gha: get ready to install genpolicy

[danmihai1]

The changes to install and test genpolicy must come later, after CI picks up these gha changes.

Fixes: #8856

[danmihai1]

/test

[wainersm]

Hi @danmihai1 !

Allow me to check if I understood. Although kata-deploy installs genpolicy tool on the cluster, for testing sake it is needed the binary on the runner machine. So it gets the same tarball used on create the kata-deploy payload image then extracts on the runner machine.

One side question: would make sense for the user to run genpolicy as a pod on the cluster? Likely not because as an user I wouldn't trust (on confidential terms) any binaries outside of the TCB. Anyway, I'd like to start that brainstorm.

[danmihai1]

Hi @danmihai1 !

Allow me to check if I understood. Although kata-deploy installs genpolicy tool on the cluster, for testing sake it is needed the binary on the runner machine. So it gets the same tarball used on create the kata-deploy payload image then extracts on the runner machine.

One side question: would make sense for the user to run genpolicy as a pod on the cluster? Likely not because as an user I wouldn't trust (on confidential terms) any binaries outside of the TCB. Anyway, I'd like to start that brainstorm.

Indeed, a customer would run genpolicy even before they created a cluster - and you described all the reasons why correctly.

[fidencio]

@danmihai1, right now I see why we can have it as you proposed. However, in the future, I'd like us to create a second tarball that can be downloaded without getting the whole kata-containers bundle.

Would it be possible to create an issue for this?

[fidencio]

I've left one comment in the code, which will make our lives slightly easier in the future.

[danmihai1]

@danmihai1, right now I see why we can have it as you proposed. However, in the future, I'd like us to create a second tarball that can be downloaded without getting the whole kata-containers bundle.

Would it be possible to create an issue for this?

Done: #8864

[danmihai1]

/test

[wainersm]

With @fidencio 's suggestions it looks better now. Thanks @danmihai1 !