Skip to content

Commit 013e3c5

Browse files
fangge1212fangge1212
committed
Add support for AMD SEV-SNP instances
This commit adds support for AMD SEV-SNP instances, so users can utilize confidential computing technology on cluster nodes. Signed-off-by: Fangge Jin <[email protected]>
1 parent 60649f3 commit 013e3c5

12 files changed

+333
-0
lines changed

‎api/v1beta1/awscluster_conversion.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ func (src *AWSCluster) ConvertTo(dstRaw conversion.Hub) error {
6666
dst.Status.Bastion.HostAffinity = restored.Status.Bastion.HostAffinity
6767
dst.Status.Bastion.HostID = restored.Status.Bastion.HostID
6868
dst.Status.Bastion.CapacityReservationPreference = restored.Status.Bastion.CapacityReservationPreference
69+
dst.Status.Bastion.CPUOptions = restored.Status.Bastion.CPUOptions
6970
}
7071
dst.Spec.Partition = restored.Spec.Partition
7172

‎api/v1beta1/awsmachine_conversion.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ func (src *AWSMachine) ConvertTo(dstRaw conversion.Hub) error {
4848
dst.Spec.HostAffinity = restored.Spec.HostAffinity
4949
dst.Spec.CapacityReservationPreference = restored.Spec.CapacityReservationPreference
5050
dst.Spec.NetworkInterfaceType = restored.Spec.NetworkInterfaceType
51+
dst.Spec.CPUOptions = restored.Spec.CPUOptions
5152
if restored.Spec.ElasticIPPool != nil {
5253
if dst.Spec.ElasticIPPool == nil {
5354
dst.Spec.ElasticIPPool = &infrav1.ElasticIPPool{}
@@ -115,6 +116,7 @@ func (r *AWSMachineTemplate) ConvertTo(dstRaw conversion.Hub) error {
115116
dst.Spec.Template.Spec.HostAffinity = restored.Spec.Template.Spec.HostAffinity
116117
dst.Spec.Template.Spec.CapacityReservationPreference = restored.Spec.Template.Spec.CapacityReservationPreference
117118
dst.Spec.Template.Spec.NetworkInterfaceType = restored.Spec.Template.Spec.NetworkInterfaceType
119+
dst.Spec.Template.Spec.CPUOptions = restored.Spec.Template.Spec.CPUOptions
118120
if restored.Spec.Template.Spec.ElasticIPPool != nil {
119121
if dst.Spec.Template.Spec.ElasticIPPool == nil {
120122
dst.Spec.Template.Spec.ElasticIPPool = &infrav1.ElasticIPPool{}

‎api/v1beta1/zz_generated.conversion.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/v1beta2/awsmachine_types.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,11 @@ type AWSMachineSpec struct {
116116
// +kubebuilder:validation:MinLength:=2
117117
InstanceType string `json:"instanceType"`
118118

119+
// CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
120+
// When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
121+
// +optional
122+
CPUOptions CPUOptions `json:"cpuOptions,omitempty,omitzero"`
123+
119124
// AdditionalTags is an optional set of tags to add to an instance, in addition to the ones added by default by the
120125
// AWS provider. If both the AWSCluster and the AWSMachine specify the same tag name with different values, the
121126
// AWSMachine's value takes precedence.

‎api/v1beta2/types.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,11 @@ type Instance struct {
293293
// +kubebuilder:validation:Enum="";None;CapacityReservationsOnly;Open
294294
// +optional
295295
CapacityReservationPreference CapacityReservationPreference `json:"capacityReservationPreference,omitempty"`
296+
297+
// CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
298+
// When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
299+
// +optional
300+
CPUOptions CPUOptions `json:"cpuOptions,omitempty,omitzero"`
296301
}
297302

