IBM System z Update v5
Red Hat for IBM System z Update v5
Filipe Miranda
 
How do I securely deploy Internet websites in PHP on my IBMi?
How do I securely deploy Internet websites in PHP on my IBMi?How do I securely deploy Internet websites in PHP on my IBMi?
How do I securely deploy Internet websites in PHP on my IBMi?
Zend by Rogue Wave Software
 
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdfOpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
ssuser9e06a61
 
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as CodeHitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Robert van Mölken
 
ansible_rhel_90.pdf
ansible_rhel_90.pdfansible_rhel_90.pdf
ansible_rhel_90.pdf
ssuserd254491
 
Linux Containers and Docker SHARE.ORG Seattle 2015
Linux Containers and Docker SHARE.ORG Seattle 2015Linux Containers and Docker SHARE.ORG Seattle 2015
Linux Containers and Docker SHARE.ORG Seattle 2015
Filipe Miranda
 
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
devopsdaysaustin
 
OpenStack Preso: DevOps on Hybrid Infrastructure
OpenStack Preso: DevOps on Hybrid InfrastructureOpenStack Preso: DevOps on Hybrid Infrastructure
OpenStack Preso: DevOps on Hybrid Infrastructure
rhirschfeld
 
Successful Patterns for running platforms
Successful Patterns for running platformsSuccessful Patterns for running platforms
Successful Patterns for running platforms
Paul Czarkowski
 
IBM Edge2015 Las Vegas
IBM Edge2015 Las VegasIBM Edge2015 Las Vegas
IBM Edge2015 Las Vegas
Filipe Miranda
 
Lenovo xClarity - Presentacion - ITALTEL.pptx
Lenovo xClarity - Presentacion - ITALTEL.pptxLenovo xClarity - Presentacion - ITALTEL.pptx
Lenovo xClarity - Presentacion - ITALTEL.pptx
JairVelasquezParraga
 
OSv presentation from Linux Foundation Collaboration Summit
OSv presentation from Linux Foundation Collaboration SummitOSv presentation from Linux Foundation Collaboration Summit
OSv presentation from Linux Foundation Collaboration Summit
Don Marti
 
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System zSHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
Filipe Miranda
 
Sap webinar-briefing-sep-2013-final
Sap webinar-briefing-sep-2013-finalSap webinar-briefing-sep-2013-final
Sap webinar-briefing-sep-2013-final
Kenneth Peeples
 
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptxToronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
Anurag Dwivedi
 
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius SchumacherOSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
NETWAYS
 
Rhel7 vs rhel6
Rhel7 vs rhel6Rhel7 vs rhel6
Rhel7 vs rhel6
Arunvignesh Venkatesh
 
MuleSoft Sizing Guidelines - VirtualMuleys
MuleSoft Sizing Guidelines - VirtualMuleysMuleSoft Sizing Guidelines - VirtualMuleys
MuleSoft Sizing Guidelines - VirtualMuleys
Angel Alberici
 
Gluecon Preso: Hybrid Container Infrastructure
Gluecon Preso: Hybrid Container InfrastructureGluecon Preso: Hybrid Container Infrastructure
Gluecon Preso: Hybrid Container Infrastructure
rhirschfeld
 

Similar to How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf (20)

CNCF Meetup - OpenShift Overview
CNCF Meetup - OpenShift OverviewCNCF Meetup - OpenShift Overview
CNCF Meetup - OpenShift Overview
 
Red Hat for IBM System z Update v5
Red Hat for IBM System z Update v5Red Hat for IBM System z Update v5
Red Hat for IBM System z Update v5
 
How do I securely deploy Internet websites in PHP on my IBMi?
How do I securely deploy Internet websites in PHP on my IBMi?How do I securely deploy Internet websites in PHP on my IBMi?
How do I securely deploy Internet websites in PHP on my IBMi?
 
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdfOpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf
 
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as CodeHitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
 
ansible_rhel_90.pdf
ansible_rhel_90.pdfansible_rhel_90.pdf
ansible_rhel_90.pdf
 
Linux Containers and Docker SHARE.ORG Seattle 2015
Linux Containers and Docker SHARE.ORG Seattle 2015Linux Containers and Docker SHARE.ORG Seattle 2015
Linux Containers and Docker SHARE.ORG Seattle 2015
 
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
2016 - Open Mic - IGNITE - Open Infrastructure = ANY Infrastructure
 
OpenStack Preso: DevOps on Hybrid Infrastructure
OpenStack Preso: DevOps on Hybrid InfrastructureOpenStack Preso: DevOps on Hybrid Infrastructure
OpenStack Preso: DevOps on Hybrid Infrastructure
 
Successful Patterns for running platforms
Successful Patterns for running platformsSuccessful Patterns for running platforms
Successful Patterns for running platforms
 
IBM Edge2015 Las Vegas
IBM Edge2015 Las VegasIBM Edge2015 Las Vegas
IBM Edge2015 Las Vegas
 
