Skip to content

Commit 6ee291b

Browse files
committed
docs: update TDX setup
This updates the TDX setup guide to reflect the changes made in #1977. While we only tested on Ubuntu Server 25.10 so far, the deployment should work with any 6.16+ host kernel. Running the `setup-tdx-host.sh` script from Canonical is not required anymore, since it doesn't do anything besides adding the patched QEMU 8.2.2 repository (not required anymore) and adding the user to the KVM group, which is not required for us, since we don't start TDX VMs from unprivileged users. The only remaining step the script performs is editing the kernel command line, which is now also reflected in the documentation.
1 parent 5eba305 commit 6ee291b

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

docs/docs/howto/cluster-setup/bare-metal.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ Consult AMD's [Using SEV with AMD EPYC Processors user guide](https://www.amd.co
3434
</TabItem>
3535
<TabItem value="intel" label="Intel TDX">
3636

37-
Follow Canonical's instructions in [4.2 Enable Intel TDX in Host OS](https://github.com/canonical/tdx?tab=readme-ov-file#42-enable-intel-tdx-in-host-os) (set `TDX_SETUP_ATTESTATION=1` in `setup-tdx-config`), [4.3 Enable Intel TDX in the Host's BIOS](https://github.com/canonical/tdx?tab=readme-ov-file#43-enable-intel-tdx-in-the-hosts-bios) and [9.2 Setup Intel&reg; SGX Data Center Attestation Primitives (Intel&reg; SGX DCAP) on the Host OS](https://github.com/canonical/tdx?tab=readme-ov-file#92-setup-intel-sgx-data-center-attestation-primitives-intel-sgx-dcap-on-the-host-os) (skipping step 9.2.1).
37+
Follow Canonical's instructions in [4.3 Enable Intel TDX in the Host's BIOS](https://github.com/canonical/tdx?tab=readme-ov-file#43-enable-intel-tdx-in-the-hosts-bios) and [9.2 Setup Intel&reg; SGX Data Center Attestation Primitives (Intel&reg; SGX DCAP) on the Host OS](https://github.com/canonical/tdx?tab=readme-ov-file#92-setup-intel-sgx-data-center-attestation-primitives-intel-sgx-dcap-on-the-host-os) (skipping step 9.2.1).
3838
You can ignore the other sections of the document.
3939

4040
Follow Intel's guide to [Update Intel TDX Module via Binary Deployment](https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/04/hardware_setup/#update-intel-tdx-module-via-binary-deployment).
@@ -50,7 +50,8 @@ Intel recommends to install the latest TDX module version available.
5050
Install Linux kernel 6.11 or greater.
5151
</TabItem>
5252
<TabItem value="intel" label="Intel TDX">
53-
Follow Canonical's instructions on [setting up Intel TDX on Ubuntu 24.04](https://github.com/canonical/tdx?tab=readme-ov-file#41-install-ubuntu-server-image). Note that Contrast currently only supports Intel TDX with Ubuntu 24.04.
53+
Install Linux kernel 6.16 or greater.
54+
Add the `nohibernate` and `kvm_intel.tdx=1` kernel command line parameters, for example by updating `GRUB_CMDLINE_LINUX` in `/etc/default/grub`.
5455
</TabItem>
5556
</Tabs>
5657

0 commit comments

Comments
 (0)