confidential-containers · Satoshi-Hirai371 · Jun 4, 2026 · Jun 23, 2026
@@ -26,9 +26,9 @@ RESOURCE_CTRL ?= true
 WEBHOOK_ENABLED ?= true
 # BUILTIN_CLOUD_PROVIDERS is used for binary build -- what providers are built in the binaries.
 ifeq ($(RELEASE_BUILD),true)
-	BUILTIN_CLOUD_PROVIDERS ?= alibabacloud aws azure gcp ibmcloud ibmcloud_powervs
+	BUILTIN_CLOUD_PROVIDERS ?= alibabacloud aws azure gcp ibmcloud ibmcloud_powervs kubevirt
 else
-	BUILTIN_CLOUD_PROVIDERS ?= alibabacloud aws azure byom gcp ibmcloud ibmcloud_powervs libvirt docker
+	BUILTIN_CLOUD_PROVIDERS ?= alibabacloud aws azure byom gcp ibmcloud ibmcloud_powervs libvirt docker kubevirt
 endif
 
 all: build

@@ -0,0 +1,10 @@
+//go:build kubevirt
+
+// (C) Copyright Confidential Containers Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	_ "github.com/confidential-containers/cloud-api-adaptor/src/cloud-providers/kubevirt"
+)
@@ -115,12 +115,20 @@ byom() {
 
 }
 
+kubevirt() {
+    set -x
+    exec cloud-api-adaptor kubevirt ${optionals}
+
+}
+
+
+
 help_msg() {
     cat <<EOF
 Usage:
-	CLOUD_PROVIDER=alibabacloud|aws|azure|byom|gcp|ibmcloud|ibmcloud-powervs|libvirt|docker $0
+	CLOUD_PROVIDER=alibabacloud|aws|azure|byom|gcp|ibmcloud|ibmcloud-powervs|libvirt|docker|kubevirt $0
 or
-	$0 alibabacloud|aws|azure|byom|gcp|ibmcloud|ibmcloud-powervs|libvirt|docker
+	$0 alibabacloud|aws|azure|byom|gcp|ibmcloud|ibmcloud-powervs|libvirt|docker|kubevirt
 
 in addition all cloud provider specific env variables must be set and valid
 (CLOUD_PROVIDER is currently set to "$CLOUD_PROVIDER")
@@ -145,6 +153,8 @@ elif [[ "$CLOUD_PROVIDER" == "libvirt" ]]; then
     libvirt
 elif [[ "$CLOUD_PROVIDER" == "docker" ]]; then
     docker
+elif [[ "$CLOUD_PROVIDER" == "kubevirt" ]]; then
+    kubevirt
 else
     help_msg
 fi
@@ -0,0 +1 @@
+# No cloud credentials required for kubevirt
@@ -0,0 +1,80 @@
+# Auto-generated by: make sync-chart-values
+# Avoid editing manually. You can, but CI will check for drift.
+# Provider: kubevirt
+
+provider: kubevirt
+
+providerConfigs:
+  kubevirt: {}
+    # CA certificate file for custom TLS (e.g. /etc/certificates/ca.crt)
+    # (default: "")
+    # CACERT_FILE: ""
+
+    # Client certificate file for custom TLS (e.g. /etc/certificates/client.crt)
+    # (default: "")
+    # CERT_FILE: ""
+
+    # Client key file for custom TLS (e.g. /etc/certificates/client.key)
+    # (default: "")
+    # CERT_KEY: ""
+
+    # Enable cloud config verify - should use it for production
+    # (default: "false")
+    # CLOUD_CONFIG_VERIFY: "false"
+
+    # Enable encrypted scratch space for pod VMs
+    # (default: "false")
+    # ENABLE_SCRATCH_SPACE: "false"
+
+    # [EXPERIMENTAL] Enable external networking via pod VM
+    # (default: "false")
+    # EXTERNAL_NETWORK_VIA_PODVM: "false"
+
+    # port number of agent protocol forwarder
+    # (default: "")
+    # FORWARDER_PORT: ""
+
+    # Default initdata for all Pods
+    # (default: "")
+    # INITDATA: ""
+
+    # pause image to be used for the pods
+    # (default: "")
+    # PAUSE_IMAGE: ""
+
+    # peer pods limit per node (default=10)
+    # (default: "10")
+    # PEERPODS_LIMIT_PER_NODE: "10"
+
+    # base directory for pod directories
+    # (default: "")
+    # PODS_DIR: ""
+
+    # [EXPERIMENTAL] Comma separated CIDRs for local pod subnets
+    # (default: "")
+    # POD_SUBNET_CIDRS: ""
+
+    # Maximum timeout in minutes for establishing agent proxy connection
+    # (default: "")
+    # PROXY_TIMEOUT: ""
+
+    # Unix domain socket path of remote hypervisor service
+    # (default: "")
+    # REMOTE_HYPERVISOR_ENDPOINT: ""
+
+    # serviceconfig filepath
+    # (default: "")
+    # SERVICECONFIG: ""
+
+    # Skip TLS certificate verification - use it only for testing
+    # (default: "false")
+    # TLS_SKIP_VERIFY: "false"
+
+    # Tunnel provider
+    # (default: "")
+    # TUNNEL_TYPE: ""
+
+    # VXLAN UDP port number (VXLAN tunnel mode only
+    # (default: "")
+    # VXLAN_PORT: ""
+
@@ -52,6 +52,16 @@ true
 {{- end -}}
 {{- end -}}
 
+{{/*
+If there is a directory named "provider" under the /providers directory, collect the files within it.
+Make the collected files accessible within Cloud-api-adaptor.
+*/}}
+{{- define "peerpods.hasProviderConfiglist" -}}
+{{- if .Files.Glob (print "providers/" .Values.provider "/*") -}}
+true
+{{- end -}}
+{{- end -}}
+
 {{/*
 Check if custom TLS certificates are configured.
 Returns "true" when CACERT_FILE is set in providerConfigs for the active

@@ -0,0 +1,17 @@
+{{- if include "peerpods.hasProviderConfiglist" . -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configlist
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: peerpods
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+{{- $currentScope := . }}
+{{- range $path, $_ := .Files.Glob (print "providers/" .Values.provider "/*") }}
+  {{ ( base $path ) }}: |
+{{- tpl ( $currentScope.Files.Get $path ) $currentScope | trim | nindent 4 }}
+{{- end }}
+{{- end }}
@@ -96,6 +96,11 @@ spec:
           name: kata-direct-volumes-dir
         - mountPath: /var/run/secrets/tokens
           name: vault-token
+{{- end }}
+{{- if include "peerpods.hasProviderConfiglist" . }}
+        - mountPath: /etc/config/caa/{{ .Values.provider }}
+          name: config-volume
+          readOnly: true
 {{- end }}
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -167,3 +172,8 @@ spec:
               expirationSeconds: 3600
               audience: iam
 {{- end }}
+{{- if include "peerpods.hasProviderConfiglist" . }}
+      - name: config-volume
+        configMap:
+          name: configlist
+{{- end }}
@@ -82,7 +82,7 @@ image:
   name: quay.io/confidential-containers/cloud-api-adaptor
   tag: "2d2e7c2c0736ec41c889cd98442a598b8b93bc0b"
 
-# Cloud provider: libvirt, aws, azure, gcp, ibmcloud, vsphere
+# Cloud provider: libvirt, aws, azure, gcp, ibmcloud, vsphere, kubevirt
 provider: libvirt
 
 # Maximum number of peer pods allowed to run simultaneously