Common Cloud API Adaptor setup

Use this page together with one provider guide. The provider guide tells you when to complete each shared step and supplies the cloud-specific cluster, network, identity, PodVM image, and Helm values.

Prerequisites

Install the tools used by every provider guide:

• kubectl
• Helm
• curl, git, and jq

Install the additional tools for your provider:

Authenticate the provider CLI before creating cloud resources. Continue with your provider guide to prepare the cluster, networking, and identity.

Prepare the CAA deployment

Complete the following steps when the provider guide directs you to prepare the shared deployment files.

Download the Helm deployment artifacts

Choose one source. Each option leaves the terminal in the peerpods Helm chart directory.

• Versions:
• Last Release
• Latest Build
• Local Checkout

CAA_VERSION="$(
  curl -fsSL \
    "https://api.github.com/repos/confidential-containers/cloud-api-adaptor/releases/latest" |
    jq -er '.tag_name | sub("^v"; "")'
)"
curl -LO "https://github.com/confidential-containers/cloud-api-adaptor/archive/refs/tags/v${CAA_VERSION}.tar.gz"
tar -xvzf "v${CAA_VERSION}.tar.gz"
cd "cloud-api-adaptor-${CAA_VERSION}/src/cloud-api-adaptor/install/charts/peerpods"

export CAA_BRANCH="main"
curl -LO "https://github.com/confidential-containers/cloud-api-adaptor/archive/refs/heads/${CAA_BRANCH}.tar.gz"
tar -xvzf "${CAA_BRANCH}.tar.gz"
cd "cloud-api-adaptor-${CAA_BRANCH}/src/cloud-api-adaptor/install/charts/peerpods"

cd <cloud-api-adaptor-checkout>/src/cloud-api-adaptor/install/charts/peerpods

Select the CAA container image

Use an image that matches the source selected above.

• Versions:
• Last Release
• Latest Build
• Custom Image

export CAA_IMAGE="quay.io/confidential-containers/cloud-api-adaptor"
export CAA_TAG="v${CAA_VERSION}-amd64"

export CAA_IMAGE="quay.io/confidential-containers/cloud-api-adaptor"
export CAA_TAG="<CI_IMAGE_TAG>"

export CAA_IMAGE="<REGISTRY>/<IMAGE>"
export CAA_TAG="<TAG>"

Install cert-manager

Note: Skip this step if cert-manager is already installed in the cluster.

The Peer Pods chart uses cert-manager for webhook certificates.

# Add the Jetstack Helm repository
helm repo add jetstack https://charts.jetstack.io
helm repo update

# Install cert-manager with CRDs
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --version v1.19.1 \
  --set crds.enabled=true

Wait for cert-manager to be ready:

kubectl wait --for=condition=ready pod \
  -l app.kubernetes.io/instance=cert-manager \
  -n cert-manager \ 
  --timeout=300s

Prepare the installation namespace

Create the namespace and add the metadata Helm needs to manage it:

kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Namespace
metadata:
  name: confidential-containers-system
  labels:
    app.kubernetes.io/managed-by: Helm
  annotations:
    meta.helm.sh/release-name: peerpods
    meta.helm.sh/release-namespace: confidential-containers-system
EOF

Return to your provider guide to configure the PodVM image, machine type, credentials, and provider values before installing the chart.