<commit_before># Deploy BigDL-PCCS-eHSM-KMS on Kubernetes with Helm Charts


![bigdl-pccs-ehsm-kms-architecture2 0](https://user-images.githubusercontent.com/60865256/174554804-4c0b361b-413b-48f9-bddc-dc2d1ad5b81e.png)


**pccs** provides SGX attestation support service.

**dkeyserver** generates domain keys inside enclave.

**dkeycache** caches keys and thus increases key hit ratio. It communicates with dkeyserver based on pccs.

**couchdb** stores run-time data (like enroll info), the persistent is based on Kubernetes PV and NFS. 

**bigdl-pccs-ehsm-kms-deployment** is the direct key service provider.


## Prerequests

- Please make sure you have a workable **Kubernetes cluster/machine**.
- Please make sure your **CPU** is able to run PCCS service, which generate and verify quotes.
- Please make sure you have a reachable **NFS**.
- Please make sure you have already installed **helm**.
- Please make sure you have an usable PCCS ApiKey for your platform. The PCCS uses this API key to request collaterals from Intel's Provisioning Certificate Service. User needs to subscribe first to obtain an API key. For how to subscribe to Intel Provisioning Certificate Service and receive an API key, goto https://api.portal.trustedservices.intel.com/provisioning-certification and click on 'Subscribe'.

## 1. Pull/Build the PCCS Image

We encapsulate host PCCS service into a docker image, which enables a user-friendly container-service.

Download image as below:

```bash
docker pull intelanalytics/pccs:0.3.0 # 0.3.0 is the latest version when writting (to do)
```

Or you are allowed to build the image manually:

```bash
cd ../pccs
# configure build parameters in build-docker-image.sh
bash build-docker-image.sh
cd ../kubernetes
```

Now you have already had a PCCS image.


## 2. Start BigDL-PCCS-eHSM-KMS on Kubernetes 

Please make sure current workdir is `kubernetes`.
<commit_msg>[PPML] Update PCCS image tag in ehsm-kms doc<commit_after># Deploy BigDL-PCCS-eHSM-KMS on Kubernetes with Helm Charts


![bigdl-pccs-ehsm-kms-architecture2 0](https://user-images.githubusercontent.com/60865256/174554804-4c0b361b-413b-48f9-bddc-dc2d1ad5b81e.png)


**pccs** provides SGX attestation support service.

**dkeyserver** generates domain keys inside enclave.

**dkeycache** caches keys and thus increases key hit ratio. It communicates with dkeyserver based on pccs.

**couchdb** stores run-time data (like enroll info), the persistent is based on Kubernetes PV and NFS. 

**bigdl-pccs-ehsm-kms-deployment** is the direct key service provider.


## Prerequests

- Please make sure you have a workable **Kubernetes cluster/machine**.
- Please make sure your **CPU** is able to run PCCS service, which generate and verify quotes.
- Please make sure you have a reachable **NFS**.
- Please make sure you have already installed **helm**.
- Please make sure you have an usable PCCS ApiKey for your platform. The PCCS uses this API key to request collaterals from Intel's Provisioning Certificate Service. User needs to subscribe first to obtain an API key. For how to subscribe to Intel Provisioning Certificate Service and receive an API key, goto https://api.portal.trustedservices.intel.com/provisioning-certification and click on 'Subscribe'.

## 1. Pull/Build the PCCS Image

We encapsulate host PCCS service into a docker image, which enables a user-friendly container-service.

Download image as below:

```bash
docker pull intelanalytics/pccs:0.3.0-SNAPSHOT
```

Or you are allowed to build the image manually:

```bash
cd ../pccs
# configure build parameters in build-docker-image.sh
bash build-docker-image.sh
cd ../kubernetes
```

Now you have already had a PCCS image.


## 2. Start BigDL-PCCS-eHSM-KMS on Kubernetes 

Please make sure current workdir is `kubernetes`.

{'fraction_non_alphanumeric': 0.08646218931782126, 'fraction_numerical': 0.021946060285563194, 'mean_word_length': 4.388888888888889, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6097694', 'n_tokens_mistral': 1255, 'n_tokens_neox': 1138, 'n_words': 470}