Support AMD SEV-SNP on AWS #1420
Conversation
openshift-ci
bot
added
the
do-not-merge/work-in-progress
fangge1212
changed the title
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@fangge1212: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
fangge1212
force-pushed
the
amd_sev_snp
branch
3 times, most recently
from
f2bdae6 to
d90c629
Compare
| { | ||
| testCase: "with confidentialCompute empty", | ||
| modifySpec: func(p *machinev1beta1.AWSMachineProviderConfig) { | ||
| p.CPUOptions = &machinev1beta1.CPUOptions{ | ||
| ConfidentialCompute: ptr.To(machinev1beta1.AWSConfidentialComputePolicy("")), | ||
| } | ||
| }, | ||
| expectedOk: true, | ||
| }, |
There was a problem hiding this comment.
I would not have expected this to be a valid case.
There was a problem hiding this comment.
Do you mean this should be a negative scenario?
There was a problem hiding this comment.
Correct. Because the set of allowed values in the API definition do not allow this to be explicitly set to the empty string ("") this should not be an allowed configuration.
…onfig This change introduces webhook validation for the CPUOptions field in AWSMachineProviderConfig. The validation ensures that if cpuOptions is provided, its confidentialCompute value is either empty or one of the supported policies: - Disabled - AMDEncryptedVirtualizationNestedPaging Signed-off-by: Fangge Jin <[email protected]>
fangge1212
force-pushed
the
amd_sev_snp
branch
from
d90c629 to
4d91e07
Compare
This change introduces webhook validation for the CPUOptions field in AWSMachineProviderConfig. The validation ensures that if cpuOptions is provided, its confidentialCompute value is either empty or one of the supported policies: