Add virtualization.confidential hardware requirement#4638
Open
Add virtualization.confidential hardware requirement#4638
virtualization.confidential hardware requirement#4638Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
LecrisUT
approved these changes
Mar 3, 2026
psss
changed the title
virtualization.confidential hardware requirement
tcornell-bus
reviewed
Mar 4, 2026
Contributor
Author
|
@tcornell-bus kindly asking for re-review |
Contributor
|
@thrix please, set the "Size" of this PR. |
Contributor
Author
thrix
force-pushed
the
add-virtualization-confidential
branch
2 times, most recently
from
19bae02 to
49d3ad5
Compare
LecrisUT
approved these changes
Mar 11, 2026
bajertom
force-pushed
the
add-virtualization-confidential
branch
from
49d3ad5 to
14156a2
Compare
bajertom
added
the
ci | full test
Contributor
|
/packit test |
Add a new boolean hardware requirement for specifying that a guest should be provisioned as a confidential VM with a hardware-based Trusted Execution Environment (TEE) such as AMD SEV-SNP, Intel TDX, or ARM CCA. Closes #4637 Assisted-by Claude Code
Assisted-by Claude Code
- Clarify implemented-by notes for both artemis and mrack - Shorten release note and add external link Assisted-by Claude Code
Co-authored-by: tcornell-bus <tcornell@redhat.com>
Add a note to the versionadded directive and a footnote to the hardware support table explaining that virtualization.confidential is not yet supported by any provisioner plugin. Assisted-by Claude Code
thrix
force-pushed
the
add-virtualization-confidential
branch
from
14156a2 to
bd30d2f
Compare
psss
reviewed
Mar 12, 2026
Contributor
psss
left a comment
psss
left a comment
There was a problem hiding this comment.
Looks ok, just the versionadded confusion.
thrix
commented
Mar 12, 2026
Co-authored-by: Miroslav Vadkerti <mvadkert@redhat.com>
psss
approved these changes
Mar 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a new boolean hardware requirement
virtualization.confidentialfor specifying that a guest should be provisioned as a confidential VM with a hardware-based Trusted Execution Environment (TEE).Confidential VMs use technologies like AMD SEV-SNP, Intel TDX, or ARM CCA to protect data while in use by encrypting VM memory from the hypervisor. All major cloud providers (Azure, GCP, AWS) support this.
Changes
confidential: true|falsetospec/hardware/virtualization.fmf'confidential'to the flag constraints in_parse_virtualization()confidentialboolean property to the virtualization block inhardware.yamlFULL_HARDWARE_REQUIREMENTSand expected output intest_hardware.pyNo provisioner transformer is included initially, consistent with how
virtualization.is-supportedis handled.Closes #4637 TFT-4391
Assisted-by Claude Code
Pull Request Checklist