From 33c80d0c764e4335b64bddbae2ed2b25c1969b31 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 21 Aug 2026 00:39:58 +0000 Subject: [PATCH 1/3] feat: add global.cluster.hcp toggle and gate MachineConfig templates HCP (Hosted Control Planes) worker nodes don't run the Machine Config Daemon. OSC 1.13 auto-detects HCP and uses DaemonSet deployment mode (Tech Preview), so KataConfig works unchanged. But the pattern's own MachineConfig resources must be skipped on HCP clusters. - Add global.cluster.hcp: false to values-global.yaml - Gate vsock-mco.yaml (TDX kernel args) with HCP check - Gate selinux-mco.yaml (KubeVirt QGS policy) with HCP check - Document new baremetal-hub and baremetal-spoke topologies For multi-cluster: hub keeps hcp: false, spoke overridden to true via managedClusterGroups.helmOverrides. Co-Authored-By: Claude Opus 4.6 (1M context) --- charts/all/baremetal/templates/vsock-mco.yaml | 2 ++ charts/all/baremetal/values.yaml | 4 ++++ .../templates/selinux-mco.yaml | 2 +- values-global.yaml | 18 +++++++++++++----- 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/charts/all/baremetal/templates/vsock-mco.yaml b/charts/all/baremetal/templates/vsock-mco.yaml index ec599324..2bb87a63 100644 --- a/charts/all/baremetal/templates/vsock-mco.yaml +++ b/charts/all/baremetal/templates/vsock-mco.yaml @@ -1,3 +1,4 @@ +{{- if not .Values.global.cluster.hcp }} {{- range list "master" "worker" }} {{- if $.Values.tdx.enabled }} --- @@ -23,3 +24,4 @@ spec: source: data:text/plain;charset=utf-8;base64,W2h5cGVydmlzb3IucWVtdV0KdGR4X3F1b3RlX2dlbmVyYXRpb25fc2VydmljZV9zb2NrZXRfcG9ydD0wCg== {{- end }} {{- end }} +{{- end }} diff --git a/charts/all/baremetal/values.yaml b/charts/all/baremetal/values.yaml index 3942cb97..9fcb2efb 100644 --- a/charts/all/baremetal/values.yaml +++ b/charts/all/baremetal/values.yaml @@ -1,2 +1,6 @@ +global: + cluster: + hcp: false + tdx: enabled: true diff --git a/charts/all/kubevirtconfidential/templates/selinux-mco.yaml b/charts/all/kubevirtconfidential/templates/selinux-mco.yaml index d57e5739..6c630ced 100644 --- a/charts/all/kubevirtconfidential/templates/selinux-mco.yaml +++ b/charts/all/kubevirtconfidential/templates/selinux-mco.yaml @@ -1,4 +1,4 @@ -{{- if .Values.global.kubevirt.confidential.enabled }} +{{- if and .Values.global.kubevirt.confidential.enabled (not .Values.global.cluster.hcp) }} {{- range list "master" "worker" }} --- apiVersion: machineconfiguration.openshift.io/v1 diff --git a/values-global.yaml b/values-global.yaml index f9943739..4e1ae1e2 100644 --- a/values-global.yaml +++ b/values-global.yaml @@ -29,13 +29,21 @@ global: defaultVMFlavour: "Standard_DC2as_v5" VMFlavours: "Standard_DC2as_v5,Standard_DC4as_v5,Standard_DC8as_v5,Standard_DC16as_v5" hardware: - profile: intel-tdx # Options: intel-tdx, amd-snp, intel-tdx-gpu, amd-snp-gpu + profile: intel-tdx # Options: intel-tdx, amd-snp, intel-tdx-gpu, amd-snp-gpu, hub-mixed + cluster: + # Hosted Control Planes (HCP) mode. When true, MachineConfig resources are skipped + # (no Machine Config Daemon on HCP workers). The sandboxed-containers operator + # auto-detects HCP and uses DaemonSet deployment mode (Tech Preview in OSC 1.13). + # For multi-cluster: set false on hub, override to true for HCP spokes via helmOverrides. + hcp: false main: # Set clusterGroupName to match your deployment topology: - # azure — Azure single-cluster (all components in one cluster) - # azure-spoke — Azure spoke (multi-cluster, imported into ACM from trusted-hub) - # baremetal — Bare metal (Intel TDX / AMD SEV-SNP, hardware profile gated) - # trusted-hub — Hub for multi-cluster (Trustee + ACM, manages spoke clusters) + # azure — Azure single-cluster (all components in one cluster) + # azure-spoke — Azure spoke (multi-cluster, imported into ACM from trusted-hub) + # baremetal — Bare metal single-cluster (Intel TDX / AMD SEV-SNP, hardware profile gated) + # baremetal-hub — Bare metal hub (Trustee + ACM, mixed TDX/SNP, manages baremetal spokes) + # baremetal-spoke — Bare metal spoke (imported into ACM from baremetal-hub) + # trusted-hub — Hub for multi-cluster Azure (Trustee + ACM, manages azure-spoke clusters) clusterGroupName: azure git: # Connected mode: repoURL is inferred from your local git remote. From f4b4874b0d4db139c7cb0462a946203bb1baed64 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 21 Aug 2026 00:41:21 +0000 Subject: [PATCH 2/3] feat: add baremetal-hub topology for multi-cluster with mixed TDX+SNP MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New topology file for bare metal hub clusters that manage spoke clusters via ACM. Trustee is configured for both Intel TDX and AMD SEV-SNP attestation simultaneously — verifiers, collateral, and VCEK certs coexist in the KBS configuration. Based on values-baremetal.yaml (infrastructure) + values-trusted-hub.yaml (managedClusterGroups). Includes full airgap support, CVM charts (commented out), and workload image override patterns. Co-Authored-By: Claude Opus 4.6 (1M context) --- values-baremetal-hub.yaml | 411 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 411 insertions(+) create mode 100644 values-baremetal-hub.yaml diff --git a/values-baremetal-hub.yaml b/values-baremetal-hub.yaml new file mode 100644 index 00000000..da603fb8 --- /dev/null +++ b/values-baremetal-hub.yaml @@ -0,0 +1,411 @@ +# Bare metal hub for multi-cluster confidential containers. +# Deploys Trustee (KBS + attestation), ACM, Vault, and full baremetal infrastructure. +# Manages spoke clusters imported via ACM with the baremetal-spoke clusterGroup. +# Trustee is configured for both Intel TDX and AMD SEV-SNP attestation simultaneously. +# Set main.clusterGroupName: baremetal-hub in values-global.yaml to use. + +clusterGroup: + name: baremetal-hub + isHubCluster: true + namespaces: + - open-cluster-management + - vault + - external-secrets-operator: + operatorGroup: true + targetNamespaces: [] + - external-secrets + - openshift-sandboxed-containers-operator + - trustee-operator-system + - cert-manager-operator + - cert-manager + - hello-openshift + - kbs-access + - openshift-cnv + - openshift-storage + - openshift-nfd + - baremetal + - intel-dcap + - intel-dcap-operator-system: + operatorGroup: true + targetNamespaces: [] + - nvidia-gpu-operator + - gpu-workload + - kyverno + - kubevirt-vms + + subscriptions: + acm: + name: advanced-cluster-management + namespace: open-cluster-management + annotations: + argocd.argoproj.io/sync-wave: "10" + eso: + name: openshift-external-secrets-operator + namespace: external-secrets-operator + channel: stable-v1 + sandbox: + name: sandboxed-containers-operator + namespace: openshift-sandboxed-containers-operator + channel: stable + installPlanApproval: Manual + csv: sandboxed-containers-operator.v1.13.0 + annotations: + argocd.argoproj.io/sync-wave: "10" + trustee: + name: trustee-operator + namespace: trustee-operator-system + channel: stable + installPlanApproval: Manual + csv: trustee-operator.v1.2.0 + annotations: + argocd.argoproj.io/sync-wave: "10" + cert-manager: + name: openshift-cert-manager-operator + namespace: cert-manager-operator + channel: stable-v1 + annotations: + argocd.argoproj.io/sync-wave: "10" + lvm-operator: + name: lvms-operator + namespace: openshift-storage + cnv: + name: kubevirt-hyperconverged + namespace: openshift-cnv + channel: stable + nfd: + name: nfd + namespace: openshift-nfd + channel: stable + annotations: + argocd.argoproj.io/sync-wave: "10" + intel-device-plugins: + name: intel-device-plugins-operator + namespace: openshift-operators + # Required for airgap -- set to your mirrored catalog source name + # source: cs-certified-operator-index-v4-22 + channel: stable + annotations: + argocd.argoproj.io/sync-wave: "10" + intel-tdx-dcap: + name: intel-tdx-dcap-operator + namespace: intel-dcap-operator-system + # Required for airgap -- set to your mirrored catalog source name + # source: cs-certified-operator-index-v4-22 + channel: alpha + annotations: + argocd.argoproj.io/sync-wave: "10" + + projects: + - hub + - vault + - trustee + - external-secrets + - sandbox + - workloads + - default + + sharedValueFiles: + - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml' + - '/overrides/values-storage-{{ $.Values.global.storageProvider }}.yaml' + - '/overrides/values-{{ $.Values.global.clusterVersion }}.yaml' + - '/overrides/values-hw-{{ $.Values.global.hardware.profile }}.yaml' + - '/overrides/values-baremetal-airgap.yaml' + + extraObjects: + wait-for-vault-unsealed: + apiVersion: batch/v1 + kind: Job + metadata: + name: wait-for-vault-unsealed + annotations: + argocd.argoproj.io/hook: Sync + argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation + argocd.argoproj.io/sync-wave: "5" + spec: + backoffLimit: 10 + activeDeadlineSeconds: 1800 + template: + spec: + restartPolicy: OnFailure + containers: + - name: wait-for-vault + image: registry.redhat.io/openshift4/ose-cli:latest + command: + - /bin/bash + - -c + - | + echo "Waiting for vault to be unsealed..." + while true; do + if curl -sk https://vault.vault.svc:8200/v1/sys/seal-status | grep -q '"sealed":false'; then + echo "Vault unsealed. Waiting 120s for secrets to load..." + sleep 120 + echo "Done. Proceeding." + exit 0 + fi + echo "Vault not ready. Retrying in 15s..." + sleep 15 + done + + applications: + acm: + name: acm + namespace: open-cluster-management + project: hub + chart: acm + chartVersion: 0.1.* + # Required for airgap -- set to your mirrored catalog source name + # overrides: + # - name: acm.mce_operator.source + # value: "cs-redhat-operator-index-v4-22" + + vault: + name: vault + namespace: vault + project: vault + chart: hashicorp-vault + chartVersion: 0.1.* + annotations: + argocd.argoproj.io/sync-wave: "0" + + secrets-operator: + name: openshift-external-secrets + namespace: external-secrets + project: external-secrets + chart: openshift-external-secrets + chartVersion: 0.0.* + annotations: + argocd.argoproj.io/sync-wave: "0" + + trustee: + name: trustee + namespace: trustee-operator-system + project: trustee + chart: trustee + chartVersion: 0.10.* + annotations: + argocd.argoproj.io/sync-wave: "20" + extraValueFiles: + - '/overrides/values-trustee.yaml' + overrides: + # Enable attestation-gated secret delivery via KBS + - name: global.coco.secured + value: "true" + # TDX attestation — hub's own Intel TDX platform + - name: kbs.tdx.enabled + value: "true" + # SNP attestation — for AMD SEV-SNP spoke clusters + - name: kbs.snp.enabled + value: "true" + # GPU attestation — enables NVIDIA CC GPU reference value verification + - name: kbs.gpu.enabled + value: "true" + # Bare metal mode — uses firmware reference values (not peer-pod PCR measurements) + - name: kbs.baremetal.enabled + value: "true" + # Inject mirror-registry CA into KBS trust store (required for airgap image pulls) + - name: kbs.registryCa.enabled + value: "true" + # TDX DCAP collateral — offline attestation without Intel PCS network access + - name: kbs.tdx.collateralService + value: "file:///opt/confidential-containers/attestation-service/tdx/platform_collaterals.json" + - name: kbs.tdx.collateralMountPath + value: "/opt/confidential-containers/attestation-service/tdx" + - name: