Prerequisites for OpenShift on Google Cloud

The instructions in this section cover the prerequisites needed for using the Anjuna Kubernetes Toolset for AMD SEV when your Kubernetes cluster is an OpenShift cluster running on Google Cloud.

This includes the prerequisites needed for installing the toolset and for deploying Pods:

Prerequisites for installing the Anjuna Kubernetes Toolset - OpenShift

The Anjuna Kubernetes Toolset for OpenShift currently supports OpenShift versions 4.16-4.21. If you are running a different version of OpenShift, contact [email protected].

Installing the Anjuna Kubernetes Toolset to OpenShift on Google Cloud has the following requirements:

  • An existing OpenShift cluster on Google Cloud with access via oc and web console.

  • A management host running Linux with at least 4GB of available memory and 20GB of free disk space.

    • When using a Google Cloud VM for this purpose, a system with at least 4GB total memory and a 25GB disk, running Ubuntu Linux 22.04 or Red Hat Enterprise Linux 8 or 9.

    • The management host will be used to run anjuna-k8s-cli, which manages the Anjuna Kubernetes Toolset. A confidential VM is not required for the management host.

  • Your user has permission to build and push container images via Docker or Podman.

  • Install the OpenShift CLI (oc) that matches your cluster version.

  • Install Helm version 3.11 or later.

  • The required service APIs are enabled in the Google Cloud project as directed in this OpenShift documentation.

  • gcloud (452.0.1 or later)

  • Install a version of the Anjuna Seaglass SEV Runtime that can be used with this Anjuna Seaglass Kubernetes Toolset for SEV. Refer to the Anjuna SEV Runtime section below for details.

Log in to your Google Cloud account by running the following command:

$ gcloud auth application-default login

Anjuna SEV Runtime

The Anjuna Seaglass Kubernetes Toolset for SEV requires the Anjuna Seaglass SEV Runtime to build the Anjuna Confidential Pod (Confidential Pod) images.

Refer to the Supported Anjuna Seaglass SEV Runtime versions for the Anjuna Seaglass Kubernetes Toolset for SEV versions matrix. The matrix shows the Anjuna Seaglass SEV Runtime versions that can be used with v2.1 of the Anjuna Seaglass Kubernetes Toolset for SEV.

Prerequisites for deploying Pods as Anjuna Confidential Pods - OpenShift

This guide assumes that your machine has the following tools installed:

Google Cloud permissions

This guide requires that you have access to the Google Cloud project where the cluster is running. The following roles are expected from your identity:

  • Storage Admin (roles/storage.admin)

  • Artifact Registry Administrator (roles/artifactregistry.admin)

  • Create Service Accounts (roles/iam.serviceAccountCreator)

  • Project IAM Admin (roles/resourcemanager.projectIamAdmin)

Also, you are required to have access to your cluster via oc or kubectl with enough access to deploy new non-privileged workloads.

Configure the environment and cluster access

If the Anjuna Kubernetes Toolset is not installed to your cluster, follow the cluster setup instructions in the Installing the Anjuna Kubernetes Toolset to OpenShift on Google Cloud section. This is required to proceed.

Refer to Validating the Anjuna Seaglass Operator installation and to Verify the Helm Chart installation to verify if the Anjuna Kubernetes Toolset is correctly installed to your cluster.

In order to correctly configure your environment for the Quickstart tutorials, a subset of the environment variables defined in Configuring your local environment will be needed. Mainly the following:

Environment variable Usage

ANJ_PROJ

The Google Cloud project name where your cluster has been set up.

ANJ_REGION

The Google Cloud region, such as us-central1.

ANJ_IMAGE_REGISTRY

The artifact registry used for storing the example Confidential Pod container images. For example: ${ANJ_REGION}-docker.pkg.dev

ANJ_IMAGE_PATH

The path in the container image registry to store the images. For example: anjuna-openshift/anjuna-k8s-toolset-examples

ANJ_K8S_TOOLSET_DIR

The absolute path to the directory where the Anjuna Kubernetes Toolset files can be found.

ANJ_SACCT_IMAGE_PULLER

The name of the service account that will be created to enable access to the artifact registry for the Anjuna Kubernetes Toolset images.

ANJ_BUCKET_NAME

The name of a Google Cloud bucket for storing the Confidential Container disk images you will build.

Creating required Google Cloud resources

This guide also requires additional cloud resources to be created, which are outlined in the following subsections.

Artifact registry

The Google Cloud artifact registry is used for storing the example Anjuna Confidential Pod images. The following commands can be used to enable it for your Google Cloud project and create a registry:

$ gcloud services enable artifactregistry.googleapis.com --project ${ANJ_PROJ}
$ gcloud artifacts repositories create anjuna-k8s-toolset \
  --project ${ANJ_PROJ} \
  --location ${ANJ_REGION} \
  --repository-format=docker

Service account for artifact registry

A service account will be needed to enable accessing the artifact registry when deploying Confidential Pods into your cluster. The resources needed (i.e., service account, role, and access key file registry-access-key.json) can be created with the following commands:

$ gcloud iam service-accounts create ${ANJ_SACCT_IMAGE_PULLER} --project ${ANJ_PROJ}
$ gcloud projects add-iam-policy-binding ${ANJ_PROJ} \
  --member serviceAccount:${ANJ_SACCT_IMAGE_PULLER}@${ANJ_PROJ}.iam.gserviceaccount.com \
  --role roles/artifactregistry.reader
$ gcloud iam service-accounts keys create registry-access-key.json \
  --iam-account ${ANJ_SACCT_IMAGE_PULLER}@${ANJ_PROJ}.iam.gserviceaccount.com

Container image Cloud Storage bucket

A storage bucket is needed to store the Confidential Container disk images. If you do not have a bucket that can be used for that purpose, create a new one with the following command:

$ gcloud storage buckets create gs://${ANJ_BUCKET_NAME}

Load and push the Anjuna Kubernetes Toolset images

Log in to Artifact Registry

A logged-in session is needed with the target Docker artifact registry. To log in to the artifact registry, run the following command:

$ gcloud auth configure-docker ${ANJ_IMAGE_REGISTRY} --project ${ANJ_PROJ}
Load the Anjuna Kubernetes Toolset services image

In order to build Confidential Pod disk images, a special Container image needs to be available in your build environment. Run the following to configure your environment correctly:

$ docker load -i ${ANJ_K8S_TOOLSET_DIR}/anjuna-k8s-sev-services-image.tar