Lenovo xClarity - Presentacion - ITALTEL.pptx
Lenovo xClarity - Presentacion - ITALTEL.pptxLenovo xClarity - Presentacion - ITALTEL.pptx
Lenovo xClarity - Presentacion - ITALTEL.pptx
 
OSv presentation from Linux Foundation Collaboration Summit
OSv presentation from Linux Foundation Collaboration SummitOSv presentation from Linux Foundation Collaboration Summit
OSv presentation from Linux Foundation Collaboration Summit
 
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System zSHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
SHARE.ORG in Boston Aug 2013 RHEL update for IBM System z
 
Sap webinar-briefing-sep-2013-final
Sap webinar-briefing-sep-2013-finalSap webinar-briefing-sep-2013-final
Sap webinar-briefing-sep-2013-final
 
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptxToronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
Toronto MuleSoft_Meetup_Run Time Fabric - Self Managed Kubernetes.pptx
 
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius SchumacherOSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
OSDC 2018 | Highly Available Cloud Foundry on Kubernetes by Cornelius Schumacher
 
Rhel7 vs rhel6
Rhel7 vs rhel6Rhel7 vs rhel6
Rhel7 vs rhel6
 
MuleSoft Sizing Guidelines - VirtualMuleys
MuleSoft Sizing Guidelines - VirtualMuleysMuleSoft Sizing Guidelines - VirtualMuleys
MuleSoft Sizing Guidelines - VirtualMuleys
 
Gluecon Preso: Hybrid Container Infrastructure
Gluecon Preso: Hybrid Container InfrastructureGluecon Preso: Hybrid Container Infrastructure
Gluecon Preso: Hybrid Container Infrastructure
 

More from FIDO Alliance

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdfFIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdfFIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdfFIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdfFIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdfFIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FIDO Alliance
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
FIDO Alliance
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
FIDO Alliance
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
FIDO Alliance
 
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
FIDO Alliance
 
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdfSimplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
FIDO Alliance
 
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdfLinux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
FIDO Alliance
 
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdfThe Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
FIDO Alliance
 
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdfIntroduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
FIDO Alliance
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
FIDO Alliance
 

More from FIDO Alliance (20)

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdfFIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
FIDO Alliance Osaka Seminar: LY-DOCOMO-KDDI-Mercari Panel.pdf
 
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdfFIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
FIDO Alliance Osaka Seminar: NEC & Yubico Panel.pdf
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
FIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdfFIDO Alliance Osaka Seminar: CloudGate.pdf
FIDO Alliance Osaka Seminar: CloudGate.pdf
 
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdfFIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
FIDO Alliance Osaka Seminar: PlayStation Passkey Deployment Case Study.pdf
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdfFIDO Alliance Osaka Seminar: Welcome Slides.pdf
FIDO Alliance Osaka Seminar: Welcome Slides.pdf
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
 
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
ASRock Industrial FDO Solutions in Action for Industrial Edge AI _ Kenny at A...
 
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
 
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
 
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdfSimplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf
 
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdfLinux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf
 
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdfThe Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
The Value of Certifying Products for FDO _ Paul at FIDO Alliance.pdf
 
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdfIntroduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
Introduction to FDO and How It works Applications _ Richard at FIDO Alliance.pdf
 
ADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptxADP Passwordless Journey Case Study.pptx
ADP Passwordless Journey Case Study.pptx
 

Recently uploaded

GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing DaysClimate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
Kari Kakkonen
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
Adtran
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Malak Abu Hammad
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Neo4j
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
Aftab Hussain
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
panagenda
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
Octavian Nadolu
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
tolgahangng
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
Neo4j
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
mikeeftimakis1
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
SOFTTECHHUB
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
Zilliz
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Neo4j
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
Neo4j
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
名前 です男
 

Recently uploaded (20)

GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing DaysClimate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
 
Pushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 daysPushing the limits of ePRTC: 100ns holdover for 100 days
Pushing the limits of ePRTC: 100ns holdover for 100 days
 
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfUnlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdf
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
 
Removing Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software FuzzingRemoving Uninteresting Bytes in Software Fuzzing
Removing Uninteresting Bytes in Software Fuzzing
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAUHCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
 
Serial Arm Control in Real Time Presentation
Serial Arm Control in Real Time PresentationSerial Arm Control in Real Time Presentation
Serial Arm Control in Real Time Presentation
 
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024GraphSummit Singapore | The Art of the  Possible with Graph - Q2 2024
GraphSummit Singapore | The Art of the Possible with Graph - Q2 2024
 
Introduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - CybersecurityIntroduction to CHERI technology - Cybersecurity
Introduction to CHERI technology - Cybersecurity
 
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalizationFull-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
 
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
 
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...
 
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
みなさんこんにちはこれ何文字まで入るの?40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの?えこ...
 

