DO NOT MERGE: Comment out tests for a reduced CI burden

WIP: workflows: Trigger CI tests with gh cli
- We are hitting limitations where gh can only call actions with 20 workflow jobs, so split out the CI test jobs as separate workflows and call them once the required artifacts are created. - Note: This commit updates the test runs to use the source branch workflows, rather than target branch that we have at the moment, we need to think about this pretty carefully to check there isn't any secuirty concerns here (I think there aren't as we are already vulnerable in this respect) WIP: Run the workflow on the ref, or the `main` version?
2026-03-05 04:12:09 +00:00 · 2025-07-17 14:51:19 +01:00 · 2025-07-17 14:51:19 +01:00 · 2025-07-17 14:51:19 +01:00
2318 changed files with 81215 additions and 154631 deletions
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -7,24 +7,19 @@
 self-hosted-runner:
  # Labels of self-hosted runner that linter should ignore
  labels:
-    - amd64-nvidia-a100
-    - amd64-nvidia-h100-snp
    - arm64-k8s
+    - ubuntu-22.04-arm
    - garm-ubuntu-2004
    - garm-ubuntu-2004-smaller
    - garm-ubuntu-2204
    - garm-ubuntu-2304
    - garm-ubuntu-2304-smaller
    - garm-ubuntu-2204-smaller
-    - ppc64le
-    - ppc64le-k8s
-    - ppc64le-small
-    - ubuntu-24.04-ppc64le
-    - ubuntu-24.04-s390x
+    - k8s-ppc64le
    - metrics
+    - ppc64le
    - riscv-builder
    - sev-snp
    - s390x
    - s390x-large
    - tdx
-    - ubuntu-24.04-arm
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,7 @@ updates:
      - "/src/tools/agent-ctl"
      - "/src/tools/genpolicy"
      - "/src/tools/kata-ctl"
+      - "/src/tools/runk"
      - "/src/tools/trace-forwarder"
    schedule:
      interval: "daily"
@@ -65,9 +66,6 @@ updates:
      rustix:
        patterns:
          - rustix
-      slab:
-        patterns:
-          - slab
      time:
        patterns:
          - time
--- a/.github/workflows/PR-wip-checks.yaml
+++ b/.github/workflows/PR-wip-checks.yaml
@@ -9,7 +9,8 @@ on:
      - labeled
      - unlabeled

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -3,8 +3,16 @@ name: Lint GHA workflows
 on:
  workflow_dispatch:
  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+    paths:
+      - '.github/workflows/**'

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -12,7 +20,6 @@ concurrency:

 jobs:
  run-actionlint:
-    name: run-actionlint
    env:
      GH_TOKEN: ${{ github.token }}
    runs-on: ubuntu-24.04
--- a/.github/workflows/basic-ci-amd64.yaml
+++ b/.github/workflows/basic-ci-amd64.yaml
@@ -13,11 +13,11 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-containerd-sandboxapi:
-    name: run-containerd-sandboxapi
    strategy:
      # We can set this to true whenever we're 100% sure that
      # the all the tests are not flaky, otherwise we'll fail
@@ -49,8 +49,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -66,12 +64,11 @@ jobs:
        run: bash tests/integration/cri-containerd/gha-run.sh run

  run-containerd-stability:
-    name: run-containerd-stability
    strategy:
      fail-fast: false
      matrix:
        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'qemu-runtime-rs']
+        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'stratovirt']
    runs-on: ubuntu-22.04
    env:
      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -92,8 +89,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/stability/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -109,7 +104,6 @@ jobs:
        run: bash tests/stability/gha-run.sh run

  run-nydus:
-    name: run-nydus
    strategy:
      # We can set this to true whenever we're 100% sure that
      # the all the tests are not flaky, otherwise we'll fail
@@ -117,7 +111,7 @@ jobs:
      fail-fast: false
      matrix:
        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball', 'qemu-runtime-rs']
+        vmm: ['clh', 'qemu', 'dragonball', 'stratovirt']
    runs-on: ubuntu-22.04
    env:
      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
@@ -138,8 +132,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/integration/nydus/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -147,24 +139,49 @@ jobs:
          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
          path: kata-artifacts

-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
      - name: Install kata
        run: bash tests/integration/nydus/gha-run.sh install-kata kata-artifacts

-      - name: Install kata-tools
-        run: bash tests/integration/nydus/gha-run.sh install-kata-tools kata-tools-artifacts
-
      - name: Run nydus tests
        timeout-minutes: 10
        run: bash tests/integration/nydus/gha-run.sh run

+  run-runk:
+    # Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether
+    if: false
+    runs-on: ubuntu-22.04
+    env:
+      CONTAINERD_VERSION: lts
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/runk/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
+
+      - name: Run runk tests
+        timeout-minutes: 10
+        run: bash tests/integration/runk/gha-run.sh run
+
  run-tracing:
-    name: run-tracing
    strategy:
      fail-fast: false
      matrix:
@@ -192,8 +209,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/functional/tracing/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -209,7 +224,6 @@ jobs:
        run: bash tests/functional/tracing/gha-run.sh run

  run-vfio:
-    name: run-vfio
    strategy:
      fail-fast: false
      matrix:
@@ -239,8 +253,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/functional/vfio/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -252,8 +264,51 @@ jobs:
        timeout-minutes: 15
        run: bash tests/functional/vfio/gha-run.sh run

+  run-docker-tests:
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm:
+          - clh
+          - qemu
+          - dragonball
+          - cloud-hypervisor
+    runs-on: ubuntu-22.04
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run
+
  run-nerdctl-tests:
-    name: run-nerdctl-tests
    strategy:
      # We can set this to true whenever we're 100% sure that
      # all the tests are not flaky, otherwise we'll fail them
@@ -265,7 +320,6 @@ jobs:
          - dragonball
          - qemu
          - cloud-hypervisor
-          - qemu-runtime-rs
    runs-on: ubuntu-22.04
    env:
      KATA_HYPERVISOR: ${{ matrix.vmm }}
@@ -285,7 +339,6 @@ jobs:
      - name: Install dependencies
        env:
          GITHUB_API_TOKEN: ${{ github.token }}
-          GH_TOKEN: ${{ github.token }}
        run: bash tests/integration/nerdctl/gha-run.sh install-dependencies

      - name: get-kata-tarball
@@ -314,7 +367,6 @@ jobs:
          retention-days: 1

  run-kata-agent-apis:
-    name: run-kata-agent-apis
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -331,8 +383,6 @@ jobs:

      - name: Install dependencies
        run: bash tests/functional/kata-agent-apis/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -340,16 +390,8 @@ jobs:
          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
          path: kata-artifacts

-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata & kata-tools
-        run: | 
-          bash tests/functional/kata-agent-apis/gha-run.sh install-kata kata-artifacts
-          bash tests/functional/kata-agent-apis/gha-run.sh install-kata-tools kata-tools-artifacts
+      - name: Install kata
+        run: bash tests/functional/kata-agent-apis/gha-run.sh install-kata kata-artifacts

      - name: Run kata agent api tests with agent-ctl
        run: bash tests/functional/kata-agent-apis/gha-run.sh run
--- a/.github/workflows/basic-ci-s390x.yaml
+++ b/.github/workflows/basic-ci-s390x.yaml
@@ -13,11 +13,11 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-containerd-sandboxapi:
-    name: run-containerd-sandboxapi
    strategy:
      # We can set this to true whenever we're 100% sure that
      # the all the tests are not flaky, otherwise we'll fail
@@ -48,9 +48,7 @@ jobs:
          TARGET_BRANCH: ${{ inputs.target-branch }}

      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh
-        env:
-          GH_TOKEN: ${{ github.token }}
+        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -66,7 +64,6 @@ jobs:
        run: bash tests/integration/cri-containerd/gha-run.sh run

  run-containerd-stability:
-    name: run-containerd-stability
    strategy:
      fail-fast: false
      matrix:
@@ -106,3 +103,43 @@ jobs:
      - name: Run containerd-stability tests
        timeout-minutes: 15
        run: bash tests/stability/gha-run.sh run
+
+  run-docker-tests:
+    strategy:
+      # We can set this to true whenever we're 100% sure that
+      # all the tests are not flaky, otherwise we'll fail them
+      # all due to a single flaky instance.
+      fail-fast: false
+      matrix:
+        vmm: ['qemu']
+    runs-on: s390x-large
+    env:
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/docker/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
+
+      - name: Run docker smoke test
+        timeout-minutes: 5
+        run: bash tests/integration/docker/gha-run.sh run
--- a/.github/workflows/build-checks-preview-riscv64.yaml
+++ b/.github/workflows/build-checks-preview-riscv64.yaml
@@ -12,12 +12,12 @@ on:
        required: true
        type: string

-permissions: {}
+permissions:
+  contents: read

 name: Build checks preview riscv64
 jobs:
  check:
-    name: check
    runs-on: ${{ inputs.instance }}
    strategy:
      fail-fast: false
@@ -124,11 +124,9 @@ jobs:
          echo "GITHUB_RUNNER_CI_NON_VIRT=true" >> "$GITHUB_ENV"
      - name: Running `${{ matrix.command }}` for ${{ matrix.component.name }}
        run: |
-          cd "${COMPONENT_PATH}"
-          ${COMMAND}
+          cd ${{ matrix.component.path }}
+          ${{ matrix.command }}
        env:
-          COMMAND: ${{ matrix.command }}
-          COMPONENT_PATH: ${{ matrix.component.path }}
          RUST_BACKTRACE: "1"
          RUST_LIB_BACKTRACE: "0"
          SKIP_GO_VERSION_CHECK: "1"
--- a/.github/workflows/build-checks.yaml
+++ b/.github/workflows/build-checks.yaml
@@ -5,19 +5,13 @@ on:
        required: true
        type: string

-permissions: {}
-
+permissions:
+  contents: read

 name: Build checks
 jobs:
  check:
-    name: check
-    runs-on: >-
-      ${{
-        ( contains(inputs.instance, 's390x') && matrix.component.name == 'runtime' ) && 's390x' ||
-        ( contains(inputs.instance, 'ppc64le') && (matrix.component.name == 'runtime' || matrix.component.name == 'agent') ) && 'ppc64le' ||
-        inputs.instance
-      }}
+    runs-on: ${{ inputs.instance }}
    strategy:
      fail-fast: false
      matrix:
@@ -48,11 +42,6 @@ jobs:
            path: src/runtime-rs
            needs:
              - rust
-          - name: libs
-            path: src/libs
-            needs:
-              - rust
-              - protobuf-compiler
          - name: agent-ctl
            path: src/tools/agent-ctl
            needs:
@@ -63,7 +52,6 @@ jobs:
            path: src/tools/kata-ctl
            needs:
              - rust
-              - protobuf-compiler
          - name: trace-forwarder
            path: src/tools/trace-forwarder
            needs:
@@ -73,8 +61,6 @@ jobs:
            needs:
              - rust
              - protobuf-compiler
-        instance:
-          - ${{ inputs.instance }} 

    steps:
      - name: Adjust a permission for repo
@@ -136,11 +122,9 @@ jobs:
          echo "GITHUB_RUNNER_CI_NON_VIRT=true" >> "$GITHUB_ENV"
      - name: Running `${{ matrix.command }}` for ${{ matrix.component.name }}
        run: |
-          cd "${COMPONENT_PATH}"
-          eval "${COMMAND}"
+          cd ${{ matrix.component.path }}
+          ${{ matrix.command }}
        env:
-          COMMAND: ${{ matrix.command }}
-          COMPONENT_PATH: ${{ matrix.component.path }}
          RUST_BACKTRACE: "1"
          RUST_LIB_BACKTRACE: "0"
          SKIP_GO_VERSION_CHECK: "1"
--- a/.github/workflows/build-helm-image.yaml
+++ b/.github/workflows/build-helm-image.yaml
@@ -1,75 +0,0 @@
-name: Build helm multi-arch image
-
-on:
-  schedule:
-    # Run every Sunday at 12:00 UTC (12 hours after kubectl image build)
-    - cron: '0 12 * * 0'
-  workflow_dispatch:
-    # Allow manual triggering
-  push:
-    branches:
-      - main
-    paths:
-      - 'tools/packaging/helm/Dockerfile'
-      - '.github/workflows/build-helm-image.yaml'
-
-permissions: {}
-
-env:
-  REGISTRY: quay.io
-  IMAGE_NAME: kata-containers/helm
-
-jobs:
-  build-and-push:
-    name: Build and push multi-arch image
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to Quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Get helm version
-        id: helm-version
-        run: |
-          HELM_VERSION=$(curl -s https://api.github.com/repos/helm/helm/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
-          echo "version=${HELM_VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Generate image metadata
-        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=latest
-            type=raw,value={{date 'YYYYMMDD'}}
-            type=raw,value=${{ steps.helm-version.outputs.version }}
-            type=sha,prefix=
-
-      - name: Build and push multi-arch image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          context: tools/packaging/helm/
-          file: tools/packaging/helm/Dockerfile
-          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -23,14 +23,12 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: false
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-asset:
-    name: build-asset
    runs-on: ubuntu-22.04
    permissions:
      contents: read
@@ -41,11 +39,16 @@ jobs:
      matrix:
        asset:
          - agent
+          - agent-ctl
          - busybox
          - cloud-hypervisor
          - cloud-hypervisor-glibc
          - coco-guest-components
+          - csi-kata-directvolume
          - firecracker
+          - genpolicy
+          - kata-ctl
+          - kata-manager
          - kernel
          - kernel-confidential
          - kernel-dragonball-experimental
@@ -54,11 +57,12 @@ jobs:
          - nydus
          - ovmf
          - ovmf-sev
-          - ovmf-tdx
          - pause-image
          - qemu
          - qemu-snp-experimental
          - qemu-tdx-experimental
+          - stratovirt
+          - trace-forwarder
          - virtiofsd
        stage:
          - ${{ inputs.stage }}
@@ -104,19 +108,16 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: Parse OCI image name and digest
        id: parse-oci-segments
        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
        run: |
-          oci_image="$(<"build/${KATA_ASSET}-oci-image")"
+          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"

-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
        with:
          version: "1.2.0"
@@ -140,7 +141,7 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

@@ -148,13 +149,12 @@ jobs:
        if: ${{ startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}-modules${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}-modules.tar.zst
+          name: kata-artifacts-amd64-${{ matrix.asset }}-headers${{ inputs.tarball-suffix }}
+          path: kata-build/kata-static-${{ matrix.asset }}-headers.tar.xz
          retention-days: 15
          if-no-files-found: error

  build-asset-rootfs:
-    name: build-asset-rootfs
    runs-on: ubuntu-22.04
    needs: build-asset
    permissions:
@@ -166,8 +166,6 @@ jobs:
          - rootfs-image
          - rootfs-image-confidential
          - rootfs-image-mariner
-          - rootfs-image-nvidia-gpu
-          - rootfs-image-nvidia-gpu-confidential
          - rootfs-initrd
          - rootfs-initrd-confidential
          - rootfs-initrd-nvidia-gpu
@@ -217,19 +215,17 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: store-artifact ${{ matrix.asset }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
-    name: remove-rootfs-binary-artifacts
    runs-on: ubuntu-22.04
    needs: build-asset-rootfs
    strategy:
@@ -237,8 +233,8 @@ jobs:
        asset:
          - busybox
          - coco-guest-components
-          - kernel-nvidia-gpu-modules
-          - kernel-nvidia-gpu-confidential-modules
+          - kernel-nvidia-gpu-headers
+          - kernel-nvidia-gpu-confidential-headers
          - pause-image
    steps:
      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
@@ -247,7 +243,6 @@ jobs:

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts-for-release:
-    name: remove-rootfs-binary-artifacts-for-release
    runs-on: ubuntu-22.04
    needs: build-asset-rootfs
    strategy:
@@ -261,7 +256,6 @@ jobs:
          name: kata-artifacts-amd64-${{ matrix.asset}}${{ inputs.tarball-suffix }}

  build-asset-shim-v2:
-    name: build-asset-shim-v2
    runs-on: ubuntu-22.04
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
    permissions:
@@ -318,12 +312,11 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-amd64-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.zst
+          path: kata-build/kata-static-shim-v2.tar.xz
          retention-days: 15
          if-no-files-found: error

  create-kata-tarball:
-    name: create-kata-tarball
    runs-on: ubuntu-22.04
    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
    permissions:
@@ -350,113 +343,10 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-        env:
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.zst
-          retention-days: 15
-          if-no-files-found: error
-
-  build-tools-asset:
-    name: build-tools-asset
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      matrix:
-        asset:
-          - agent-ctl
-          - csi-kata-directvolume
-          - genpolicy
-          - kata-ctl
-          - kata-manager
-          - trace-forwarder
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: quay.io
-          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        id: build
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-tools-build && cp "${build_dir}"/kata-static-"${KATA_ASSET}"*.tar.* kata-tools-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: kata-tools-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-tools-build/kata-static-${{ matrix.asset }}.tar.zst
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tools-tarball:
-    name: create-kata-tools-tarball
-    runs-on: ubuntu-22.04
-    needs: [build-tools-asset]
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          fetch-tags: true
-          persist-credentials: false
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          pattern: kata-tools-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-tools-artifacts versions.yaml kata-tools-static.tar.zst
-        env:
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-      - name: store-artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-static.tar.zst
+          path: kata-static.tar.xz
          retention-days: 15
          if-no-files-found: error
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -23,15 +23,13 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: false
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-asset:
-    name: build-asset
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    permissions:
      contents: read
      packages: write
@@ -47,10 +45,10 @@ jobs:
          - kernel
          - kernel-dragonball-experimental
          - kernel-nvidia-gpu
-          - kernel-cca-confidential
          - nydus
          - ovmf
          - qemu
+          - stratovirt
          - virtiofsd
    env:
      PERFORM_ATTESTATION: ${{ matrix.asset == 'agent' && inputs.push-to-registry == 'yes' && 'yes' || 'no' }}
@@ -90,19 +88,16 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: Parse OCI image name and digest
        id: parse-oci-segments
        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
        run: |
-          oci_image="$(<"build/${KATA_ASSET}-oci-image")"
+          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"

-      - uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+      - uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
        with:
          version: "1.2.0"
@@ -126,7 +121,7 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

@@ -134,14 +129,13 @@ jobs:
        if: ${{ startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}-modules${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}-modules.tar.zst
+          name: kata-artifacts-arm64-${{ matrix.asset }}-headers${{ inputs.tarball-suffix }}
+          path: kata-build/kata-static-${{ matrix.asset }}-headers.tar.xz
          retention-days: 15
          if-no-files-found: error

  build-asset-rootfs:
-    name: build-asset-rootfs
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset
    permissions:
      contents: read
@@ -150,7 +144,6 @@ jobs:
      matrix:
        asset:
          - rootfs-image
-          - rootfs-image-nvidia-gpu
          - rootfs-initrd
          - rootfs-initrd-nvidia-gpu
    steps:
@@ -197,26 +190,24 @@ jobs:
          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ inputs.target-branch }}
          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-          KBUILD_SIGN_PIN: ${{ contains(matrix.asset, 'nvidia') && secrets.KBUILD_SIGN_PIN || '' }}

      - name: store-artifact ${{ matrix.asset }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
-    name: remove-rootfs-binary-artifacts
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset-rootfs
    strategy:
      matrix:
        asset:
          - busybox
-          - kernel-nvidia-gpu-modules
+          - kernel-nvidia-gpu-headers
    steps:
      - uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
        with:
@@ -224,8 +215,7 @@ jobs:

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts-for-release:
-    name: remove-rootfs-binary-artifacts-for-release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: build-asset-rootfs
    strategy:
      matrix:
@@ -238,8 +228,7 @@ jobs:
          name: kata-artifacts-arm64-${{ matrix.asset}}${{ inputs.tarball-suffix }}

  build-asset-shim-v2:
-    name: build-asset-shim-v2
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts, remove-rootfs-binary-artifacts-for-release]
    permissions:
      contents: read
@@ -293,13 +282,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-arm64-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.zst
+          path: kata-build/kata-static-shim-v2.tar.xz
          retention-days: 15
          if-no-files-found: error

  create-kata-tarball:
-    name: create-kata-tarball
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
    permissions:
      contents: read
@@ -325,12 +313,10 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-        env:
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.zst
+          path: kata-static.tar.xz
          retention-days: 15
          if-no-files-found: error
--- a/.github/workflows/build-kata-static-tarball-ppc64le.yaml
+++ b/.github/workflows/build-kata-static-tarball-ppc64le.yaml
@@ -24,15 +24,15 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-asset:
-    name: build-asset
    permissions:
      contents: read
      packages: write
-    runs-on: ubuntu-24.04-ppc64le
+    runs-on: ppc64le
    strategy:
      matrix:
        asset:
@@ -83,13 +83,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 1
          if-no-files-found: error

  build-asset-rootfs:
-    name: build-asset-rootfs
-    runs-on: ubuntu-24.04-ppc64le
+    runs-on: ppc64le
    needs: build-asset
    permissions:
      contents: read
@@ -149,13 +148,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 1
          if-no-files-found: error

