From fd56e8d78573f63ca1fbaa31e80f82703173cc0d Mon Sep 17 00:00:00 2001 From: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> Date: Fri, 22 May 2026 11:06:21 -0400 Subject: [PATCH 1/6] Updates for coco 1.1 Signed-off-by: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> --- .../confidential-containers-deploy.rst | 46 +++++++++---------- confidential-containers/release-notes.rst | 22 +++++++++ .../supported-platforms.rst | 23 ++++------ gpu-operator/deploy-kata-containers.rst | 41 +++++++++++------ repo.toml | 5 +- 5 files changed, 84 insertions(+), 53 deletions(-) diff --git a/confidential-containers/confidential-containers-deploy.rst b/confidential-containers/confidential-containers-deploy.rst index d08aa1be5..fc6044f95 100644 --- a/confidential-containers/confidential-containers-deploy.rst +++ b/confidential-containers/confidential-containers-deploy.rst @@ -55,7 +55,7 @@ After completing the installation, you can :doc:`Run a Sample Workload `_ for information about supported NVIDIA GPUs, such as the NVIDIA Hopper H100. @@ -98,7 +101,7 @@ The following topics in the deployment guide apply to a cloud-native environment * Hardware selection and initial hardware configuration, such as BIOS settings. * Host operating system selection, initial configuration, and validation. -When following the cloud-native sections in the deployment guide linked above, use Ubuntu 25.10 as the host OS with its default kernel version and configuration. +When following the cloud-native sections in the deployment guide linked above, use Ubuntu 25.10 or 26.04 as the host OS with its default kernel version and configuration. For additional resources on machine setup: @@ -126,24 +129,18 @@ Supported Software Components * - `QEMU `__ - 10.1 \+ Patches * - `Containerd `__ - - 2.2.2 + - 2.2.x or 2.3.x * - `Kubernetes `__ - 1.32 \+ * - `NVIDIA GPU Operator `__ and its components. - + Refer to the :ref:`GPU Operator Component Matrix ` for the list of components and versions included in each release. - - v26.3.1 and higher + - ${gpu_operator_version} and higher * - `Kata Containers `__ - - 3.29 (installed with ``kata-deploy`` Helm chart) + - ${kata_version} (installed with ``kata-deploy`` Helm chart) * - `Key Broker Service (KBS) protocol `__ - 0.4.0 * - `Kata Lifecycle Manager `__ - 0.1.4 Users may leverage `Red Hat OpenShift Sandboxed Containers `__ to deploy Confidential Containers, however, Confidential GPU features are currently classified as Technology Preview by the downstream provider. - - - - - - diff --git a/gpu-operator/deploy-kata-containers.rst b/gpu-operator/deploy-kata-containers.rst index 3d9801d06..6f2493bf9 100644 --- a/gpu-operator/deploy-kata-containers.rst +++ b/gpu-operator/deploy-kata-containers.rst @@ -305,13 +305,13 @@ Install the Kata Containers Helm Chart Install Kata Containers using the ``kata-deploy`` Helm chart. The ``kata-deploy`` chart installs all required components from the Kata Containers project including the Kata Containers runtime binary, runtime configuration, UVM kernel, and images that NVIDIA uses for Kata Containers. -The minimum required version is 3.29.0. +The minimum required version is ${kata_version}. #. Set the chart version and registry path: .. code-block:: console - $ export VERSION="3.29.0" + $ export VERSION="${kata_version}" $ export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy" @@ -322,7 +322,6 @@ The minimum required version is 3.29.0. $ helm install kata-deploy "${CHART}" \ --namespace kata-system --create-namespace \ --set nfd.enabled=false \ - --wait --timeout 10m \ --version "${VERSION}" *Example Output:* @@ -336,33 +335,45 @@ The minimum required version is 3.29.0. DESCRIPTION: Install complete TEST SUITE: None - .. note:: - - The ``--wait`` flag in the install command