feat: add firmware reference values workflow for bare metal attestation

[butler54]

Overview

Add comprehensive tooling and documentation for collecting and managing firmware reference values (TDX/SNP measurements) used in bare metal attestation policies.

This is PR 2A of Wave 2 (firmware hardening) from the bare metal attestation hardening plan.

Changes

Full Lifecycle Automation

🛠️ scripts/collect-firmware-refvals.sh - Complete pod lifecycle automation:

• Launches kata pod with specified RuntimeClass (default: kata-cc)
• Installs pip + veritas inside pod
• Collects firmware measurements from TEE
• Transforms veritas output to RVPS format (JSON with arrays)
• Saves to ~/.coco-pattern/firmware-reference-values.json
• Cleanup pod via trap handlers (EXIT/ERR/SIGINT/SIGTERM)
• Supports --merge for multi-OCP-version reference values
• Options: --namespace, --output, --runtime-class, --pod-image

Pattern A Integration (Local File → values-secret → Vault)

• values-secret.yaml.template: Single JSON blob with path: reference (commented out, like PCCS secrets)
• Makefile: make collect-firmware-refvals and make collect-firmware-refvals-merge targets
• scripts/gen-secrets.sh: Add firmware collection messaging for bare metal deployments

Documentation

📘 docs/firmware-reference-values.md - Complete workflow guide:

• Step-by-step automated collection via make collect-firmware-refvals
• Multi-OCP-version support workflow
• Architecture of TDX (mr_td, rtmr_1/2, xfam) and SNP measurements
• SHA-256 vs SHA-384 algorithm clarification (different layers, both correct)
• Known veritas gaps (TCB versions, SNP policy bits, image measurements)
• Security considerations and policy trade-offs

Usage

# On bare metal cluster with kata-cc RuntimeClass:
make collect-firmware-refvals

# Verify output
cat ~/.coco-pattern/firmware-reference-values.json

# Uncomment firmwareReferenceValues in ~/values-secret-coco-pattern.yaml
# Then load to Vault:
make load-secrets

# For multi-OCP-version support (merge with existing):
make collect-firmware-refvals-merge

Output Format

Single JSON object with arrays (supports multiple valid values per field):

{
  "mr_td": ["<sha384-hex>"],
  "rtmr_1": ["<sha384-hex>"],
  "rtmr_2": ["<sha384-hex>"],
  "xfam": ["<hex>"],
  "snp_launch_measurement": ["<sha384-hex>"]
}

Dependencies

Requires trustee-chart PR #30 (change RVPS to consume single JSON blob instead of multi-key secret).

Testing

This PR only adds documentation and tooling. The actual attestation policy enforcement comes in subsequent PRs:

• PR 2B (trustee-chart): firmware ESO + RVPS integration
• PR 2C (trustee-chart): attestation policy hardening
• PR 2D (coco-pattern): baremetal profile wiring

Related

Part of Wave 2 (firmware hardening) from the bare metal attestation hardening roadmap.

Aligns firmware reference value management with established patterns (pcrStash, KBS keys) - eliminates manual Vault interaction.