feat: baremetal multi-cluster with mixed TEE and HCP support

charts/all/baremetal/templates/vsock-mco.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.global.cluster.hcp }}
 {{- range list "master" "worker" }}
 {{- if $.Values.tdx.enabled }}
 ---
@@ -23,3 +24,4 @@ spec:
             source: data:text/plain;charset=utf-8;base64,W2h5cGVydmlzb3IucWVtdV0KdGR4X3F1b3RlX2dlbmVyYXRpb25fc2VydmljZV9zb2NrZXRfcG9ydD0wCg==
 {{- end }}
 {{- end }}
+{{- end }}

charts/all/baremetal/values.yaml

@@ -1,2 +1,6 @@
+global:
+  cluster:
+    hcp: false
+
 tdx:
   enabled: true

charts/all/kubevirtconfidential/templates/selinux-mco.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.global.kubevirt.confidential.enabled }}
+{{- if and .Values.global.kubevirt.confidential.enabled (not .Values.global.cluster.hcp) }}
 {{- range list "master" "worker" }}
 ---
 apiVersion: machineconfiguration.openshift.io/v1

overrides/values-hw-hub-mixed.yaml

@@ -0,0 +1,23 @@
+# Hardware profile: Hub with mixed TDX + SNP attestation
+# Used on baremetal-hub clusters that attest both Intel TDX and AMD SEV-SNP spokes.
+# The hub's own hardware is typically Intel TDX, but trustee accepts both TEE types.
+# Intel DCAP infrastructure (QGS, SGX plugin) remains enabled for the hub's TDX platform.
+# SNP VCEK secrets are loaded via overrides/values-snp-vcek.yaml (in sharedValueFiles).
+
+clusterGroup:
+  subscriptions:
+    gpu-operator:
+      disabled: true
+
+  applications:
+    nvidia-gpu:
+      disabled: true
+    gpu-workload:
+      disabled: true
+
+    trustee:
+      overrides:
+        - name: kbs.tdx.enabled
+          value: "true"
+        - name: kbs.snp.enabled
+          value: "true"