Skip to content

Commit 01cdda9

Browse files
SNiemann15SNiemann15
committed
Enable IBM Secure Execution on ocpvirt
1 parent 665918f commit 01cdda9

File tree

4 files changed

+158
-0
lines changed

4 files changed

+158
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4820,6 +4820,8 @@ Topics:
48204820
File: virt-creating-vms-from-instance-types
48214821
- Name: Creating VMs from templates
48224822
File: virt-creating-vms-from-templates
4823+
- Name: Configuring IBM Secure Execution virtual machines on IBM Z and IBM LinuxONE
4824+
File: virt-configuring-ibm-secure-execution-vms-ibm-z
48234825
- Name: Advanced VM creation
48244826
Dir: creating_vms_advanced
48254827
Topics:

‎modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/virtual_machines/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-enabling-vms-ibm-secure-execution-ibm-z_{context}"]
7+
= Enabling VMs to run {ibm-name} Secure Execution on {ibm-z-name} and {ibm-linuxone-name}
8+
9+
To enable {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name} on the compute nodes of your cluster, you must ensure that you meet the prerequisites and complete the following steps.
10+
11+
.Prerequisites
12+
13+
* Your cluster has logical partition (LPAR) nodes running on {ibm-name} z15 or later, or {ibm-linuxone-name} III or later.
14+
* You have {ibm-name} Secure Execution workloads available to run on the cluster.
15+
* You have installed the {oc-first}.
16+
17+
.Procedure
18+
19+
. To run {ibm-name} Secure Execution VMs, you must add the `prot_virt=1` kernel parameter for each compute node. To enable all compute nodes, create a file named `secure-execution.yaml` that contains the following machine config manifest:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: machineconfiguration.openshift.io/v1
24+
kind: MachineConfig
25+
metadata:
26+
name: secure-execution
27+
labels:
28+
machineconfiguration.openshift.io/role: worker
29+
spec:
30+
kernelArguments:
31+
- prot_virt=1
32+
----
33+
+
34+
where:
35+
+
36+
`prot_virt=1`:: Specifies that the ultravisor can store memory security information.
37+
38+
. Apply the changes by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc apply -f secure-execution.yaml
43+
----
44+
+
45+
The Machine Config Operator (MCO) applies the changes and reboots the nodes in a controlled rollout.
46+
47+
. Edit the `HyperConverged` custom resource (CR) by running the following command:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged
52+
----
53+
54+
. Enable the feature gate for {ibm-name} Secure Execution by applying the following annotations:
55+
+
56+
[source,yaml,subs="attributes+"]
57+
----
58+
apiVersion: hco.kubevirt.io/v1beta1
59+
kind: HyperConverged
60+
metadata:
61+
annotations:
62+
kubevirt.kubevirt.io/jsonpatch: |-
63+
[
64+
{
65+
"op":"add",
66+
"path":"/spec/configuration/developerConfiguration/featureGates/-",
67+
"value":"SecureExecution"
68+
}
69+
]
70+
----

‎modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * virt/virtual_machines/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="virt-launching-ibm-secure-execution-vm-ibm-z_{context}"]
7+
= Launching an {ibm-title} Secure Execution VM on {ibm-z-title} and {ibm-linuxone-title}
8+
9+
Before launching an {ibm-name} Secure Execution VM on {ibm-z-name} and {ibm-linuxone-name}, you must add the `launchSecurity` parameter to the VM manifest. Otherwise, the VM does not boot correctly because it does not have access to the devices.
10+
11+
.Procedure
12+
13+
* Apply the following `VirtualMachine` manifest to the cluster:
14+
+
15+
[source,yaml]
16+
----
17+
apiVersion: kubevirt.io/v1
18+
kind: VirtualMachine
19+
metadata:
20+
labels:
21+
kubevirt.io/vm: f41-se
22+
name: f41-se
23+
spec:
24+
runStrategy: Always
25+
template:
26+
metadata:
27+
labels:
28+
kubevirt.io/vm: f41-se
29+
spec:
30+
domain:
31+
launchSecurity: {}
32+
devices:
33+
disks:
34+
- disk:
35+
bus: virtio
36+
name: rootfs
37+
machine:
38+
type: ""
39+
resources:
40+
requests:
41+
memory: 4Gi
42+
terminationGracePeriodSeconds: 0
43+
volumes:
44+
- name: rootfs
45+
dataVolume:
46+
name: f41-se
47+
----
48+
+
49+
To launch {ibm-name} Secure Execution VMs, you must include the following YAML in the manifest:
50+
+
51+
[source,yaml]
52+
----
53+
spec:
54+
domain:
55+
launchSecurity: {}
56+
----
57+
+
58+
The rest of the VM manifest is variable depending on your setup.
59+
+
60+
[NOTE]
61+
====
62+
Because the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs can only be migrated offline.
63+
====

‎virt/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
include::_attributes/common-attributes.adoc[]
3+
4+
[id="virt-configuring-ibm-secure-execution-vms-ibm-z"]
5+
= Configuring {ibm-title} Secure Execution virtual machines on {ibm-z-title} and {ibm-linuxone-title}
6+
7+
:context: virt-configuring-ibm-secure-execution-vms-ibm-z
8+
9+
toc::[]
10+
11+
You can configure {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}.
12+
13+
{ibm-name} Secure Execution for Linux is a s390x security technology that is introduced with {ibm-name} z15 and {ibm-linuxone-name} III. It protects data of workloads that run in a KVM guest from being inspected or modified by the server environment.
14+
15+
In particular, no hardware administrator, no KVM code, and no KVM administrator can access the data in a guest that was started as an IBM Secure Execution guest.
16+
17+
[role="_additional-resources"]
18+
.Additional resources
19+
* link:https://www.ibm.com/docs/en/linux-on-systems?topic=execution-introduction[What is IBM Secure Execution?]
20+
21+
include::modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc[leveloffset=+1]
22+
23+
include::modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)