Skip to content

gcp: Support AMD SEV-SNP confidential instances #3871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 11, 2024
Merged

gcp: Support AMD SEV-SNP confidential instances #3871

merged 2 commits into from
Sep 11, 2024

Conversation

@HuijingHei
Copy link
Member

@HuijingHei HuijingHei commented Sep 5, 2024 •
edited
Loading

mantle: bump google.golang.org/api library to latest (0.196.0)

This was achieved via:

go get -u google.golang.org/api@v0.196.0
go get google.golang.org/api/option@v0.196.0
go get google.golang.org/api/internal@v0.196.0
go get github.com/coreos/coreos-assembler/mantle/auth
go get github.com/coreos/coreos-assembler/mantle/cmd/kola
go get github.com/coreos/coreos-assembler/mantle/cmd/ore/gcloud
go mod vendor

mantle: Support AMD SEV-SNP confidential instances on GCP

Fix #3556

HuijingHei
HuijingHei commented Sep 5, 2024
View reviewed changes
@HuijingHei
Copy link
Member Author

HuijingHei commented Sep 5, 2024

hold on, seems need to rebase first

@HuijingHei HuijingHei force-pushed the gcp-sev-snp branch 3 times, most recently from c46ddfb to e2cac4b Compare September 6, 2024 12:29
@HuijingHei
Copy link
Member Author

HuijingHei commented Sep 6, 2024

Ready to review, thanks!

jbtrystram
jbtrystram reviewed Sep 6, 2024
View reviewed changes
Copy link
Member

@jbtrystram jbtrystram left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know this code in-depth but that looks good to me

@HuijingHei
Copy link
Member Author

HuijingHei commented Sep 10, 2024

According to @jmarrero 's suggestion, build locally and run test ext.config.platforms.gcp.nvme-symlink, the result is PASSED, as the CI can not cover it.

podman build -t hhei-cosa .
export COREOS_ASSEMBLER_CONTAINER=localhost/hhei-cosa:latest
cosa shell
[coreos-assembler]$ cd coreos-assembler/
[coreos-assembler]$ make KOLET_ARCHES=x86_64
[coreos-assembler]$ sudo make install

[coreos-assembler]$ kola run -E ./fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=xxx --gcp-project=xxx --gcp-confidential-type SEV_SNP --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computingUsing n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
--- PASS: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (87.73s)
PASS, output in _kola_temp/gcp-2024-09-10-0309-9321

jlebon
jlebon reviewed Sep 10, 2024
View reviewed changes
Copy link
Member

@jlebon jlebon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks sane overall. Let's fold the last commit into the first (which would now be the second)?

@HuijingHei
mantle: bump google.golang.org/api library to latest (0.196.0)
0afebdf 
This was achieved via:

```
go get -u google.golang.org/api@v0.196.0
go get google.golang.org/api/option@v0.196.0
go get google.golang.org/api/internal@v0.196.0
go get github.com/coreos/coreos-assembler/mantle/auth
go get github.com/coreos/coreos-assembler/mantle/cmd/kola
go get github.com/coreos/coreos-assembler/mantle/cmd/ore/gcloud
go mod vendor
```
@HuijingHei HuijingHei force-pushed the gcp-sev-snp branch 4 times, most recently from c16d522 to 0a88d9f Compare September 11, 2024 03:19
@HuijingHei
Copy link
Member Author

HuijingHei commented Sep 11, 2024

Update is done, thanks @jlebon for the review!

For unsupported sev-aa, the result is failed as exected.
For sev-snp, the result is passed.

[coreos-assembler]$ make KOLET_ARCHES=x86_64 kola

[coreos-assembler]$ ./bin/kola run -E  ../fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=/srv/tool/gcp.json --gcp-project=openshift-rhcos-devel --gcp-confidential-type sev-aa --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computing
Using n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
2024-09-11T03:20:28Z kola: retryloop: failed to bring up machines: failed to create instance "kola-f2e87ec46890322a6933": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
2024-09-11T03:20:29Z kola: retryloop: failed to bring up machines: failed to create instance "kola-2372e797fb2244a35fff": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
2024-09-11T03:20:29Z kola: Platform failed starting machines. Adding as candidate for rerun success: ext.fedora-coreos-config.platforms.gcp.nvme-symlink
--- FAIL: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (1.00s)
        harness.go:1782: Cluster failed starting machines: failed to create instance "kola-2372e797fb2244a35fff": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
FAIL, output in _kola_temp/gcp-2024-09-11-0320-12692
Error: harness: test suite failed
2024-09-11T03:20:29Z cli: harness: test suite failed

