feat: baremetal multi-cluster with mixed TEE and HCP support - #108
Open
butler54 wants to merge 3 commits into
Open
feat: baremetal multi-cluster with mixed TEE and HCP support#108butler54 wants to merge 3 commits into
butler54 wants to merge 3 commits into
Conversation
HCP (Hosted Control Planes) worker nodes don't run the Machine Config Daemon. OSC 1.13 auto-detects HCP and uses DaemonSet deployment mode (Tech Preview), so KataConfig works unchanged. But the pattern's own MachineConfig resources must be skipped on HCP clusters. - Add global.cluster.hcp: false to values-global.yaml - Gate vsock-mco.yaml (TDX kernel args) with HCP check - Gate selinux-mco.yaml (KubeVirt QGS policy) with HCP check - Document new baremetal-hub and baremetal-spoke topologies For multi-cluster: hub keeps hcp: false, spoke overridden to true via managedClusterGroups.helmOverrides. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New topology file for bare metal hub clusters that manage spoke clusters via ACM. Trustee is configured for both Intel TDX and AMD SEV-SNP attestation simultaneously — verifiers, collateral, and VCEK certs coexist in the KBS configuration. Based on values-baremetal.yaml (infrastructure) + values-trusted-hub.yaml (managedClusterGroups). Includes full airgap support, CVM charts (commented out), and workload image override patterns. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
values-baremetal-spoke.yaml: Spoke topology for baremetal multi-cluster. No Trustee/Vault/ACM (managed by hub). Has sandboxed-containers, baremetal chart (NFD, MachineConfigs), workloads, Kyverno policies. Supports HCP via global.cluster.hcp toggle (MCO templates skipped). overrides/values-hw-hub-mixed.yaml: Hardware profile for hub clusters that attest both Intel TDX and AMD SEV-SNP simultaneously. Enables both kbs.tdx and kbs.snp in trustee. Intel DCAP stays enabled for the hub's own TDX platform. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds baremetal multi-cluster topology support with mixed Intel TDX + AMD SEV-SNP attestation and Hosted Control Planes (HCP) compatibility.
New topologies
baremetal-hub— Hub cluster running Trustee configured for both TDX and SNP attestation simultaneously, ACM managing spoke clusters, full baremetal infrastructure (NFD, Intel DCAP, Kyverno, storage, CVM charts)baremetal-spoke— Spoke cluster with sandboxed containers, baremetal chart, workloads. No Trustee/Vault/ACM (managed by hub). Supports HCP deployment modeHCP support
global.cluster.hcp: falsetoggle in values-global.yaml{{- if not .Values.global.cluster.hcp }}hcp: false, spoke overridden totrueviamanagedClusterGroups.helmOverridesMixed TEE attestation
hub-mixedhardware profile enables bothkbs.tdx.enabledandkbs.snp.enabledoverrides/values-snp-vcek.yaml)Non-destructive
baremetal,azure,azure-spoke,trusted-hubtopologies unchangedglobal.cluster.hcp: falsedefault — existing deployments unaffectedTest plan
baremetaltopology unaffected (JSON schema, helm template)global.cluster.hcp: falserenders MachineConfigs normallyglobal.cluster.hcp: trueskips MachineConfigs🤖 Generated with Claude Code