instructs Helm to wait until the release is deployed before returning. - It can take a few minutes to return output. - - There is a `known Helm issue `_ on single node clusters, that may result in the Helm command finishing before all deployed pods are finished initializing. - If you are deploying to a single node cluster, you may need to wait for an additional few minutes after the Helm command completes for the ``kata-deploy`` pod to be in the Running state. - .. note:: Both ``kata-deploy`` and the GPU Operator deploy Node Feature Discovery (NFD) by default. The install command includes ``--set nfd.enabled=false`` to prevent ``kata-deploy`` from deploying NFD. The GPU Operator will deploy and manage NFD in the next step. + .. note:: -#. Optional: Verify that the ``kata-deploy`` pod is running: + The Helm install command returns as soon as the Kubernetes resources are created. + The ``kata-deploy`` DaemonSet then takes several minutes per node to extract artifacts, restart containerd, and label the node before its pods report ready. + You can use either of the optional verification steps below to confirm readiness before continuing. + + +#. Optional: Verify that the ``kata-deploy`` DaemonSet has finished rolling out on every node: .. code-block:: console - $ kubectl get pods -n kata-system | grep kata-deploy + $ kubectl -n kata-system rollout status ds/kata-deploy --timeout=20m + + *Example Output:* + + .. code-block:: output + + Waiting for daemon set "kata-deploy" rollout to finish: 0 of 1 updated pods are available... + daemon set "kata-deploy" successfully rolled out + + +#. Optional: Verify that the ``kata-deploy`` pods are running: + + .. code-block:: console + + $ kubectl get pods -n kata-system *Example Output:* .. code-block:: output - NAME READY STATUS RESTARTS AGE - kata-deploy-b2lzs 1/1 Running 0 6m37s + NAME READY STATUS RESTARTS AGE + kata-deploy-b2lzs 1/1 Running 0 6m37s #. Optional: Verify that the ``kata-qemu-nvidia-gpu`` runtime class is available: diff --git a/repo.toml b/repo.toml index 374e1d164..269826a02 100644 --- a/repo.toml +++ b/repo.toml @@ -176,7 +176,7 @@ docs_root = "${root}/gpu-operator" project = "gpu-operator" name = "NVIDIA GPU Operator" version = "26.3" # Update repo_docs.projects.openshift.version to match latest patch version maj.min.patch -source_substitutions = { minor_version = "26.3", version = "v26.3.3", recommended = "580.173.02", dra_version = "0.4.1" } +source_substitutions = { minor_version = "26.3", version = "v26.3.3", recommended = "580.173.02", dra_version = "0.4.1", kata_version = "3.31.0" } copyright_start = 2020 sphinx_exclude_patterns = [ "life-cycle-policy.rst", @@ -213,7 +213,8 @@ output_format = "linkcheck" docs_root = "${root}/confidential-containers" project = "confidential-containers" name = "NVIDIA Confidential Containers Architecture" -version = "1.0.0" +version = "1.1.0" +source_substitutions = { kata_version = "3.31.0", gpu_operator_version = "v26.3.1", gpu_operator_minor_version = "26.3" } copyright_start = 2020 [repo_docs.projects.confidential-containers.builds.linkcheck] From afef4d2f5007d8a9c88414f8ce3a07eec44489b4 Mon Sep 17 00:00:00 2001 From: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> Date: Wed, 27 May 2026 11:15:40 -0400 Subject: [PATCH 2/6] Add kata helm values file Signed-off-by: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> --- .../confidential-containers-deploy.rst | 10 +- confidential-containers/release-notes.rst | 1 - .../samples/kata-nvidia-gpu-values.yaml | 125 ++++++++++++++++++ .../supported-platforms.rst | 2 +- 4 files changed, 132 insertions(+), 6 deletions(-) create mode 100644 confidential-containers/samples/kata-nvidia-gpu-values.yaml diff --git a/confidential-containers/confidential-containers-deploy.rst