From 1ea4e67aa32a278668b032b888b39475167c1478 Mon Sep 17 00:00:00 2001 From: Mike McKiernan Date: Tue, 25 Aug 2026 10:33:27 -0400 Subject: [PATCH 1/2] fix: clarify prereq, installed, post-inst Signed-off-by: Mike McKiernan --- .../supported-platforms.rst | 71 +++++++++++++++---- 1 file changed, 56 insertions(+), 15 deletions(-) diff --git a/confidential-containers/supported-platforms.rst b/confidential-containers/supported-platforms.rst index e12c37cfc..2ca3827b5 100644 --- a/confidential-containers/supported-platforms.rst +++ b/confidential-containers/supported-platforms.rst @@ -28,7 +28,7 @@ This page is relevant to the following users: * The :ref:`Hardware IT Administrator ` uses the hardware tables to confirm that the selected CPU and GPU are validated for Confidential Computing before configuring the system. * The :ref:`Host OS Administrator ` uses the hardware tables to confirm validated host OS and kernel versions. -* The :ref:`Kubernetes Cluster Administrator ` uses the software component matrix to confirm that the correct versions are in place before beginning cluster installation. +* The :ref:`Kubernetes Cluster Administrator ` uses the component matrix to confirm supported versions. ******** Hardware @@ -75,16 +75,16 @@ NVIDIA GPUs For both single and multi GPU Passthrough, all GPUs on the host must be configured for Confidential Computing and all GPUs must be assigned to one Confidential Container virtual machine. Configuring only some GPUs on a node for Confidential Computing is not supported. -CPU Platforms -============= +Host Platforms +============== .. flat-table:: :header-rows: 1 - * - Category + * - CPU Platform - TEE - - Operating System - - Kernel Version + - Host Operating System + - Host Kernel Version * - AMD Genoa / Milan - AMD SEV-SNP - Ubuntu 25.10 or 26.04 @@ -115,11 +115,44 @@ For additional resources on machine setup: Supported Software Components ***************************** +Cluster and Deployment Software +================================ + +The installation guides begin with an existing Kubernetes cluster that uses ``containerd``. +You then install Kata Containers and the NVIDIA GPU Operator. + .. flat-table:: :header-rows: 1 * - Component - Release/Version + - Installation + * - `Kubernetes `__ + - 1.32 \+ + - Prerequisite, must already be installed on the cluster hosts. + * - `containerd `__ + - 2.3.x + - Prerequisite, must already be installed on the cluster hosts. + * - `Kata Containers `__ + - ${kata_version} + - Installed with the ``kata-deploy`` Helm chart by following the :doc:`Quickstart Install ` or :doc:`Detailed Install Guide `. + * - `NVIDIA GPU Operator `__ and its components. + + Refer to the :ref:`GPU Operator Component Matrix ` for the list of components and versions included in each release. + - ${gpu_operator_version} and higher + - Installed by following the :doc:`Quickstart Install ` or :doc:`Detailed Install Guide `. + +Kata-provided Guest and Runtime Artifacts +========================================= + +The supported ``kata-deploy`` Helm chart installs the guest OS, guest kernel, OVMF, and QEMU artifacts listed in the following table as part of Kata Containers. +You do not supply or install these artifacts individually. + +.. flat-table:: + :header-rows: 1 + + * - Artifact + - Release/Version * - Guest OS - Distroless * - Guest kernel @@ -128,19 +161,27 @@ Supported Software Components - edk2-stable202511 * - `QEMU `__ - 10.1 \+ Patches - * - `Containerd `__ - - 2.3.x - * - `Kubernetes `__ - - 1.32 \+ - * - `NVIDIA GPU Operator `__ and its components. - Refer to the :ref:`GPU Operator Component Matrix ` for the list of components and versions included in each release. - - ${gpu_operator_version} and higher - * - `Kata Containers `__ - - ${kata_version} (installed with ``kata-deploy`` Helm chart) +Separately Deployed Components and Interfaces +============================================= + +The following components and interfaces are not installed by the :doc:`Quickstart Install ` or :doc:`Detailed Install Guide `. + +.. flat-table:: + :header-rows: 1 + + * - Interface or Component + - Version + - When It Is Needed + - How It Is Provided * - `Key Broker Service (KBS) protocol `__ - 0.4.0 + - Required for Trustee-based attestation and secret or key release. + - The :doc:`Attestation ` quickstart installs a local evaluation Trustee. + Deploy a production Trustee separately by following the upstream Confidential Containers documentation. * - `Kata Lifecycle Manager `__ - 0.1.8 + - Optional for Kata Containers upgrades and day-two lifecycle management. + - Install separately by following the upstream Kata Lifecycle Manager documentation. Users may leverage `Red Hat OpenShift Sandboxed Containers `__ to deploy Confidential Containers. From b20497dcdcb3f062aaba477cf5088b79e5faa4ef Mon Sep 17 00:00:00 2001 From: Mike McKiernan Date: Thu, 27 Aug 2026 11:23:49 -0400 Subject: [PATCH 2/2] docs: Add ref to genpolicy command Signed-off-by: Mike McKiernan --- confidential-containers/supported-platforms.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/confidential-containers/supported-platforms.rst b/confidential-containers/supported-platforms.rst index 2ca3827b5..7e613d174 100644 --- a/confidential-containers/supported-platforms.rst +++ b/confidential-containers/supported-platforms.rst @@ -183,5 +183,9 @@ The following components and interfaces are not installed by the :doc:`Quickstar - 0.1.8 - Optional for Kata Containers upgrades and day-two lifecycle management. - Install separately by following the upstream Kata Lifecycle Manager documentation. + * - `Kata Containers genpolicy `__ + - ${kata_version} + - Used to generate an agent security policy for attested production workloads. + - Download separately from the corresponding Kata Containers release. Users may leverage `Red Hat OpenShift Sandboxed Containers `__ to deploy Confidential Containers.