[CNV#69839] Enable IBM Secure Execution on ocpvirt #99764

SNiemann15 · 2025-09-26T10:44:09Z

Version(s): 4.20+

Issue:
https://issues.redhat.com/browse/CNV-69839

Link to docs preview:
https://99764--ocpdocs-pr.netlify.app/openshift-enterprise/latest/virt/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.html

QE review:

QE has approved this change.

Additional information:

jschintag

LGTM
Thank you @SNiemann15

ocpdocs-previewbot · 2025-09-26T10:58:38Z

🤖 Fri Oct 03 10:31:36 - Prow CI generated the docs preview:

https://99764--ocpdocs-pr.netlify.app/openshift-enterprise/latest/virt/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.html

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

jschintag

/lgtm

openshift-ci · 2025-09-26T14:20:12Z

New changes are detected. LGTM label has been removed.

aspauldi · 2025-09-26T15:14:21Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+[id="virt-enabling-vms-ibm-secure-execution-ibm-z_{context}"]
+= Enabling VMs to run {ibm-name} Secure Execution on {ibm-z-name} and {ibm-linuxone-name}
+
+Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name} you must prepare the cluster.


Suggested change

Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name} you must prepare the cluster.

Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}, you must prepare the cluster.

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

aspauldi · 2025-09-26T15:21:17Z

Hi @SNiemann15, just a few small comments! Otherwise, LGTM.

nbziouec · 2025-09-29T17:33:29Z

/lgtm

openshift-ci · 2025-09-29T17:34:35Z

@nbziouec: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ousleyp

Hey Silke, I have some comments and suggestions for you to peruse. :) Please let me know if you have any questions; thanks!

ousleyp · 2025-09-30T15:16:43Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+[id="virt-enabling-vms-ibm-secure-execution-ibm-z_{context}"]
+= Enabling VMs to run {ibm-name} Secure Execution on {ibm-z-name} and {ibm-linuxone-name}
+
+Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}, you must prepare the cluster.


"Prepare the cluster" doesn't inform me of what I am about to do. I would suggest making this intro more specific, if possible.

@SNiemann15 , i would propose to say:
Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}, you need to fulfil the following prerequisite and follow the step bellow to enable SE feature on the computer nodes of the cluster

ousleyp · 2025-09-30T15:20:26Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+
+.Procedure
+
+. To run {ibm-name} Secure Execution VMs, you must enable the nodes using the kernel command line. To do this for all compute nodes, apply the following machine configuration:


Suggestion for clarity:

Suggested change

. To run {ibm-name} Secure Execution VMs, you must enable the nodes using the kernel command line. To do this for all compute nodes, apply the following machine configuration:

. To run {ibm-name} Secure Execution VMs, you must enable the nodes using the kernel command line. To enable all compute nodes, create a file named `secure-execution.yaml` containing the following machine config manifest:

I'm also unclear about what "enable the nodes using the kernel command line" means, and can't quite tell if that phrasing needs to be adjusted. Maybe you could explain this a bit in the intro, since it's the main action to be taken (other than the feature gate)?

proposal :
"To be able to run {ibm-name} Secure Execution VMs, you have to enable the following parameter (prot_virt=1) on the kernel level of each compute node. Apply the following machine configuration on each compute node : "

ousleyp · 2025-09-30T15:23:39Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+spec:
+  kernelArguments:
+    - prot_virt=1
+----
+


The rest of the YAML seems self-explanatory, but I would love context on this parameter. Suggestion:

Suggested change

spec:

kernelArguments:

- prot_virt=1

----

spec:

kernelArguments:

- prot_virt=1

----

+

where:

`prot_virt=1`:: Specifies <explanation of what this parameter does/why it is here>

prot_virt=1:: enabling this parameter on the kernel of the host allows the ultravisor to store in memory the required security information.
more details : https://libvirt.org/kbase/s390_protected_virt.html#host-requirements

ousleyp · 2025-09-30T15:29:37Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+.Prerequisites
+
+* Your cluster has logical partition (LPAR) nodes running on IBM z15 or later.
+* You have {ibm-name} Secure Execution workloads available to run on the cluster.
+


Suggested change

.Prerequisites

* Your cluster has logical partition (LPAR) nodes running on IBM z15 or later.

* You have {ibm-name} Secure Execution workloads available to run on the cluster.

.Prerequisites

* Your cluster has logical partition (LPAR) nodes running on IBM z15 or later.

* You have {ibm-name} Secure Execution workloads available to run on the cluster.

* You have installed the {oc-first}.

@SNiemann15 i just caught this , we are refering to z15 but not linuxone version , i would propose to also add :

Your cluster has logical partition (LPAR) nodes running on IBM z15 or later IBM Z machine, or IBM LinuxONE III or later LinuxONE machine

ousleyp · 2025-09-30T15:30:41Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+
+[source,terminal]
+----
+oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged


Suggested change

oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged

$ oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged

ousleyp · 2025-09-30T15:42:02Z

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

+
+.Procedure
+
+. Apply the following machine configuration:


For a one-step procedure, there should be a * (unordered list) instead of a . (ordered list). But this might be a two step procedure. (Confirm, but I think we need a second step to apply the changes, even if that step is just saving the file.)

