provider specific behavior isn't localized to providers

[gcoon151]

Example: https://github.com/confidential-containers/cloud-api-adaptor/blob/main/src/cloud-api-adaptor/podvm/files/usr/local/bin/setup-nat-for-imds.sh

#!/bin/bash
# This script sets up NAT for IMDS on Azure/AWS
# This is required for IMDS to work on Azure/AWS
# This script is executed as a oneshot systemd service
# during first boot

and I believe I've seen some afterburn stuff similarly executing everywhere.

For the moment I'm just noting it as it's caused me problems not running on AWS/Azure.

[mkulke]

I think the idia was/is to have a generic podvm build across cloud providers. while this would be neat e.g. for providing a single set of golden measurements, I'm not sure it's feasible: images could only be shred work across providers of the same arch. AFAIU GCP, IBM Cloud, Azure, AWS have different attestation schemes even for similar TEE archs, so we'll have to bundle everything and choose the appropriate workflow at runtime.

it's doable, I think we can have solid heuristics to detect the CSP via cpuid/dmi (see #2423) and we have to have a guest-component build with all the required attesters (and their runtime deps included) but I'm not sure it's worth it. the alternative would be CSP= flags at podvm build time.