Skip to content

Commit 4caab92

Browse files
pawelprospawelpros
committed
docs: Updated installation using helm charts
Signed-off-by: Pawel Proskurnicki <pawel.proskurnicki@intel.com>
1 parent 3f08059 commit 4caab92

File tree

6 files changed

+189
-27
lines changed

6 files changed

+189
-27
lines changed

‎assets/scss/_styles_project.scss‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
@import 'td/code-dark'
1+
@import 'td/code-dark';

content/en/docs/getting-started/installation.md renamed to content/en/docs/getting-started/installation/_index.md

Lines changed: 41 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,36 @@
11
---
2-
title: Installation
2+
title: Installation
33
description: Installing Confidential Containers with Helm charts
4-
weight: 20
4+
weight: 11
55
categories:
6-
- getting-started
6+
- getting-started
77
tags:
8-
- helm
9-
- installation
8+
- helm
9+
- installation
1010
---
11+
1112
{{% alert title="Note" color="primary" %}}
1213
Make sure you have completed the pre-requisites before installing Confidential Containers.
1314
{{% /alert %}}
1415

15-
### Install CoCo with Helm
16+
## Install CoCo with Helm
1617

17-
Install the CoCo runtime using the Helm chart, substituting `<VERSION>` with the desired
18-
[release version](https://github.com/confidential-containers/charts/releases):
18+
Install the CoCo runtime using the Helm chart from the Confidential Containers charts
19+
repository.
1920

21+
{{< tabpane text=true right=true >}}
22+
{{% tab header="Latest release" lang="bash" %}}
23+
Install the latest released version:
24+
```bash
25+
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
26+
--namespace coco-system \
27+
--create-namespace
2028
```
29+
{{% /tab %}}
30+
{{% tab header="Pinned version" lang="bash" %}}
31+
Substitute `<VERSION>` with the desired [release version](https://github.com/confidential-containers/charts/releases):
32+
33+
```bash
2134
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
2235
--version <VERSION> \
2336
--namespace coco-system \
@@ -26,16 +39,18 @@ helm install coco oci://ghcr.io/confidential-containers/charts/confidential-cont
2639

2740
For example, to install version v0.18.0:
2841

29-
```
42+
```bash
3043
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
31-
--version v0.18.0 \
44+
--version 0.18.0 \
3245
--namespace coco-system \
3346
--create-namespace
3447
```
48+
{{% /tab %}}
49+
{{< /tabpane >}}
3550

3651
Wait until each pod has the STATUS of Running.
3752

38-
```
53+
```bash
3954
kubectl get pods -n coco-system --watch
4055
```
4156

@@ -45,14 +60,14 @@ see the [charts repository documentation](https://github.com/confidential-contai
4560
### Verify Installation
4661

4762
See if the expected runtime classes were created.
48-
```
63+
```bash
4964
kubectl get runtimeclass
5065
```
5166

5267
The available runtimeclasses depend on the architecture:
5368

5469
{{< tabpane text=true right=true >}}
55-
{{% tab header="x86_64" lang="bash" %}}
70+
{{% tab header="x86_64" lang="bash" %}}
5671
| runtimeclass | Description |
5772
| ------------ | ----------- |
5873
| `kata-qemu-coco-dev` | Development/testing runtime |
@@ -61,18 +76,26 @@ The available runtimeclasses depend on the architecture:
6176
| `kata-qemu-tdx` | Intel TDX |
6277
| `kata-qemu-nvidia-gpu-snp` | NVIDIA GPU with AMD SEV-SNP protection |
6378
| `kata-qemu-nvidia-gpu-tdx` | NVIDIA GPU with Intel TDX protection |
64-
{{% /tab %}}
65-
{{% tab header="s390x" lang="bash" %}}
79+
{{% /tab %}}
80+
{{% tab header="s390x" lang="bash" %}}
6681
| runtimeclass | Description |
6782
| ------------ | ----------- |
6883
| `kata-qemu-coco-dev` | Development/testing runtime |
6984
| `kata-qemu-coco-dev-runtime-rs` | Development/testing runtime (Rust-based) |
7085
| `kata-qemu-se` | IBM Secure Execution |
7186
| `kata-qemu-se-runtime-rs` | IBM Secure Execution (Rust-based) |
72-
{{% /tab %}}
73-
{{% tab header="peer-pods" lang="bash" %}}
87+
{{% /tab %}}
88+
{{% tab header="peer-pods" lang="bash" %}}
7489
| runtimeclass | Description |
7590
| ------------ | ----------- |
7691
| `kata-remote` | Peer-pods |
77-
{{% /tab %}}
92+
{{% /tab %}}
7893
{{< /tabpane >}}
94+
95+
### Uninstall
96+
97+
To uninstall Confidential Containers and delete the `coco-system` namespace, run:
98+
```bash
99+
helm uninstall coco --namespace coco-system
100+
kubectl delete namespace coco-system
101+
```

