Skip to main content

Deploying on Oracle Cloud

Oracle Cloud runs Polaris on AMD SEV-SNP confidential VMs. Read Deploying Polaris first for the choices common to every cloud; this page covers what is specific to OCI.

Before you start​

You deploy into your own OCI tenancy and compartment. You provide the tenancy and compartment identifiers and the region. Pick a region that offers the AMD EPYC confidential-VM shapes.

TEE options​

ChoiceHardwareShape
AMD SEV-SNPAMD EPYC TurinVM.Standard.E6.Flex / BM.Standard.E6.256

Intel TDX and confidential GPUs are not available on OCI. If you need those, see the Google Cloud or Microsoft Azure pages.

Verification path​

Polaris verifies the AMD SEV-SNP report against AMD's published keys, so no cloud attestation service sits in the trust path. On top of that platform check you get the full continuous-attestation model: image integrity, runtime behavior, and kernel integrity, all gating key access.

Key management​

The Policy Manager gates a key in OCI Vault. The vault and key are created in your compartment and named unless you set your own names.

The gate is a defined tag on each workload VM. While appraisal passes, the Policy Manager sets Polaris.AttestationState to active on the VM. That puts the VM in a dynamic group whose policy allows encrypt and decrypt on the key, and nothing else: no export, no sign. When appraisal fails, the Policy Manager removes the tag.

The Policy Manager can only tag VMs that carry Polaris.Role = workload-cvm, so it cannot put itself or any other instance in the group.

Revocation is not instant. OCI reads group membership from the tags inside a VM's instance principal token, and that token lives 20 minutes. A VM that fetches a new token for each call loses the key within about 30 seconds of the revoke. A process that holds on to a token issued while the VM was active keeps the key until the token expires, so plan for up to 20 minutes.

Network shape​

The Oracle module puts the workload VMs in a private subnet behind a public network load balancer that passes TCP through on 443, and the Policy Manager in a separate control subnet. Two options are worth calling out at setup:

  • A public endpoint for the Policy Manager. Optional, so you can reach the management API directly instead of going through the proxy passthrough. You name the allowed source ranges; an open 0.0.0.0/0 is rejected.
  • A bastion for SSH. Optional access into the private subnets through the OCI Bastion service, again scoped to ranges you name.

Sizing​

You set the shape for the workload VMs and for the Policy Manager, and how many workload VMs to run behind the load balancer.

How you deploy​

  • Command line. Point the deploy script at an Oracle config file with your tenancy, compartment, and region.
  • OCI Marketplace. Deploy from the listing as a Resource Manager stack. The marketplace image bakes in the Polaris components, so nothing but your own workload image is pulled at launch, and the stack generates the Policy Manager's management token for you.

Notes​

  • The load balancer terminates nothing: it passes encrypted TCP straight to the proxy on the confidential VM, so TLS is still terminated inside the TEE.
  • Tearing down the deployment removes the VMs, the load balancer, the network, and the vault resources it created.