validatedpatterns · butler54 · Aug 17, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/.github/workflows/superlinter.yml b/.github/workflows/superlinter.yml
@@ -38,6 +38,8 @@ jobs:
           VALIDATE_SHELL_SHFMT: false
           VALIDATE_YAML: false
           VALIDATE_YAML_PRETTIER: false
+          # Exclude vendored upstream charts from linting
+          FILTER_REGEX_EXCLUDE: "charts/vendor/.*"
           # VALIDATE_DOCKERFILE_HADOLINT: false
           # VALIDATE_MARKDOWN: false
           # VALIDATE_NATURAL_LANGUAGE: false

diff --git a/Makefile b/Makefile
@@ -17,7 +17,71 @@ cache-keys: ## Download Red Hat signing keys from official sources to ~/.coco-pa
 	@echo "Done. Verify fingerprints at https://access.redhat.com/security/team/key/"
 
 
+.PHONY: cache-registry-ca
+cache-registry-ca: ## Copy mirror-registry CA cert to ~/.coco-pattern/ for use by load-secrets
+	@mkdir -p ~/.coco-pattern
+	@if [ -f ~/.coco-pattern/quay-ca-cert.pem ]; then \
+		mv ~/.coco-pattern/quay-ca-cert.pem ~/.coco-pattern/mirror-registry-ca-cert.pem; \
+		echo "  Migrated quay-ca-cert.pem -> mirror-registry-ca-cert.pem"; \
+	fi
+	@if [ -f ~/mirror-registry-certs/ca.crt ]; then \
+		cp ~/mirror-registry-certs/ca.crt ~/.coco-pattern/mirror-registry-ca-cert.pem; \
+		echo "  Cached mirror-registry CA at ~/.coco-pattern/mirror-registry-ca-cert.pem"; \
+	else \
+		echo "ERROR: ~/mirror-registry-certs/ca.crt not found."; \
+		echo "  Ensure the mirror registry was initialised and its certs are at ~/mirror-registry-certs/"; \
+		exit 1; \
+	fi
+
+.PHONY: load-bootstrap
+load-bootstrap: ## Load ArgoCD bootstrap secrets (DEL-2) — run after cluster exists but before Vault is up
+	@echo "Loading ArgoCD OCI Helm registry bootstrap secret..."
+	@if ! ./pattern.sh ansible-playbook rhvp.cluster_utils.load_bootstrap_secrets --list-tasks >/dev/null 2>&1; then \
+		echo "ERROR: load_bootstrap_secrets playbook not found in utility container."; \
+		echo "  Bump utility-container tag in imageset-config and re-mirror."; \
+		exit 1; \
+	fi
+	@echo "Pre-creating bootstrap secret target namespaces (avoids race with patterns-operator)..."
+	@python3 -c "\
+import yaml, os, pathlib; \
+pattern = yaml.safe_load(open('values-global.yaml'))['global']['pattern']; \
+search = [pathlib.Path(p) for p in [ \
+  os.environ.get('VALUES_SECRET', ''), \
+  os.path.expanduser(f'~/values-secret-{pattern}.yaml'), \
+  os.path.expanduser('~/values-secret.yaml'), \
+  'values-secret.yaml', \
+] if p]; \
+f = next((p for p in search if p.is_file()), None); \
+data = yaml.safe_load(f.read_text()) if f else {}; \
+[print(ns) for s in data.get('bootstrap_secrets',[]) for ns in s.get('targetNamespaces',[])] \
+" 2>/dev/null | \
+	  sort -u | xargs -I{} sh -c 'oc create namespace {} --dry-run=client -o yaml | oc apply -f - 2>/dev/null; true'
+	./pattern.sh ansible-playbook rhvp.cluster_utils.load_bootstrap_secrets
+
+.PHONY: gen-mirror-helm-secret
+gen-mirror-helm-secret: ## Generate mirror-registry Helm OCI password file from mirror-registry init output
+	@mkdir -p ~/.coco-pattern
+	@echo "Enter the mirror-registry password (from ~/mirror-registry-init.txt or ~/mirror-registry-output/init.json):"
+	@read -r MRPASS; printf '%s' "$$MRPASS" > ~/.coco-pattern/mirror-registry-password; chmod 600 ~/.coco-pattern/mirror-registry-password
+	@echo "  Saved to ~/.coco-pattern/mirror-registry-password"
+
+.PHONY: pck-register
+pck-register: ## Register PCK certificates with Intel PCS (requires INTEL_PCS_API_KEY)
+	@if [ -z "$(INTEL_PCS_API_KEY)" ]; then \
+		echo "ERROR: Set INTEL_PCS_API_KEY environment variable"; \
+		echo "  Usage: make pck-register INTEL_PCS_API_KEY=<key>"; \
+		exit 1; \
+	fi
+	@PCS_TOOL="$(HOME)/confidential-computing.tee.dcap/tools/PcsClientTool/pcsclient.py"; \
+	if [ ! -f "$$PCS_TOOL" ]; then \
+		echo "ERROR: PCS Client Tool not found at $$PCS_TOOL"; \
+		echo "  Clone: git clone https://github.com/intel/confidential-computing.tee.dcap ~/confidential-computing.tee.dcap"; \
+		exit 1; \
+	fi; \
+	cd "$$(dirname $$PCS_TOOL)" && python3 pcsclient.py -t register -k "$(INTEL_PCS_API_KEY)"
+
 ##@ Reference Value Collection
+
 .PHONY: collect-firmware-refvals
 collect-firmware-refvals: ## Collect firmware reference values (bare metal, default)
 	@scripts/collect-firmware-refvals.sh
@@ -26,6 +90,106 @@ collect-firmware-refvals: ## Collect firmware reference values (bare metal, defa
 collect-azure-refvals: ## Collect PCR reference values (Azure)
 	@scripts/collect-firmware-refvals.sh --platform azure
 
+.PHONY: collect-dcap-collateral
+collect-dcap-collateral: ## Collect TDX DCAP collateral from Intel PCS (API key via OS keyring)
+	@scripts/collect-dcap-collateral.sh
+
+.PHONY: dcap-offline-provision
+dcap-offline-provision: ## Full DCAP offline provisioning workflow (collect collateral + load secrets)
+	$(MAKE) collect-dcap-collateral
+	$(MAKE) load-secrets
+
+##@ AMD SEV-SNP VCEK Provisioning
+
+.PHONY: snp-collect-vcek-urls
+snp-collect-vcek-urls: ## Collect VCEK URLs from AMD SNP nodes (requires KUBECONFIG)
+	@scripts/collect-snp-vcek-urls.sh
+
+.PHONY: snp-download-vcek
+snp-download-vcek: ## Download VCEK certs from AMD KDS (requires internet)
+	@scripts/download-snp-vcek.sh
+
+.PHONY: snp-gen-overrides
+snp-gen-overrides: ## Generate SNP VCEK values override from cached certs (local only)
+	@scripts/gen-snp-vcek-overrides.sh
+
+.PHONY: snp-offline-provision
+snp-offline-provision: snp-collect-vcek-urls snp-download-vcek snp-gen-overrides ## Full SNP VCEK offline provisioning
+
+##@ Disconnected Deployment
+MIRROR_REGISTRY ?= quay.example.com:443/mirror
+IMAGESET_CONFIG ?= airgap/imageset-config.yaml
+OC_MIRROR_WORKSPACE ?= file://$(HOME)/oc-mirror-workspace
+
+.PHONY: airgap-mirror
+airgap-mirror: ## Mirror content to disconnected registry (requires MIRROR_REGISTRY)
+	oc-mirror -c $(IMAGESET_CONFIG) \
+		--workspace $(OC_MIRROR_WORKSPACE) \
+		--dest-tls-verify=false \
+		docker://$(MIRROR_REGISTRY) --v2
+
+.PHONY: airgap-post-install
+airgap-post-install: ## Post-install bootstrap (after airgap-mirror + labctl apply-mirror-resources)
+	@scripts/airgap-post-install.sh
+
+.PHONY: airgap-deploy-pattern
+airgap-deploy-pattern: ## Deploy Pattern CR directly (skip pattern.sh, use values-global.yaml config)
+	@scripts/airgap-post-install.sh --deploy-pattern
+
+.PHONY: airgap-fix-manifests
+airgap-fix-manifests: ## Fix oc-mirror manifest list failures with fallback mirroring
+	@scripts/airgap-post-install.sh --fix-manifest-lists
+
+.PHONY: airgap-sync-repos
+airgap-sync-repos: ## Push working copy changes to bare HTTP repos and restart git server
+	@scripts/airgap-post-install.sh --sync-repos-only
+
+ARGOCD_CLI_DIR ?= $(HOME)/.local/bin
+
+.PHONY: argocd-install
+argocd-install: ## Download argocd CLI from the cluster's ArgoCD image into ~/.local/bin
+	@mkdir -p $(ARGOCD_CLI_DIR)
+	@ARGOCD_NS=$$(oc get argocd -A -o jsonpath='{.items[0].metadata.namespace}') || \
+		{ echo "ERROR: No ArgoCD instance found. Is KUBECONFIG set and the pattern deployed?"; exit 1; }; \
+	ARGOCD_IMG=$$(oc get deployment -n $$ARGOCD_NS -l app.kubernetes.io/component=server,app.kubernetes.io/part-of=argocd \
+		-o jsonpath='{.items[0].spec.template.spec.containers[0].image}') || \
+		{ echo "ERROR: Could not find ArgoCD server deployment in $$ARGOCD_NS"; exit 1; }; \
+	echo "Extracting argocd CLI from $$ARGOCD_IMG ..."; \
+	POD_NAME="argocd-cli-extract-$$$$"; \
