feat: baremetal multi-cluster with mixed TEE and HCP support

charts/all/baremetal/templates/vsock-mco.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.global.cluster.hcp }}
 {{- range list "master" "worker" }}
 {{- if $.Values.tdx.enabled }}
 ---
@@ -23,3 +24,4 @@ spec:
             source: data:text/plain;charset=utf-8;base64,W2h5cGVydmlzb3IucWVtdV0KdGR4X3F1b3RlX2dlbmVyYXRpb25fc2VydmljZV9zb2NrZXRfcG9ydD0wCg==
 {{- end }}
 {{- end }}
+{{- end }}

charts/all/baremetal/values.yaml

@@ -1,2 +1,11 @@
+global:
+  cluster:
+    hcp: false
+
+# Node-level (OSC/kata) TDX enablement — controls the TDX MachineConfig
+# (kvm_intel.tdx=1 kernel arg + kata-tdx socket config). This is SEPARATE from
+# trustee's kbs.tdx.enabled, which controls attestation (quote verification).
+# A cluster may verify TDX evidence (trustee) without running TDX workloads,
+# and vice versa. The amd-snp hardware profile sets this false.
 tdx:
   enabled: true

charts/all/kubevirtconfidential/templates/selinux-mco.yaml

@@ -1,4 +1,5 @@
-{{- if .Values.global.kubevirt.confidential.enabled }}
+{{- /* QGS-socket SELinux policy is Intel TDX-specific. Skip on non-TDX and on HCP (no MCD). */}}
+{{- if and .Values.global.kubevirt.confidential.enabled .Values.tdx.enabled (not .Values.global.cluster.hcp) }}
 {{- range list "master" "worker" }}
 ---
 apiVersion: machineconfiguration.openshift.io/v1

charts/all/kubevirtconfidential/values.yaml

@@ -6,3 +6,11 @@ global:
     confidential:
       # enabled: false by default. Set to true in values-baremetal.yaml to deploy HCO + SELinux MCO.
       enabled: false
+  cluster:
+    # HCP clusters have no Machine Config Daemon — SELinux MachineConfig is skipped.
+    hcp: false
+
+# The QGS-socket SELinux policy (selinux-mco.yaml) is Intel TDX-specific.
+# Set false on non-TDX clusters so the MachineConfig is not deployed.
+tdx:
+  enabled: true

overrides/values-hw-amd-snp.yaml

@@ -22,6 +22,12 @@ clusterGroup:
     gpu-workload:
       disabled: true
 
+    # Node has no Intel TDX — skip the TDX MachineConfig (kvm_intel.tdx=1 kernel arg).
+    baremetal:
+      overrides:
+        - name: tdx.enabled
+          value: "false"
+
     trustee:
       overrides:
         - name: kbs.snp.enabled