Install GPU drivers by default - #228
Merged
Merged
Conversation
snir911
force-pushed
the
konflux-nv
branch
3 times, most recently
from
May 31, 2026 09:11
b2012db to
4675780
Compare
snir911
force-pushed
the
konflux-nv
branch
2 times, most recently
from
June 7, 2026 09:06
247bea1 to
fc801ea
Compare
snir911
force-pushed
the
konflux-nv
branch
4 times, most recently
from
June 18, 2026 14:02
e4f5188 to
416e7d9
Compare
littlejawa
reviewed
Jun 24, 2026
littlejawa
left a comment
littlejawa
left a comment
Collaborator
There was a problem hiding this comment.
Overall looks ok, but I have some comments.
Collaborator
|
Looks good to me, the only security aspect we need to be very careful about is that the PCR annotations have to be included under the signature, otherwise an attacker can change them keeping the OCI artifact intact. |
snir911
force-pushed
the
konflux-nv
branch
3 times, most recently
from
June 28, 2026 08:14
e5ffd0e to
8645d7b
Compare
Contributor
|
Caution There are some errors in your PipelineRun template.
|
To be used with RHEL 10.2 ISO: rhel-10.2-x86_64-dvd.iso image sha256sum: e15cb333529c332e76e4b1b946efe3515c99f996546675aec18e8effdf2540a5 KERNEL_VERSION=6.12.0-211.16.1.el10_2 Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
Add PCR measurements as individual OCI image annotations in addition to the existing measurements.json file. This allows users to query PCR values via skopeo/podman inspect without pulling the image. Annotations added: - io.github.confidential-containers.measurements.algorithm - io.github.confidential-containers.measurements.pcr03 - io.github.confidential-containers.measurements.pcr09 - io.github.confidential-containers.measurements.pcr11 - io.github.confidential-containers.measurements.pcr12 Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
These packages are required by libnvat.so.1 required by latest payload image Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
NVIDIA_DRIVER_VERSION=595.58.03 (if NVIDIA_DRIVER_VERSION, driver installtion will be skipped) Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
These packages are required by libnvat.so.1 required by latest payload image Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
To be used with RHEL 10.2 ISO: rhel-10.2-x86_64-dvd.iso image sha256sum: e15cb333529c332e76e4b1b946efe3515c99f996546675aec18e8effdf2540a5 KERNEL_VERSION=6.12.0-211.16.1.el10_2 Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
NVIDIA_DRIVER_VERSION=595.58.03 (if NVIDIA_DRIVER_VERSION, driver installtion will be skipped) Assisted-by: Claude AI Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the PodVM/dm-verity image build pipeline to install NVIDIA GPU drivers by default (with a configurable driver version), while also bumping the base RHEL image checksum/kernel version and enriching pushed OCI artifacts with TPM measurement metadata.
Changes:
- Add
NVIDIA_DRIVER_VERSIONparameter and install NVIDIA driver/tooling during disk customization. - Update default RHEL image checksum and kernel version used during image build.
- Add PCR measurement values as OCI manifest annotations during
buildah commit, and update CoCo payload image digests.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| task/build-dm-verity-image/0.1/build-dm-verity-image.yaml | Adds NVIDIA driver install steps, bumps defaults, and annotates OCI manifests with PCR measurements. |
| .tekton/build-dm-verity-image-debug.yaml | Mirrors the main task updates for the debug variant. |
| scripts/coco/podvm/script-disk-mods.sh | Updates the standalone disk modification script with kernel bump + NVIDIA driver install + CDI generation service. |
| scripts/coco/coco-components.sh | Updates default payload image digest references. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
temporarily exclude old kernel-uki-virt packages due to a deletion conflict Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
temporarily exclude old kernel-uki-virt packages due to a deletion conflict Signed-off-by: Snir Schreiber <ssheribe@redhat.com> Assisted-by: Claude AI
(pre-released) sha256:15d70ba45e3263be545254060674e93fbdef3922480f9c3c80381c599ca1cb67 Signed-off-by: Snir Schreiber <ssheribe@redhat.com>
esposem
approved these changes
Jun 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.