‎content/en/docs/getting-started/installation/advanced_configuration.md‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
title: Customization
3+
description: Customize the Helm chart deployment of Confidential Containers
4+
weight: 1
5+
categories:
6+
- installation
7+
- helm
8+
---
9+
The Helm chart can be customized by passing additional parameters to the `helm install` command.
10+
11+
## Important Notes
12+
13+
1. **Node Selectors:** When setting node selectors with dots in the key, escape them: `node-role\.kubernetes\.io/worker`
14+
2. **Namespace:** All examples use `coco-system` namespace. Adjust as needed for your environment
15+
3. **Architecture:** The default architecture is x86_64. Other architectures must be explicitly specified
16+
4. **Comma Escaping:** When using `--set` with values containing commas, escape them with `\,`
17+
18+
## Customizing deployment
19+
20+
You can combine architecture values files (with `-f`) and/or with `--set` flags for customizations.
21+
22+
23+
### Using `--set` flags
24+
25+
To customize the installation using `--set` flags, run one of the following commands based on your architecture:
26+
27+
```bash
28+
# For x86_64
29+
30+
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
31+
--set kata-as-coco-runtime.debug=true \
32+
--namespace coco-system \
33+
--create-namespace
34+
35+
# For s390x
36+
37+
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
38+
-f https://raw.githubusercontent.com/confidential-containers/charts/main/values/kata-s390x.yaml \
39+
--set kata-as-coco-runtime.debug=true \
40+
--namespace coco-system \
41+
--create-namespace
42+
```
43+
44+
Parameters that are commonly customized (use `--set` flags):
45+
46+
| Parameter | Description | Default |
47+
|-----------------------------------------|---------------------------------------------------------|----------|
48+
| `kata-as-coco-runtime.imagePullPolicy` | Image pull policy | `Always` |
49+
| `kata-as-coco-runtime.imagePullSecrets` | Image pull secrets for private registry | `[]` |
50+
| `kata-as-coco-runtime.k8sDistribution` | Kubernetes distribution (k8s, k3s, rke2, k0s, microk8s) | `k8s` |
51+
| `kata-as-coco-runtime.nodeSelector` | Node selector for deployment | `{}` |
52+
| `kata-as-coco-runtime.debug` | Enable debug logging | `false` |
53+
54+
#### Structured Configuration (Kata Containers)
55+
56+
The chart uses Kata Containers' structured configuration format for TEE shims. Parameters set by architecture-specific
57+
kata runtime values files:
58+
59+
| Parameter | Description | Set by values/kata-*.yaml |
60+
|--------------------------------------------------------------------|-----------------------------------------------------------------------------------------|---------------------------|
61+
| `architecture` | Architecture label for NOTES | `x86_64` or `s390x` |
62+
| `kata-as-coco-runtime.snapshotter.setup` | Array of snapshotters to set up (e.g., `["nydus"]`) | Architecture-specific |
63+
| `kata-as-coco-runtime.shims.<shim-name>.enabled` | Enable/disable specific shim (e.g., `qemu-snp`, `qemu-tdx`, `qemu-se`, `qemu-coco-dev`) | Architecture-specific |
64+
| `kata-as-coco-runtime.shims.<shim-name>.supportedArches` | List of architectures supported by the shim | Architecture-specific |
65+
| `kata-as-coco-runtime.shims.<shim-name>.containerd.snapshotter` | Snapshotter to use for containerd (e.g., `nydus`, `""` for none) | Architecture-specific |
66+
| `kata-as-coco-runtime.shims.<shim-name>.containerd.forceGuestPull` | Enable experimental force guest pull | `false` |
67+
| `kata-as-coco-runtime.shims.<shim-name>.crio.guestPull` | Enable guest pull for CRI-O | Architecture-specific |
68+
| `kata-as-coco-runtime.shims.<shim-name>.agent.httpsProxy` | HTTPS proxy for guest agent | `""` |
69+
| `kata-as-coco-runtime.shims.<shim-name>.agent.noProxy` | No proxy settings for guest agent | `""` |
70+
| `kata-as-coco-runtime.runtimeClasses.enabled` | Create runtimeclass resources | `true` |
71+
| `kata-as-coco-runtime.runtimeClasses.createDefault` | Create default k8s runtimeclass | `false` |
72+
| `kata-as-coco-runtime.runtimeClasses.defaultName` | Name for default runtimeclass | `"kata"` |
73+
| `kata-as-coco-runtime.defaultShim.<arch>` | Default shim per architecture (e.g., `amd64: qemu-snp`) | Architecture-specific |
74+
75+
#### Additional Parameters (kata-deploy options)
76+
77+
These inherit from kata-deploy defaults but can be overridden:
78+
79+
| Parameter | Description | Default |
80+
|-----------------------------------------------|-----------------------------------|---------------------------------------|
81+
| `kata-as-coco-runtime.image.reference` | Kata deploy image | `quay.io/kata-containers/kata-deploy` |
82+
| `kata-as-coco-runtime.image.tag` | Kata deploy image tag | Chart's application version |
83+
| `kata-as-coco-runtime.env.installationPrefix` | Installation path prefix | `""` (uses kata-deploy defaults) |
84+
| `kata-as-coco-runtime.env.multiInstallSuffix` | Suffix for multiple installations | `""` |
85+
86+
See [quickstart](https://github.com/confidential-containers/charts/blob/main/QUICKSTART.md) for complete customization examples and usage.
87+
88+
### Using file based values
89+
90+
Prepare `my-values.yaml` file in one of the following ways:
91+
92+
- Using latest default values downloaded from the chart:
93+
94+
```bash
95+
helm show values oci://ghcr.io/confidential-containers/charts/confidential-containers > my-values.yaml
96+
```
97+
98+
- Using newly created file `my-values.yaml` with your customizations, e.g., for s390x with debug and node selector:
99+
100+
```yaml
101+
architecture: s390x
102+
103+
kata-as-coco-runtime:
104+
env:
105+
debug: "true"
106+
shims: "qemu-coco-dev qemu-se"
107+
snapshotterHandlerMapping: "qemu-coco-dev:nydus,qemu-se:nydus"
108+
agentHttpsProxy: "http://proxy.example.com:8080"
109+
nodeSelector:
110+
node-role.kubernetes.io/worker: ""
111+
```
112+
113+
List of custom values examples can be found in the [examples-custom-values](https://github.com/confidential-containers/charts/blob/main/examples-custom-values.yaml).
114+
115+
Install chart using your custom values file:
116+
117+
```bash
118+
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
119+
-f my-values.yaml \
120+
--namespace coco-system \
121+
--create-namespace
122+
```
123+
124+
#### Multiple combined customization options
125+
126+
Customizations using `--set` flags can be combined with file based values using `-f`.
127+
128+
See below example which will provide s390x architecture, enable debug logging, and set a node selector for worker nodes.
129+
130+
```bash
131+
helm install coco oci://ghcr.io/confidential-containers/charts/confidential-containers \
132+
-f https://raw.githubusercontent.com/confidential-containers/charts/main/values/kata-s390x.yaml \
133+
--set kata-as-coco-runtime.env.debug=true \
134+
--set kata-as-coco-runtime.nodeSelector."node-role\.kubernetes\.io/worker"="" \
135+
--set kata-as-coco-runtime.k8sDistribution=k3s \
136+
--namespace coco-system \
137+
--create-namespace
138+
```

