podvm: Enable se image build for rhel with and without --no-verify

[ANJANA-A-R-K]

Made changes to build RHEL SE enabled podvm image with an extra Arg of SE_VERIFY=true

- Description of the problem which is fixed/What is the use case
This PR introduces an additional feature to verify and download required certificates for secure environments when the SE_VERIFY tag is set to true

- What I did
I added a conditional block that checks if the SE_VERIFY environment variable is set to true. If so, it performs the following actions:

Downloads the IBM Z Host Key Signing Certificate (ibm-z-host-key-signing-gen2.crt).

Downloads the DigiCert CA certificate (DigiCertCA.crt).

Downloads the IBM Z Host Key CRL (ibm-z-host-key-gen2.crl).

- How to verify it
Built and deploy the pod VM image.

[root@bastion-rr-initdata ~]# oc get pods
NAME          READY   STATUS    RESTARTS   AGE
busybox-new   1/1     Running   0          41s

- Description for the changelog
Added SE_VERIFY flag to enable downloading and verifying security certificates for secure prod environments.

[openshift-ci]

Hi @ANJANA-A-R-K. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bpradipt]

Is IMAGE_NAME used in libvirt handler ?

[ANJANA-A-R-K]

yes it is being referenced in cloud-api-adaptor https://github.com/confidential-containers/cloud-api-adaptor/blob/0fb6afebc06909a2a6da62f389bb3abe5eda05f2/src/cloud-api-adaptor/podvm/Makefile.inc#L70
without this parameter the image creation jobs fails.
Makefile.inc:77: *** Failed to derive an image name. Explicitly define IMAGE_NAME. Stop.

[bpradipt]

nit: For other providers we are setting IMAGE_NAME in the handler code. You may want to check that to be sure..

[bpradipt]

lgtm

[snir911]

LGTM, also if it would make sense maybe it should be considered to have the certificates statically

[littlejawa]

/ok-to-test

[openshift-ci]

@ANJANA-A-R-K: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.