b/confidential-containers/confidential-containers-deploy.rst index fc6044f95..115249281 100644 --- a/confidential-containers/confidential-containers-deploy.rst +++ b/confidential-containers/confidential-containers-deploy.rst @@ -153,14 +153,18 @@ The minimum required version is ${kata_version}. $ export VERSION="${kata_version}" $ export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy" +#. Create a values file, such as ``kata-nvidia-gpu-values.yaml``, to configure the ``kata-deploy`` chart for NVIDIA Confidential Containers: -#. Install the kata-deploy Helm chart: + .. literalinclude:: ./samples/kata-nvidia-gpu-values.yaml + :language: yaml + +#. Install the kata-deploy Helm chart with the values file: .. code-block:: console $ helm install kata-deploy "${CHART}" \ --namespace kata-system --create-namespace \ - --set nfd.enabled=false \ + -f kata-nvidia-gpu-values.yaml \ --version "${VERSION}" *Example Output immediately after running the command:* @@ -200,8 +204,6 @@ The minimum required version is ${kata_version}. The install command includes ``--set nfd.enabled=false`` to prevent ``kata-deploy`` from deploying NFD. The GPU Operator will deploy and manage NFD in the next step. - .. note:: - #. Verify that the ``kata-deploy`` pod is running: .. code-block:: console diff --git a/confidential-containers/release-notes.rst b/confidential-containers/release-notes.rst index b79dd6efc..0e146bdfc 100644 --- a/confidential-containers/release-notes.rst +++ b/confidential-containers/release-notes.rst @@ -44,7 +44,6 @@ New Features * Kata Containers 3.31.0 * containerd 2.3.x - * NVIDIA GPU Operator v26.3.1 ---- diff --git a/confidential-containers/samples/kata-nvidia-gpu-values.yaml b/confidential-containers/samples/kata-nvidia-gpu-values.yaml new file mode 100644 index 000000000..662feb513 --- /dev/null +++ b/confidential-containers/samples/kata-nvidia-gpu-values.yaml @@ -0,0 +1,125 @@ +# Example values file to enable NVIDIA GPU shims for the NVIDIA +# Confidential Containers Reference Architecture. + +# Disable verbose debug logging in kata-deploy and the Kata runtime. Change this to true if you want to troubleshoot issues. +debug: false + +# Disable Node Feature Discovery (NFD) deployment by kata-deploy. +# Both kata-deploy and the GPU Operator deploy NFD by default. This +# reference architecture relies on the NFD instance that the GPU Operator +# deploys and manages, so the kata-deploy NFD is turned off to avoid a +# duplicate, conflicting deployment. +nfd: + enabled: false + +# Install the nydus snapshotter on each node alongside containerd. +# The confidential -snp and -tdx shims below use nydus to pull container +# images directly into the confidential VM (guest pull), which keeps image +# contents inside the trusted execution environment (TEE). +snapshotter: + setup: ["nydus"] + +# Disable every shim the kata-deploy chart enables by default, then opt in +# only to the NVIDIA GPU shims. +# The default chart installs a broad set of hypervisor and TEE shims +# (clh, dragonball, fc, qemu, qemu-sev, qemu-snp, qemu-tdx, stratovirt, +# and the -runtime-rs variants) that are not part of this reference +# architecture. +shims: + disableAll: true + + # Non-confidential NVIDIA GPU passthrough shim used when Confidential + # Computing mode is off on the node. The runtime class is restricted to + # nodes where the GPU Operator's Confidential Computing Manager has + # reported nvidia.com/cc.ready.state=false, so it will not schedule on + # CC-ready nodes. The empty containerd snapshotter falls back to the + # default (overlayfs); guest pull is not used for this non-confidential + # path. + qemu-nvidia-gpu: + enabled: true + supportedArches: + - amd64 + allowedHypervisorAnnotations: [] + containerd: + snapshotter: "" + runtimeClass: + # This label is automatically added by the GPU Operator. + nodeSelector: + nvidia.com/cc.ready.state: "false" + + # Note: the upstream kata-deploy chart also distributes -runtime-rs + # variants of the NVIDIA GPU shims (an alternative Rust-based runtime). + # They are not yet supported by this reference architecture and are + # left disabled by the disableAll setting above. + + # Confidential NVIDIA GPU passthrough shim for AMD SEV-SNP nodes. + # The runtime class is pinned to nodes where the GPU Operator has set + # nvidia.com/cc.ready.state=true (CC mode applied) AND where Node + # Feature Discovery has set amd.feature.node.kubernetes.io/snp=true + # (host CPU advertises SEV-SNP). The nydus containerd snapshotter and + # CRI-O guestPull pull container images directly into the confidential + # VM. Set agent.httpsProxy / agent.noProxy if the guest needs to reach + # the registry through a proxy. + qemu-nvidia-gpu-snp: + enabled: true + supportedArches: + - amd64 + allowedHypervisorAnnotations: [] + containerd: + snapshotter: "nydus" + forceGuestPull: false + crio: + guestPull: true + agent: + httpsProxy: "" + noProxy: "" + runtimeClass: + # These labels are automatically added by the GPU Operator and NFD + # respectively. + nodeSelector: + nvidia.com/cc.ready.state: "true" + amd.feature.node.kubernetes.io/snp: "true" + + # Confidential NVIDIA GPU passthrough shim for Intel TDX nodes. + # The runtime class is pinned to nodes where the GPU Operator has set + # nvidia.com/cc.ready.state=true (CC mode applied) AND where Node + # Feature Discovery has set intel.feature.node.kubernetes.io/tdx=true + # (host CPU advertises TDX). Snapshotter, guest pull, and proxy + # behavior match the SNP shim above. + qemu-nvidia-gpu-tdx: + enabled: true + supportedArches: + - amd64 + allowedHypervisorAnnotations: [] + containerd: + snapshotter: "nydus" + forceGuestPull: false + crio: + guestPull: true + agent: + httpsProxy: "" + noProxy: "" + runtimeClass: + # These labels are automatically added by the GPU Operator and NFD + # respectively. + nodeSelector: + nvidia.com/cc.ready.state: "true" + intel.feature.node.kubernetes.io/tdx: "true" + +# Default shim per architecture used by kata-deploy when a pod does not +# request a specific runtime class. Set to the non-confidential NVIDIA +# GPU shim so pods only run inside a confidential VM when they +# explicitly request the kata-qemu-nvidia-gpu-snp or +# kata-qemu-nvidia-gpu-tdx runtime class. +defaultShim: + amd64: qemu-nvidia-gpu # Can be changed to qemu-nvidia-gpu-snp or qemu-nvidia-gpu-tdx if preferred + +# Create one Kubernetes RuntimeClass per enabled shim above +# (kata-qemu-nvidia-gpu, kata-qemu-nvidia-gpu-snp, kata-qemu-nvidia-gpu-tdx). +# createDefault: false suppresses the generic "kata" RuntimeClass since +# you should always reference a specific NVIDIA shim +# by name in pod specs. +runtimeClasses: + enabled: true + createDefault: false + defaultName: "kata" diff --git a/confidential-containers/supported-platforms.rst b/confidential-containers/supported-platforms.rst index 33e207a3d..cbbd9b67f 100644 --- a/confidential-containers/supported-platforms.rst +++ b/confidential-containers/supported-platforms.rst @@ -129,7 +129,7 @@ Supported Software Components * - `QEMU `__ - 10.1 \+ Patches * - `Containerd `__ - - 2.2.x or 2.3.x + - 2.2.2 or 2.3.x * - `Kubernetes `__ - 1.32 \+ * - `NVIDIA GPU Operator `__ and its components. From 38dd7a87c17901673b9e65868f50a5ae98057b77 Mon Sep 17 00:00:00 2001 From: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> Date: Wed, 27 May 2026 14:22:06 -0400 Subject: [PATCH 3/6] Add docs changelog Signed-off-by: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> --- confidential-containers/release-notes.rst | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/confidential-containers/release-notes.rst b/confidential-containers/release-notes.rst index 0e146bdfc..230da0c2a 100644 --- a/confidential-containers/release-notes.rst +++ b/confidential-containers/release-notes.rst @@ -45,6 +45,19 @@ New Features * Kata Containers 3.31.0 * containerd 2.3.x + +Docs Changelog +-------------- + +The :ref:`coco-install-kata-chart` procedure was updated for this release. +Changes include: + +* Installs ``kata-deploy`` with a values file instead of inline ``--set`` flags. + +* Includes a new sample values file, :file:`samples/kata-nvidia-gpu-values.yaml`, that configures the ``kata-deploy`` Helm chart for the NVIDIA Confidential Containers reference architecture (NVIDIA GPU shims only, NFD disabled, ``nydus`` snapshotter, and per-shim runtime class node selectors). + +* Adds a readiness verification step using ``kubectl rollout status ds/kata-deploy``. This step relies on the readiness reporting added in Kata Containers 3.31.0 and lets you confirm that ``kata-deploy`` has finished extracting artifacts and restarting containerd on every node before continuing. + ---- .. _coco-v1.0.0: From 41b1ffda21c3839178fca18da6a6dbdcad00033a Mon Sep 17 00:00:00 2001 From: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> Date: Wed, 27 May 2026 14:55:34 -0400 Subject: [PATCH 4/6] Review sample comments Signed-off-by: Abigail McCarthy <20771501+a-mccarthy@users.noreply.github.com> --- .../samples/kata-nvidia-gpu-values.yaml | 44 ++++++------------- 1 file changed, 13 insertions(+), 31 deletions(-) diff --git a/confidential-containers/samples/kata-nvidia-gpu-values.yaml b/confidential-containers/samples/kata-nvidia-gpu-values.yaml index 662feb513..cb7ebf608 100644 --- a/confidential-containers/samples/kata-nvidia-gpu-values.yaml +++ b/confidential-containers/samples/kata-nvidia-gpu-values.yaml @@ -1,7 +1,7 @@ # Example values file to enable NVIDIA GPU shims for the NVIDIA # Confidential Containers Reference Architecture. -# Disable verbose debug logging in kata-deploy and the Kata runtime. Change this to true if you want to troubleshoot issues. +# Set to true for verbose kata-deploy and Kata runtime logging. debug: false # Disable Node Feature Discovery (NFD) deployment by kata-deploy. @@ -19,12 +19,8 @@ nfd: snapshotter: setup: ["nydus"] -# Disable every shim the kata-deploy chart enables by default, then opt in -# only to the NVIDIA GPU shims. -# The default chart installs a broad set of hypervisor and TEE shims -# (clh, dragonball, fc, qemu, qemu-sev, qemu-snp, qemu-tdx, stratovirt, -# and the -runtime-rs variants) that are not part of this reference -# architecture. +# Disable the chart's default hypervisor/TEE shims and opt in only to +# the NVIDIA GPU shims supported by this reference architecture. shims: disableAll: true @@ -47,19 +43,10 @@ shims: nodeSelector: nvidia.com/cc.ready.state: "false" - # Note: the upstream kata-deploy chart also distributes -runtime-rs - # variants of the NVIDIA GPU shims (an alternative Rust-based runtime). - # They are not yet supported by this reference architecture and are - # left disabled by the disableAll setting above. - - # Confidential NVIDIA GPU passthrough shim for AMD SEV-SNP nodes. - # The runtime class is pinned to nodes where the GPU Operator has set - # nvidia.com/cc.ready.state=true (CC mode applied) AND where Node - # Feature Discovery has set amd.feature.node.kubernetes.io/snp=true - # (host CPU advertises SEV-SNP). The nydus containerd snapshotter and - # CRI-O guestPull pull container images directly into the confidential - # VM. Set agent.httpsProxy / agent.noProxy if the guest needs to reach - # the registry through a proxy. + # Confidential NVIDIA GPU passthrough for AMD SEV-SNP nodes. + # Scheduled where the GPU Operator