[coreos-assembler]$ ./bin/kola run -E  ../fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=/srv/tool/gcp.json --gcp-project=openshift-rhcos-devel --gcp-confidential-type sev-snp --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computing
Using n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Using confidential type for confidential computing SEV_SNP
--- PASS: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (78.89s)
PASS, output in _kola_temp/gcp-2024-09-11-0320-12704

dustymabe
dustymabe reviewed Sep 11, 2024
View reviewed changes
dustymabe
dustymabe previously approved these changes Sep 11, 2024
View reviewed changes
Copy link
Member

@dustymabe dustymabe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - minor suggestion in the code.

HuijingHei added a commit to HuijingHei/fedora-coreos-pipeline that referenced this pull request Sep 11, 2024
@HuijingHei
gcp: run tests with instance using confidential type sev-snp
7e779ad 
Based on coreos/coreos-assembler#3871
@HuijingHei HuijingHei mentioned this pull request Sep 11, 2024
Merged
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 11, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type sev-snp
4ce8435 
Based on coreos/coreos-assembler#3871
@HuijingHei HuijingHei mentioned this pull request Sep 11, 2024
Merged
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 11, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
be2c1e6 
`sev-snp`

Based on coreos/coreos-assembler#3871
dustymabe
dustymabe approved these changes Sep 11, 2024
View reviewed changes
Copy link
Member

@dustymabe dustymabe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dustymabe dustymabe merged commit db803c3 into coreos:main Sep 11, 2024
@HuijingHei HuijingHei deleted the gcp-sev-snp branch September 11, 2024 13:33
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
25c2585 
`sev_snp`

Based on coreos/coreos-assembler#3871
HuijingHei added a commit to HuijingHei/fedora-coreos-pipeline that referenced this pull request Sep 13, 2024
@HuijingHei
gcp: run tests with instance using confidential type sev_snp
cbb6379 
Based on coreos/coreos-assembler#3871
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
e7df896 
`sev_snp`

Based on coreos/coreos-assembler#3871
dustymabe pushed a commit to coreos/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
0b797dd 
`sev_snp`

Based on coreos/coreos-assembler#3871
dustymabe pushed a commit to dustymabe/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
814ed69 
`sev_snp`

Based on coreos/coreos-assembler#3871

(cherry picked from commit 0b797dd)
@dustymabe dustymabe mentioned this pull request Sep 13, 2024
Merged
dustymabe pushed a commit to coreos/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
3d42243 
`sev_snp`

Based on coreos/coreos-assembler#3871

(cherry picked from commit 0b797dd)
This was referenced Oct 15, 2024
Closed
Closed
bgartzi added a commit to bgartzi/coreos-assembler that referenced this pull request Jan 20, 2025
@bgartzi
gcloud: Enable TDX_CAPABLE
a034fd8 
Previous work: coreos#3547,coreos#3871
Fixes: coreos#1814
bgartzi added a commit to bgartzi/coreos-assembler that referenced this pull request Jan 22, 2025
@bgartzi
gcloud: Enable TDX_CAPABLE
fa99e94 
Previous work: coreos#3547
Previous work: coreos#3871
Fixes: coreos/fedora-coreos-tracker#1814
Fixes: https://issues.redhat.com/browse/COS-3111
@bgartzi bgartzi mentioned this pull request Jan 22, 2025
Merged
bgartzi added a commit to bgartzi/coreos-assembler that referenced this pull request Jan 22, 2025
@bgartzi
gcloud: Enable TDX_CAPABLE
5f659ed 
Previous work: coreos#3547
Previous work: coreos#3871
Fixes: coreos/fedora-coreos-tracker#1814
Fixes: https://issues.redhat.com/browse/COS-3111
jlebon pushed a commit that referenced this pull request Jan 30, 2025
@bgartzi @jlebon
gcloud: Enable TDX_CAPABLE
8171b63 
Previous work: #3547
Previous work: #3871
Fixes: coreos/fedora-coreos-tracker#1814
Fixes: https://issues.redhat.com/browse/COS-3111
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jlebon jlebon jlebon left review comments

@jbtrystram jbtrystram jbtrystram left review comments

@dustymabe dustymabe dustymabe approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support AMD SEV-SNP instances on GCP

5 participants

@HuijingHei @dustymabe @jlebon @jbtrystram @openshift-merge-robot