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
-    name: remove-rootfs-binary-artifacts
    runs-on: ubuntu-22.04
    needs: build-asset-rootfs
    strategy:
@@ -169,8 +167,7 @@ jobs:
          name: kata-artifacts-ppc64le-${{ matrix.asset}}${{ inputs.tarball-suffix }}

  build-asset-shim-v2:
-    name: build-asset-shim-v2
-    runs-on: ubuntu-24.04-ppc64le
+    runs-on: ppc64le
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
    permissions:
      contents: read
@@ -224,13 +221,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-ppc64le-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.zst
+          path: kata-build/kata-static-shim-v2.tar.xz
          retention-days: 1
          if-no-files-found: error

  create-kata-tarball:
-    name: create-kata-tarball
-    runs-on: ubuntu-24.04-ppc64le
+    runs-on: ppc64le
    needs: [build-asset, build-asset-rootfs, build-asset-shim-v2]
    permissions:
      contents: read
@@ -260,12 +256,10 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-        env:
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-static.tar.zst
+          path: kata-static.tar.xz
          retention-days: 1
          if-no-files-found: error
--- a/.github/workflows/build-kata-static-tarball-riscv64.yaml
+++ b/.github/workflows/build-kata-static-tarball-riscv64.yaml
@@ -20,12 +20,15 @@ on:
        required: false
        type: string
        default: ""
+    secrets:
+      QUAY_DEPLOYER_PASSWORD:
+        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-asset:
-    name: build-asset
    runs-on: riscv-builder
    permissions:
      contents: read
@@ -38,6 +41,14 @@ jobs:
          - kernel
          - virtiofsd
    steps:
+      - name: Login to Kata Containers quay.io
+        if: ${{ inputs.push-to-registry == 'yes' }}
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: quay.io
+          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
+          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.commit-hash }}
@@ -70,6 +81,6 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-riscv64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
-          retention-days: 3
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          retention-days: 15
          if-no-files-found: error
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -27,12 +27,12 @@ on:
        required: true


-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-asset:
-    name: build-asset
-    runs-on: ubuntu-24.04-s390x
+    runs-on: s390x
    permissions:
      contents: read
      packages: write
@@ -91,10 +91,8 @@ jobs:
      - name: Parse OCI image name and digest
        id: parse-oci-segments
        if: ${{ env.PERFORM_ATTESTATION == 'yes' }}
-        env:
-          ASSET: ${{ matrix.asset }}
        run: |
-          oci_image="$(<"build/${ASSET}-oci-image")"
+          oci_image="$(<"build/${{ matrix.asset }}-oci-image")"
          echo "oci-name=${oci_image%@*}" >> "$GITHUB_OUTPUT"
          echo "oci-digest=${oci_image#*@}" >> "$GITHUB_OUTPUT"

@@ -117,12 +115,11 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

  build-asset-rootfs:
-    name: build-asset-rootfs
    runs-on: s390x
    needs: build-asset
    permissions:
@@ -185,12 +182,11 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.zst
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
          retention-days: 15
          if-no-files-found: error

  build-asset-boot-image-se:
-    name: build-asset-boot-image-se
    runs-on: s390x
    needs: [build-asset, build-asset-rootfs]
    permissions:
@@ -234,13 +230,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-s390x${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-boot-image-se.tar.zst
+          path: kata-build/kata-static-boot-image-se.tar.xz
          retention-days: 1
          if-no-files-found: error

  # We don't need the binaries installed in the rootfs as part of the release tarball, so can delete them now we've built the rootfs
  remove-rootfs-binary-artifacts:
-    name: remove-rootfs-binary-artifacts
    runs-on: ubuntu-22.04
    needs: [build-asset-rootfs, build-asset-boot-image-se]
    strategy:
@@ -256,8 +251,7 @@ jobs:
          name: kata-artifacts-s390x-${{ matrix.asset}}${{ inputs.tarball-suffix }}

  build-asset-shim-v2:
-    name: build-asset-shim-v2
-    runs-on: ubuntu-24.04-s390x
+    runs-on: s390x
    needs: [build-asset, build-asset-rootfs, remove-rootfs-binary-artifacts]
    permissions:
      contents: read
@@ -313,13 +307,12 @@ jobs:
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-artifacts-s390x-shim-v2${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-shim-v2.tar.zst
+          path: kata-build/kata-static-shim-v2.tar.xz
          retention-days: 15
          if-no-files-found: error

  create-kata-tarball:
-    name: create-kata-tarball
-    runs-on: ubuntu-24.04-s390x
+    runs-on: s390x
    needs:
      - build-asset
      - build-asset-rootfs
@@ -349,12 +342,10 @@ jobs:
      - name: merge-artifacts
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-        env:
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
      - name: store-artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-static.tar.zst
+          path: kata-static.tar.xz
          retention-days: 15
          if-no-files-found: error
--- a/.github/workflows/build-kubectl-image.yaml
+++ b/.github/workflows/build-kubectl-image.yaml
@@ -1,75 +0,0 @@
-name: Build kubectl multi-arch image
-
-on:
-  schedule:
-    # Run every Sunday at 00:00 UTC
-    - cron: '0 0 * * 0'
-  workflow_dispatch:
-    # Allow manual triggering
-  push:
-    branches:
-      - main
-    paths:
-      - 'tools/packaging/kubectl/Dockerfile'
-      - '.github/workflows/build-kubectl-image.yaml'
-
-permissions: {}
-
-env:
-  REGISTRY: quay.io
-  IMAGE_NAME: kata-containers/kubectl
-
-jobs:
-  build-and-push:
-    name: Build and push multi-arch image
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Login to Quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Get kubectl version
-        id: kubectl-version
-        run: |
-          KUBECTL_VERSION=$(curl -L -s https://dl.k8s.io/release/stable.txt)
-          echo "version=${KUBECTL_VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Generate image metadata
-        id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=latest
-            type=raw,value={{date 'YYYYMMDD'}}
-            type=raw,value=${{ steps.kubectl-version.outputs.version }}
-            type=sha,prefix=
-
-      - name: Build and push multi-arch image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
-        with:
-          context: tools/packaging/kubectl/
-          file: tools/packaging/kubectl/Dockerfile
-          platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
--- a/.github/workflows/cargo-deny-runner.yaml
+++ b/.github/workflows/cargo-deny-runner.yaml
@@ -11,11 +11,11 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  cargo-deny-runner:
-    name: cargo-deny-runner
    runs-on: ubuntu-22.04

    steps:
--- a/.github/workflows/ci-coco-stability.yaml
+++ b/.github/workflows/ci-coco-stability.yaml
@@ -9,7 +9,8 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  kata-containers-ci-on-push:
@@ -30,4 +31,3 @@ jobs:
      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-devel.yaml
+++ b/.github/workflows/ci-devel.yaml
@@ -2,15 +2,17 @@ name: Kata Containers CI (manually triggered)
 on:
  workflow_dispatch:

-permissions: {}
+permissions:
+  contents: read

 jobs:
  kata-containers-ci-on-push:
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      actions: write
      attestations: write
+      contents: read
+      id-token: write
+      packages: write
    uses: ./.github/workflows/ci.yaml
    with:
      commit-hash: ${{ github.sha }}
@@ -26,8 +28,6 @@ jobs:
      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-checks:
    uses: ./.github/workflows/build-checks.yaml
--- a/.github/workflows/ci-nightly-riscv.yaml
+++ b/.github/workflows/ci-nightly-riscv.yaml
@@ -1,34 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for RISC-V
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  build-kata-static-tarball-riscv:
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
-    with:
-      tarball-suffix: -${{ github.sha }}
-      commit-hash: ${{ github.sha }}
-      target-branch: ${{ github.ref_name }}
-
-  build-checks-preview:
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "riscv-builder"
-    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
-    with:
-      instance: ${{ matrix.instance }}
--- a/.github/workflows/ci-nightly-s390x.yaml
+++ b/.github/workflows/ci-nightly-s390x.yaml
@@ -4,11 +4,11 @@ on:

 name: Nightly CI for s390x

-permissions: {}
+permissions:
+  contents: read

 jobs:
  check-internal-test-result:
-    name: check-internal-test-result
    runs-on: s390x
    strategy:
      fail-fast: false
@@ -16,8 +16,7 @@ jobs:
        test_title:
          - kata-vfio-ap-e2e-tests
          - cc-vfio-ap-e2e-tests
-          - cc-se-e2e-tests-go
-          - cc-se-e2e-tests-rs
+          - cc-se-e2e-tests
    steps:
    - name: Fetch a test result for {{ matrix.test_title }}
      run: |
--- a/.github/workflows/ci-nightly.yaml
+++ b/.github/workflows/ci-nightly.yaml
@@ -7,15 +7,17 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  kata-containers-ci-on-push:
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      actions: write
      attestations: write
+      contents: read
+      id-token: write
+      packages: write
    uses: ./.github/workflows/ci.yaml
    with:
      commit-hash: ${{ github.sha }}
@@ -30,5 +32,3 @@ jobs:
      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-on-push.yaml
+++ b/.github/workflows/ci-on-push.yaml
@@ -1,8 +1,9 @@
 name: Kata Containers CI
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] See #11332.
+  pull_request_target:
    branches:
      - 'main'
+      - 'stable-*'
    types:
      # Adding 'labeled' to the list of activity types that trigger this event
      # (default: opened, synchronize, reopened) so that we can run this
@@ -13,7 +14,8 @@ on:
      - reopened
      - labeled

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -31,10 +33,11 @@ jobs:
    needs: skipper
    if: ${{ needs.skipper.outputs.skip_build != 'yes' }}
    permissions:
-      contents: read
-      packages: write
-      id-token: write
+      actions: write
      attestations: write
+      contents: read
+      id-token: write
+      packages: write
    uses: ./.github/workflows/ci.yaml
    with:
      commit-hash: ${{ github.event.pull_request.head.sha }}
@@ -50,5 +53,3 @@ jobs:
      CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
      ITA_KEY: ${{ secrets.ITA_KEY }}
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
--- a/.github/workflows/ci-weekly.yaml
+++ b/.github/workflows/ci-weekly.yaml
@@ -27,10 +27,9 @@ on:
        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-kata-static-tarball-amd64:
@@ -44,8 +43,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-amd64:
    needs: build-kata-static-tarball-amd64
@@ -66,7 +63,6 @@ jobs:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-and-publish-tee-confidential-unencrypted-image:
-    name: build-and-publish-tee-confidential-unencrypted-image
    permissions:
      contents: read
      packages: write
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -35,12 +35,10 @@ on:
        required: true
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      NGC_API_KEY:
-        required: true
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
  build-kata-static-tarball-amd64:
@@ -54,8 +52,6 @@ jobs:
      tarball-suffix: -${{ inputs.tag }}
      commit-hash: ${{ inputs.commit-hash }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  publish-kata-deploy-payload-amd64:
    needs: build-kata-static-tarball-amd64
@@ -75,103 +71,114 @@ jobs:
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

-  build-kata-static-tarball-arm64:
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
+  # build-kata-static-tarball-arm64:
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #     id-token: write
+  #     attestations: write
+  #   uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}

-  publish-kata-deploy-payload-arm64:
-    needs: build-kata-static-tarball-arm64
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-arm64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-24.04-arm
-      arch: arm64
-    secrets:
-      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+  # publish-kata-deploy-payload-arm64:
+  #   needs: build-kata-static-tarball-arm64
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #   uses: ./.github/workflows/publish-kata-deploy-payload.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-arm64
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: ubuntu-22.04-arm
+  #     arch: arm64
+  #   secrets:
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