+	oc run "$$POD_NAME" -n $$ARGOCD_NS --image="$$ARGOCD_IMG" \
+		--restart=Never --command -- sleep 300; \
+	echo "Waiting for extract pod..."; \
+	oc wait --for=condition=Ready pod/"$$POD_NAME" -n $$ARGOCD_NS --timeout=120s; \
+	oc cp "$$ARGOCD_NS/$$POD_NAME:/usr/local/bin/argocd" "$(ARGOCD_CLI_DIR)/argocd"; \
+	chmod +x "$(ARGOCD_CLI_DIR)/argocd"; \
+	oc delete pod "$$POD_NAME" -n $$ARGOCD_NS --force --grace-period=0 2>/dev/null; \
+	echo "Installed: $(ARGOCD_CLI_DIR)/argocd"; \
+	$(ARGOCD_CLI_DIR)/argocd version --client | head -1
+
+.PHONY: argocd-login
+argocd-login: ## Extract ArgoCD credentials from cluster and log in with argocd CLI
+	@ARGOCD_NS=$$(oc get argocd -A -o jsonpath='{.items[0].metadata.namespace}' 2>/dev/null) && \
+	ARGOCD_NAME=$$(oc get argocd -n $$ARGOCD_NS -o jsonpath='{.items[0].metadata.name}' 2>/dev/null) && \
+	ARGOCD_ROUTE=$$(oc get route $${ARGOCD_NAME}-server -n $$ARGOCD_NS -o jsonpath='{.spec.host}' 2>/dev/null) && \
+	ARGOCD_PASS=$$(oc get secret $${ARGOCD_NAME}-cluster -n $$ARGOCD_NS -o jsonpath='{.data.admin\.password}' 2>/dev/null | base64 -d) && \
+	echo "ArgoCD URL:  https://$$ARGOCD_ROUTE" && \
+	echo "Username:    admin" && \
+	echo "Password:    $$ARGOCD_PASS" && \
+	echo "" && \
+	if command -v argocd >/dev/null 2>&1; then \
+		oc config set-context --current --namespace=$$ARGOCD_NS && \
+		argocd login --core && \
+		echo "" && \
+		echo "Logged in (core mode, namespace $$ARGOCD_NS)." && \
+		echo "Usage: argocd app list"; \
+	else \
+		echo "argocd CLI not installed. To install:" && \
+		echo "  curl -sSL -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64" && \
+		echo "  chmod +x /usr/local/bin/argocd" && \
+		echo "" && \
+		echo "Or use the web UI at: https://$$ARGOCD_ROUTE"; \
+	fi
+
 ##@ Hardware Detection
 .PHONY: detect-hardware
 detect-hardware: ## Detect hardware profile from cluster nodes (requires KUBECONFIG or oc login)
@@ -59,3 +223,16 @@ detect-hardware: ## Detect hardware profile from cluster nodes (requires KUBECON
 	fi && \
 	echo "" && \
 	echo "To apply: edit values-global.yaml and set global.hardware.profile to the recommended value."
+
+##@ Chart Management
+KYVERNO_VERSION ?= 3.7.2
+KYVERNO_REPO ?= https://kyverno.github.io/kyverno/
+
+.PHONY: update-kyverno-chart
+update-kyverno-chart: ## Pull and embed upstream Kyverno Helm chart (requires internet)
+	@echo "Pulling kyverno chart v$(KYVERNO_VERSION)..."
+	@rm -rf charts/vendor/kyverno
+	@helm pull kyverno --repo $(KYVERNO_REPO) --version $(KYVERNO_VERSION) --untar -d charts/vendor/
+	@find charts/vendor/kyverno -name "README.md" -o -name "README.md.gotmpl" | xargs rm -f
+	@echo "Embedded charts/vendor/kyverno (v$(KYVERNO_VERSION))"
+	@echo "Next: commit, push, and sync ArgoCD"
diff --git a/README.md b/README.md
@@ -26,40 +26,59 @@ The topology is controlled by the `main.clusterGroupName` field in `values-globa
 
