-
Bug
-
Resolution: Unresolved
-
Medium
-
None
-
None
-
None
2.5.2. Creating the NodeFeatureRule custom resource
Two NodeFeatureRules should be applied - one from 1. and second from Intel TDX.
Proposal:
a) Separate them:
- Name my-nodefeaturerule.yaml for runtime-kata label
- Name tdx-nodefeaturerule.yaml for intel TDX label
- Name sev-nodefeaturerule.yaml for AMD SEV label
b) Combine them to single nodeFeatureRule to always try set all of them
2.5.2 misleading/wrong. There is some "base set" of NodeFeatureRules and then TEE-addons. If only TEE Rules are added, runtime handler creation is incomplete and TDX pods fail.
Also, "namespace" can be dropped from NodeFeatureRules CRs since they are cluster scope resources.
Task scope:
- Consolidate 3 existing yaml files (osc-rules, tdx, and snp) into a single yaml file. This will support all setups, including a future use case (SNP and TDX nodes in same cluster).
- Remove "namespace: openshift-nfd". Not required. See NFR example in OCP docs.
- Change "feature.node.kubernetes.io/sgx": "true" to "intel.feature.node.kubernetes.io/sgx": "true"
This change is critical as without it instruction won't work