-  build-kata-static-tarball-s390x:
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      CI_HKD_PATH: ${{ secrets.ci_hkd_path }}
-      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+  # build-kata-static-tarball-s390x:
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #     id-token: write
+  #     attestations: write
+  #   uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #   secrets:
+  #     CI_HKD_PATH: ${{ secrets.ci_hkd_path }}
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

-  build-kata-static-tarball-ppc64le:
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+  # build-kata-static-tarball-ppc64le:
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #   uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #   secrets:
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

-  publish-kata-deploy-payload-s390x:
-    needs: build-kata-static-tarball-s390x
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-24.04-s390x
-      arch: s390x
-    secrets:
-      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+  # build-kata-static-tarball-riscv64:
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #     id-token: write
+  #     attestations: write
+  #   uses: ./.github/workflows/build-kata-static-tarball-riscv64.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #   secrets:
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

-  publish-kata-deploy-payload-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/publish-kata-deploy-payload.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-24.04-ppc64le
-      arch: ppc64le
-    secrets:
-      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+  # publish-kata-deploy-payload-s390x:
+  #   needs: build-kata-static-tarball-s390x
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #   uses: ./.github/workflows/publish-kata-deploy-payload.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-s390x
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: s390x
+  #     arch: s390x
+  #   secrets:
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
+
+  # publish-kata-deploy-payload-ppc64le:
+  #   needs: build-kata-static-tarball-ppc64le
+  #   permissions:
+  #     contents: read
+  #     packages: write
+  #   uses: ./.github/workflows/publish-kata-deploy-payload.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-ppc64le
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: ppc64le
+  #     arch: ppc64le
+  #   secrets:
+  #     QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  build-and-publish-tee-confidential-unencrypted-image:
-    name: build-and-publish-tee-confidential-unencrypted-image
    permissions:
      contents: read
      packages: write
@@ -213,7 +220,6 @@ jobs:
          file: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/Dockerfile

  publish-csi-driver-amd64:
-    name: publish-csi-driver-amd64
    needs: build-kata-static-tarball-amd64
    permissions:
      contents: read
@@ -233,14 +239,14 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: get-kata-tools-tarball
+      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
-          name: kata-tools-static-tarball-amd64-${{ inputs.tag }}
-          path: kata-tools-artifacts
+          name: kata-static-tarball-amd64-${{ inputs.tag }}
+          path: kata-artifacts

-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
+      - name: Install tools
+        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts

      - name: Copy binary into Docker context
        run: |
@@ -269,225 +275,274 @@ jobs:

  run-kata-monitor-tests:
    if: ${{ inputs.skip-test != 'yes' }}
+    runs-on: ubuntu-22.04
    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-kata-monitor-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
+    env:
+      GH_TOKEN: ${{ github.token }}
+    permissions:
+      actions: write # Permission to trigger the gh workflows
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Trigger kata monitor tests
+        run: |
+          ./tests/gha-helper.sh trigger-and-check-workflow \
+            run-kata-monitor-tests.yaml \
+            ${{ github.ref }} \
+            ${{ github.sha }} \
+            '{
+              "artifact-run-id":"${{ github.run_id }}",
+              "tarball-suffix":"-${{ inputs.tag }}",
+              "commit-hash":"${{ inputs.commit-hash }}",
+              "target-branch":"${{ inputs.target-branch }}"
+            }'

  run-k8s-tests-on-aks:
    if: ${{ inputs.skip-test != 'yes' }}
+    runs-on: ubuntu-22.04
    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
-
+    env:
+      GH_TOKEN: ${{ github.token }}
    permissions:
-      contents: read
-      id-token: write # Used for OIDC access to log into Azure
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      AZ_APPID: ${{ secrets.AZ_APPID }}
-      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+      actions: write # Permission to trigger the gh workflows
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Trigger run-k8s-tests-on-aks workflow
+        run: |
+          ./tests/gha-helper.sh trigger-and-check-workflow \
+            run-k8s-tests-on-aks.yaml \
+            ${{ github.ref }} \
+            ${{ github.sha }} \
+            '{
+              "artifact-run-id":"${{ github.run_id }}",
+              "tarball-suffix":"-${{ inputs.tag }}",
+              "registry":"ghcr.io",
+              "repo":"${{ github.repository_owner }}/kata-deploy-ci",
+              "tag":"${{ inputs.tag }}-amd64",
+              "commit-hash":"${{ inputs.commit-hash }}",
+              "pr-number":"${{ inputs.pr-number }}",
+              "target-branch":"${{ inputs.target-branch }}"
+            }'

-  run-k8s-tests-on-arm64:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-arm64
-    uses: ./.github/workflows/run-k8s-tests-on-arm64.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-arm64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-k8s-tests-on-nvidia-gpu:
+  run-k8s-tests-on-amd64:
    if: ${{ inputs.skip-test != 'yes' }}
    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml
+    uses: ./.github/workflows/run-k8s-tests-on-amd64.yaml
    with:
-      tarball-suffix: -${{ inputs.tag }}
      registry: ghcr.io
      repo: ${{ github.repository_owner }}/kata-deploy-ci
      tag: ${{ inputs.tag }}-amd64
      commit-hash: ${{ inputs.commit-hash }}
      pr-number: ${{ inputs.pr-number }}
      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      NGC_API_KEY: ${{ secrets.NGC_API_KEY }}

+  # run-k8s-tests-on-arm64:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: publish-kata-deploy-payload-arm64
+  #   uses: ./.github/workflows/run-k8s-tests-on-arm64.yaml
+  #   with:
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-arm64
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     pr-number: ${{ inputs.pr-number }}
+  #     target-branch: ${{ inputs.target-branch }}

  run-kata-coco-tests:
    if: ${{ inputs.skip-test != 'yes' }}
+    runs-on: ubuntu-22.04
    needs:
-     - publish-kata-deploy-payload-amd64
-     - build-and-publish-tee-confidential-unencrypted-image
-     - publish-csi-driver-amd64
-    uses: ./.github/workflows/run-kata-coco-tests.yaml
+    - publish-kata-deploy-payload-amd64
+    - build-and-publish-tee-confidential-unencrypted-image
+    - publish-csi-driver-amd64
+    env:
+      GH_TOKEN: ${{ github.token }}
    permissions:
-      contents: read
-      id-token: write # Used for OIDC access to log into Azure
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      AZ_APPID: ${{ secrets.AZ_APPID }}
-      AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-      AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-      ITA_KEY: ${{ secrets.ITA_KEY }}
+      actions: write # Permission to trigger the gh workflows
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Trigger kata-coco-tests for amd64 arch
+        run: |
+          ./tests/gha-helper.sh trigger-and-check-workflow \
+            run-kata-coco-tests.yaml \
+            ${{ github.ref }} \
+            ${{ github.sha }} \
+            '{
+              "artifact-run-id":"${{ github.run_id }}",
+              "tarball-suffix":"-${{ inputs.tag }}",
+              "registry":"ghcr.io",
+              "repo":"${{ github.repository_owner }}/kata-deploy-ci",
+              "tag":"${{ inputs.tag }}-amd64",
+              "commit-hash":"${{ inputs.commit-hash }}",
+              "pr-number":"${{ inputs.pr-number }}",
+              "target-branch":"${{ inputs.target-branch }}"
+            }'

-  run-k8s-tests-on-zvsi:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: [publish-kata-deploy-payload-s390x, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-k8s-tests-on-zvsi.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets:
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+  # run-k8s-tests-on-zvsi:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: [publish-kata-deploy-payload-s390x, build-and-publish-tee-confidential-unencrypted-image]
+  #   uses: ./.github/workflows/run-k8s-tests-on-zvsi.yaml
+  #   with:
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-s390x
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     pr-number: ${{ inputs.pr-number }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #   secrets:
+  #     AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}

-  run-k8s-tests-on-ppc64le:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: publish-kata-deploy-payload-ppc64le
-    uses: ./.github/workflows/run-k8s-tests-on-ppc64le.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
+  # run-k8s-tests-on-ppc64le:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: publish-kata-deploy-payload-ppc64le
+  #   uses: ./.github/workflows/run-k8s-tests-on-ppc64le.yaml
+  #   with:
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-ppc64le
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     pr-number: ${{ inputs.pr-number }}
+  #     target-branch: ${{ inputs.target-branch }}

-  run-kata-deploy-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: [publish-kata-deploy-payload-amd64]
-    uses: ./.github/workflows/run-kata-deploy-tests.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
+  # run-kata-deploy-tests:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: [publish-kata-deploy-payload-amd64]
+  #   uses: ./.github/workflows/run-kata-deploy-tests.yaml
+  #   with:
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-amd64
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     pr-number: ${{ inputs.pr-number }}
+  #     target-branch: ${{ inputs.target-branch }}

-  run-basic-amd64-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/basic-ci-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
+  # run-metrics-tests:
+  #   # Skip metrics tests whilst runner is broken
+  #   if: false
+  #   # if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-amd64
+  #   uses: ./.github/workflows/run-metrics.yaml
+  #   with:
+  #     registry: ghcr.io
+  #     repo: ${{ github.repository_owner }}/kata-deploy-ci
+  #     tag: ${{ inputs.tag }}-amd64
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     pr-number: ${{ inputs.pr-number }}
+  #     target-branch: ${{ inputs.target-branch }}

-  run-basic-s390x-tests:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/basic-ci-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
+  # run-basic-amd64-tests:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-amd64
+  #   uses: ./.github/workflows/basic-ci-amd64.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}

-  run-cri-containerd-amd64:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-amd64
-    strategy:
-      fail-fast: false
-      matrix:
-        params: [
-          { containerd_version: lts,    vmm: clh              },
-          { containerd_version: lts,    vmm: dragonball       },
-          { containerd_version: lts,    vmm: qemu             },
-          { containerd_version: lts,    vmm: cloud-hypervisor },
-          { containerd_version: lts,    vmm: qemu-runtime-rs  },
-          { containerd_version: active, vmm: clh              },
-          { containerd_version: active, vmm: dragonball       },
-          { containerd_version: active, vmm: qemu             },
-          { containerd_version: active, vmm: cloud-hypervisor },
-          { containerd_version: active, vmm: qemu-runtime-rs  },
-         ]
-    uses: ./.github/workflows/run-cri-containerd-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ubuntu-22.04
-      arch: amd64
-      containerd_version: ${{ matrix.params.containerd_version }}
-      vmm: ${{ matrix.params.vmm }}
+  # run-basic-s390x-tests:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-s390x
+  #   uses: ./.github/workflows/basic-ci-s390x.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}

-  run-cri-containerd-s390x:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-s390x
-    strategy:
-      fail-fast: false
-      matrix:
-        params: [
-          { containerd_version: active, vmm: qemu            },
-          { containerd_version: active, vmm: qemu-runtime-rs },
-         ]
-    uses: ./.github/workflows/run-cri-containerd-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: s390x-large
-      arch: s390x
-      containerd_version: ${{ matrix.params.containerd_version }}
-      vmm: ${{ matrix.params.vmm }}
+  # run-cri-containerd-amd64:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-amd64
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       params: [
+  #         { containerd_version: lts,    vmm: clh              },
+  #         { containerd_version: lts,    vmm: dragonball       },
+  #         { containerd_version: lts,    vmm: qemu             },
+  #         { containerd_version: lts,    vmm: stratovirt       },
+  #         { containerd_version: lts,    vmm: cloud-hypervisor },
+  #         { containerd_version: lts,    vmm: qemu-runtime-rs  },
+  #         { containerd_version: active, vmm: clh              },
+  #         { containerd_version: active, vmm: dragonball       },
+  #         { containerd_version: active, vmm: qemu             },
+  #         { containerd_version: active, vmm: stratovirt       },
+  #         { containerd_version: active, vmm: cloud-hypervisor },
+  #         { containerd_version: active, vmm: qemu-runtime-rs  },
+  #        ]
+  #   uses: ./.github/workflows/run-cri-containerd-tests.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: ubuntu-22.04
+  #     arch: amd64
+  #     containerd_version: ${{ matrix.params.containerd_version }}
+  #     vmm: ${{ matrix.params.vmm }}

-  run-cri-containerd-tests-ppc64le:
-    if: ${{ inputs.skip-test != 'yes' }}
-    needs: build-kata-static-tarball-ppc64le
-    strategy:
-      fail-fast: false
-      matrix:
-        params: [
-          { containerd_version: active, vmm: qemu },
-         ]
-    uses: ./.github/workflows/run-cri-containerd-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: ppc64le-small
-      arch: ppc64le
-      containerd_version: ${{ matrix.params.containerd_version }}
-      vmm: ${{ matrix.params.vmm }}
+  # run-cri-containerd-s390x:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-s390x
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       params: [
+  #         { containerd_version: active, vmm: qemu            },
+  #         { containerd_version: active, vmm: qemu-runtime-rs },
+  #        ]
+  #   uses: ./.github/workflows/run-cri-containerd-tests.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: s390x-large
+  #     arch: s390x
+  #     containerd_version: ${{ matrix.params.containerd_version }}
+  #     vmm: ${{ matrix.params.vmm }}

-  run-cri-containerd-tests-arm64:
-    if: false
-    needs: build-kata-static-tarball-arm64
-    strategy:
-      fail-fast: false
-      matrix:
-        params: [
-          { containerd_version: active, vmm: qemu },
-         ]
-    uses: ./.github/workflows/run-cri-containerd-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-      runner: arm64-non-k8s
-      arch: arm64
-      containerd_version: ${{ matrix.params.containerd_version }}
-      vmm: ${{ matrix.params.vmm }}
+  # run-cri-containerd-tests-ppc64le:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-ppc64le
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       params: [
+  #         { containerd_version: active, vmm: qemu },
+  #        ]
+  #   uses: ./.github/workflows/run-cri-containerd-tests.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: ppc64le
+  #     arch: ppc64le
+  #     containerd_version: ${{ matrix.params.containerd_version }}
+  #     vmm: ${{ matrix.params.vmm }}
+
+  # run-cri-containerd-tests-arm64:
+  #   if: ${{ inputs.skip-test != 'yes' }}
+  #   needs: build-kata-static-tarball-arm64
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       params: [
+  #         { containerd_version: active, vmm: qemu },
+  #        ]
+  #   uses: ./.github/workflows/run-cri-containerd-tests.yaml
+  #   with:
+  #     tarball-suffix: -${{ inputs.tag }}
+  #     commit-hash: ${{ inputs.commit-hash }}
+  #     target-branch: ${{ inputs.target-branch }}
+  #     runner: arm64-non-k8s
+  #     arch: arm64
+  #     containerd_version: ${{ matrix.params.containerd_version }}
+  #     vmm: ${{ matrix.params.vmm }}
--- a/.github/workflows/cleanup-resources.yaml
+++ b/.github/workflows/cleanup-resources.yaml
@@ -4,14 +4,13 @@ on:
    - cron: "0 0 * * *"
  workflow_dispatch:

-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
  cleanup-resources:
-    name: cleanup-resources
    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,8 +19,8 @@ on:
  schedule:
    - cron: '45 0 * * 1'

-permissions: {}
-
+permissions:
+  contents: read

 jobs:
  analyze:
--- a/.github/workflows/commit-message-check.yaml
+++ b/.github/workflows/commit-message-check.yaml
@@ -6,7 +6,8 @@ on:
      - reopened
      - synchronize

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -41,7 +42,7 @@ jobs:
        filter_out_pattern: '^Revert "|^Reapply "'

    - name: DCO Check
-      uses: tim-actions/dco@f2279e6e62d5a7d9115b0cb8e837b777b1b02e21 # v1.1.0
+      uses: tim-actions/dco@2fd0504dc0d27b33f542867c300c60840c6dcb20 # master (2020-04-28)
      with:
        commits: ${{ steps.get-pr-commits.outputs.commits }}

--- a/.github/workflows/darwin-tests.yaml
+++ b/.github/workflows/darwin-tests.yaml
@@ -6,7 +6,8 @@ on:
      - reopened
      - synchronize

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -15,29 +16,15 @@ concurrency:
 name: Darwin tests
 jobs:
  test:
-    name: test
    runs-on: macos-latest
    steps:
-    - name: Install Protoc
-      run: |
-        f=$(mktemp)
-        curl -sSLo "$f" https://github.com/protocolbuffers/protobuf/releases/download/v28.2/protoc-28.2-osx-aarch_64.zip
-        mkdir -p "$HOME/.local"
-        unzip -d "$HOME/.local" "$f"
-        echo "$HOME/.local/bin" >> "${GITHUB_PATH}"
-
+    - name: Install Go
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      with:
+        go-version: 1.23.10
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: false
-
-    - name: Install golang
-      run: |
-        ./tests/install_go.sh -f -p
-        echo "/usr/local/go/bin" >> "${GITHUB_PATH}"
-
-    - name: Install Rust
-      run: ./tests/install_rust.sh
-
    - name: Build utils
      run: ./ci/darwin-test.sh
--- a/.github/workflows/docs-url-alive-check.yaml
+++ b/.github/workflows/docs-url-alive-check.yaml
@@ -1,34 +1,36 @@
 on:
  schedule:
    - cron:  '0 23 * * 0'
-  workflow_dispatch:

-permissions: {}
+permissions:
+  contents: read

 name: Docs URL Alive Check
 jobs:
  test:
-    name: test
    runs-on: ubuntu-22.04
    # don't run this action on forks
    if: github.repository_owner == 'kata-containers'
    env:
      target_branch: ${{ github.base_ref }}
    steps:
+    - name: Install Go
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      with:
+        go-version: 1.23.10
+      env:
+        GOPATH: ${{ github.workspace }}/kata-containers
    - name: Set env
      run: |
-        echo "GOPATH=${GITHUB_WORKSPACE}" >> "$GITHUB_ENV"
+        echo "GOPATH=${{ github.workspace }}" >> "$GITHUB_ENV"
+        echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
        persist-credentials: false
-
-    - name: Install golang
-      run: |
-        ./tests/install_go.sh -f -p
-        echo "/usr/local/go/bin" >> "${GITHUB_PATH}"
-
+        path: ./src/github.com/${{ github.repository }}
+    # docs url alive check
    - name: Docs URL Alive Check
      run: |
-        make docs-url-alive-check
+        cd "${GOPATH}/src/github.com/${{ github.repository }}" && make docs-url-alive-check
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -1,32 +0,0 @@
-name: Documentation
-on:
-  push:
-    branches:
-      - main
-permissions: {}
-jobs:
-  deploy-docs:
-    name: deploy-docs
-    permissions:
-      contents: read
-      pages: write
-      id-token: write
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/configure-pages@v5
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@v5
-        with:
-          python-version: 3.x
-      - run: pip install zensical
-      - run: zensical build --clean
-      - uses: actions/upload-pages-artifact@v4
-        with:
-          path: site
-      - uses: actions/deploy-pages@v4
-        id: deployment
--- a/.github/workflows/gatekeeper-skipper.yaml
+++ b/.github/workflows/gatekeeper-skipper.yaml
@@ -31,11 +31,11 @@ on:
      skip_static:
        value: ${{ jobs.skipper.outputs.skip_static }}

-permissions: {}
+permissions:
+  contents: read

 jobs:
  skipper:
-    name: skipper
    runs-on: ubuntu-22.04
    outputs:
      skip_build: ${{ steps.skipper.outputs.skip_build }}
--- a/.github/workflows/gatekeeper.yaml
+++ b/.github/workflows/gatekeeper.yaml
@@ -5,16 +5,15 @@ name: Gatekeeper
 # reporting the status.

 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] See #11332.
+  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
-      - edited
      - labeled
-      - unlabeled

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -22,7 +21,6 @@ concurrency:

 jobs:
  gatekeeper:
-    name: gatekeeper
    runs-on: ubuntu-22.04
    permissions:
      actions: read
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -3,23 +3,23 @@ on:

 name: Govulncheck

-permissions: {}
+permissions:
+  contents: read

 jobs:
  govulncheck:
-    name: govulncheck
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        include:
          - binary: "kata-runtime"
            make_target: "runtime"
-          - binary: "containerd-shim-kata-v2"
+          - binary: "containerd-shim-kata-v2" 
            make_target: "containerd-shim-v2"
          - binary: "kata-monitor"
            make_target: "monitor"
      fail-fast: false
-
+    
    steps:
      - name: Checkout the code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -40,14 +40,11 @@ jobs:
      - name: Build runtime binaries
        run: |
          cd src/runtime
-          make "${MAKE_TARGET}"
+          make ${{ matrix.make_target }}
        env:
-          MAKE_TARGET: ${{ matrix.make_target }}
          SKIP_GO_VERSION_CHECK: "1"

