7.3. Configuring IBM Secure Execution virtual machines on IBM Z and IBM LinuxONE

Procedure

1. To run IBM® Secure Execution VMs, you must add the prot_virt=1 kernel parameter for each compute node. To enable all compute nodes, create a file named secure-execution.yaml that contains the following machine config manifest:

   apiVersion: machineconfiguration.openshift.io/v1
   kind: MachineConfig
   metadata:
     name: secure-execution
     labels:
       machineconfiguration.openshift.io/role: worker
   spec:
     kernelArguments:
       - prot_virt=1

   where:

   prot_virt=1

   Specifies that the ultravisor can store memory security information.

2. Apply the changes by running the following command:

   $ oc apply -f secure-execution.yaml

   The Machine Config Operator (MCO) applies the changes and reboots the nodes in a controlled rollout.