This is a VM manifest, not a machine config :)

Suggested change

. Apply the following machine configuration:

* Apply the following `VirtualMachine` manifest to the cluster:

ousleyp · 2025-09-30T15:43:17Z

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

+apiVersion: kubevirt.io/v1
+kind: VirtualMachine
+metadata:
+  labels:
+    kubevirt.io/vm: f41-se
+  name: f41-se
+spec:
+  runStrategy: Always
+  template:
+    metadata:
+      labels:
+        kubevirt.io/vm: f41-se
+    spec:
+      domain:
+        launchSecurity: {}
+        devices:
+          disks:
+          - disk:
+              bus: virtio
+            name: rootfs
+        machine:
+          type: ""
+        resources:
+          requests:
+            memory: 4Gi
+      terminationGracePeriodSeconds: 0
+      volumes:
+        - name: rootfs
+          dataVolume:
+            name: f41-se


This is a very specific VM manifest; is it always these exact parameters? If not, please update it (using the description list format) so that it is clear which parameters need to be changed by the customer.

the point from this VM manifest example is to point that we need to add spec.domain.launchSecurity element/part in the manifest : this part :
spec:
domain:
launchSecurity: {}

those are the exact parameters everytime , the rest can vary depends on the VM spec (other parameters in the manifest are described in other parts of the doc i believe for all archs )

ousleyp · 2025-09-30T15:45:12Z

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

+As the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs
+can only be migrated offline.


ISG nit; also removing hard wrap.

Suggested change

As the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs

can only be migrated offline.

Because the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs can only be migrated offline.

ousleyp · 2025-09-30T15:48:59Z

virt/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc

+:_mod-docs-content-type: ASSEMBLY
+include::_attributes/common-attributes.adoc[]
+[id="virt-configuring-ibm-secure-execution-vms-ibm-z"]
+= Configuring {ibm-title} Secure Execution virtual machines on {ibm-z-title} and {ibm-linuxone-title}
+:context: virt-configuring-ibm-secure-execution-vms-ibm-z


You need a couple blank lines here (source: https://github.com/openshift/openshift-docs/blob/main/contributing_to_docs/doc_guidelines.adoc#general-file-guidelines).

Suggested change

:_mod-docs-content-type: ASSEMBLY

include::_attributes/common-attributes.adoc[]

[id="virt-configuring-ibm-secure-execution-vms-ibm-z"]

= Configuring {ibm-title} Secure Execution virtual machines on {ibm-z-title} and {ibm-linuxone-title}

:context: virt-configuring-ibm-secure-execution-vms-ibm-z

:_mod-docs-content-type: ASSEMBLY

include::_attributes/common-attributes.adoc[]

[id="virt-configuring-ibm-secure-execution-vms-ibm-z"]

= Configuring {ibm-title} Secure Execution virtual machines on {ibm-z-title} and {ibm-linuxone-title}

:context: virt-configuring-ibm-secure-execution-vms-ibm-z

ousleyp · 2025-09-30T15:50:24Z

virt/creating_vm/virt-configuring-ibm-secure-execution-vms-ibm-z.adoc

+
+toc::[]
+
+You can configure {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}.


This might be out of scope for this change, but I would love to see some more conceptual information regarding what a Secure Execution VM is, or some additional resources.

i would propose to use the same information as @jschintag did for the documentation upstream for kubevirt : https://kubevirt.io/user-guide/cluster_admin/confidential_computing/#ibm-secure-execution-for-linux-secure-execution
"IBM Secure Execution for Linux is a s390x security technology that is introduced with IBM z15 and LinuxONE III. It protects data of workloads that run in a KVM guest from being inspected or modified by the server environment.

In particular, no hardware administrator, no KVM code, and no KVM administrator can access the data in a guest that was started as an IBM Secure Execution guest.

For more details please read the official documentation."

Yes we can take that he took the text from ibm.docs page.

ousleyp · 2025-10-02T15:22:46Z

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc

+
+where:
+
+`prot_virt=1`:: Specifies that the ultravisor can use memory-protection hardwrarehost supports guests in {ibm-name} Secure Execution mode and allow the .


@SNiemann15 fyi, this line has some weird things going on :D

ousleyp · 2025-10-02T15:23:09Z

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

+
+.Procedure
+
+. Apply the following `VirtualMachine` manifest to the cluster:


If you're keeping this as one step, please change the . to *

ousleyp · 2025-10-02T15:38:04Z

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc

+where:
+
+[source,yaml]
+----
+spec:
+   domain:
+     launchSecurity:
+----
+
+Is required to launch  {ibm-name} Secure Execution VMs, the other values can vary depending on the setup.


Suggested change

where:

+

[source,yaml]

----

spec:

domain:

launchSecurity:

----

+

Is required to launch {ibm-name} Secure Execution VMs, the other values can vary depending on the setup.

