Merge branch 'yousef/provider-pod-annotations-stack' of github.com:cohere-ai/cloud-api-adaptor into yousef/configurable-overlay-mtu-stack

Author: yousef-cohere

src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go

@@ -114,7 +114,7 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) {
 		reg.BoolWithEnv(&cfg.serverConfig.EnableCloudConfigVerify, "cloud-config-verify", false, "CLOUD_CONFIG_VERIFY", "Enable cloud config verify - should use it for production")
 		reg.IntWithEnv(&cfg.serverConfig.PeerPodsLimitPerNode, "peerpods-limit-per-node", 10, "PEERPODS_LIMIT_PER_NODE", "peer pods limit per node (default=10)")
 		reg.BoolWithEnv(&cfg.serverConfig.EnableScratchSpace, "enable-scratch-space", false, "ENABLE_SCRATCH_SPACE", "Enable encrypted scratch space for pod VMs")
-		reg.StringWithEnv(&cfg.serverConfig.AllowedCloudConfigAnnotations, "allowed-cloud-config-annotations", "", "ALLOWED_CLOUD_CONFIG_ANNOTATIONS", "Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration")
+		reg.StringWithEnv(&cfg.serverConfig.AllowedCloudConfigAnnotations, "allowed-cloud-config-annotations", "", "ALLOWED_CLOUD_CONFIG_ANNOTATIONS", "Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration")
 		reg.BoolWithEnv(&cfg.networkConfig.ExternalNetViaPodVM, "ext-network-via-podvm", false, "EXTERNAL_NETWORK_VIA_PODVM", "[EXPERIMENTAL] Enable external networking via pod VM")
 		reg.CustomTypeWithEnv(&cfg.networkConfig.PodSubnetCIDRs, "pod-subnet-cidrs", "", "POD_SUBNET_CIDRS", "[EXPERIMENTAL] Comma separated CIDRs for local pod subnets")
 
@@ -139,7 +139,7 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) {
 	// This call will be removed in a future release.
 	cloud.LoadEnv()
 
-	if err := util.ValidateAllowedCloudConfigAnnotations(cfg.serverConfig.AllowedCloudConfigAnnotations); err != nil {
+	if err := util.ValidateAllowedCloudConfigAnnotations(cloudName, cfg.serverConfig.AllowedCloudConfigAnnotations); err != nil {
 		return nil, err
 	}
 

src/cloud-api-adaptor/install/charts/peerpods/README.md

@@ -193,7 +193,6 @@ Prepend `io.katacontainers.config.hypervisor.` to each suffix below.
 |---|---|---|---|
 | `gcp_zone` | GCP | Selects a zone in the configured subnet region | Capacity and data-residency change |
 | `gcp_disk_type` | GCP | Selects the boot disk type | Cost and performance change |
-| `gcp_confidential_type` | GCP | Selects the configured confidential VM technology | Attestation policy compatibility |
 | `gcp_root_volume_size` | GCP | Increases boot disk size | Cost increase |
 | `gcp_use_public_ip` | GCP | Attaches an external IP | Public network exposure |
 | `gcp_network_tags` | GCP | Adds firewall-targeting network tags | Expands firewall policy matches |
@@ -207,7 +206,8 @@ Prepend `io.katacontainers.config.hypervisor.` to each suffix below.
 | `use_spot` | GCP, Azure | Requests interruptible capacity | VM eviction and workload interruption |
 
 The following security-sensitive keys cannot be allowlisted:
-`gcp_disable_cvm`, `azure_disable_cvm`, and `azure_enable_secure_boot`.
+`gcp_disable_cvm`, `gcp_confidential_type`, `azure_disable_cvm`, and
+`azure_enable_secure_boot`.
 Run a separate CAA instance if workloads require weaker confidential-compute
 or boot-integrity settings.
 

src/cloud-api-adaptor/install/charts/peerpods/providers/alibabacloud.yaml

@@ -6,7 +6,7 @@ provider: alibabacloud
 
 providerConfigs:
   alibabacloud:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/aws.yaml

@@ -6,7 +6,7 @@ provider: aws
 
 providerConfigs:
   aws:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/azure.yaml

@@ -6,7 +6,7 @@ provider: azure
 
 providerConfigs:
   azure:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/byom.yaml

@@ -6,7 +6,7 @@ provider: byom
 
 providerConfigs:
   byom:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/docker.yaml

@@ -11,7 +11,7 @@ image:
 
 providerConfigs:
   docker: {}
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/gcp.yaml

@@ -6,7 +6,7 @@ provider: gcp
 
 providerConfigs:
   gcp:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/ibmcloud.yaml

@@ -6,7 +6,7 @@ provider: ibmcloud
 
 providerConfigs:
   ibmcloud:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""
 

src/cloud-api-adaptor/install/charts/peerpods/providers/ibmcloudpowervs.yaml

@@ -6,7 +6,7 @@ provider: ibmcloudpowervs
 
 providerConfigs:
   ibmcloudpowervs:
-    # Comma-separated allowlist of cloud-specific pod annotations that may override operator VM configuration
+    # Comma-separated allowlist of GCP or Azure pod annotations that may override operator VM configuration
     # (default: "")
     # ALLOWED_CLOUD_CONFIG_ANNOTATIONS: ""