Skip to content

Conversation

@cw-kojima1003
Copy link

Summary:
This pull request allows cloud-api-adaptor(CAA) to support OpenStack-based clouds.

Background:
There is currently no provider in CAA that supports clouds built with standard OpenStack.
By implementing an OpenStack provider, we can offer secure pod execution environments in a wider range of fields.

As stated in the link below, we are focusing on implementations related to ARM CCA.
This PR provides an architecture-independent implementation.
Moving forward, we aim to execute PeerPods on OpenStack clouds that support ARM CCA.

Links:
This PR is for the purpose and related work described in the following Issue.
#2387

Task:
Adding an built-in Provider for OpenStack, referring to the following documentation.

https://github.com/confidential-containers/cloud-api-adaptor/blob/main/src/cloud-api-adaptor/docs/addnewprovider.md

  • Add and initialize the OpenStack provider manager
  • Add a definition for the configuration struct
  • Add cloud interfaces
  • Add provider interfaces
  • Add additional files to modularize the code
  • Add relevant unit tests
  • Update entrypoint.sh and Makefile

Implemented:

  • Launch Peer Pod with standard VM
  • Unit tests
  • Manual connectivity verification

Future implementation:

  • [] Validate user-data reception on the Pod VM image
    The user-data related features are currently foundational, with validation and testing for operational integrity still pending.
  • [] Create documentation for CAA deployment and Pod VM creation steps
  • [] Implement end-to-end (E2E) tests (CI) for the new provider
  • [] Enable CVM (Confidential Virtual Machine) launch for CCA support
  • [] Other features: pause-image, VXLAN, TLS, etc

This commit allows cloud-api-adaptor(CAA) to support OpenStack-based clouds.

There is currently no provider in CAA that supports clouds built with standard OpenStack.
By implementing an OpenStack provider, we can offer secure pod execution environments in a wider range of fields.

Adding an inbox Provider for OpenStack, referring to the following documentation.
---
https://github.com/confidential-containers/cloud-api-adaptor/blob/main/src/cloud-api-adaptor/docs/addnewprovider.md

- Add and initialize the OpenStack provider manager
- Add a definition for the configuration struct
- Add cloud interfaces
- Add provider interfaces
- Add additional files to modularize the code
- Add relevant unit tests
- Update entrypoint.sh and Makefile

Signed-off-by: cw-kojima1003 <[email protected]>
@cw-kojima1003 cw-kojima1003 requested a review from a team as a code owner January 26, 2026 10:32
Copy link
Collaborator

@mkulke mkulke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have some reservations about adding a provider without e2e tests, we cannot really make any statements about whether a provider is working or not without those.

What kind of PodVM image can be used with the provider?

@cw-kojima1003
Copy link
Author

@mkule, thank you for your comment.

The details of the Pod VM image used are as follows:

Image source: https://quay.io/repository/confidential-containers/podvm-generic-ubuntu-amd64

For obtaining the image, we used the download-image.sh script provided by CAA.
Here is the command we used to obtain the image:

$ ./src/cloud-api-adaptor/podvm/hack/download-image.sh quay.io/confidential-containers/podvm-generic-ubuntu-amd64:v0.17.0 . -o podvm.qcow2

The obtained image was placed within the locally constructed OpenStack cluster.

I have some reservations about adding a provider without e2e tests, we cannot really make any statements about whether a provider is working or not without those.

The e2e tests are currently underway and will be committed at a later date.
We initially planned to submit the e2e tests as a separate pull request, but we can also add them to this PR.
Could you please share your opinions on this?

Finally, I have conducted PeerPod functionality tests in my local environment.
BusyBox was used to initiate the Pod.
Below, you'll find the YAML file we referenced:

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: busybox
  name: busybox
spec:
  containers:
  - image: quay.io/prometheus/busybox
    name: busybox
    resources: {}
  dnsPolicy: ClusterFirst
  restartPolicy: Never
  runtimeClassName: kata-remote

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants