Trusted Infrastructure APIs
The vcenter trusted_infrastructure package provides services that enable a Trusted Infrastructure. They are responsible for ensuring that infrastructure nodes are running trusted software and for releasing encryption keys only to trusted infrastructure nodes.
Resources
Principal
The Principal service contains information about the certificates which sign the tokens used by vCenter for authentication.
Trust Authority Clusters
The TrustAuthorityClusters service manages all the Trust Authority Components on each Trust Authority Host in the cluster. The TrustAuthorityClusters service transforms a ClusterComputeResource into Trust Authority Cluster and vice versa.
Attestation
Services
The Services service contains information about the registered instances of the Attestation Service in vCenter.
Hosts Hardware
TPM
The Tpm interface provides operations to get available Trusted Platform Module (TPM) information on a host.
Hosts Hardware TPM
Endorsement Keys
The EndorsementKeys interface provides operations to get the Trusted Platform Module (TPM) Endorsement Key (EK) on a host.
Event Log
The EventLog interface provides operations to get the Trusted Platform Module (TPM) event log on a host.
KMS
Services
The Services service contains information about the registered instances of the Key Provider Service in vCenter.
Trust Authority Clusters
Consumer Principals
The ConsumerPrincipals service configures the token policies and STS trust necessary for the workload vCenter to query the trusted services for their status.
Trust Authority Clusters Attestation
Service Status
The ServiceStatus service provides operations to get the Attestation Service health status.
Trust Authority Clusters Attestation OS ESX
Base Images
The BaseImages service provides operations to manage trusted instances of ESX software on a cluster level.
Trust Authority Clusters Attestation TPM2
CA Certificates
The CaCertificates service provides operations to manage Trusted Platform Module (TPM) CA certificates. Endorsement Keys are typically packaged in a certificate that is signed by a certificate authority (CA). This service allows the CA certificate to be registered with the Attestation Service in order to validate TPM EK certificates when presented at attestation time.
Endorsement Keys
The EndorsementKeys service provides operations to manage Trusted Platform Module (TPM) Endorsement Keys (EK) on a cluster level.
Settings
The Settings interface provides operations to get or update settings related to the TPM 2.0 attestation protocol behavior.
Trust Authority Clusters KMS
Providers
The Providers interface provides operations to create, update and delete Key Providers that handoff to key servers.
Service Status
The ServiceStatus service provides operations to get the Key Provider Service health status.
Trust Authority Clusters KMS Providers
Client Certificate
The ClientCertificate interface provides operations to add and retrieve client certificate.
Credential
The Credential interface provides operations to add a credential for external key management service(s).
Current Peer Certificates
Retrieves the list of TLS certificates used by peer key servers. Those are meant for review. Following approval these certificates should be added as trusted certificates in the TrustedPeerCertificates service
Trusted Peer Certificates
Provides management operations for the TLS certificates trusted for communication with peer key servers. To obtain the currently used TLS certificates use the CurrentPeerCertificates service
Trust Authority Clusters KMS Providers Client Certificate
CSR
The Csr interface provides operations to create a certificate signing request(CSR).
Trust Authority Hosts
Attestation
The Attestation service contains information necessary to connect to the hosts running Attestation Service.
KMS
The Kms service contains information necessary to connect to the hosts running Key Provider Service.
Trusted Clusters
Services Applied Config
The ServicesAppliedConfig service provides information about the aggregate health of the applied Trust Authority Component configurations on the Trusted Clusters. The desired state of the Trust Authority Component configurations is stored within vCenter, while the applied configuration is stored on the hosts in the cluster and is a copy of the desired state. The ServicesAppliedConfig service is available for all clusters, not only Trusted Clusters. When an applied Trust Authority Component configuration is found outside of a Trusted Cluster it is considered an ERROR. The ServicesAppliedConfig service is able to make the applied Trust Authority Component configuration consistent with the desired state when individual host configurations have diverged from the desired state.
Trusted Clusters Attestation
Services
The Services service manages the Attestation Service instances a Trusted Cluster is configured to use.
Services Applied Config
The ServicesAppliedConfig service provides information about the aggregate health of the applied Attestation Service configuration on the Trusted Clusters. The desired state of the Attestation Service is stored within vCenter, while the applied configuration is stored on the hosts in the cluster. The ServicesAppliedConfig service is available for all clusters, not only Trusted Clusters. In such cases empty desired state is assumed, e.g. when an applied Attestation Service configuration is found outside of a Trusted Cluster it is considered an ERROR. The ServicesAppliedConfig service is able to put the applied Attestation Service configuration into a consistent state when individual host configurations have diverged from the desired state.
Trusted Clusters KMS
Services
The Services service manages the Key Provider Service instances a Trusted Cluster is configured to use.
Services Applied Config
The ServicesAppliedConfig service provides information about the aggregate health of the applied Key Provider Service configuration on the Trusted Clusters. The desired state of the Key Provider Service is stored within vCenter, while the applied configuration is stored on the hosts in the cluster. The ServicesAppliedConfig service is available for all clusters, not only Trusted Clusters. In such cases empty desired state is assumed, e.g. when an applied Key Provider Service configuration is found outside of a Trusted Cluster it is considered an ERROR. The ServicesAppliedConfig service is able to put the applied Key Provider Service configuration into a consistent state when individual host configurations have diverged from the desired state.