298303
// CapacityReservationPreference describes the preferred use of capacity reservations
@@ -534,3 +539,33 @@ var (
534539
// SubnetSchemaPreferPublic allocates more subnets in the VPC to public subnets.
535540
SubnetSchemaPreferPublic = SubnetSchemaType("PreferPublic")
536541
)
542+
543+
// AWSConfidentialComputePolicy represents the confidential compute configuration for the instance.
544+
// +kubebuilder:validation:Enum=Disabled;AMDEncrytedVirtualizationNestedPaging
545+
type AWSConfidentialComputePolicy string
546+
547+
const (
548+
// AWSConfidentialComputePolicyDisabled disables confidential computing for the instance.
549+
AWSConfidentialComputePolicyDisabled AWSConfidentialComputePolicy = "Disabled"
550+
// AWSConfidentialComputePolicySEVSNP enables AMD SEV-SNP as the confidential computing technology for the instance.
551+
AWSConfidentialComputePolicySEVSNP AWSConfidentialComputePolicy = "AMDEncrytedVirtualizationNestedPaging"
552+
)
553+
554+
// CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
555+
// +kubebuilder:validation:MinProperties=1
556+
type CPUOptions struct {
557+
// confidentialCompute specifies whether confidential computing should be enabled for the instance,
558+
// and, if so, which confidential computing technology to use.
559+
// Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
560+
// When set to Disabled, confidential computing will be disabled for the instance.
561+
// When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
562+
// In this case, ensure the following conditions are met:
563+
// 1) The selected instance type supports AMD SEV-SNP.
564+
// 2) The selected AWS region supports AMD SEV-SNP.
565+
// 3) The selected AMI supports AMD SEV-SNP.
566+
// More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
567+
// When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
568+
// which is subject to change without notice. The current default is Disabled.
569+
// +optional
570+
ConfidentialCompute AWSConfidentialComputePolicy `json:"confidentialCompute,omitempty"`
571+
}

