Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gcp: Support AMD SEV-SNP confidential instances #3871

Merged
merged 2 commits into from
Sep 11, 2024
Merged

gcp: Support AMD SEV-SNP confidential instances #3871

merged 2 commits into from
Sep 11, 2024

Conversation

HuijingHei
Copy link
Member

@HuijingHei HuijingHei commented Sep 5, 2024 •
edited
Loading

mantle: bump google.golang.org/api library to latest (0.196.0)

This was achieved via:

go get -u google.golang.org/api@v0.196.0
go get google.golang.org/api/option@v0.196.0
go get google.golang.org/api/internal@v0.196.0
go get github.com/coreos/coreos-assembler/mantle/auth
go get github.com/coreos/coreos-assembler/mantle/cmd/kola
go get github.com/coreos/coreos-assembler/mantle/cmd/ore/gcloud
go mod vendor

mantle: Support AMD SEV-SNP confidential instances on GCP

Fix #3556

HuijingHei
HuijingHei commented Sep 5, 2024
View reviewed changes
go.mod Show resolved Hide resolved
@HuijingHei
Copy link
Member Author

hold on, seems need to rebase first

@HuijingHei HuijingHei force-pushed the gcp-sev-snp branch 3 times, most recently from c46ddfb to e2cac4b Compare September 6, 2024 12:29
@HuijingHei
Copy link
Member Author

Ready to review, thanks!

jbtrystram
jbtrystram reviewed Sep 6, 2024
View reviewed changes
Copy link
Contributor

@jbtrystram jbtrystram left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know this code in-depth but that looks good to me

@HuijingHei
Copy link
Member Author

According to @jmarrero 's suggestion, build locally and run test ext.config.platforms.gcp.nvme-symlink, the result is PASSED, as the CI can not cover it.

podman build -t hhei-cosa .
export COREOS_ASSEMBLER_CONTAINER=localhost/hhei-cosa:latest
cosa shell
[coreos-assembler]$ cd coreos-assembler/
[coreos-assembler]$ make KOLET_ARCHES=x86_64
[coreos-assembler]$ sudo make install

[coreos-assembler]$ kola run -E ./fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=xxx --gcp-project=xxx --gcp-confidential-type SEV_SNP --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computingUsing n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
--- PASS: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (87.73s)
PASS, output in _kola_temp/gcp-2024-09-10-0309-9321

jlebon
jlebon reviewed Sep 10, 2024
View reviewed changes
Copy link
Member

@jlebon jlebon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks sane overall. Let's fold the last commit into the first (which would now be the second)?

mantle/cmd/kola/options.go Outdated Show resolved Hide resolved
mantle/platform/api/gcloud/compute.go Outdated Show resolved Hide resolved
mantle/cmd/kola/options.go Outdated Show resolved Hide resolved
mantle/platform/api/gcloud/compute.go Outdated Show resolved Hide resolved
@HuijingHei
mantle: bump google.golang.org/api library to latest (0.196.0)
0afebdf 
This was achieved via:

```
go get -u google.golang.org/api@v0.196.0
go get google.golang.org/api/option@v0.196.0
go get google.golang.org/api/internal@v0.196.0
go get github.com/coreos/coreos-assembler/mantle/auth
go get github.com/coreos/coreos-assembler/mantle/cmd/kola
go get github.com/coreos/coreos-assembler/mantle/cmd/ore/gcloud
go mod vendor
```
@HuijingHei HuijingHei force-pushed the gcp-sev-snp branch 4 times, most recently from c16d522 to 0a88d9f Compare September 11, 2024 03:19
@HuijingHei
Copy link
Member Author

Update is done, thanks @jlebon for the review!

For unsupported sev-aa, the result is failed as exected.
For sev-snp, the result is passed.