      - name: Run govulncheck on ${{ matrix.binary }}
-        env:
-          BINARY: ${{ matrix.binary }}
        run: |
          cd src/runtime
-          bash ../../tests/govulncheck-runner.sh "./${BINARY}"
+          bash ../../tests/govulncheck-runner.sh "./${{ matrix.binary }}"
--- a/.github/workflows/kata-runtime-classes-sync.yaml
+++ b/.github/workflows/kata-runtime-classes-sync.yaml
@@ -0,0 +1,41 @@
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  kata-deploy-runtime-classes-check:
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+    - name: Ensure the split out runtime classes match the all-in-one file
+      run: |
+        pushd tools/packaging/kata-deploy/runtimeclasses/
+        echo "::group::Combine runtime classes"
+        for runtimeClass in $(find . -type f \( -name "*.yaml" -and -not -name "kata-runtimeClasses.yaml" \) | sort); do
+            echo "Adding ${runtimeClass} to the resultingRuntimeClasses.yaml"
+            cat "${runtimeClass}" >> resultingRuntimeClasses.yaml;
+        done
+        echo "::endgroup::"
+        echo "::group::Displaying the content of resultingRuntimeClasses.yaml"
+        cat resultingRuntimeClasses.yaml
+        echo "::endgroup::"
+        echo ""
+        echo "::group::Displaying the content of kata-runtimeClasses.yaml"
+        cat kata-runtimeClasses.yaml
+        echo "::endgroup::"
+        echo ""
+        diff resultingRuntimeClasses.yaml kata-runtimeClasses.yaml
--- a/.github/workflows/nydus-snapshotter-version-in-sync.yaml
+++ b/.github/workflows/nydus-snapshotter-version-in-sync.yaml
@@ -1,35 +0,0 @@
-name: nydus-snapshotter-version-sync
-
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  nydus-snapshotter-version-check:
-    name: nydus-snapshotter-version-check
-    runs-on: ubuntu-22.04
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        persist-credentials: false
-    - name: Ensure nydus-snapshotter-version is in sync inside our repo
-      run: |
-        dockerfile_version=$(grep "ARG NYDUS_SNAPSHOTTER_VERSION" tools/packaging/kata-deploy/Dockerfile | cut -f2 -d'=')
-        versions_version=$(yq ".externals.nydus-snapshotter.version | explode(.)" versions.yaml)
-        if [[ "${dockerfile_version}" != "${versions_version}" ]]; then
-          echo "nydus-snapshotter version must be the same in the following places: "
-          echo "- versions.yaml: ${versions_version}"
-          echo "- tools/packaging/kata-deploy/Dockerfile: ${dockerfile_version}"
-          exit 1
-        fi
--- a/.github/workflows/osv-scanner.yaml
+++ b/.github/workflows/osv-scanner.yaml
@@ -1,43 +0,0 @@
-# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
-# in addition to a PR check which fails if new vulnerabilities are introduced.
-#
-# For more examples and options, including how to ignore specific vulnerabilities,
-# see https://google.github.io/osv-scanner/github-action/
-
-name: OSV-Scanner
-
-on:
-  workflow_dispatch:
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '0 1 * * 0'
-  push:
-    branches: [ "main" ]
-
-permissions: {}
-
-jobs:
-  scan-scheduled:
-    permissions:
-      actions: read # # Required to upload SARIF file to CodeQL
-      contents: read  # Read commit contents
-      security-events: write  # Require writing security events to upload SARIF file to security tab
-    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6" # v2.1.0
-    with:
-      scan-args: |-
-        -r
-        ./
-  scan-pr:
-    permissions:
-      actions: read # Required to upload SARIF file to CodeQL
-      contents: read  # Read commit contents
-      security-events: write  # Require writing security events to upload SARIF file to security tab
-    if: ${{ github.event_name == 'pull_request' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6" # v2.1.0
-    with:
-      # Example of specifying custom arguments
-      scan-args: |-
-        -r
-        ./
--- a/.github/workflows/payload-after-push.yaml
+++ b/.github/workflows/payload-after-push.yaml
@@ -5,7 +5,8 @@ on:
      - main
  workflow_dispatch:

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,7 +25,6 @@ jobs:
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-arm64:
    permissions:
@@ -39,7 +39,6 @@ jobs:
      target-branch: ${{ github.ref_name }}
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-assets-s390x:
    permissions:
@@ -97,7 +96,7 @@ jobs:
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-arm64
      target-branch: ${{ github.ref_name }}
-      runner: ubuntu-24.04-arm
+      runner: ubuntu-22.04-arm
      arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
@@ -131,13 +130,12 @@ jobs:
      repo: kata-containers/kata-deploy-ci
      tag: kata-containers-latest-ppc64le
      target-branch: ${{ github.ref_name }}
-      runner: ubuntu-24.04-ppc64le
+      runner: ppc64le
      arch: ppc64le
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-manifest:
-    name: publish-manifest
    runs-on: ubuntu-22.04
    permissions:
      contents: read
@@ -162,42 +160,3 @@ jobs:
        env:
          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"
-
-  upload-helm-chart-tarball:
-    name: upload-helm-chart-tarball
-    needs: publish-manifest
-    runs-on: ubuntu-22.04
-    permissions:
-      packages: write # needed to push the helm chart to ghcr.io
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Install helm
-        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
-        id: install
-
-      - name: Login to the OCI registries
-        env:
-          QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
-          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
-
-      - name: Push helm chart to the OCI registries
-        run: |
-          echo "Adjusting the Chart.yaml and values.yaml"
-          yq eval '.version = "0.0.0-dev" | .appVersion = "0.0.0-dev"' -i tools/packaging/kata-deploy/helm-chart/kata-deploy/Chart.yaml
-          yq eval '.image.reference = "quay.io/kata-containers/kata-deploy-ci" | .image.tag = "kata-containers-latest"' -i tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml
-
-          echo "Generating the chart package"
-          helm dependencies update tools/packaging/kata-deploy/helm-chart/kata-deploy
-          helm package tools/packaging/kata-deploy/helm-chart/kata-deploy
-
-          echo "Pushing the chart to the OCI registries"
-          helm push "kata-deploy-0.0.0-dev.tgz" oci://quay.io/kata-containers/kata-deploy-charts
-          helm push "kata-deploy-0.0.0-dev.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts
--- a/.github/workflows/publish-kata-deploy-payload.yaml
+++ b/.github/workflows/publish-kata-deploy-payload.yaml
@@ -34,11 +34,11 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  kata-payload:
-    name: kata-payload
    permissions:
      contents: read
      packages: write
@@ -50,24 +50,6 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
      - name: Rebase atop of the latest target branch
        run: |
          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
@@ -103,6 +85,6 @@ jobs:
          TAG: ${{ inputs.tag }}
        run: |
          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          "$(pwd)/kata-static.tar.zst" \
+          "$(pwd)/kata-static.tar.xz" \
          "${REGISTRY}/${REPO}" \
          "${TAG}"
--- a/.github/workflows/release-amd64.yaml
+++ b/.github/workflows/release-amd64.yaml
@@ -8,10 +8,9 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-kata-static-tarball-amd64:
@@ -21,7 +20,6 @@ jobs:
      stage: release
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
    permissions:
      contents: read
      packages: write
@@ -29,7 +27,6 @@ jobs:
      attestations: write

  kata-deploy:
-    name: kata-deploy
    needs: build-kata-static-tarball-amd64
    permissions:
      contents: read
@@ -74,9 +71,9 @@ jobs:
          fi
          for tag in "${tags[@]}"; do
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "ghcr.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "ghcr.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "quay.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
          done
--- a/.github/workflows/release-arm64.yaml
+++ b/.github/workflows/release-arm64.yaml
@@ -8,10 +8,9 @@ on:
    secrets:
      QUAY_DEPLOYER_PASSWORD:
        required: true
-      KBUILD_SIGN_PIN:
-        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-kata-static-tarball-arm64:
@@ -21,7 +20,6 @@ jobs:
      stage: release
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
    permissions:
      contents: read
      packages: write
@@ -29,12 +27,11 @@ jobs:
      attestations: write

  kata-deploy:
-    name: kata-deploy
    needs: build-kata-static-tarball-arm64
    permissions:
      contents: read
      packages: write
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-22.04-arm
    steps:
      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
@@ -74,9 +71,9 @@ jobs:
          fi
          for tag in "${tags[@]}"; do
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "ghcr.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "ghcr.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "quay.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
          done
--- a/.github/workflows/release-ppc64le.yaml
+++ b/.github/workflows/release-ppc64le.yaml
@@ -9,7 +9,8 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-kata-static-tarball-ppc64le:
@@ -26,12 +27,11 @@ jobs:
      attestations: write

  kata-deploy:
-    name: kata-deploy
    needs: build-kata-static-tarball-ppc64le
    permissions:
      contents: read
      packages: write
-    runs-on: ubuntu-24.04-ppc64le
+    runs-on: ppc64le
    steps:
      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
@@ -71,9 +71,9 @@ jobs:
          fi
          for tag in "${tags[@]}"; do
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "ghcr.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "ghcr.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "quay.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
          done
--- a/.github/workflows/release-s390x.yaml
+++ b/.github/workflows/release-s390x.yaml
@@ -11,7 +11,8 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  build-kata-static-tarball-s390x:
@@ -30,12 +31,11 @@ jobs:


  kata-deploy:
-    name: kata-deploy
    needs: build-kata-static-tarball-s390x
    permissions:
      contents: read
      packages: write
-    runs-on: ubuntu-24.04-s390x
+    runs-on: s390x
    steps:
      - name: Login to Kata Containers ghcr.io
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
@@ -75,9 +75,9 @@ jobs:
          fi
          for tag in "${tags[@]}"; do
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "ghcr.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "ghcr.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  "$(pwd)"/kata-static.tar.zst "quay.io/kata-containers/kata-deploy" \
+                  "$(pwd)"/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
                  "${tag}-${TARGET_ARCH}"
          done
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,11 +2,11 @@ name: Release Kata Containers
 on:
  workflow_dispatch

-permissions: {}
+permissions:
+  contents: read

 jobs:
  release:
-    name: release
    runs-on: ubuntu-22.04
    permissions:
      contents: write # needed for the `gh release create` command
@@ -35,7 +35,6 @@ jobs:
      target-arch: amd64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-and-push-assets-arm64:
    needs: release
@@ -49,7 +48,6 @@ jobs:
      target-arch: arm64
    secrets:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-      KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}

  build-and-push-assets-s390x:
    needs: release
@@ -79,7 +77,6 @@ jobs:
      QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}

  publish-multi-arch-images:
-    name: publish-multi-arch-images
    runs-on: ubuntu-22.04
    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
    permissions:
@@ -117,7 +114,6 @@ jobs:
          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy ghcr.io/kata-containers/kata-deploy"

  upload-multi-arch-static-tarball:
-    name: upload-multi-arch-static-tarball
    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
    permissions:
      contents: write # needed for the `gh release` commands
@@ -130,7 +126,7 @@ jobs:

      - name: Set KATA_STATIC_TARBALL env var
        run: |
-          tarball=$(pwd)/kata-static.tar.zst
+          tarball=$(pwd)/kata-static.tar.xz
          echo "KATA_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"

      - name: Download amd64 artifacts
@@ -181,25 +177,7 @@ jobs:
          GH_TOKEN: ${{ github.token }}
          ARCHITECTURE: ppc64le