reports CC mode is on AND NFD + # reports SEV-SNP support. Set agent.httpsProxy / agent.noProxy if + # the guest needs a proxy to reach the registry. qemu-nvidia-gpu-snp: enabled: true supportedArches: @@ -80,12 +67,9 @@ shims: nvidia.com/cc.ready.state: "true" amd.feature.node.kubernetes.io/snp: "true" - # Confidential NVIDIA GPU passthrough shim for Intel TDX nodes. - # The runtime class is pinned to nodes where the GPU Operator has set - # nvidia.com/cc.ready.state=true (CC mode applied) AND where Node - # Feature Discovery has set intel.feature.node.kubernetes.io/tdx=true - # (host CPU advertises TDX). Snapshotter, guest pull, and proxy - # behavior match the SNP shim above. + # Confidential NVIDIA GPU passthrough for Intel TDX nodes. + # Same selectors and snapshotter behavior as the SNP shim above, + # but pinned to TDX-capable hosts. qemu-nvidia-gpu-tdx: enabled: true supportedArches: @@ -106,11 +90,9 @@ shims: nvidia.com/cc.ready.state: "true" intel.feature.node.kubernetes.io/tdx: "true" -# Default shim per architecture used by kata-deploy when a pod does not -# request a specific runtime class. Set to the non-confidential NVIDIA -# GPU shim so pods only run inside a confidential VM when they -# explicitly request the kata-qemu-nvidia-gpu-snp or -# kata-qemu-nvidia-gpu-tdx runtime class. +# Default shim when a pod does not request a runtime class. Set to the +# non-confidential shim so pods only run in a confidential VM when +# they explicitly request the -snp or -tdx runtime class. defaultShim: amd64: qemu-nvidia-gpu # Can be changed to qemu-nvidia-gpu-snp or qemu-nvidia-gpu-tdx if preferred From 6ffa6a43ddb1be32321b999d4d9054909503fb07 Mon Sep 17 00:00:00 2001 From: Mike McKiernan Date: Thu, 30 Jul 2026 14:08:03 -0400 Subject: [PATCH 5/6] docs: Final review comments for RA 1.1 Signed-off-by: Mike McKiernan --- .../supported-platforms.rst | 2 +- gpu-operator/deploy-kata-containers.rst | 21 +++++++++++-------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/confidential-containers/supported-platforms.rst b/confidential-containers/supported-platforms.rst index cbbd9b67f..aa6cba3ab 100644 --- a/confidential-containers/supported-platforms.rst +++ b/confidential-containers/supported-platforms.rst @@ -129,7 +129,7 @@ Supported Software Components * - `QEMU `__ - 10.1 \+ Patches * - `Containerd `__ - - 2.2.2 or 2.3.x + - 2.3.x * - `Kubernetes `__ - 1.32 \+ * - `NVIDIA GPU Operator `__ and its components. diff --git a/gpu-operator/deploy-kata-containers.rst b/gpu-operator/deploy-kata-containers.rst index 6f2493bf9..2ad1a28a7 100644 --- a/gpu-operator/deploy-kata-containers.rst +++ b/gpu-operator/deploy-kata-containers.rst @@ -32,7 +32,7 @@ Deploy with Kata Containers About the Operator with Kata Containers *************************************** -`Kata Containers `_ is an open source project that creates lightweight Virtual Machines (VMs) that feel and perform like traditional containers such as a Docker container. +`Kata Containers `_ is an open source project that creates lightweight Virtual Machines (VMs) that feel and perform like traditional containers such as a Docker container. A traditional container packages software for user-space isolation from the host, but the container runs on the host and shares the operating system kernel with the host. Sharing the operating system kernel is a potential vulnerability. @@ -129,9 +129,9 @@ To enable Kata Containers for GPUs on your cluster, you do the following: #. Make sure your cluster meets the prerequisites. #. Label the nodes you want to use for Kata Containers. -#. Install the upstream ``kata-deploy`` Helm chart, which deploys all Kata runtime classes, including NVIDIA-specific runtime classes. +#. Install the upstream ``kata-deploy`` Helm chart, which