aws: Add cpuOptions to install-config.yaml

This will allow configuring confidential computing on AWS platform,
only AMD SEV-SNP is supported for now.

Signed-off-by: Fangge Jin <[email protected]>

Author: fangge1212

data/data/install.openshift.io_installconfigs.yaml

@@ -171,6 +171,34 @@ spec:
                           AMIID is the AMI that should be used to boot the ec2 instance.
                           If set, the AMI should belong to the same region as the cluster.
                         type: string
+                      cpuOptions:
+                        description: |-
+                          CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
+                          When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
+                          More info:
+                          https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CpuOptionsRequest.html,
+                          https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html
+                        minProperties: 1
+                        properties:
+                          confidentialCompute:
+                            description: |-
+                              ConfidentialCompute specifies whether confidential computing should be enabled for the instance,
+                              and, if so, which confidential computing technology to use.
+                              Valid values are: Disabled, AMDEncryptedVirtualizationNestedPaging and omitted.
+                              When set to Disabled, confidential computing will be disabled for the instance.
+                              When set to AMDEncryptedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
+                              In this case, ensure the following conditions are met:
+                              1) The selected instance type supports AMD SEV-SNP.
+                              2) The selected AWS region supports AMD SEV-SNP.
+                              3) The selected AMI supports AMD SEV-SNP.
+                              More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
+                              When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
+                              which is subject to change without notice. The current default is Disabled.
+                            enum:
+                            - Disabled
+                            - AMDEncryptedVirtualizationNestedPaging
+                            type: string
+                        type: object
                       iamProfile:
                         description: |-
                           IAMProfile is the name of the IAM instance profile to use for the machine.
@@ -1689,6 +1717,34 @@ spec:
                             AMIID is the AMI that should be used to boot the ec2 instance.
                             If set, the AMI should belong to the same region as the cluster.
                           type: string
+                        cpuOptions:
+                          description: |-
+                            CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
+                            When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
+                            More info:
+                            https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CpuOptionsRequest.html,
+                            https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html
+                          minProperties: 1
+                          properties:
+                            confidentialCompute:
+                              description: |-
+                                ConfidentialCompute specifies whether confidential computing should be enabled for the instance,
+                                and, if so, which confidential computing technology to use.
+                                Valid values are: Disabled, AMDEncryptedVirtualizationNestedPaging and omitted.
+                                When set to Disabled, confidential computing will be disabled for the instance.
+                                When set to AMDEncryptedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
+                                In this case, ensure the following conditions are met:
+                                1) The selected instance type supports AMD SEV-SNP.
+                                2) The selected AWS region supports AMD SEV-SNP.
+                                3) The selected AMI supports AMD SEV-SNP.
+                                More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
+                                When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
+                                which is subject to change without notice. The current default is Disabled.
+                              enum:
+                              - Disabled
+                              - AMDEncryptedVirtualizationNestedPaging
+                              type: string
+                          type: object
                         iamProfile:
                           description: |-
                             IAMProfile is the name of the IAM instance profile to use for the machine.
@@ -3147,6 +3203,34 @@ spec:
                           AMIID is the AMI that should be used to boot the ec2 instance.
                           If set, the AMI should belong to the same region as the cluster.
                         type: string
+                      cpuOptions:
+                        description: |-
+                          CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
+                          When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
+                          More info:
+                          https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CpuOptionsRequest.html,
+                          https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html
+                        minProperties: 1
+                        properties:
+                          confidentialCompute:
+                            description: |-
+                              ConfidentialCompute specifies whether confidential computing should be enabled for the instance,
+                              and, if so, which confidential computing technology to use.
+                              Valid values are: Disabled, AMDEncryptedVirtualizationNestedPaging and omitted.
+                              When set to Disabled, confidential computing will be disabled for the instance.
+                              When set to AMDEncryptedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
+                              In this case, ensure the following conditions are met:
+                              1) The selected instance type supports AMD SEV-SNP.
+                              2) The selected AWS region supports AMD SEV-SNP.
+                              3) The selected AMI supports AMD SEV-SNP.
+                              More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
+                              When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
+                              which is subject to change without notice. The current default is Disabled.
+                            enum:
+                            - Disabled
+                            - AMDEncryptedVirtualizationNestedPaging
+                            type: string
+                        type: object
                       iamProfile:
                         description: |-
                           IAMProfile is the name of the IAM instance profile to use for the machine.
@@ -4798,6 +4882,34 @@ spec:
                           AMIID is the AMI that should be used to boot the ec2 instance.
                           If set, the AMI should belong to the same region as the cluster.
                         type: string
+                      cpuOptions:
+                        description: |-
+                          CPUOptions defines CPU-related settings for the instance, including the confidential computing policy.
+                          When omitted, this means no opinion and the AWS platform is left to choose a reasonable default.
+                          More info:
+                          https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CpuOptionsRequest.html,
+                          https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html
+                        minProperties: 1
+                        properties:
+                          confidentialCompute:
+                            description: |-
+                              ConfidentialCompute specifies whether confidential computing should be enabled for the instance,
+                              and, if so, which confidential computing technology to use.
+                              Valid values are: Disabled, AMDEncryptedVirtualizationNestedPaging and omitted.
+                              When set to Disabled, confidential computing will be disabled for the instance.
+                              When set to AMDEncryptedVirtualizationNestedPaging, AMD SEV-SNP will be used as the confidential computing technology for the instance.
+                              In this case, ensure the following conditions are met:
+                              1) The selected instance type supports AMD SEV-SNP.
+                              2) The selected AWS region supports AMD SEV-SNP.
+                              3) The selected AMI supports AMD SEV-SNP.
+                              More details can be checked at https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sev-snp.html
+                              When omitted, this means no opinion and the AWS platform is left to choose a reasonable default,
+                              which is subject to change without notice. The current default is Disabled.
+                            enum:
+                            - Disabled
+                            - AMDEncryptedVirtualizationNestedPaging
+                            type: string
+                        type: object
                       iamProfile:
                         description: |-
                           IAMProfile is the name of the IAM instance profile to use for the machine.