Uploaded image for project: 'Openshift sandboxed containers'
  1. Openshift sandboxed containers
  2. KATA-4518

NodeFeatureRules documentation

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Medium Medium
    • None
    • None
    • Documentation
    • None
    • 3
    • 0

      2.5.2. Creating the NodeFeatureRule custom resource

      Two NodeFeatureRules should be applied - one from 1. and second from Intel TDX.

      Proposal:

      a) Separate them:

      • Name my-nodefeaturerule.yaml for runtime-kata label
      • Name tdx-nodefeaturerule.yaml for intel TDX label
      • Name sev-nodefeaturerule.yaml for AMD SEV label

      b) Combine them to single nodeFeatureRule to always try set all of them


      2.5.2 misleading/wrong. There is some "base set" of NodeFeatureRules and then TEE-addons. If only TEE Rules are added, runtime handler creation is incomplete and TDX pods fail.

      Also, "namespace" can be dropped from NodeFeatureRules CRs since they are cluster scope resources. 

      Slack thread

      Task scope:

      • Consolidate 3 existing yaml files (osc-rules, tdx, and snp)  into a single yaml file. This will support all setups, including a future use case (SNP and TDX nodes in same cluster).
      • Remove "namespace: openshift-nfd". Not required. See NFR example in OCP docs.
      • Change "feature.node.kubernetes.io/sgx": "true" to "intel.feature.node.kubernetes.io/sgx": "true"
        This change is critical as without it instruction won't work

              gnecasov@redhat.com Gabriela Necasova
              rh-ee-mylinen Mikko Ylinen
              Greg Kurz, Pawel Proskurnicki
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: