values-baremetal.yaml

# Bare metal deployment for confidential containers.
# Supports Intel TDX and AMD SEV-SNP with optional NVIDIA GPU.
# Hardware profile (global.hardware.profile) controls which operators are active.
# Set main.clusterGroupName: baremetal in values-global.yaml to use.

clusterGroup:
  name: baremetal
  isHubCluster: true
  namespaces:
  - open-cluster-management
  - vault
  - external-secrets-operator:
      operatorGroup: true
      targetNamespaces: []
  - external-secrets
  - openshift-sandboxed-containers-operator
  - trustee-operator-system
  - cert-manager-operator
  - cert-manager
  - hello-openshift
  - kbs-access
  - openshift-cnv
  - openshift-storage
  - openshift-nfd
  - baremetal
  - intel-dcap
  - intel-dcap-operator-system:
      operatorGroup: true
      targetNamespaces: []
  - nvidia-gpu-operator
  - gpu-workload
  - kyverno
  - kubevirt-vms

  subscriptions:
    acm:
      name: advanced-cluster-management
      namespace: open-cluster-management
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    eso:
      name: openshift-external-secrets-operator
      namespace: external-secrets-operator
      channel: stable-v1
    sandbox:
      name: sandboxed-containers-operator
      namespace: openshift-sandboxed-containers-operator
      channel: stable
      installPlanApproval: Manual
      csv: sandboxed-containers-operator.v1.13.0
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    trustee:
      name: trustee-operator
      namespace: trustee-operator-system
      channel: stable
      installPlanApproval: Manual
      csv: trustee-operator.v1.2.0
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    cert-manager:
      name: openshift-cert-manager-operator
      namespace: cert-manager-operator
      channel: stable-v1
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    lvm-operator:
      name: lvms-operator
      namespace: openshift-storage
    cnv:
      name: kubevirt-hyperconverged
      namespace: openshift-cnv
      channel: stable
    nfd:
      name: nfd
      namespace: openshift-nfd
      channel: stable
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    intel-device-plugins:
      name: intel-device-plugins-operator
      namespace: openshift-operators
      # Required for airgap -- set to your mirrored catalog source name
      # source: cs-certified-operator-index-v4-22
      channel: stable
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    intel-tdx-dcap:
      name: intel-tdx-dcap-operator
      namespace: intel-dcap-operator-system
      # Required for airgap -- set to your mirrored catalog source name
      # source: cs-certified-operator-index-v4-22
      channel: alpha
      annotations:
        argocd.argoproj.io/sync-wave: "10"
    # GPU operator disabled — NVIDIA bundle image has oc-mirror signature issue.
    # Re-enable when NVIDIA bundle is mirrored or upstream fix lands.
    # gpu-operator:
    #   name: gpu-operator-certified
    #   namespace: nvidia-gpu-operator
    #   source: cs-certified-operator-index-v4-22
    #   channel: v26.3
    #   installPlanApproval: Manual
    #   csv: gpu-operator-certified.v26.3.0
    #   annotations:
    #     argocd.argoproj.io/sync-wave: "25"
  projects:
  - hub
  - vault
  - trustee
  - external-secrets
  - sandbox
  - workloads
  - default

  # Explicitly mention the cluster-state based overrides we plan to use for this pattern.
  # We can use self-referential variables because the chart calls the tpl function with these variables defined
  sharedValueFiles:
  - '/overrides/values-{{ $.Values.global.clusterPlatform }}.yaml'
  - '/overrides/values-storage-{{ $.Values.global.storageProvider }}.yaml'
  - '/overrides/values-{{ $.Values.global.clusterVersion }}.yaml'
  - '/overrides/values-hw-{{ $.Values.global.hardware.profile }}.yaml'
  - '/overrides/values-baremetal-airgap.yaml'

  extraObjects:
    wait-for-vault-unsealed:
      apiVersion: batch/v1
      kind: Job
      metadata:
        name: wait-for-vault-unsealed
        annotations:
          argocd.argoproj.io/hook: Sync
          argocd.argoproj.io/hook-delete-policy: HookSucceeded,BeforeHookCreation
          argocd.argoproj.io/sync-wave: "5"
      spec:
        backoffLimit: 10
        activeDeadlineSeconds: 1800
        template:
          spec:
            restartPolicy: OnFailure
            containers:
              - name: wait-for-vault
                image: registry.redhat.io/openshift4/ose-cli:latest
                command:
                  - /bin/bash
                  - -c
                  - |
                    echo "Waiting for vault to be unsealed..."
                    while true; do
                      if curl -sk https://vault.vault.svc:8200/v1/sys/seal-status | grep -q '"sealed":false'; then
                        echo "Vault unsealed. Waiting 120s for secrets to load..."
                        sleep 120
                        echo "Done. Proceeding."
                        exit 0
                      fi
                      echo "Vault not ready. Retrying in 15s..."
                      sleep 15
                    done

  applications:
    acm:
      name: acm
      namespace: open-cluster-management
      project: hub
      chart: acm
      chartVersion: 0.1.*
      # Required for airgap -- set to your mirrored catalog source name
      # overrides:
      #   - name: acm.mce_operator.source
      #     value: "cs-redhat-operator-index-v4-22"

    vault:
      name: vault
      namespace: vault
      project: vault
      chart: hashicorp-vault
      chartVersion: 0.1.*
      annotations:
        argocd.argoproj.io/sync-wave: "0"

    secrets-operator:
      name: openshift-external-secrets
      namespace: external-secrets
      project: external-secrets
      chart: openshift-external-secrets
      chartVersion: 0.0.*
      annotations:
        argocd.argoproj.io/sync-wave: "0"

    trustee:
      name: trustee
      namespace: trustee-operator-system
      project: trustee
      chart: trustee
      chartVersion: 0.10.*
      annotations:
        argocd.argoproj.io/sync-wave: "20"
      extraValueFiles:
        - '/overrides/values-trustee.yaml'
      overrides:
        # Enable attestation-gated secret delivery via KBS
        - name: global.coco.secured
          value: "true"
        # TDX attestation — enables Intel TDX reference value verification in AS
        - name: kbs.tdx.enabled
          value: "true"
        # GPU attestation — enables NVIDIA CC GPU reference value verification
        - name: kbs.gpu.enabled
          value: "true"
        # Bare metal mode — uses firmware reference values (not peer-pod PCR measurements)
        - name: kbs.baremetal.enabled
          value: "true"
        # Inject mirror-registry CA into KBS trust store (required for airgap image pulls)
        - name: kbs.registryCa.enabled
          value: "true"
        # TDX DCAP collateral — offline attestation without Intel PCS network access.
        # Collateral is collected via `make collect-dcap-collateral` and loaded into Vault.
        # The file path below is where the AS container mounts the collateral from its ESO secret.
        - name: kbs.tdx.collateralService
          value: "file:///opt/confidential-containers/attestation-service/tdx/platform_collaterals.json"
        - name: kbs.tdx.collateralMountPath
          value: "/opt/confidential-containers/attestation-service/tdx"
        - name: kbs.tdx.collateralFileName
          value: "platform_collaterals.json"

    storage:
      name: storage
      namespace: openshift-storage
      project: hub
      path: charts/hub/storage
      annotations:
        argocd.argoproj.io/sync-wave: "0"

    baremetal:
      name: baremetal
      namespace: baremetal
      project: hub
      path: charts/all/baremetal
      annotations:
        argocd.argoproj.io/sync-wave: "10"

    sandbox:
      name: sandbox
      namespace: openshift-sandboxed-containers-operator
      project: sandbox
      annotations:
        argocd.argoproj.io/sync-wave: "10"
      chart: sandboxed-containers
      chartVersion: 0.2.*
      overrides:
        - name: enablePeerPods
          value: "false"


    intel-dcap:
      name: intel-dcap
      namespace: intel-dcap
      project: hub
      path: charts/all/intel-dcap
      annotations:
        argocd.argoproj.io/sync-wave: "20"
      ignoreDifferences:
        - group: deviceplugin.intel.com
          kind: SgxDevicePlugin
          name: sgxdeviceplugin-sample
          jsonPointers:
            - /spec
        - group: trustedservices.intel.com
          kind: TdxQuoteGenerationService
          name: intel-tdx-dcap
          jsonPointers:
            - /spec
            - /status

    # KubeVirt confidential containers support (experimental)
    # Deploys HyperConverged CR with TDX feature gate and SELinux MCO for QGS socket access.
    # Requires Intel TDX hardware and CNV operator. Gated by chart-level values.
    # Uncomment to enable:
    # kubevirtconfidential:
    #   name: kubevirtconfidential
    #   namespace: openshift-cnv
    #   project: hub
    #   path: charts/all/kubevirtconfidential
    #   annotations:
    #     argocd.argoproj.io/sync-wave: "30"

    # KubeVirt test VMs (experimental)
    # Baseline and TDX-enabled RHEL9 VMs for validating confidential VM workloads.
    # Requires kubevirtconfidential above and LVM storage. Gated by chart-level values.
    # Uncomment to enable:
    # kubevirtvm:
    #   name: kubevirtvm
    #   namespace: kubevirt-vms
    #   project: hub
    #   path: charts/all/kubevirtvm
    #   annotations:
    #     argocd.argoproj.io/sync-wave: "35"
    #   syncPolicy:
    #     automated:
    #       prune: true

    # GPU apps disabled — depends on gpu-operator subscription (disabled above).
    # nvidia-gpu:
    #   name: nvidia-gpu
    #   namespace: nvidia-gpu-operator
    #   project: hub
    #   path: charts/all/nvidia-gpu
    #   annotations:
    #     argocd.argoproj.io/sync-wave: "25"

    # gpu-workload:
    #   name: gpu-workload
    #   namespace: gpu-workload
    #   project: workloads
    #   path: charts/coco-supported/gpu-workload
    #   annotations:
    #     argocd.argoproj.io/sync-wave: "30"
    #   syncPolicy:
    #     automated:
    #       prune: true

    sandbox-policies:
      name: sandbox-policies
      namespace: openshift-sandboxed-containers-operator
      project: sandbox
      chart: sandboxed-policies
      chartVersion: 0.2.*
      annotations:
        argocd.argoproj.io/sync-wave: "20"

    hello-openshift:
      name: hello-openshift
      namespace: hello-openshift
      project: workloads
      path: charts/coco-supported/hello-openshift
      annotations:
        argocd.argoproj.io/sync-wave: "30"
      # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM.
      # Uncomment and set MIRROR_REGISTRY_HOST to your mirror registry.
      # overrides:
      #   - name: image
      #     value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
      syncPolicy:
        automated:
          prune: true

    kbs-access-curl:
      name: kbs-access-curl
      namespace: kbs-access
      project: workloads
      path: charts/coco-supported/kbs-access-curl
      annotations:
        argocd.argoproj.io/sync-wave: "30"
      # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM.
      # overrides:
      #   - name: image
      #     value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
      #   - name: initImage
      #     value: "MIRROR_REGISTRY_HOST:8443/ubi9/ubi:latest"
      syncPolicy:
        automated:
          prune: true

    kbs-access-sealed:
      name: kbs-access-sealed
      namespace: kbs-access
      project: workloads
      path: charts/coco-supported/kbs-access-sealed
      annotations:
        argocd.argoproj.io/sync-wave: "30"
      # Required for airgap — CoCo guest VMs pull images directly, no IDMS/ITMS in the CVM.
      # overrides:
      #   - name: image
      #     value: "MIRROR_REGISTRY_HOST:8443/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
      syncPolicy:
        automated:
          prune: true

    kyverno:
      name: kyverno
      namespace: kyverno
      project: hub
      path: charts/vendor/kyverno
      annotations:
        argocd.argoproj.io/sync-wave: "0"
      syncPolicy:
        automated: {}
        retry:
          limit: 20
        syncOptions:
          - ServerSideApply=true
          - RespectIgnoreDifferences=true
      ignoreDifferences:
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: deletingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: generatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: imagevalidatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: mutatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: namespaceddeletingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: namespacedgeneratingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: namespacedimagevalidatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: namespacedmutatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: namespacedvalidatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: policyexceptions.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
        - group: apiextensions.k8s.io
          kind: CustomResourceDefinition
          name: validatingpolicies.policies.kyverno.io
          jsonPointers:
            - /metadata/labels
            - /metadata/annotations
      extraValueFiles:
        - '/overrides/values-kyverno.yaml'
      overrides:
        - name: backgroundController.resources.limits.memory
          value: "512Mi"
        - name: backgroundController.resources.requests.memory
          value: "256Mi"

    coco-kyverno-policies:
      name: coco-kyverno-policies
      namespace: openshift-sandboxed-containers-operator
      project: sandbox
      path: charts/all/coco-kyverno-policies
      annotations:
        argocd.argoproj.io/sync-wave: "20"

  imperative:
    # NOTE: We *must* use lists and not hashes. As hashes lose ordering once parsed by helm
    # The default schedule is every 10 minutes: imperative.schedule
    # Total timeout of all jobs is 1h: imperative.activeDeadlineSeconds
    # imagePullPolicy is set to always: imperative.imagePullPolicy
    # For additional overrides that apply to the jobs, please refer to
    # https://validatedpatterns.io/imperative-actions/#additional-job-customizations
    serviceAccountCreate: true
    clusterRoleYaml:
      - apiGroups:
        - '*'
        resources:
        - '*'
        verbs:
        - '*'
    jobs:
    - name: init-data-gzipper
      playbook: ansible/init-data-gzipper.yaml
      verbosity: -vvv
      timeout: 3600
    - name: reconcile-kataconfig-gpu
      playbook: ansible/reconcile-kataconfig-gpu.yaml
      verbosity: -vvv
      timeout: 600