How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf

  • 1. © FIDO Alliance 2024 Confidential 1 How Red Hat Uses FDO in Device Lifecycle Vitaliy Emporopulo & Costin Gamenţ, Red Hat
  • 2. Device Lifecycle Space for a two-line subhead here Day 0: Device onboarding · Red Hat implementation of FDO for secure device onboarding. · FDO is included in Red Hat Enterprise Linux starting with 8.6 (today 9.3). Wrap short subheads Day 1: Device customization · OSTree for switching to a custom operating system tailored for a particular device role. · Utilize the FDO onboarding process to Adjust lower text blocks up or down Day 2: Device management · Ansible Automation Platform (AAP) for managing configuration, updates, etc. · Utilize the FDO onboarding process to add
  • 6. Red Hat Implementation of FDO ● Manufacturing server ● Rendezvous server ● Onboarding server ● ServiceInfo API server ● Initialization (manufacturing) client ● Onboarding client In addition ● Administrator CLI tool ● Owner CLI tool Included in Red Hat Enterprise Linux starting version 8.6. Open source, written in Rust, under active development.
  • 7. Red Hat FDO Components
  • 9. FDO Operator for OpenShift Red Hat's primary platform for running containerized applications is OpenShift Container Platform. It is based on Kubernetes with additional enterprise features for enhanced security, observability, etc. An operator is a method of packaging, deploying, and managing a Kubernetes application. The FDO Operator allows for easy deployment and management of FDO services on OpenShift.
  • 10. Installing the FDO Operator
  • 11. Example Configuration service_info: files: - path: /etc/containers/registries.conf.d/003-rhel4edge.conf # image registry for ostree source_path: /etc/fdo/service_info/003-rhel4edge.conf - path: /var/rebase-ostree.sh # script for swapping the operating system (ostree) source_path: /etc/fdo/service_info/rebase-ostree.sh - path: /var/register-with-aap.sh # script for registering with Ansible source_path: /etc/fdo/service_info/register-with-aap.sh commands: - command: /bin/bash args: - /var/rebase-ostree.sh # replace operating system (ostree) image - ostree-image-signed:docker://registry.acme.com:5000/rhel4edge:base #ostree image - command: /bin/bash args: - /var/register-with-aap.sh # register with Ansible Automation Platform (AAP) - https://aap-registration.svc.acme.com # AAP API endpoint - <registration-token> # AAP API key
  • 12. Operating System as a Container Image
  • 13. Red Hat Enterprise Linux for Edge Red Hat Enterprise Linux is the leading OS for servers, but what do we need at the edge? ● customizable operating system images ● edge management and scalable deployment ● efficient over-the-air (OTA) updates ● intelligent rollbacks And that is Red Hat Enterprise Linux for Edge.
  • 14. (lib)OSTree Dry definition: “libostree is both a shared library and suite of command line tools that combines a "git-like" model for committing and downloading bootable filesystem trees, along with a layer for deploying them and managing the bootloader configuration.” Reality: ·Immutable operating system ·Very easy updates, upgrades and rollback (the rollbacks can even be completely automatic!) ·Minimal bandwidth usage for updates ·Dead simple operating system change procedure
  • 15. rpm-ostree So, how can I change my operating system with one command? rpm-ostree rebase ostree-image- signed:docker://registry.acme.com:5000/rhel4edge:base
  • 17. Ansible Automation Platform (AAP) · Based on Ansible configuration management tool · Agentless · Runs on OpenShift as an operator
  • 20. OpenShift Assisted Installer Another interesting use case is combining FDO with the Assisted Installer. The Assisted Installer allows installing clusters on bare metal by booting into a discovery ISO that runs an installation agent, and following a UI wizard.
  • 21. FDO and Assisted Installer ● FDO is used to verify cluster nodes and start the installer agent. ● Storing all sensitive data on the FDO server also removes the need to embed it into the discovery ISO. ● Easy late binding of a device to a cluster/customer.
  • 22. Assisted Installer with and without FDO Generated ISO Assisted Installer Service Device Installer agent Installation credentials 1 2 3 Assisted Installer Service Generated ISO Device FDO client Installer agent FDO onboarding server FDO ServiceInfo API server Installatio n credential s 1 2 1 3 4 5 FDO manufacturi ng 0
  • 23. Resources · FDO Implementation https://github.com/fdo-rs/fido-device-onboard-rs · FDO Operator https://github.com/fdo-rs/fdo-operator · FDO Ansible collection https://github.com/fdo-rs/ansible.community.fdo · Red Hat Ansible Automation Platform Operator Installation Guide https://access.redhat.com/documentation/en- us/red_hat_ansible_automation_platform/2.1/html/red_hat_ansible_auto mation_platform_operator_installation_guide/index · libOSTree https://ostreedev.github.io/ostree/ · Installing an on-premise cluster using the Assisted Installer https://docs.openshift.com/container- platform/4.15/installing/installing_on_prem_assisted/installing-on-prem- assisted.html
  • 24. © FIDO Alliance 2024 Confidential 24 Thank you