install: parameterise hypervisor socket and pods dir

Allow customising the hypervisor socket and pods dir. This provides the foundation for running multiple CAA daemonsets on a single cluster. Signed-off-by: Pradipta Banerjee <pradipta.banerjee@gmail.com>
confidential-containers · Feb 11, 2025 · f08a334 · f08a334
1 parent deabbfe
commit f08a334
Show file tree

Hide file tree

Showing 9 changed files with 54 additions and 25 deletions.
diff --git a/src/cloud-api-adaptor/entrypoint.sh b/src/cloud-api-adaptor/entrypoint.sh
@@ -5,6 +5,9 @@ CLOUD_PROVIDER=${1:-$CLOUD_PROVIDER}
 ENABLE_CLOUD_PROVIDER_EXTERNAL_PLUGIN=${ENABLE_CLOUD_PROVIDER_EXTERNAL_PLUGIN:-false}
 
 CRI_RUNTIME_ENDPOINT=${CRI_RUNTIME_ENDPOINT:-/run/cri-runtime.sock}
+REMOTE_HYPERVISOR_ENDPOINT=${REMOTE_HYPERVISOR_ENDPOINT:-/run/peerpod/hypervisor.sock}
+PEER_PODS_DIR=${PODS_DIR:-/run/peerpod/pods}
+
 optionals+=""
 
 # Ensure you add a space before the closing quote (") when updating the optionals
@@ -63,9 +66,10 @@ aws() {
 
     set -x
     exec cloud-api-adaptor aws \
-        -pods-dir /run/peerpod/pods \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
+        ${optionals}
+
 }
 
 azure() {
@@ -80,6 +84,8 @@ azure() {
 
     set -x
     exec cloud-api-adaptor azure \
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
         -subscriptionid "${AZURE_SUBSCRIPTION_ID}" \
         -region "${AZURE_REGION}" \
         -instance-size "${AZURE_INSTANCE_SIZE}" \
@@ -97,13 +103,14 @@ gcp() {
     [[ "${PODVM_IMAGE_NAME}" ]] && optionals+="-image-name ${PODVM_IMAGE_NAME} "
     [[ "${GCP_PROJECT_ID}" ]] && optionals+="-gcp-project-id ${GCP_PROJECT_ID} "
     [[ "${GCP_ZONE}" ]] && optionals+="-zone ${GCP_ZONE} "                         # if not set retrieved from IMDS
-    [[ "${GCP_MACHINE_TYPE}" ]] && optionals+="-machine-type ${GCP_MACHINE_TYPE} "     # default e2-medium
+    [[ "${GCP_MACHINE_TYPE}" ]] && optionals+="-machine-type ${GCP_MACHINE_TYPE} " # default e2-medium
     [[ "${GCP_NETWORK}" ]] && optionals+="-network ${GCP_NETWORK} "                # defaults to 'default'
-    [[ "${GCP_DISK_TYPE}" ]] && optionals+="-disk-type ${GCP_DISK_TYPE} "              # defaults to 'pd-standard'
+    [[ "${GCP_DISK_TYPE}" ]] && optionals+="-disk-type ${GCP_DISK_TYPE} "          # defaults to 'pd-standard'
 
     set -x
     exec cloud-api-adaptor gcp \
-        -pods-dir /run/peerpod/pods \
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
         ${optionals}
 }
 
@@ -112,6 +119,8 @@ ibmcloud() {
 
     set -x
     exec cloud-api-adaptor ibmcloud \
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
         -iam-service-url "${IBMCLOUD_IAM_ENDPOINT}" \
         -vpc-service-url "${IBMCLOUD_VPC_ENDPOINT}" \
         -resource-group-id "${IBMCLOUD_RESOURCE_GROUP_ID}" \
@@ -123,9 +132,8 @@ ibmcloud() {
         -primary-subnet-id "${IBMCLOUD_VPC_SUBNET_ID}" \
         -primary-security-group-id "${IBMCLOUD_VPC_SG_ID}" \
         -vpc-id "${IBMCLOUD_VPC_ID}" \
-        -pods-dir /run/peerpod/pods \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        ${optionals}
+
 }
 
 ibmcloud_powervs() {
@@ -139,14 +147,15 @@ ibmcloud_powervs() {
 
     set -x
     exec cloud-api-adaptor ibmcloud-powervs \
-        -service-instance-id ${POWERVS_SERVICE_INSTANCE_ID} \
-        -zone ${POWERVS_ZONE} \
-        -image-id ${POWERVS_IMAGE_ID} \
-        -network-id ${POWERVS_NETWORK_ID} \
-        -ssh-key ${POWERVS_SSH_KEY_NAME} \
-        -pods-dir /run/peerpod/pods \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
+        -service-instance-id "${POWERVS_SERVICE_INSTANCE_ID}" \
+        -zone "${POWERVS_ZONE}" \
+        -image-id "${POWERVS_IMAGE_ID}" \
+        -network-id "${POWERVS_NETWORK_ID}" \
+        -ssh-key "${POWERVS_SSH_KEY_NAME}" \
+        ${optionals}
+
 }
 