 Azure deployments use peer-pods, which provision confidential VMs (`Standard_DCas_v5` family) directly on the Azure hypervisor. Bare metal deployments use layered images and hardware TEE features directly.
 
-## Current version (5.*)
+## Current version (8.*)
 
-Breaking change from v4. Uses GA releases of the CoCo stack with Kyverno-based initdata injection.
+Breaking change from v5. Upgrades to OSC 1.13 / Trustee 1.2, adds full airgap (disconnected) deployment support, and introduces experimental KubeVirt TDX VM workloads.
 
-- **5.0** — Kyverno-based `cc_init_data` injection (replaces MutatingAdmissionPolicy), OSC 1.12 / Trustee 1.1 GA, external chart repositories, self-signed certificates via cert-manager, multi-cluster support via ACM. Requires OCP 4.19.28+.
-- **5.1** — Bare metal support for Intel TDX and AMD SEV-SNP via NFD auto-detection. Currently tested on SNO (Single Node OpenShift) configurations only.
-- **5.2** — NVIDIA H100 confidential GPU support for bare metal (`baremetal-gpu` clusterGroup). Adds GPU Operator, IOMMU configuration, CC Manager, and sample CUDA workload.
-- **5.3** — DRY refactor of trustee and kyverno overrides, Kyverno CRD label fix, pattern infrastructure update.
-- **5.4** — Firmware reference values workflow for bare metal attestation via veritas. Adds `collect-firmware-refvals.sh`, RVPS integration, and hardened attestation policy (trustee-chart v0.5.0).
-- **5.5** — Trustee-chart v0.7.0 (td_attributes.debug path fix). Unified reference value collection for Azure and bare metal via veritas container.
-- **5.6** — Documentation update, sandboxed-policies v0.2.0 (Azure-conditional peer-pods).
+- **8.0** — OSC 1.13 / Trustee 1.2 upgrade. KBS TOML rewrite, RVPS format alignment, operator CSV pins, trustee-chart v0.10.0. Airgap deployment support: single mirror-registry architecture, `oc-mirror` v2, `airgap-post-install.sh` bootstrap, `DEPLOY-RUNBOOK.md` operational guide. Requires OCP 4.22+.
+
+**Key changes from v5:**
+- **Operator upgrade:** OSC 1.12 → 1.13, Trustee 1.1 → 1.2. Breaking API changes in KBS configuration and RVPS reference value format.
+- **Airgap support:** Full disconnected deployment on bare metal via a single mirror-registry. Includes `oc-mirror` imageset configs, `airgap-post-install.sh` for bootstrap (CatalogSources, IDMS/ITMS, NeverContactSource policy normalisation, ArgoCD CA injection, git HTTP server), and a step-by-step operational runbook at `airgap/DEPLOY-RUNBOOK.md`.
+- **Chart architecture:** trustee-chart moved to OCI Helm artifact (`quay.io/validatedpatterns/trustee:0.10.0`). Kyverno chart vendored under `charts/vendor/`. External charts (sandboxed-containers, sandboxed-policies) remain OCI.
+- **TDX MachineConfig:** QGS socket port `socket_port=0` now deployed via MachineConfig drop-in (replaces manual `sed` workaround).
+- **DCAP collateral:** `collect-dcap-collateral.sh` uses `pcsclient.py fetch -p E5` with `jq` fixup for QeIdentity (Red Hat OSC 1.13 disconnected TDX procedure).
+- **Experimental:** KubeVirt TDX confidential VMs (`charts/all/kubevirtconfidential/`, `charts/all/kubevirtvm/`). Disabled by default. Requires Intel TDX hardware and KubeVirt post-v1.8.4 for full QGS attestation. See chart READMEs for details.
 
