coco docs: improvements for version pinning and minor fixes - #494
Conversation
Documentation preview |
mikemckiernan
left a comment
mikemckiernan
left a comment
There was a problem hiding this comment.
One small request, can you update the release-notes.rst with something like a Post-Release Documentation Updates section? My concern is to prevent gaslighting a reader who notices changes w/o a record other than commit history.
dcmiddle
left a comment
dcmiddle
left a comment
There was a problem hiding this comment.
Generally lgtm! Good additions on specificity for component versions.
Nit on whether we need to always mention the version in prose.
Unclear on whether we are recommending helm or docker compose. Might be this RA release we are sticking with docker compose, but future release will recommend helm?
100%, thanks - I also merged #479 and #480 without adding these. I will add a section which also includes the updates made by these two PRs. |
5879725 to
ac8faa0
Compare
The post-release section was already there. In fact, it was always there. |
fitzthum
left a comment
fitzthum
left a comment
There was a problem hiding this comment.
Nice. We can just get the version stuff hammered out with hashes for now. The next CoCo release (v0.24.0) should improve the situation.
| .. note:: | ||
|
|
||
| The Trustee ${trustee_version} `docker-compose.yml <https://github.com/confidential-containers/trustee/blob/${trustee_version}/docker-compose.yml>`_ still references ``:latest`` images for KBS, AS, and RVPS. | ||
| While cloning that tag pins the compose configuration to a released version, ``docker compose up -d`` still pulls whatever ``:latest`` resolves to at that time. |
There was a problem hiding this comment.
Let's add some guidance for how to patch the image. We will be able to remove this in the future when we change the Trustee release process.
There was a problem hiding this comment.
@fitzthum ptal, updated with new concrete pins for the time being - in a future time, we can just remove the .. note:: on this
There was a problem hiding this comment.
Looks good. We will be able to do this a bit more cleanly when we switch to Helm chart and then before too long we won't need to do it at all.
ac8faa0 to
dfdcd11
Compare
Recommend Kata Containers genpolicy 4.1.0 for agent security policy generation, and point downloads and the README at that release instead of main or an unnamed matching Kata tag. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Record NVRC v0.1.5 and NVIDIA GPU driver 595.58.03 in the distroless guest OS cell so the platforms matrix names the payload this architecture validates. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Align the guest kernel and QEMU versions with Kata Containers 4.1.0 versions.yaml (6.18.35 and 11.0.1 plus GPU patches). Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Use gpu_operator_version in the Helm install command so the quickstart pin stays in sync with the detailed install page. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Add --wait to the detailed install command so Helm blocks as described, and attribute nfd.enabled=false to the values file. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Replace the KBS protocol 0.4.0 matrix row with Trustee v0.21.0, name guest-components v0.21.0 in the distroless guest, and pin the attestation quickstart clone, Compose images, and kbs-client to that release. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Use the kata-deploy node-feature-discovery chart key in the CoCo sample values file and the GPU Operator Kata install command. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
Add a CoCo 1.1.0 section so published changes after the RA ship with a visible record, including NVIDIA#479, NVIDIA#480, and this PR. Record the kata-deploy NFD correction in GPU Operator 26.7.0. Document Trustee Compose image pins for the v0.21.0 commit. Signed-off-by: Manuel Huber <manuelh@nvidia.com> Assisted-by: Cursor Grok 4.6
dfdcd11 to
0dce299
Compare
5 participants
A few changes:
main; drop the KBS protocol 0.4.0 row).--waiton the detailed kata-deploy install.--setusednfd.enabled, which only applies to the GPU Operator chart. Usenode-feature-discovery.enabledso kata-deploy actually turns NFD off and does not lean on a default.