To launch {ibm-name} Secure Execution VMs, you must include the following YAML in the manifest:

+

[source,yaml]

----

spec:

domain:

launchSecurity:

----

+

The rest of the VM manifest is variable depending on your setup.

ousleyp

I didn't do a full re-review but commented on a few things that stood out to me. Let me know when you're ready for another round! :)

openshift-ci · 2025-10-03T10:32:17Z

@SNiemann15: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ousleyp · 2025-10-03T17:56:35Z

Thanks so much for implementing my comments! It's probably a good idea to double check the feature gate implementation later, but for now it LGTM.

ousleyp · 2025-10-03T17:56:45Z

/cherrypick enterprise-4.20

openshift-cherrypick-robot · 2025-10-03T17:57:40Z

@ousleyp: new pull request created: #100013

In response to this:

/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 26, 2025

jschintag approved these changes Sep 26, 2025

View reviewed changes

jschintag reviewed Sep 26, 2025

View reviewed changes

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc Show resolved Hide resolved

SNiemann15 force-pushed the ocpvirt_secure_execution branch from 0394064 to b48529d Compare September 26, 2025 12:05

jschintag approved these changes Sep 26, 2025

View reviewed changes

openshift-ci bot assigned jschintag Sep 26, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 26, 2025

SNiemann15 force-pushed the ocpvirt_secure_execution branch from b48529d to c20adce Compare September 26, 2025 14:20

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 26, 2025

aspauldi reviewed Sep 26, 2025

View reviewed changes

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc Outdated Show resolved Hide resolved

aspauldi reviewed Sep 26, 2025

View reviewed changes

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc Outdated Show resolved Hide resolved

aspauldi reviewed Sep 26, 2025

View reviewed changes

modules/virt-enabling-vms-ibm-secure-execution-ibm-z.adoc Outdated Show resolved Hide resolved

aspauldi reviewed Sep 26, 2025

View reviewed changes

modules/virt-launching-ibm-secure-execution-vm-ibm-z.adoc Outdated Show resolved Hide resolved

SNiemann15 force-pushed the ocpvirt_secure_execution branch 2 times, most recently from 51a4480 to bbc50d4 Compare September 29, 2025 08:46

ousleyp added CNV Label for all CNV PRs branch/enterprise-4.20 labels Sep 30, 2025

ousleyp added this to the Planned for 4.20 GA milestone Sep 30, 2025

ousleyp reviewed Sep 30, 2025

View reviewed changes

SNiemann15 force-pushed the ocpvirt_secure_execution branch from bbc50d4 to f772c8a Compare October 2, 2025 14:43

ousleyp reviewed Oct 2, 2025

View reviewed changes

SNiemann15 force-pushed the ocpvirt_secure_execution branch from f772c8a to e7437c9 Compare October 3, 2025 10:11

Enable IBM Secure Execution on ocpvirt

01cdda9

SNiemann15 force-pushed the ocpvirt_secure_execution branch from e7437c9 to 01cdda9 Compare October 3, 2025 10:25

ousleyp merged commit aed0b9c into openshift:main Oct 3, 2025
2 checks passed

openshift-cherrypick-robot mentioned this pull request Oct 3, 2025

[enterprise-4.20] [CNV#69839] Enable IBM Secure Execution on ocpvirt #100013

Merged

SNiemann15 deleted the ocpvirt_secure_execution branch October 6, 2025 08:38

	Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name} you must prepare the cluster.
	Before you can run {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}, you must prepare the cluster.


		.Procedure

		. To run {ibm-name} Secure Execution VMs, you must enable the nodes using the kernel command line. To do this for all compute nodes, apply the following machine configuration:

	oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged
	$ oc edit -n openshift-cnv HyperConverged kubevirt-hyperconverged

	. Apply the following machine configuration:
	* Apply the following `VirtualMachine` manifest to the cluster:

		As the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs
		can only be migrated offline.

	As the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs
	can only be migrated offline.
	Because the memory of the VM is protected, {ibm-name} Secure Execution VMs are not live migratable. The VMs can only be migrated offline.


		toc::[]

		You can configure {ibm-name} Secure Execution virtual machines (VMs) on {ibm-z-name} and {ibm-linuxone-name}.


		.Procedure

		. Apply the following `VirtualMachine` manifest to the cluster:

[CNV#69839] Enable IBM Secure Execution on ocpvirt #99764

[CNV#69839] Enable IBM Secure Execution on ocpvirt #99764

Uh oh!

Conversation

SNiemann15 commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jschintag left a comment

Choose a reason for hiding this comment

Uh oh!

ocpdocs-previewbot commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jschintag left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Sep 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aspauldi commented Sep 26, 2025

Uh oh!

nbziouec commented Sep 29, 2025

Uh oh!

openshift-ci bot commented Sep 29, 2025

Uh oh!

ousleyp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nbziouec Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ousleyp left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 3, 2025

SNiemann15 commented Sep 26, 2025 •

edited

Loading

ocpdocs-previewbot commented Sep 26, 2025 •

edited

Loading

nbziouec Oct 1, 2025 •

edited

Loading