 ### Previous versions
 
 | Version | Trustee | OSC | Min OCP | Notes |
 |---------|---------|-----|---------|-------|
+| **5.*** | 1.1 (GA) | 1.12 | 4.19.28+ | Kyverno initdata injection, multi-cluster, bare metal, GPU |
 | **4.*** | 1.1 (GA) | 1.12 | 4.19.28+ | First GA release; MutatingAdmissionPolicy-based initdata |
 | **3.*** | 0.4.* (Tech Preview) | 1.10.* | 4.16+ | |
 | **2.*** | 0.3.* (Tech Preview) | 1.9.* | 4.16+ | |
 | **1.0.0** | 0.2.0 (Tech Preview) | 1.8.1 | 4.16+ | |
 
+### Airgap (disconnected) deployment
+
+For air-gapped bare metal environments, see [`airgap/DEPLOY-RUNBOOK.md`](airgap/DEPLOY-RUNBOOK.md) for the full operational procedure. The runbook covers:
+- Phase 0: One-time jump host setup (mirror registry, git HTTP server, CA certificates)
+- Phase A–B: Mirror wipe and `oc-mirror` v2 re-mirror
+- Phase C: Agent-based OCP install
+- Phase D: Pattern bootstrap (`airgap-post-install.sh`)
+- Phase E: Intel DCAP collateral and TDX attestation
+- Phase F: Verification and pass/fail checklist
+
+**Prerequisites for airgap:**
+- A jump host with internet access (for `oc-mirror`) and network access to the target cluster
+- `docker.io/library/registry:2` container running as the mirror registry (setup documented in Phase 0)
+- `scripts/git-http-server.py` serving pattern repos over smart HTTP (required by the patterns-operator's go-git client)
+- All operator images, OCI Helm charts, and workload images mirrored via `airgap/imageset-config-4.22.yaml`
+
 ## Setup
 
 ### Prerequisites
 
 **Azure deployments:**
 
-- OpenShift 4.19.28+ cluster on Azure (self-managed via `openshift-install` or ARO)
+- OpenShift 4.22+ cluster on Azure (self-managed via `openshift-install` or ARO)
 - Azure `Standard_DCas_v5` VM quota in your target region (these are confidential computing VMs and are not available in all regions). See the note below for more details.
 - Azure DNS hosting the cluster's DNS zone
 
 **Bare metal deployments:**
 
-- OpenShift 4.19.28+ cluster on bare metal with Intel TDX or AMD SEV-SNP hardware
+- OpenShift 4.22+ cluster on bare metal with Intel TDX or AMD SEV-SNP hardware
 - BIOS/firmware configured to enable TDX or SEV-SNP
 - Available block devices for LVMS storage (auto-discovered)
 - For Intel TDX: an Intel PCS API key from [api.portal.trustedservices.intel.com](https://api.portal.trustedservices.intel.com/)
@@ -74,12 +93,12 @@ Breaking change from v4. Uses GA releases of the CoCo stack with Kyverno-based i
 
 These scripts generate the cryptographic material and attestation reference values needed by Trustee. Run them once before your first deployment.
 
