Secured software workload provisioning to a trusted execution environment

A system comprising:

• a memory;
• and
• a processing device operatively coupled to the memory, wherein the processing device is further to:
• perform, at a host computer system of a computing environment, a provisioning process of a software trusted client agent (TCA) to the host computer system;
• determine a set of signing certificates associated with one or more trusted signing parties for validating signing certificates of workloads being deployed to a trusted execution environment (TEE) of the computing environment;
• and
• associate the set of certificates with the TCA.

A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a processing device, cause the processing device to:

• receive, at a software trusted client agent (TCA) residing in a host computer system of a computing environment, a software provisioning command from an orchestration system of the computing environment, wherein the software provisioning command identifies a workload to be provisioned to a trusted execution environment (TEE) of the computing environment;
• determine a validation measure associated with the workload;
• and
• responsive to determining that the validation measure satisfies a predetermined condition, perform the software provisioning operation to deploy the workload at the TEE.