‎api/v1beta2/zz_generated.deepcopy.go

Lines changed: 17 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,6 +1237,31 @@ spec:
12371237
"None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
12381238
"CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation. Note that this is incompatible with a MarketType of `Spot`
12391239
type: string
1240+
cpuOptions:
1241+
description: |-
1242+
CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
1243+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
1244+
minProperties: 1
1245+
properties:
1246+
confidentialCompute:
1247+
description: |-
1248+
confidentialCompute specifies whether confidential computing should be enabled for the instance,
1249+
and, if so, which confidential computing technology to use.
1250+
Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
1251+
When set to Disabled, confidential computing will be disabled for the instance.
1252+
When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
1253+
In this case, ensure the following conditions are met:
1254+
1) The selected instance type supports AMD SEV-SNP.
1255+
2) The selected AWS region supports AMD SEV-SNP.
1256+
3) The selected AMI supports AMD SEV-SNP.
1257+
More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
1258+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
1259+
which is subject to change without notice. The current default is Disabled.
1260+
enum:
1261+
- Disabled
1262+
- AMDEncrytedVirtualizationNestedPaging
1263+
type: string
1264+
type: object
12401265
ebsOptimized:
12411266
description: Indicates whether the instance is optimized for Amazon
12421267
EBS I/O.
@@ -3456,6 +3481,31 @@ spec:
34563481
"None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
34573482
"CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation. Note that this is incompatible with a MarketType of `Spot`
34583483
type: string
3484+
cpuOptions:
3485+
description: |-
3486+
CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
3487+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
3488+
minProperties: 1
3489+
properties:
3490+
confidentialCompute:
3491+
description: |-
3492+
confidentialCompute specifies whether confidential computing should be enabled for the instance,
3493+
and, if so, which confidential computing technology to use.
3494+
Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
3495+
When set to Disabled, confidential computing will be disabled for the instance.
3496+
When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
3497+
In this case, ensure the following conditions are met:
3498+
1) The selected instance type supports AMD SEV-SNP.
3499+
2) The selected AWS region supports AMD SEV-SNP.
3500+
3) The selected AMI supports AMD SEV-SNP.
3501+
More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
3502+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
3503+
which is subject to change without notice. The current default is Disabled.
3504+
enum:
3505+
- Disabled
3506+
- AMDEncrytedVirtualizationNestedPaging
3507+
type: string
3508+
type: object
34593509
ebsOptimized:
34603510
description: Indicates whether the instance is optimized for Amazon
34613511
EBS I/O.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsclusters.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2215,6 +2215,31 @@ spec:
22152215
"None": The instance may not make use of any Capacity Reservations. This is to conserve open reservations for desired workloads
22162216
"CapacityReservationsOnly": The instance will only run if matched or targeted to a Capacity Reservation. Note that this is incompatible with a MarketType of `Spot`
22172217
type: string
2218+
cpuOptions:
2219+
description: |-
2220+
CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
2221+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
2222+
minProperties: 1
2223+
properties:
2224+
confidentialCompute:
2225+
description: |-
2226+
confidentialCompute specifies whether confidential computing should be enabled for the instance,
2227+
and, if so, which confidential computing technology to use.
2228+
Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
2229+
When set to Disabled, confidential computing will be disabled for the instance.
2230+
When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
2231+
In this case, ensure the following conditions are met:
2232+
1) The selected instance type supports AMD SEV-SNP.
2233+
2) The selected AWS region supports AMD SEV-SNP.
2234+
3) The selected AMI supports AMD SEV-SNP.
2235+
More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
2236+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
2237+
which is subject to change without notice. The current default is Disabled.
2238+
enum:
2239+
- Disabled
2240+
- AMDEncrytedVirtualizationNestedPaging
2241+
type: string
2242+
type: object
22182243
ebsOptimized:
22192244
description: Indicates whether the instance is optimized for Amazon
22202245
EBS I/O.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachines.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -692,6 +692,31 @@ spec:
692692
- ssm-parameter-store
693693
type: string
694694
type: object
695+
cpuOptions:
696+
description: |-
697+
CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
698+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
699+
minProperties: 1
700+
properties:
701+
confidentialCompute:
702+
description: |-
703+
confidentialCompute specifies whether confidential computing should be enabled for the instance,
704+
and, if so, which confidential computing technology to use.
705+
Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
706+
When set to Disabled, confidential computing will be disabled for the instance.
707+
When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
708+
In this case, ensure the following conditions are met:
709+
1) The selected instance type supports AMD SEV-SNP.
710+
2) The selected AWS region supports AMD SEV-SNP.
711+
3) The selected AMI supports AMD SEV-SNP.
712+
More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
713+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
714+
which is subject to change without notice. The current default is Disabled.
715+
enum:
716+
- Disabled
717+
- AMDEncrytedVirtualizationNestedPaging
718+
type: string
719+
type: object
695720
elasticIpPool:
696721
description: ElasticIPPool is the configuration to allocate Public
697722
IPv4 address (Elastic IP/EIP) from user-defined pool.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmachinetemplates.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,31 @@ spec:
611611
- ssm-parameter-store
612612
type: string
613613
type: object
614+
cpuOptions:
615+
description: |-
616+
CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
617+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
618+
minProperties: 1
619+
properties:
620+
confidentialCompute:
621+
description: |-
622+
confidentialCompute specifies whether confidential computing should be enabled for the instance,
623+
and, if so, which confidential computing technology to use.
624+
Valid values are: Disabled, AMDEncrytedVirtualizationNestedPaging
625+
When set to Disabled, confidential computing will be disabled for the instance.
626+
When set to AMDEncrytedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
627+
In this case, ensure the following conditions are met:
628+
1) The selected instance type supports AMD SEV-SNP.
629+
2) The selected AWS region supports AMD SEV-SNP.
630+
3) The selected AMI supports AMD SEV-SNP.
631+
More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
632+
When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
633+
which is subject to change without notice. The current default is Disabled.
634+
enum:
635+
- Disabled
636+
- AMDEncrytedVirtualizationNestedPaging
637+
type: string
638+
type: object
614639
elasticIpPool:
615640
description: ElasticIPPool is the configuration to allocate
616641
Public IPv4 address (Elastic IP/EIP) from user-defined pool.

0 commit comments

Comments
 (0)