Help Center/ Cloud Container Engine/ User Guide/ Nodes/ Accepting Secure Boot-Enabled ECSs
Updated on 2026-06-16 GMT+08:00
View PDF
Share

Accepting Secure Boot-Enabled ECSs

CCE clusters can accept ECSs with Unified Extensible Firmware Interface (UEFI) Secure Boot enabled, ensuring boot integrity from hardware to the OS and establishing a hardware-rooted trust foundation. During node startup, Secure Boot verifies the cryptographic signatures of the firmware, bootloader, kernel, and drivers sequentially, in accordance with UEFI specifications. Only authenticated components are permitted to load and execute, effectively mitigating threats such as boot chain tampering, malicious code injection, and rootkit attacks. Building on this, CCE extends the trust chain from hardware to containers, integrating underlying trust capabilities with the container runtime and supporting remote attestation. This achieves end-to-end trustworthiness and full-link controllability.

Leveraging the Huawei Cloud QingTian trusted computing architecture and Secure Boot capabilities, CCE implements a layered trust transfer mechanism: hardware firmware > UEFI Secure Boot > OS kernel > container runtime > service containers. Each layer is loaded only after verification by the preceding trusted layer, ensuring the entire chain remains tamper-proof and non-bypassable. Additionally, remote attestation enables external systems to verify the trustworthiness of CCE nodes and clusters, confirming that the runtime environment has not been compromised and remains in a trusted, compliant state. This satisfies regulatory audit requirements, including DJCP Level 3 and cryptographic compliance assessments.

What Is Secure Boot?

Secure Boot verifies the integrity of each boot component, including the bootloader, OS kernel, and kernel drivers, before it is loaded during device startup. This prevents security threats to the system and user data that could result from loading or executing unauthenticated components.

Secure Boot is a UEFI feature that requires all low-level firmware and software components to be cryptographically signed and validated before execution. During startup, UEFI Secure Boot checks the signature of each piece of boot software, including UEFI firmware drivers (also known as option ROMs), EFI applications, OS bootloaders, and associated binary files. If the signature is valid and trusted by the original equipment manufacturer (OEM), the boot process continues and control is handed over to the OS.

Secure Boot relies on key pairs to sign and verify boot components, ensuring that ECSs boot only software signed by trusted encryption keys. This protects the boot chain against threats during the boot process. The Secure Boot keys are stored in the UEFI non-volatile variable storage key database.

  • When Secure Boot is enabled, the system verifies component integrity during startup. This verification process does not affect running services.
  • When Secure Boot is disabled, the system skips component integrity verification during startup. This does not affect running services.

Prerequisites

  • A private image that supports Secure Boot and an ECS with Secure Boot enabled are available. For details, see Configuring Secure Boot for an ECS.
  • A cluster is available, whose VPC subnet matches that of the created ECS.

Procedure

  1. Log in to the CCE console and go to the cluster where the node to be accepted resides.
  2. In the navigation pane, choose Nodes. On the displayed page, click the Nodes tab and then Accept Node in the upper right corner.
  3. Click Select Cloud Server and choose the target ECS.

  4. Select Private image for OS. Then, choose the private image that supports Secure Boot.

  5. Configure other parameters as needed. After the node is accepted, log in to it and run the following command: 

    mokutil --sb-state

    View the command output:

    • If UEFI Secure Boot is enabled, the output contains SecureBoot enabled.
    • If UEFI Secure Boot is disabled or cannot be read, the output contains SecureBoot disabled or Failed to read SecureBoot.

Helpful Links

Parent Topic: Nodes