Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support Intel TDX instances on GCP #1814

Closed
2 tasks done
HuijingHei opened this issue Oct 18, 2024 · 7 comments · Fixed by coreos/coreos-assembler#4006
Closed
2 tasks done

Support Intel TDX instances on GCP #1814

HuijingHei opened this issue Oct 18, 2024 · 7 comments · Fixed by coreos/coreos-assembler#4006
Labels
jira for syncing to jira status/pending-stable-release Fixed upstream and in testing. Waiting on stable release.

Comments

@HuijingHei
Copy link
Member

HuijingHei commented Oct 18, 2024 •
edited
Loading

Google Cloud Platform supports "Confidential Compute Instances" which are run on Intel TDX hardware nodes, see https://cloud.google.com/blog/products/identity-security/rsa-google-intel-confidential-computing-more-secure.

In order to fully support this VM option, the images need to be marked as TDX_CAPABLE.

Check list:

  • Mark FCOS GCP images as TDX_CAPABLE.
  • Add a test to make sure that FCOS runs on TDX_CAPABLE instances in GCP.

Related AMD SEV-SNP issue, see:
@travier travier added the jira for syncing to jira label Jan 22, 2025
bgartzi added a commit to bgartzi/coreos-assembler that referenced this issue Jan 22, 2025
@bgartzi
gcloud: Enable TDX_CAPABLE
fa99e94 
Previous work: coreos#3547
Previous work: coreos#3871
Fixes: coreos/fedora-coreos-tracker#1814
Fixes: https://issues.redhat.com/browse/COS-3111
@bgartzi bgartzi mentioned this issue Jan 22, 2025
Merged
bgartzi added a commit to bgartzi/coreos-assembler that referenced this issue Jan 22, 2025
@bgartzi
gcloud: Enable TDX_CAPABLE
5f659ed 
Previous work: coreos#3547
Previous work: coreos#3871
Fixes: coreos/fedora-coreos-tracker#1814
Fixes: https://issues.redhat.com/browse/COS-3111
@jlebon
Copy link
Member

jlebon commented Jan 30, 2025

Re-open for tests.

@jlebon jlebon reopened this Jan 30, 2025
@HuijingHei
Copy link
Member Author

Maybe click the wrong button?

@HuijingHei HuijingHei reopened this Feb 7, 2025
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Feb 12, 2025
@HuijingHei
test: verify FCOS runs on TDX_CAPABLE instances in GCP
017bdda 
See coreos/fedora-coreos-tracker#1814

Use type `c3-standard-4` with only 1 disk that uses the NVMe
interface, as Intel TDX `c3-standard-4-lssd` is not supported yet.
(Refer to https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations)
@HuijingHei HuijingHei mentioned this issue Feb 12, 2025
Merged
@HuijingHei
Copy link
Member Author

Add test coreos/fedora-coreos-config#3356, welcome to review, thanks!

HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Feb 12, 2025
@HuijingHei
test: verify FCOS runs on TDX_CAPABLE instances in GCP
62a085b 
See coreos/fedora-coreos-tracker#1814

Use type `c3-standard-4` with only 1 disk that uses the NVMe
interface, as Intel TDX `c3-standard-4-lssd` is not supported yet.
(Refer to https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations)
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Feb 12, 2025
@HuijingHei
test: verify FCOS runs on TDX_CAPABLE instances in GCP
28d8786 
See coreos/fedora-coreos-tracker#1814

Use type `c3-standard-4` with only 1 disk that uses the NVMe
interface, as Intel TDX `c3-standard-4-lssd` is not supported yet.
(Refer to https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations)
HuijingHei added a commit to HuijingHei/fedora-coreos-config that referenced this issue Feb 12, 2025
@HuijingHei
test: verify FCOS runs on TDX_CAPABLE instances in GCP
d063918 
See coreos/fedora-coreos-tracker#1814

Use type `c3-standard-4` with only 1 disk that uses the NVMe
interface, as Intel TDX `c3-standard-4-lssd` is not supported yet.
(Refer to https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations)
HuijingHei added a commit to coreos/fedora-coreos-config that referenced this issue Feb 14, 2025
@HuijingHei
test: verify FCOS runs on TDX_CAPABLE instances in GCP
1dc0db3 
See coreos/fedora-coreos-tracker#1814

Use type `c3-standard-4` with only 1 disk that uses the NVMe
interface, as Intel TDX `c3-standard-4-lssd` is not supported yet.
(Refer to https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations#limitations)
@HuijingHei
Copy link
Member Author

And the related pipeline config update coreos/fedora-coreos-pipeline#1092

HuijingHei added a commit to HuijingHei/fedora-coreos-pipeline that referenced this issue Feb 14, 2025
@HuijingHei
Update config to run Intel TDX test
b34d9a4 
Update config to run SNP test and add Intel TDX test.
See:
- test script coreos/fedora-coreos-config#3356
- tracker issue coreos/fedora-coreos-tracker#1814
@HuijingHei
Copy link
Member Author

Close this issue as done.

@dustymabe dustymabe added status/pending-testing-release Fixed upstream. Waiting on a testing release. status/pending-next-release Fixed upstream. Waiting on a next release. status/pending-stable-release Fixed upstream and in testing. Waiting on stable release. labels Feb 14, 2025
@marmijo
Copy link
Member

marmijo commented Feb 18, 2025

The fix for this went into next stream release 41.20250215.1.0. Please try out the new release and report issues.

@marmijo
Copy link
Member

marmijo commented Feb 18, 2025

The fix for this went into testing stream release 41.20250215.2.0. Please try out the new release and report issues.

@marmijo marmijo removed status/pending-testing-release Fixed upstream. Waiting on a testing release. status/pending-next-release Fixed upstream. Waiting on a next release. labels Feb 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
jira for syncing to jira status/pending-stable-release Fixed upstream and in testing. Waiting on stable release.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

GCP: Mark images as TDX_CAPABLE bgartzi/coreos-assembler
5 participants
@dustymabe @jlebon @HuijingHei @marmijo @travier