kubevirt / hyperconverged-cluster-operator / 35991659476

85%

push

github

Support Confidential Computing (#4519)

* api: expose WorkloadEncryptionSEV and WorkloadEncryptionTDX feature gates

Add two new alpha feature gates to the HyperConverged API to allow users
to enable confidential VM support without manually patching the KubeVirt CR.

- workloadEncryptionSEV: enables AMD SEV and SEV-SNP workload encryption,
  setting the WorkloadEncryptionSEV feature gate in the KubeVirt CR.
- workloadEncryptionTDX: enables Intel TDX workload encryption, setting
  the WorkloadEncryptionTDX feature gate in the KubeVirt CR.

Both are disabled by default (alpha phase). Hosts require the appropriate
hardware and kernel parameters to use these features.

Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com>
Assisted-by: claude-4.6-opus

* api: expose confidentialCompute configuration field

Allow users to configure cluster-level confidential computing settings
through the HyperConverged CR, instead of manually patching the KubeVirt
CR. The field is passed through to KubeVirt's spec.configuration using
the upstream type directly.

Currently this supports TDX attestation via QGS, configuring the socket
path and whether attestation is enforced for scheduling.

Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com>
Assisted-by: claude-4.6-opus

---------

Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com>

1 of 1 new or added line in 1 file covered. (100.0%)

11740 of 13863 relevant lines covered (84.69%)

2.21 hits per line