feat(snc): add --profile flag with virtualization addon support

Add a profile system to the OpenShift SNC command that allows
installing addons on the cluster after deployment. The first
supported profile is 'virtualization' which installs the OCP
Virtualization (CNV) operator and enables nested virtualization
on the compute instance.

Author: jangel97

cmd/mapt/cmd/aws/services/snc.go

@@ -22,6 +22,9 @@ const (
 	pullSecretFileDesc          = "file path of image pull secret (download from https://console.redhat.com/openshift/create/local)"
 	disableClusterReadiness     = "disable-cluster-readiness"
 	disableClusterReadinessDesc = "If this flag is set it will skip the checks for the cluster readiness. In this case the kubeconfig can not be generated"
+
+	sncProfile     = "profile"
+	sncProfileDesc = "comma separated list of profiles to apply on the SNC cluster. Profiles available: virtualization"
 )
 
 func GetOpenshiftSNCCmd() *cobra.Command {
@@ -51,6 +54,11 @@ func createSNC() *cobra.Command {
 			if err := viper.BindPFlags(cmd.Flags()); err != nil {
 				return err
 			}
+			profiles := viper.GetStringSlice(sncProfile)
+			computeReq := params.ComputeRequestArgs()
+			if sncApi.ProfilesRequireNestedVirt(profiles) {
+				computeReq.NestedVirt = true
+			}
 			if _, err := openshiftsnc.Create(
 				&maptContext.ContextArgs{
 					Context:       cmd.Context(),
@@ -62,13 +70,14 @@ func createSNC() *cobra.Command {
 					Tags:          viper.GetStringMapString(params.Tags),
 				},
 				&sncApi.SNCArgs{
-					ComputeRequest:          params.ComputeRequestArgs(),
+					ComputeRequest:          computeReq,
 					Spot:                    params.SpotArgs(),
 					Version:                 viper.GetString(ocpVersion),
 					DisableClusterReadiness: viper.IsSet(disableClusterReadiness),
 					Arch:                    viper.GetString(params.LinuxArch),
 					PullSecretFile:          viper.GetString(pullSecretFile),
-					Timeout:                 viper.GetString(params.Timeout)}); err != nil {
+					Timeout:                 viper.GetString(params.Timeout),
+					Profiles:                profiles}); err != nil {
 				return err
 			}
 			return nil
@@ -82,6 +91,7 @@ func createSNC() *cobra.Command {
 	flagSet.StringP(pullSecretFile, "", "", pullSecretFileDesc)
 	flagSet.StringP(params.Timeout, "", "", params.TimeoutDesc)
 	flagSet.StringToStringP(params.Tags, "", nil, params.TagsDesc)
+	flagSet.StringSliceP(sncProfile, "", []string{}, sncProfileDesc)
 	params.AddComputeRequestFlags(flagSet)
 	params.AddSpotFlags(flagSet)
 	c.PersistentFlags().AddFlagSet(flagSet)

docs/aws/openshift-snc.md

@@ -47,3 +47,34 @@ After the AMI is published and accessible by the account, we can use the followi
 
 After the above command succeeds the `kubeconfig` to access the deployed cluster will be available in `/tmp/snc/kubeconfig`
 
+## Profiles
+
+Profiles are optional addons that are installed on the SNC cluster after it is ready. Use the `--profile` flag to enable one or more profiles:
+
+```
+mapt aws openshift-snc create \
+    --spot \
+    --version 4.21.0 \
+    --project-name mapt-snc \
+    --backed-url file:///Users/tester/workspace \
+    --conn-details-output /tmp/snc \
+    --pull-secret-file /Users/tester/Downloads/pull-secret \
+    --profile virtualization
+```
+
+Multiple profiles can be specified as a comma-separated list (e.g., `--profile virtualization,serverless`).
+
+### Available profiles
+
+| Profile | Description |
+|---------|-------------|
+| `virtualization` | Installs [OpenShift Virtualization](https://docs.openshift.com/container-platform/latest/virt/about_virt/about-virt.html) (CNV) on the cluster. This enables running virtual machines on the single node cluster. It also enables nested virtualization on the cloud instance. |
+
+### Adding new profiles
+
+To add a new profile, create the following files under `pkg/target/service/snc/`:
+
+1. `profile_<name>.go` — Go file that embeds the YAML manifests and returns the list of shell commands to execute on the SNC instance
+2. `profile_<name>_*.yaml` — YAML manifests for the profile (Namespace, Operator, CRs, etc.)
+3. Register the profile name in `profiles.go` by adding it to `validProfiles` and the `ProfileCommands()` switch
+