[coreos-assembler]$ make KOLET_ARCHES=x86_64 kola

[coreos-assembler]$ ./bin/kola run -E  ../fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=/srv/tool/gcp.json --gcp-project=openshift-rhcos-devel --gcp-confidential-type sev-aa --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computing
Using n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
2024-09-11T03:20:28Z kola: retryloop: failed to bring up machines: failed to create instance "kola-f2e87ec46890322a6933": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
2024-09-11T03:20:29Z kola: retryloop: failed to bring up machines: failed to create instance "kola-2372e797fb2244a35fff": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
2024-09-11T03:20:29Z kola: Platform failed starting machines. Adding as candidate for rerun success: ext.fedora-coreos-config.platforms.gcp.nvme-symlink
--- FAIL: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (1.00s)
        harness.go:1782: Cluster failed starting machines: failed to create instance "kola-2372e797fb2244a35fff": Does not support confidential type sev-aa, should be: sev, sev_snp, sev-snp
FAIL, output in _kola_temp/gcp-2024-09-11-0320-12692
Error: harness: test suite failed
2024-09-11T03:20:29Z cli: harness: test suite failed

[coreos-assembler]$ ./bin/kola run -E  ../fedora-coreos-config -p=gcp --gcp-image=projects/fedora-coreos-cloud/global/images/fedora-coreos-40-20240903-20-0-gcp-x86-64 --gcp-json-key=/srv/tool/gcp.json --gcp-project=openshift-rhcos-devel --gcp-confidential-type sev-snp --tag confidential ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Setting instance type for confidential computing
Using n2d-standard-2 instance type
=== RUN   ext.fedora-coreos-config.platforms.gcp.nvme-symlink
Using confidential type for confidential computing SEV_SNP
--- PASS: ext.fedora-coreos-config.platforms.gcp.nvme-symlink (78.89s)
PASS, output in _kola_temp/gcp-2024-09-11-0320-12704

dustymabe
dustymabe previously approved these changes Sep 11, 2024
View reviewed changes
Copy link
Member

@dustymabe dustymabe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - minor suggestion in the code.

HuijingHei added a commit to HuijingHei/fedora-coreos-pipeline that referenced this pull request Sep 11, 2024
@HuijingHei
gcp: run tests with instance using confidential type sev-snp
7e779ad 
Based on coreos/coreos-assembler#3871
@HuijingHei HuijingHei mentioned this pull request Sep 11, 2024
Merged
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 11, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type sev-snp
4ce8435 
Based on coreos/coreos-assembler#3871
@HuijingHei HuijingHei mentioned this pull request Sep 11, 2024
Merged
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 11, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
be2c1e6 
`sev-snp`

Based on coreos/coreos-assembler#3871
dustymabe
dustymabe approved these changes Sep 11, 2024
View reviewed changes
Copy link
Member

@dustymabe dustymabe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dustymabe dustymabe merged commit db803c3 into coreos:main Sep 11, 2024
5 checks passed
@HuijingHei HuijingHei deleted the gcp-sev-snp branch September 11, 2024 13:33
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
25c2585 
`sev_snp`

Based on coreos/coreos-assembler#3871
HuijingHei added a commit to HuijingHei/fedora-coreos-pipeline that referenced this pull request Sep 13, 2024
@HuijingHei
gcp: run tests with instance using confidential type sev_snp
cbb6379 
Based on coreos/coreos-assembler#3871
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei
gcp-test: update check to run instance with confidential type
e7df896 
`sev_snp`

Based on coreos/coreos-assembler#3871
dustymabe pushed a commit to coreos/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
0b797dd 
`sev_snp`

Based on coreos/coreos-assembler#3871
dustymabe pushed a commit to dustymabe/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
814ed69 
`sev_snp`

Based on coreos/coreos-assembler#3871

(cherry picked from commit 0b797dd)
@dustymabe dustymabe mentioned this pull request Sep 13, 2024
Merged
dustymabe pushed a commit to coreos/fedora-coreos-config that referenced this pull request Sep 13, 2024
@HuijingHei @dustymabe
gcp-test: update check to run instance with confidential type
3d42243 
`sev_snp`

Based on coreos/coreos-assembler#3871

(cherry picked from commit 0b797dd)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jlebon jlebon jlebon left review comments

@jbtrystram jbtrystram jbtrystram left review comments

@dustymabe dustymabe dustymabe approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support AMD SEV-SNP instances on GCP
5 participants
@HuijingHei @dustymabe @jlebon @jbtrystram @openshift-merge-robot