 libvirt() {
@@ -155,13 +164,14 @@ libvirt() {
     [[ "${DISABLECVM}" = "true" ]] && optionals+="-disable-cvm "
     set -x
     exec cloud-api-adaptor libvirt \
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
         -uri "${LIBVIRT_URI}" \
         -data-dir /opt/data-dir \
-        -pods-dir /run/peerpod/pods \
         -network-name "${LIBVIRT_NET:-default}" \
         -pool-name "${LIBVIRT_POOL:-default}" \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        ${optionals}
+
 }
 
 vsphere() {
@@ -176,10 +186,12 @@ vsphere() {
 
     set -x
     exec cloud-api-adaptor vsphere \
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
         -vcenter-url ${GOVC_URL} \
         -data-center ${GOVC_DATACENTER} \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        ${optionals}
+
 }
 
 docker() {
@@ -192,9 +204,9 @@ docker() {
 
     set -x
     exec cloud-api-adaptor docker \
-        -pods-dir /run/peerpod/pods \
-        ${optionals} \
-        -socket /run/peerpod/hypervisor.sock
+        -pods-dir "${PEER_PODS_DIR}" \
+        -socket "${REMOTE_HYPERVISOR_ENDPOINT}" \
+        ${optionals}
 
 }
 

diff --git a/src/cloud-api-adaptor/install/overlays/aws/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/aws/kustomization.yaml
@@ -37,6 +37,8 @@ configMapGenerator:
   #- ROOT_VOLUME_SIZE="30" # Uncomment and set if you want to use a specific root volume size. Defaults to 30
   #- FORWARDER_PORT="" # Uncomment and set if you want to use a specific port for agent-protocol-forwarder. Defaults to 15150
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/azure/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/azure/kustomization.yaml
@@ -43,6 +43,8 @@ configMapGenerator:
   #- FORWARDER_PORT="" # Uncomment and set if you want to use a specific port for agent-protocol-forwarder. Defaults to 15150
   #- USE_PUBLIC_IP="true" # Uncomment if you want to use public ip for podvm
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/docker/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/docker/kustomization.yaml
@@ -28,6 +28,8 @@ configMapGenerator:
     #- TUNNEL_TYPE="" # Uncomment and set if you want to use a specific tunnel type. Defaults to vxlan
     #- VXLAN_PORT="" # Uncomment and set if you want to use a specific vxlan port. Defaults to 4789
     #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+    #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+    #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
 #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
 #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/gcp/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/gcp/kustomization.yaml
@@ -25,6 +25,9 @@ configMapGenerator:
   - GCP_ZONE="" # set e.g. "us-west1-a"
   - GCP_MACHINE_TYPE="e2-medium" # replace if needed. caa defaults to e2-medium
   - GCP_NETWORK="global/networks/default" # replace if needed.
+  #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/ibmcloud-powervs/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/ibmcloud-powervs/kustomization.yaml
@@ -36,6 +36,8 @@ configMapGenerator:
   #- USE_PUBLIC_IP="true" # Uncomment if you want to use public ip for podvm
   #- FORWARDER_PORT="" # Uncomment and set if you want to use a specific port for agent-protocol-forwarder. Defaults to 15150
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/ibmcloud/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/ibmcloud/kustomization.yaml
@@ -34,6 +34,8 @@ configMapGenerator:
   #- TUNNEL_TYPE="" # Uncomment and set if you want to use a specific tunnel type. Defaults to vxlan
   #- VXLAN_PORT="" # Uncomment and set if you want to use a specific vxlan port. Defaults to 4789
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/libvirt/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/libvirt/kustomization.yaml
@@ -32,6 +32,8 @@ configMapGenerator:
   #- TUNNEL_TYPE="" # Uncomment and set if you want to use a specific tunnel type. Defaults to vxlan
   #- VXLAN_PORT="" # Uncomment and set if you want to use a specific vxlan port. Defaults to 4789
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS

diff --git a/src/cloud-api-adaptor/install/overlays/vsphere/kustomization.yaml b/src/cloud-api-adaptor/install/overlays/vsphere/kustomization.yaml
@@ -49,6 +49,8 @@ configMapGenerator:
   #- VXLAN_PORT=""     # Uncomment and set to use "9000" or change if you want to use a specific vxlan port.
                        # Defaults to 4789.
   #- PEERPODS_LIMIT_PER_NODE="10" # Max number of peer pods that can be created per node. Default is 10
+  #- REMOTE_HYPERVISOR_ENDPOINT="/run/peerpod/hypervisor.sock" # Path to Kata remote hypervisor socket. Default is /run/peerpod/hypervisor.sock
+  #- PEER_PODS_DIR="/run/peerpod/pods" # Path to peer pods directory. Default is /run/peerpod/pods
 ##TLS_SETTINGS
   #- CACERT_FILE="/etc/certificates/ca.crt" # for TLS
   #- CERT_FILE="/etc/certificates/client.crt" # for TLS