‎content/en/docs/getting-started/prerequisites/software.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Confidential Containers requires Kubernetes.
1212
A cluster must be installed before installing the Helm charts.
1313
Many different clusters can be used but they should meet the following requirements.
1414
- The minimum Kubernetes version is 1.24
15-
- Cluster must use `containerd`. Note: `cri-o` is not tested with the Helm charts for baremetal deployments.
15+
- Cluster must use `containerd` in version 1.7+ or newer. Note: `cri-o` is not tested with the Helm charts for baremetal deployments.
1616
- At least one node has the label `node.kubernetes.io/worker`.
1717
- SELinux is not enabled.
1818
- Helm 3.8+ is installed.

‎content/en/docs/getting-started/workload.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ Once you've used the Helm charts to install Confidential Containers, you can run
1212
First, we will use the `kata-qemu-coco-dev` runtime class which uses CoCo without hardware support.
1313
Initially we will try this with an unencrypted container image.
1414

15-
In this example, we will be using the bitnami/nginx image as described in the following yaml:
16-
```
15+
In this example, we will be using the nginx image as described in the following yaml:
16+
```yaml
1717
apiVersion: v1
1818
kind: Pod
1919
metadata:
@@ -24,8 +24,8 @@ metadata:
2424
io.containerd.cri.runtime-handler: kata-qemu-coco-dev
2525
spec:
2626
containers:
27-
- image: bitnami/nginx:1.22.0
28-
name: nginx
27+
- name: nginx
28+
image: nginx:1.29.4
2929
dnsPolicy: ClusterFirst
3030
runtimeClassName: kata-qemu-coco-dev
3131
```
@@ -36,16 +36,16 @@ the only requirement for the pod YAML.
3636
Create a pod YAML file as previously described (we named it `nginx.yaml`) .
3737

3838
Create the workload:
39-
```
39+
```bash
4040
kubectl apply -f nginx.yaml
4141
```
4242
Output:
43-
```
43+
```bash
4444
pod/nginx created
4545
```
4646

4747
Ensure the pod was created successfully (in running state):
48-
```
48+
```bash
4949
kubectl get pods
5050
```
5151
Output:

‎styles/config/vocabularies/coco/accept.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,3 +164,4 @@ RTMR[s]
164164
vTPM[s]
165165
SBOM[s]
166166
Tekton
167+
snapshotter[s]

0 commit comments

Comments
 (0)