kbs.tdx.collateralFileName + value: "platform_collaterals.json" + + storage: + name: storage + namespace: openshift-storage + project: hub + path: charts/hub/storage + annotations: + argocd.argoproj.io/sync-wave: "0" + + baremetal: + name: baremetal + namespace: baremetal + project: hub + path: charts/all/baremetal + annotations: + argocd.argoproj.io/sync-wave: "10" + + sandbox: + name: sandbox + namespace: openshift-sandboxed-containers-operator + project: sandbox + annotations: + argocd.argoproj.io/sync-wave: "10" + chart: sandboxed-containers + chartVersion: 0.2.* + overrides: + - name: enablePeerPods + value: "false" + + intel-dcap: + name: intel-dcap + namespace: intel-dcap + project: hub + path: charts/all/intel-dcap + annotations: + argocd.argoproj.io/sync-wave: "20" + ignoreDifferences: + - group: deviceplugin.intel.com + kind: SgxDevicePlugin + name: sgxdeviceplugin-sample + jsonPointers: + - /spec + - group: trustedservices.intel.com + kind: TdxQuoteGenerationService + name: intel-tdx-dcap + jsonPointers: + - /spec + - /status + + # KubeVirt confidential containers support (experimental) + # Requires Intel TDX hardware and CNV operator. Gated by chart-level values. + # Uncomment to enable: + # kubevirtconfidential: + # name: kubevirtconfidential + # namespace: openshift-cnv + # project: hub + # path: charts/all/kubevirtconfidential + # annotations: + # argocd.argoproj.io/sync-wave: "30" + + # KubeVirt test VMs (experimental) + # Uncomment to enable: + # kubevirtvm: + # name: kubevirtvm + # namespace: kubevirt-vms + # project: hub + # path: charts/all/kubevirtvm + # annotations: + # argocd.argoproj.io/sync-wave: "35" + # syncPolicy: + # automated: + # prune: true + + sandbox-policies: + name: sandbox-policies + namespace: openshift-sandboxed-containers-operator + project: sandbox + chart: sandboxed-policies + chartVersion: 0.2.* + annotations: + argocd.argoproj.io/sync-wave: "20" + + hello-openshift: + name: hello-openshift + namespace: hello-openshift + project: workloads + path: charts/coco-supported/hello-openshift + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # Uncomment and set MIRROR_REGISTRY_HOST to your mirror registry. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + syncPolicy: + automated: + prune: true + + kbs-access-curl: + name: kbs-access-curl + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-curl + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + # - name: initImage + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/ubi:latest" + syncPolicy: + automated: + prune: true + + kbs-access-sealed: + name: kbs-access-sealed + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-sealed + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + syncPolicy: + automated: + prune: true + + kyverno: + name: kyverno + namespace: kyverno + project: hub + path: charts/vendor/kyverno + annotations: + argocd.argoproj.io/sync-wave: "0" + syncPolicy: + automated: {} + retry: + limit: 20 + syncOptions: + - ServerSideApply=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .metadata.labels + - .metadata.annotations + extraValueFiles: + - '/overrides/values-kyverno.yaml' + overrides: + - name: backgroundController.resources.limits.memory + value: "512Mi" + - name: backgroundController.resources.requests.memory + value: "256Mi" + + coco-kyverno-policies: + name: coco-kyverno-policies + namespace: openshift-sandboxed-containers-operator + project: sandbox + path: charts/all/coco-kyverno-policies + annotations: + argocd.argoproj.io/sync-wave: "20" + + imperative: + serviceAccountCreate: true + clusterRoleYaml: + - apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' + jobs: + - name: init-data-gzipper + playbook: ansible/init-data-gzipper.yaml + verbosity: -vvv + timeout: 3600 + - name: reconcile-kataconfig-gpu + playbook: ansible/reconcile-kataconfig-gpu.yaml + verbosity: -vvv + timeout: 600 + + managedClusterGroups: + baremetal-spoke: + name: baremetal-spoke + acmlabels: + - name: clusterGroup + value: baremetal-spoke + helmOverrides: + - name: clusterGroup.isHubCluster + value: false + # Uncomment for HCP spoke clusters (OSC uses DaemonSet mode, MCO templates skipped) + # - name: global.cluster.hcp + # value: true From 91fbdfd427e4b0c5d4db0fdcc4179bd49a868a9c Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 21 Aug 2026 00:42:19 +0000 Subject: [PATCH 3/3] feat: add baremetal-spoke topology and hub-mixed hardware profile values-baremetal-spoke.yaml: Spoke topology for baremetal multi-cluster. No Trustee/Vault/ACM (managed by hub). Has sandboxed-containers, baremetal chart (NFD, MachineConfigs), workloads, Kyverno policies. Supports HCP via global.cluster.hcp toggle (MCO templates skipped). overrides/values-hw-hub-mixed.yaml: Hardware profile for hub clusters that attest both Intel TDX and AMD SEV-SNP simultaneously. Enables both kbs.tdx and kbs.snp in trustee. Intel DCAP stays enabled for the hub's own TDX platform. Co-Authored-By: Claude Opus 4.6 (1M context) --- overrides/values-hw-hub-mixed.yaml | 23 ++++ values-baremetal-spoke.yaml | 203 +++++++++++++++++++++++++++++ 2 files changed, 226 insertions(+) create mode 100644 overrides/values-hw-hub-mixed.yaml create mode 100644 values-baremetal-spoke.yaml diff --git a/overrides/values-hw-hub-mixed.yaml b/overrides/values-hw-hub-mixed.yaml new file mode 100644 index 00000000..96b8a6bb --- /dev/null +++ b/overrides/values-hw-hub-mixed.yaml @@ -0,0 +1,23 @@ +# Hardware profile: Hub with mixed TDX + SNP attestation +# Used on baremetal-hub clusters that attest both Intel TDX and AMD SEV-SNP spokes. +# The hub's own hardware is typically Intel TDX, but trustee accepts both TEE types. +# Intel DCAP infrastructure (QGS, SGX plugin) remains enabled for the hub's TDX platform. +# SNP VCEK secrets are loaded via overrides/values-snp-vcek.yaml (in sharedValueFiles). + +clusterGroup: + subscriptions: + gpu-operator: + disabled: true + + applications: + nvidia-gpu: + disabled: true + gpu-workload: + disabled: true + + trustee: + overrides: + - name: kbs.tdx.enabled + value: "true" + - name: kbs.snp.enabled + value: "true" diff --git a/values-baremetal-spoke.yaml b/values-baremetal-spoke.yaml new file mode 100644 index 00000000..5da79347 --- /dev/null +++ b/values-baremetal-spoke.yaml @@ -0,0 +1,203 @@ +# Bare metal spoke topology for confidential containers (multi-cluster). +# Runs sandboxed containers operator and confidential workloads. +# Paired with baremetal-hub topology — spoke is imported into ACM from the hub. +# Set main.clusterGroupName: baremetal-spoke in values-global.yaml on the spoke cluster. +# +# HCP support: If the spoke is a Hosted Control Plane cluster, set global.cluster.hcp: true +# in values-global.yaml (or via helmOverrides from the hub). OSC 1.13 auto-detects HCP and +# uses DaemonSet deployment mode. MachineConfig templates are skipped. + +clusterGroup: + name: baremetal-spoke + isHubCluster: false + namespaces: + - external-secrets-operator: + operatorGroup: true + targetNamespaces: [] + - external-secrets + - openshift-sandboxed-containers-operator + - hello-openshift + - kbs-access + - cert-manager-operator + - openshift-nfd + - baremetal + - kyverno + + subscriptions: + eso: + name: openshift-external-secrets-operator + namespace: external-secrets-operator + channel: stable-v1 + sandbox: + name: sandboxed-containers-operator + namespace: openshift-sandboxed-containers-operator + channel: stable + installPlanApproval: Manual + csv: sandboxed-containers-operator.v1.13.0 + annotations: + argocd.argoproj.io/sync-wave: "10" + cert-manager: + name: openshift-cert-manager-operator + namespace: cert-manager-operator + channel: stable-v1 + nfd: + name: nfd + namespace: openshift-nfd + channel: stable + annotations: + argocd.argoproj.io/sync-wave: "10" + + projects: + - hub + - external-secrets + - sandbox + - workloads + - default + + sharedValueFiles: + - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml' + - '/overrides/values-storage-{{ $.Values.global.storageProvider }}.yaml' + - '/overrides/values-{{ $.Values.global.clusterVersion }}.yaml' + - '/overrides/values-hw-{{ $.Values.global.hardware.profile }}.yaml' + - '/overrides/values-baremetal-airgap.yaml' + + applications: + secrets-operator: + name: openshift-external-secrets + namespace: external-secrets + project: external-secrets + chart: openshift-external-secrets + chartVersion: 0.0.* + + sandbox: + name: sandbox + namespace: openshift-sandboxed-containers-operator + project: sandbox + chart: sandboxed-containers + chartVersion: 0.2.* + annotations: + argocd.argoproj.io/sync-wave: "10" + overrides: + - name: enablePeerPods + value: "false" + - name: global.secretStore.backend + value: vault + - name: secretStore.name + value: vault-backend + - name: secretStore.kind + value: ClusterSecretStore + + baremetal: + name: baremetal + namespace: baremetal + project: hub + path: charts/all/baremetal + annotations: + argocd.argoproj.io/sync-wave: "10" + + sandbox-policies: + name: sandbox-policies + namespace: openshift-sandboxed-containers-operator + project: sandbox + chart: sandboxed-policies + chartVersion: 0.2.* + annotations: + argocd.argoproj.io/sync-wave: "20" + + hello-openshift: + name: hello-openshift + namespace: hello-openshift + project: workloads + path: charts/coco-supported/hello-openshift + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + syncPolicy: + automated: + prune: true + + kbs-access-curl: + name: kbs-access-curl + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-curl + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + # - name: initImage + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/ubi:latest" + syncPolicy: + automated: + prune: true + + kbs-access-sealed: + name: kbs-access-sealed + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-sealed + annotations: + argocd.argoproj.io/sync-wave: "30" + # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM. + # overrides: + # - name: image + # value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2" + syncPolicy: + automated: + prune: true + + kyverno: + name: kyverno + namespace: kyverno + project: hub + path: charts/vendor/kyverno + annotations: + argocd.argoproj.io/sync-wave: "0" + syncPolicy: + automated: {} + retry: + limit: 20 + syncOptions: + - ServerSideApply=true + - RespectIgnoreDifferences=true + ignoreDifferences: + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + jqPathExpressions: + - .metadata.labels + - .metadata.annotations + extraValueFiles: + - '/overrides/values-kyverno.yaml' + overrides: + - name: backgroundController.resources.limits.memory + value: "512Mi" + - name: backgroundController.resources.requests.memory + value: "256Mi" + + coco-kyverno-policies: + name: coco-kyverno-policies + namespace: openshift-sandboxed-containers-operator + project: sandbox + path: charts/all/coco-kyverno-policies + annotations: + argocd.argoproj.io/sync-wave: "20" + + imperative: + serviceAccountCreate: true + clusterRoleYaml: + - apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' + jobs: + - name: init-data-gzipper + playbook: ansible/init-data-gzipper.yaml + verbosity: -vvv + timeout: 3600