In the document "Creating and managing images", section "2.3. Creating an image for UEFI Secure Boot" [0] we have the following comment:

When the overcloud contains UEFI Secure Boot Compute nodes, you can create a Secure Boot instance image that cloud users can use to launch Secure Boot instances.

 
This suggests that the overcloud node itself needs to boot into secure boot before it can provide this feature to the guest VMs, which is not correct. Requirements for the VMs are the machine type and the image properties, both documented in the same section.

Possibly clarification is also required in regards to the compute node OS version that is supported.

 [0] https://docs.redhat.com/en/documentation/red_hat_openstack_platform/17.1/html/creating_and_managing_images/assembly_glance-creating-images_osp#proc_create-an-image-for-uefi-secure-boot_glance-creating-images