deploys all Kata runtime classes, including NVIDIA-specific runtime classes. The ``kata-qemu-nvidia-gpu`` runtime class is used with Kata Containers. -#. Install the NVIDIA GPU Operator with Kata sandbox mode enabled. +#. Install the NVIDIA GPU Operator with Kata sandbox mode enabled. After installation, you can run a sample workload that uses the Kata runtime class. @@ -225,7 +225,7 @@ Kubernetes Cluster Refer to the `Kata Containers documentation `_ for more details on the Kata runtime and VFIO cold-plug. -* Increase kubelet image pull timeouts configuration to 20 minutes to avoid timeouts when pulling large images. +* Increase kubelet image pull timeouts configuration to 20 minutes to avoid timeouts when pulling large images. Kubelet can de-allocate your pod if the image pull exceeds the configured timeout before the container transitions to the running state. Increase ``runtimeRequestTimeout`` in your `kubelet configuration `_ to ``20m`` to match the default values for the Kata shim configurations in Kata Containers. @@ -246,8 +246,8 @@ Kubernetes Cluster $ sudo systemctl restart kubelet - If you need a timeout of more than 1200 seconds (20 minutes), you will also need to adjust the Kata Agent's ``image_pull_timeout``, which defaults to 1200s. - This setting also sets the confidential data hub's image pull API timeout in seconds. + If you need a timeout of more than 1200 seconds (20 minutes), you will also need to adjust the Kata Agent's ``image_pull_timeout``, which defaults to 1200s. + This setting also sets the confidential data hub's image pull API timeout in seconds. To do this, add the ``agent.image_pull_timeout`` kernel parameter to your shim configuration, or pass an explicit value in a pod annotation in the ``io.katacontainers.config.hypervisor.kernel_params: "..."`` annotation. .. _label-nodes-kata-containers: @@ -322,8 +322,12 @@ The minimum required version is ${kata_version}. $ helm install kata-deploy "${CHART}" \ --namespace kata-system --create-namespace \ --set nfd.enabled=false \ + -f kata-nvidia-gpu-values.yaml \ --version "${VERSION}" + The sample `kata-nvidia-gpu-values.yaml` file is included in the GitHub repository at + https://github.com/NVIDIA/cloud-native-docs/blob/main/confidential-containers/samples/kata-nvidia-gpu-values.yaml. + *Example Output:* .. code-block:: output @@ -660,8 +664,8 @@ If the sample workload does not run, confirm that you labeled nodes to run virtu .. code-block:: output NAME STATUS ROLES AGE VERSION - kata-worker-1 Ready 10d v1.35.3 - kata-worker-2 Ready 10d v1.35.3 + kata-worker-1 Ready 10d v1.35.3 + kata-worker-2 Ready 10d v1.35.3 kata-worker-3 Ready 10d v1.35.3 You might have configured ``vm-passthrough`` as the default sandbox workload in the ClusterPolicy resource. @@ -680,4 +684,3 @@ Also confirm in the ClusterPolicy that ``sandboxWorkloads`` is configured for Ka enabled: true defaultWorkload: vm-passthrough mode: kata - From 9e332f614e12f409a5530d07315cb49d9a30eb9c Mon Sep 17 00:00:00 2001 From: Mike McKiernan Date: Thu, 30 Jul 2026 14:25:04 -0400 Subject: [PATCH 6/6] docs: containerd version in one place Keep software component version reqs on the supported platforms page. Revise the prereqs page into hardware and cluster configuration requirements, like BIOS settings and IOMMU conf. Signed-off-by: Mike McKiernan --- confidential-containers/prerequisites.rst | 55 +++++++---------------- 1 file changed, 17 insertions(+), 38 deletions(-) diff --git a/confidential-containers/prerequisites.rst b/confidential-containers/prerequisites.rst index 4b2244654..c4a5b6066 100644 --- a/confidential-containers/prerequisites.rst +++ b/confidential-containers/prerequisites.rst @@ -27,19 +27,18 @@ As a :ref:`Kubernetes Cluster Administrator ` or :ref:`Host OS Administrator ` to confirm or implement hardware prerequisites. -For validated hardware and software versions, refer to :doc:`Supported Platforms `. -Use the checklists below for an at-a-glance summary, then follow each linked section for verification steps. +Use the following checklists as at-a-glance summary and supplement to the :doc:`Supported Platforms ` page. -**Hardware prerequisites** +**Hardware Configuration Requirements** + +For validated hardware, refer to :doc:`Supported Platforms `. .. list-table:: :header-rows: 1 :widths: 30 70 - * - Prerequisite + * - Configuration Requirement - Details - * - :ref:`Use a supported platform ` - - CPU, GPU, and host OS match :doc:`Supported Platforms ` * - :ref:`Hardware virtualization and ACS enabled ` - Hardware virtualization and ACS enabled in host BIOS * - :ref:`IOMMU enabled ` @@ -47,26 +46,26 @@ Use the checklists below for an at-a-glance summary, then follow each linked sec * - :ref:`No host NVIDIA GPU drivers ` - No NVIDIA GPU drivers installed or loaded on worker hosts. -**Cluster prerequisites** +**Cluster Configuration Requirements** + +For validated software components, refer to :doc:`Supported Platforms `. .. list-table:: :header-rows: 1 :widths: 30 70 - * - Prerequisite + * - Configuration Requirement - Details * - :ref:`A Kubernetes cluster and cluster administrator access ` - - Cluster administrator access to a Kubernetes cluster running a supported version (refer to :ref:`Supported Software Components `) - * - :ref:`containerd 2.2.2 installed ` - - containerd 2.2.2 installed on each GPU worker node + - Cluster administrator access to a Kubernetes cluster running a supported version. * - :ref:`Helm installed ` - Helm installed on your cluster administration system * - :ref:`Kubelet configured ` - Enable ``KubeletPodResourcesGet`` (required before Kubernetes v1.34) and ``RuntimeClassInImageCriApi`` feature gates; set ``runtimeRequestTimeout: 20m`` on GPU worker nodes -***************** -Hardware and BIOS -***************** +******************************************** +Hardware and BIOS Configuration Requirements +******************************************** .. _coco-prereq-supported-platform: @@ -172,9 +171,9 @@ In this architecture, the NVIDIA GPU Operator handles GPU driver installation an Refer to `Removing the Driver `_ in the NVIDIA Driver Installation Guide. -****************** -Kubernetes Cluster -****************** +********************************************* +Kubernetes Cluster Configuration Requirements +********************************************* The following sections describe requirements for worker nodes and for the system you use for cluster administration. @@ -186,26 +185,6 @@ Kubernetes Cluster and Cluster Administrator Access You must have cluster administrator access to a Kubernetes cluster running a supported Kubernetes version. Refer to the :ref:`Supported Software Components ` section in :doc:`Supported Platforms ` for supported Kubernetes and component versions. -.. _coco-prereq-containerd: - -containerd 2.2.2 -================ - -Verify the installed version on each GPU worker node: - -.. code-block:: console - - $ containerd --version - -*Example Output:* - -.. code-block:: output - - containerd containerd.io 2.2.2 ... - -Your actual output may vary, but the reported version must be ``2.2.2``. -If you are running a different version on any worker node, refer to the `containerd Getting Started guide `_ for installation instructions. - .. _coco-prereq-helm: Helm @@ -256,7 +235,7 @@ Apply these settings as follows: #. Open the kubelet configuration file: .. code-block:: console - + $ sudo nano /var/lib/kubelet/config.yaml This is typically located at ``/var/lib/kubelet/config.yaml``, but your configuration file may be in a different location.