-1. `bash scripts/gen-secrets.sh` — generates KBS key pairs, PCCS certificates/tokens (for bare metal), and copies `values-secret.yaml.template` to `~/values-secret-coco-pattern.yaml`
+1. `bash scripts/gen-secrets.sh` — generates KBS key pairs, sealed-secrets signing keys, and copies `values-secret.yaml.template` to `~/values-secret-coco-pattern.yaml`
 2. Collect attestation reference values (requires `podman`, `yq`, `jq`, and `~/pull-secret.json`):
    - **Azure:** `make collect-azure-refvals` — pulls PCR measurements from the dm-verity image via veritas. Saves to `~/.coco-pattern/measurements.json`.
    - **Bare metal:** `make collect-firmware-refvals` — computes firmware measurements from OCP release artifacts via veritas. Saves to `~/.coco-pattern/firmware-reference-values.json`. For bare metal, also uncomment the `firmwareReferenceValues` section in `~/values-secret-coco-pattern.yaml`.
    - See [docs/firmware-reference-values.md](docs/firmware-reference-values.md) for detailed workflow and options.
-3. Review and customise `~/values-secret-coco-pattern.yaml` — this file is loaded into Vault and provides secrets to the pattern. For bare metal, uncomment the PCCS secrets section and provide your Intel PCS API key.
+3. Review and customise `~/values-secret-coco-pattern.yaml` — this file is loaded into Vault and provides secrets to the pattern.
 
 > **Note:** `gen-secrets.sh` will not overwrite existing secrets. Delete `~/.coco-pattern/` if you need to regenerate.
 
@@ -95,7 +114,7 @@ These scripts generate the cryptographic material and attestation reference valu
 1. Set `main.clusterGroupName: trusted-hub` in `values-global.yaml`
 2. Deploy the hub cluster: `./pattern.sh make install`
 3. Wait for ACM (`MultiClusterHub`) to reach `Running` state on the hub
-4. Provision a second OpenShift 4.19.28+ cluster on Azure for the spoke
+4. Provision a second OpenShift 4.22+ cluster on Azure for the spoke
 5. Import the spoke into ACM with label `clusterGroup=azure-spoke`
    (see [importing a cluster](https://validatedpatterns.io/learn/importing-a-cluster/))
 6. ACM will automatically deploy the `azure-spoke` clusterGroup applications (sandboxed containers, workloads) to the imported cluster
@@ -107,8 +126,7 @@ These scripts generate the cryptographic material and attestation reference valu
    - Run `make detect-hardware` after NFD is deployed to detect your hardware profile automatically
    - Options: `intel-tdx`, `amd-snp`, `intel-tdx-gpu`, `amd-snp-gpu`
 3. Run `bash scripts/gen-secrets.sh` to generate KBS keys and PCCS secrets
-4. For Intel TDX: uncomment the PCCS secrets in `~/values-secret-coco-pattern.yaml` and provide your Intel PCS API key
-5. `./pattern.sh make install`
+4. `./pattern.sh make install`
 6. Wait for the cluster to reboot nodes (MachineConfig updates for TDX/SEV-SNP kernel parameters and vsock)
 
 > **Note:** Bare metal support is currently tested on SNO (Single Node OpenShift) configurations. Multi-node bare metal clusters are expected to work but have not been validated yet.
@@ -120,9 +138,7 @@ The system auto-detects your hardware:
 - **RuntimeClass** `kata-cc` is created automatically pointing to the correct handler (`kata-tdx` or `kata-snp`)
 - Both `kata-tdx` and `kata-snp` RuntimeClasses are deployed; only the one matching your hardware has schedulable nodes
 - MachineConfigs are deployed for both `master` and `worker` roles (safe on SNO where only master exists)
-- PCCS and QGS services deploy unconditionally; DaemonSets only schedule on Intel nodes via NFD labels
-
-Optional: pin PCCS to a specific node with `bash scripts/get-pccs-node.sh` and set `baremetal.pccs.nodeSelector` in the baremetal chart values.
+- DCAP QGS (Quote Generation Service) deploys on Intel nodes via NFD labels; offline collateral mode (no PCCS server required)
 
 For GPU-enabled deployments (`intel-tdx-gpu` or `amd-snp-gpu` profiles):