pkg/provider/aws/action/snc/snc.go

@@ -43,6 +43,7 @@ type openshiftSNCRequest struct {
 	timeout                 *string
 	pullSecretFile          *string
 	allocationData          *allocation.AllocationResult
+	profiles                []string
 }
 
 func (r *openshiftSNCRequest) validate() error {
@@ -63,6 +64,10 @@ func Create(mCtxArgs *mc.ContextArgs, args *apiSNC.SNCArgs) (_ *apiSNC.SNCResult
 	if err != nil {
 		return nil, err
 	}
+	// Validate profiles
+	if err := apiSNC.ValidateProfiles(args.Profiles); err != nil {
+		return nil, err
+	}
 	// Compose request
 	prefix := util.If(len(args.Prefix) > 0, args.Prefix, "main")
 	r := openshiftSNCRequest{
@@ -72,7 +77,8 @@ func Create(mCtxArgs *mc.ContextArgs, args *apiSNC.SNCArgs) (_ *apiSNC.SNCResult
 		disableClusterReadiness: args.DisableClusterReadiness,
 		arch:                    &args.Arch,
 		pullSecretFile:          &args.PullSecretFile,
-		timeout:                 &args.Timeout}
+		timeout:                 &args.Timeout,
+		profiles:                args.Profiles}
 	if args.Spot != nil {
 		r.spot = args.Spot.Spot
 	}
@@ -252,7 +258,7 @@ func (r *openshiftSNCRequest) deploy(ctx *pulumi.Context) error {
 		}
 	}
 	// Use kubeconfig as the readiness for the cluster
-	kubeconfig, err := kubeconfig(ctx, r.prefix, c, keyResources.PrivateKey, *r.version, r.disableClusterReadiness)
+	kubeconfig, err := kubeconfig(ctx, r.prefix, c, keyResources.PrivateKey, *r.version, r.disableClusterReadiness, r.profiles)
 	if err != nil {
 		return err
 	}
@@ -361,6 +367,7 @@ func kubeconfig(ctx *pulumi.Context,
 	c *compute.Compute, mk *tls.PrivateKey,
 	ocpVersion string,
 	disableClusterReadiness bool,
+	profiles []string,
 ) (pulumi.StringOutput, error) {
 	// Once the cluster setup is comleted we
 	// get the kubeconfig file from the host running the cluster
@@ -396,13 +403,29 @@ func kubeconfig(ctx *pulumi.Context,
 		return pulumi.StringOutput{}, err
 	}
 
+	// Execute profile commands after cluster is ready
+	var lastDep pulumi.Resource = ocpCaRotatedCmd
+	for _, profileName := range profiles {
+		for _, pc := range apiSNC.ProfileCommands(profileName) {
+			profileCmd, err := c.RunCommand(ctx,
+				pc.Command,
+				compute.LoggingCmdStd,
+				fmt.Sprintf("%s-%s", *prefix, pc.Name), apiSNC.OCPSNCID,
+				mk, amiUserDefault, nil, []pulumi.Resource{lastDep})
+			if err != nil {
+				return pulumi.StringOutput{}, err
+			}
+			lastDep = profileCmd
+		}
+	}
+
 	// Get content for /opt/kubeconfig
 	getKCCmd := ("sudo cat /opt/crc/kubeconfig")
 	getKC, err := c.RunCommand(ctx,
 		getKCCmd,
 		compute.NoLoggingCmdStd,
 		fmt.Sprintf("%s-kubeconfig", *prefix), apiSNC.OCPSNCID, mk, amiUserDefault,
-		nil, []pulumi.Resource{ocpCaRotatedCmd})
+		nil, []pulumi.Resource{lastDep})
 	if err != nil {
 		return pulumi.StringOutput{}, err
 	}

pkg/target/service/snc/api.go

@@ -49,6 +49,7 @@ type SNCArgs struct {
 	PullSecretFile          string
 	Spot                    *spotTypes.SpotArgs
 	Timeout                 string
+	Profiles                []string
 }
 
 type SNCResults struct {

pkg/target/service/snc/profile_virtualization.go

@@ -0,0 +1,39 @@
+package snc
+
+import (
+	_ "embed"
+	"fmt"
+)
+
+//go:embed profile_virtualization_operators.yaml
+var virtOperatorsManifest []byte
+
+//go:embed profile_virtualization_hco.yaml
+var virtHCOManifest []byte
+
+func virtualizationCommands() []ProfileCommand {
+	kcFlag := fmt.Sprintf("--kubeconfig %s", ClientKubeconfigPath)
+
+	applyOperators := fmt.Sprintf(
+		"sudo bash -c 'cat <<\"EOFMANIFEST\" | oc apply %s -f -\n%s\nEOFMANIFEST'",
+		kcFlag, string(virtOperatorsManifest))
+
+	waitCSV := fmt.Sprintf(
+		"sudo bash -c 'until oc get csv %s -n openshift-cnv -o jsonpath=\"{.items[0].status.phase}\" 2>/dev/null | grep -q Succeeded; do echo \"Waiting for CNV CSV...\"; sleep 15; done'",
+		kcFlag)
+
+	applyHCO := fmt.Sprintf(
+		"sudo bash -c 'cat <<\"EOFHCO\" | oc apply %s -f -\n%s\nEOFHCO'",
+		kcFlag, string(virtHCOManifest))
+
+	waitHCO := fmt.Sprintf(
+		"sudo bash -c 'until oc get hyperconverged kubevirt-hyperconverged %s -n openshift-cnv -o jsonpath=\"{.status.conditions[?(@.type==\\\"Available\\\")].status}\" 2>/dev/null | grep -q True; do echo \"Waiting for HyperConverged...\"; sleep 15; done'",
+		kcFlag)
+
+	return []ProfileCommand{
+		{Name: "virt-apply-operators", Command: applyOperators},
+		{Name: "virt-wait-csv", Command: waitCSV},
+		{Name: "virt-apply-hco", Command: applyHCO},
+		{Name: "virt-wait-hco-ready", Command: waitHCO},
+	}
+}

pkg/target/service/snc/profile_virtualization_hco.yaml

@@ -0,0 +1,6 @@
+apiVersion: hco.kubevirt.io/v1beta1
+kind: HyperConverged
+metadata:
+  name: kubevirt-hyperconverged
+  namespace: openshift-cnv
+spec: {}

pkg/target/service/snc/profile_virtualization_operators.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openshift-cnv
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: kubevirt-hyperconverged-group
+  namespace: openshift-cnv
+spec:
+  targetNamespaces:
+    - openshift-cnv
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: hco-operatorhub
+  namespace: openshift-cnv
+spec:
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+  name: kubevirt-hyperconverged
+  channel: stable
+  installPlanApproval: Automatic

pkg/target/service/snc/profiles.go

@@ -0,0 +1,48 @@
+package snc
+
+import (
+	"fmt"
+	"slices"
+)
+
+const (
+	ProfileVirtualization = "virtualization"
+)
+
+// validProfiles is the single source of truth for supported profile names.
+var validProfiles = []string{ProfileVirtualization}
+
+// ProfileCommand holds a logical name and the shell command string
+// for one step of a profile's installation on the SNC instance.
+type ProfileCommand struct {
+	Name    string
+	Command string
+}
+
+// ValidateProfiles checks that all requested profiles are supported.
+func ValidateProfiles(profiles []string) error {
+	for _, p := range profiles {
+		if !slices.Contains(validProfiles, p) {
+			return fmt.Errorf("profile %q is not supported for SNC. Supported profiles: %v", p, validProfiles)
+		}
+	}
+	return nil
+}
+
+// ProfileCommands returns an ordered list of commands to execute via SSH
+// for the given profile. Each command will be chained as a Pulumi
+// remote.Command depending on the previous one.
+func ProfileCommands(profile string) []ProfileCommand {
+	switch profile {
+	case ProfileVirtualization:
+		return virtualizationCommands()
+	default:
+		return nil
+	}
+}
+
+// ProfilesRequireNestedVirt returns true if any of the given profiles
+// requires nested virtualization on the compute instance.
+func ProfilesRequireNestedVirt(profiles []string) bool {
+	return slices.Contains(profiles, ProfileVirtualization)
+}