-      - name: Set KATA_TOOLS_STATIC_TARBALL env var
-        run: |
-          tarball=$(pwd)/kata-tools-static.tar.zst
-          echo "KATA_TOOLS_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
-
-      - name: Download amd64 tools artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64
-
-      - name: Upload amd64 static tarball tools to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-tools-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: amd64
-
  upload-versions-yaml:
-    name: upload-versions-yaml
    needs: release
    runs-on: ubuntu-22.04
    permissions:
@@ -217,7 +195,6 @@ jobs:
          GH_TOKEN: ${{ github.token }}

  upload-cargo-vendored-tarball:
-    name: upload-cargo-vendored-tarball
    needs: release
    runs-on: ubuntu-22.04
    permissions:
@@ -235,7 +212,6 @@ jobs:
          GH_TOKEN: ${{ github.token }}

  upload-libseccomp-tarball:
-    name: upload-libseccomp-tarball
    needs: release
    runs-on: ubuntu-22.04
    permissions:
@@ -253,7 +229,6 @@ jobs:
          GH_TOKEN: ${{ github.token }}

  upload-helm-chart-tarball:
-    name: upload-helm-chart-tarball
    needs: release
    runs-on: ubuntu-22.04
    permissions:
@@ -278,24 +253,18 @@ jobs:
      - name: Login to the OCI registries
        env:
          QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }}
-          QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_ACTOR: ${{ github.actor }}
        run: |
-          echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
-          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
+          echo "${{ secrets.QUAY_DEPLOYER_PASSWORD }}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
+          echo "${{ github.token }}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin

-      - name: Push helm charts to the OCI registries
+      - name: Push helm chart to the OCI registries
        run: |
          release_version=$(./tools/packaging/release/release.sh release-version)
-          # Push kata-deploy chart
          helm push "kata-deploy-${release_version}.tgz" oci://quay.io/kata-containers/kata-deploy-charts
          helm push "kata-deploy-${release_version}.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts
-          # Push kata-lifecycle-manager chart
-          helm push "kata-lifecycle-manager-${release_version}.tgz" oci://quay.io/kata-containers/kata-deploy-charts
-          helm push "kata-lifecycle-manager-${release_version}.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts

  publish-release:
-    name: publish-release
    needs: [ build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le, publish-multi-arch-images, upload-multi-arch-static-tarball, upload-versions-yaml, upload-cargo-vendored-tarball, upload-libseccomp-tarball ]
    runs-on: ubuntu-22.04
    permissions:
--- a/.github/workflows/run-cri-containerd-tests.yaml
+++ b/.github/workflows/run-cri-containerd-tests.yaml
@@ -1,6 +1,7 @@
 name: CI | Run cri-containerd tests

-permissions: {}
+permissions:
+  contents: read

 on:
  workflow_call:
@@ -58,8 +59,6 @@ jobs:
      - name: Install dependencies
        timeout-minutes: 15
        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball for ${{ inputs.arch }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -2,6 +2,11 @@ name: CI | Run kubernetes tests on AKS
 on:
  workflow_call:
    inputs:
+      artifact-run-id:
+        description: "The run id where the artifact was uploaded"
+        required: false
+        type: string
+        default: ${{ github.run_id }}
      tarball-suffix:
        required: false
        type: string
@@ -32,13 +37,49 @@ on:
       required: true
      AZ_SUBSCRIPTION_ID:
        required: true
+  workflow_dispatch:
+    inputs:
+      artifact-run-id:
+        description: "The workflow run id where the artifact was uploaded"
+        required: true
+        type: string
+      tarball-suffix:
+        description: "The suffix of the kata tarball to use"
+        required: false
+        type: string
+      registry:
+        description: "The oci container registry to install kata-deploy from"
+        required: true
+        type: string
+      repo:
+        description: "The oci container repository/image to install kata-deploy from"
+        required: true
+        type: string
+      tag:
+        description: "The oci container image tag to install kata-deploy using"
+        required: true
+        type: string
+      pr-number:
+        description: "Identifier used to distinguish between PRs/dev/nightly tests"
+        required: true
+        type: string
+      commit-hash:
+        description: "The code to checkout for testing"
+        required: false
+        type: string
+      target-branch:
+        description: "The target branch to rebase on and ensure the tests are up-to-date"
+        required: false
+        type: string
+        default: ""


-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
  run-k8s-tests:
-    name: run-k8s-tests
    strategy:
      fail-fast: false
      matrix:
@@ -49,6 +90,7 @@ jobs:
          - dragonball
          - qemu
          - qemu-runtime-rs
+          - stratovirt
          - cloud-hypervisor
        instance-type:
          - small
@@ -58,17 +100,17 @@ jobs:
            vmm: clh
            instance-type: small
            genpolicy-pull-method: oci-distribution
+            auto-generate-policy: yes
          - host_os: cbl-mariner
            vmm: clh
            instance-type: small
            genpolicy-pull-method: containerd
+            auto-generate-policy: yes
          - host_os: cbl-mariner
            vmm: clh
            instance-type: normal
+            auto-generate-policy: yes
    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
@@ -78,8 +120,10 @@ jobs:
      KATA_HOST_OS: ${{ matrix.host_os }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: "vanilla"
+      USING_NFD: "false"
      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
+      AUTO_GENERATE_POLICY: ${{ matrix.auto-generate-policy }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -93,14 +137,17 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: get-kata-tools-tarball
+      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository}}
+          path: kata-artifacts

-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
+      - name: Install kata
+        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts

      - name: Download Azure CLI
        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
@@ -135,25 +182,13 @@ jobs:
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks

      - name: Run tests
        timeout-minutes: 60
        run: bash tests/integration/kubernetes/gha-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Refresh OIDC token in case access token expired
-        if: always()
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-        with:
-          client-id: ${{ secrets.AZ_APPID }}
-          tenant-id: ${{ secrets.AZ_TENANT_ID }}
-          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
      - name: Delete AKS cluster
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster
--- a/.github/workflows/run-k8s-tests-on-amd64.yaml
+++ b/.github/workflows/run-k8s-tests-on-amd64.yaml
@@ -0,0 +1,115 @@
+name: CI | Run kubernetes tests on amd64
+on:
+  workflow_call:
+    inputs:
+      registry:
+        required: true
+        type: string
+      repo:
+        required: true
+        type: string
+      tag:
+        required: true
+        type: string
+      pr-number:
+        required: true
+        type: string
+      commit-hash:
+        required: false
+        type: string
+      target-branch:
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  run-k8s-tests-amd64:
+    strategy:
+      fail-fast: false
+      matrix:
+        vmm:
+          - clh #cloud-hypervisor
+          - dragonball
+          - fc #firecracker
+          - qemu
+          - cloud-hypervisor
+        container_runtime:
+          - containerd
+        snapshotter:
+          - devmapper
+        k8s:
+          - k3s
+        include:
+          - vmm: qemu
+            container_runtime: crio
+            snapshotter: ""
+            k8s: k0s
+    runs-on: ubuntu-22.04
+    env:
+      DOCKER_REGISTRY: ${{ inputs.registry }}
+      DOCKER_REPO: ${{ inputs.repo }}
+      DOCKER_TAG: ${{ inputs.tag }}
+      GH_PR_NUMBER: ${{ inputs.pr-number }}
+      KATA_HYPERVISOR: ${{ matrix.vmm }}
+      KUBERNETES: ${{ matrix.k8s }}
+      KUBERNETES_EXTRA_PARAMS: ${{ matrix.container_runtime != 'crio' && '' || '--cri-socket remote:unix:///var/run/crio/crio.sock --kubelet-extra-args --cgroup-driver="systemd"' }}
+      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: "false"
+      K8S_TEST_HOST_TYPE: all
+      CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Configure CRI-O
+        if: matrix.container_runtime == 'crio'
+        run: bash tests/integration/kubernetes/gha-run.sh setup-crio
+
+      - name: Deploy ${{ matrix.k8s }}
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
+        env:
+          CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
+
+      - name: Configure the ${{ matrix.snapshotter }} snapshotter
+        if: matrix.snapshotter != ''
+        run: bash tests/integration/kubernetes/gha-run.sh configure-snapshotter
+
+      - name: Deploy Kata
+        timeout-minutes: 10
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
+
+      - name: Install `bats`
+        run: bash tests/integration/kubernetes/gha-run.sh install-bats
+
+      - name: Run tests
+        timeout-minutes: 30
+        run: bash tests/integration/kubernetes/gha-run.sh run-tests
+
+      - name: Collect artifacts ${{ matrix.vmm }}
+        if: always()
+        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
+        continue-on-error: true
+
+      - name: Archive artifacts ${{ matrix.vmm }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: k8s-tests-${{ matrix.vmm }}-${{ matrix.snapshotter }}-${{ matrix.k8s }}-${{ inputs.tag }}
+          path: /tmp/artifacts
+          retention-days: 1
+
+      - name: Delete kata-deploy
+        if: always()
+        timeout-minutes: 5
+        run: bash tests/integration/kubernetes/gha-run.sh cleanup
--- a/.github/workflows/run-k8s-tests-on-arm64.yaml
+++ b/.github/workflows/run-k8s-tests-on-arm64.yaml
@@ -22,17 +22,16 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-k8s-tests-on-arm64:
-    name: run-k8s-tests-on-arm64
    strategy:
      fail-fast: false
      matrix:
        vmm:
          - qemu
-          - qemu-runtime-rs
        k8s:
          - kubeadm
    runs-on: arm64-k8s
@@ -43,6 +42,7 @@ jobs:
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
      K8S_TEST_HOST_TYPE: all
      TARGET_ARCH: "aarch64"
    steps:
@@ -59,7 +59,7 @@ jobs:
          TARGET_BRANCH: ${{ inputs.target-branch }}

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata

      - name: Install `bats`
@@ -69,10 +69,6 @@ jobs:
        timeout-minutes: 30
        run: bash tests/integration/kubernetes/gha-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
      - name: Collect artifacts ${{ matrix.vmm }}
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
@@ -87,5 +83,5 @@ jobs:

      - name: Delete kata-deploy
        if: always()
-        timeout-minutes: 15
+        timeout-minutes: 5
        run: bash tests/integration/kubernetes/gha-run.sh cleanup
--- a/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml
+++ b/.github/workflows/run-k8s-tests-on-nvidia-gpu.yaml
@@ -1,131 +0,0 @@
-name: CI | Run NVIDIA GPU kubernetes tests on amd64
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: true
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-    secrets:
-      NGC_API_KEY:
-        required: true
-
-permissions: {}
-
-jobs:
-  run-nvidia-gpu-tests-on-amd64:
-    name: run-${{ matrix.environment.name }}-tests-on-amd64
-    strategy:
-      fail-fast: false
-      matrix:
-        environment: [
-          { name: nvidia-gpu,     vmm: qemu-nvidia-gpu,     runner: amd64-nvidia-a100 },
-          { name: nvidia-gpu-snp, vmm: qemu-nvidia-gpu-snp, runner: amd64-nvidia-h100-snp },
-        ]
-    runs-on: ${{ matrix.environment.runner }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
-      KUBERNETES: kubeadm
-      KBS: ${{ matrix.environment.name == 'nvidia-gpu-snp' && 'true' || 'false' }}
-      K8S_TEST_HOST_TYPE: baremetal
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
-
-      - name: Uninstall previous `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-        env:
-          NVIDIA_VERIFIER_MODE: remote
-          KBS_INGRESS: nodeport
-
-      - name: Install `kbs-client`
-        if: matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Run tests ${{ matrix.environment.vmm }}
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-nv-tests
-        env:
-          NGC_API_KEY: ${{ secrets.NGC_API_KEY }}
-
-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Collect artifacts ${{ matrix.environment.vmm }}
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
-        continue-on-error: true
-
-      - name: Archive artifacts ${{ matrix.environment.vmm }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: k8s-tests-${{ matrix.environment.vmm }}-kubeadm-${{ inputs.tag }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always() && matrix.environment.name != 'nvidia-gpu'
-        timeout-minutes: 10
-        run: |
-          bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
--- a/.github/workflows/run-k8s-tests-on-ppc64le.yaml
+++ b/.github/workflows/run-k8s-tests-on-ppc64le.yaml
@@ -22,11 +22,11 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-k8s-tests:
-    name: run-k8s-tests
    strategy:
      fail-fast: false
      matrix:
@@ -34,7 +34,7 @@ jobs:
          - qemu
        k8s:
          - kubeadm
-    runs-on: ppc64le-k8s
+    runs-on: k8s-ppc64le
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -43,6 +43,7 @@ jobs:
      GOPATH: ${{ github.workspace }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
      TARGET_ARCH: "ppc64le"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -62,20 +63,19 @@ jobs:
          ./tests/install_go.sh -f -p
          echo "/usr/local/go/bin" >> "$GITHUB_PATH"

-      - name: Prepare the runner for k8s test suite
-        run: bash "${HOME}/scripts/k8s_cluster_prepare.sh"
+      - name: Prepare the runner for k8s cluster creation
+        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"

-      - name: Check if cluster is healthy to run the tests
-        run: bash "${HOME}/scripts/k8s_cluster_check.sh"
+      - name: Create k8s cluster using kubeadm
+        run: bash "${HOME}/scripts/k8s_cluster_create.sh"

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm

      - name: Run tests
        timeout-minutes: 30
        run: bash tests/integration/kubernetes/gha-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
+      - name: Delete cluster and post cleanup actions
+        run: bash "${HOME}/scripts/k8s_cluster_cleanup.sh"
--- a/.github/workflows/run-k8s-tests-on-zvsi.yaml
+++ b/.github/workflows/run-k8s-tests-on-zvsi.yaml
@@ -25,11 +25,11 @@ on:
      AUTHENTICATED_IMAGE_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-k8s-tests:
-    name: run-k8s-tests
    strategy:
      fail-fast: false
      matrix:
@@ -46,9 +46,11 @@ jobs:
        include:
          - snapshotter: devmapper
            pull-type: default
+            using-nfd: true
            deploy-cmd: configure-snapshotter
          - snapshotter: nydus
            pull-type: guest-pull
+            using-nfd: false
            deploy-cmd: deploy-snapshotter
        exclude:
          - snapshotter: overlayfs
@@ -74,6 +76,7 @@ jobs:
      KUBERNETES: ${{ matrix.k8s }}
      PULL_TYPE: ${{ matrix.pull-type }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: ${{ matrix.using-nfd }}
      TARGET_ARCH: "s390x"
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
@@ -103,13 +106,11 @@ jobs:
      # qemu-runtime-rs only works with overlayfs
      # See: https://github.com/kata-containers/kata-containers/issues/10066
      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        env:
-          DEPLOY_CMD: ${{ matrix.deploy-cmd }}
-        run: bash tests/integration/kubernetes/gha-run.sh "${DEPLOY_CMD}"
+        run: bash tests/integration/kubernetes/gha-run.sh ${{ matrix.deploy-cmd }}
        if: ${{ matrix.snapshotter != 'overlayfs' }}

      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-zvsi

      - name: Uninstall previous `kbs-client`
@@ -131,18 +132,12 @@ jobs:
        timeout-minutes: 60
        run: bash tests/integration/kubernetes/gha-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
      - name: Delete kata-deploy
        if: always()
-        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh cleanup-zvsi

      - name: Delete CoCo KBS
        if: always()
-        timeout-minutes: 10
        run: |
          if [ "${KBS}" == "true" ]; then
            bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
--- a/.github/workflows/run-kata-coco-stability-tests.yaml
+++ b/.github/workflows/run-kata-coco-stability-tests.yaml
@@ -35,26 +35,23 @@ on:
      AUTHENTICATED_IMAGE_PASSWORD:
        required: true

-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
  # Generate jobs for testing CoCo on non-TEE environments
  run-stability-k8s-tests-coco-nontee:
-    name: run-stability-k8s-tests-coco-nontee
    strategy:
      fail-fast: false
      matrix:
        vmm:
          - qemu-coco-dev
-          - qemu-coco-dev-runtime-rs
        snapshotter:
          - nydus
        pull-type:
          - guest-pull
    runs-on: ubuntu-22.04
-    permissions:
-
-      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
@@ -71,6 +68,7 @@ jobs:
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -84,14 +82,17 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: get-kata-tools-tarball
+      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts

-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
+      - name: Install kata
+        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
+
+      - name: Download Azure CLI
+        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli

      - name: Log into the Azure account
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
@@ -140,18 +141,6 @@ jobs:
        timeout-minutes: 300
        run: bash tests/stability/gha-stability-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Refresh OIDC token in case access token expired
-        if: always()
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-        with:
-          client-id: ${{ secrets.AZ_APPID }}
-          tenant-id: ${{ secrets.AZ_TENANT_ID }}
-          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
      - name: Delete AKS cluster
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster
--- a/.github/workflows/run-kata-coco-tests.yaml
+++ b/.github/workflows/run-kata-coco-tests.yaml
@@ -2,6 +2,11 @@ name: CI | Run kata coco tests
 on:
  workflow_call:
    inputs:
+      artifact-run-id:
+        description: "The run id where the artifact was uploaded"
+        required: false
+        type: string
+        default: ${{ github.run_id }}
      tarball-suffix:
        required: false
        type: string
@@ -35,125 +40,229 @@ on:
        required: true
      ITA_KEY:
        required: true
+  workflow_dispatch:
+    inputs:
+      artifact-run-id:
+        description: "The workflow run id where the artifact was uploaded"
+        required: true
+        type: string
+      tarball-suffix:
+        description: "The suffix of the kata tarball to use"
+        required: false
+        type: string
+      registry:
+        description: "The oci container registry to install kata-deploy from"
+        required: true
+        type: string
+      repo:
+        description: "The oci container repository/image to install kata-deploy from"
+        required: true
+        type: string
+      tag:
+        description: "The oci container image tag to install kata-deploy using"
+        required: true
+        type: string
+      pr-number:
+        description: "Identifier used to distinguish between PRs/dev/nightly tests"
+        required: true
+        type: string
+      commit-hash:
+        description: "The code to checkout for testing"
+        required: false
+        type: string
+      target-branch:
+        description: "The target branch to rebase on and ensure the tests are up-to-date"
+        required: false
+        type: string
+        default: ""

-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
-  run-k8s-tests-on-tee:
-    name: run-k8s-tests-on-tee
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: tdx
-            vmm: qemu-tdx
-          - runner: sev-snp
-            vmm: qemu-snp
-    runs-on: ${{ matrix.runner }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      KBS: "true"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      KBS_INGRESS: "nodeport"
-      SNAPSHOTTER: "nydus"
-      PULL_TYPE: "guest-pull"
-      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      GH_ITA_KEY: ${{ secrets.ITA_KEY }}
-      AUTO_GENERATE_POLICY: "yes"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
+  # run-k8s-tests-on-tdx:
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       vmm:
+  #         - qemu-tdx
+  #       snapshotter:
+  #         - nydus
+  #       pull-type:
+  #         - guest-pull
+  #   runs-on: tdx
+  #   env:
+  #     DOCKER_REGISTRY: ${{ inputs.registry }}
+  #     DOCKER_REPO: ${{ inputs.repo }}
+  #     DOCKER_TAG: ${{ inputs.tag }}
+  #     GH_PR_NUMBER: ${{ inputs.pr-number }}
+  #     KATA_HYPERVISOR: ${{ matrix.vmm }}
+  #     KUBERNETES: "vanilla"
+  #     USING_NFD: "true"
+  #     KBS: "true"
+  #     K8S_TEST_HOST_TYPE: "baremetal"
+  #     KBS_INGRESS: "nodeport"
+  #     SNAPSHOTTER: ${{ matrix.snapshotter }}
+  #     PULL_TYPE: ${{ matrix.pull-type }}
+  #     AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
+  #     AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+  #     ITA_KEY: ${{ secrets.ITA_KEY }}
+  #     AUTO_GENERATE_POLICY: "yes"
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #       with:
+  #         ref: ${{ inputs.commit-hash }}
+  #         fetch-depth: 0
+  #         persist-credentials: false

-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
+  #     - name: Rebase atop of the latest target branch
+  #       run: |
+  #         ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+  #       env:
+  #         TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
+  #     - name: Deploy Snapshotter
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter

-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
+  #     - name: Deploy Kata
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx

-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
+  #     - name: Uninstall previous `kbs-client`
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client

-      - name: Uninstall previous `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
+  #     - name: Deploy CoCo KBS
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs

-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-        env:
-          ITA_KEY: ${{ env.KATA_HYPERVISOR == 'qemu-tdx' && env.GH_ITA_KEY || '' }}
+  #     - name: Install `kbs-client`
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client

-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
+  #     - name: Deploy CSI driver
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver

-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
+  #     - name: Run tests
+  #       timeout-minutes: 100
+  #       run: bash tests/integration/kubernetes/gha-run.sh run-tests

-      - name: Run tests
-        timeout-minutes: 100
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
+  #     - name: Delete kata-deploy
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh cleanup-tdx

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
+  #     - name: Delete Snapshotter
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter

-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
+  #     - name: Delete CoCo KBS
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs

-      - name: Delete CoCo KBS
-        if: always()
-        timeout-minutes: 10
-        run: |
-          [[ "${KATA_HYPERVISOR}" == "qemu-tdx" ]] && echo "ITA_KEY=${GH_ITA_KEY}" >> "${GITHUB_ENV}"
-          bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
+  #     - name: Delete CSI driver
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver

-      - name: Delete CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
+  # run-k8s-tests-sev-snp:
+  #   strategy:
+  #     fail-fast: false
+  #     matrix:
+  #       vmm:
+  #         - qemu-snp
+  #       snapshotter:
+  #         - nydus
+  #       pull-type:
+  #         - guest-pull
+  #   runs-on: sev-snp
+  #   env:
+  #     DOCKER_REGISTRY: ${{ inputs.registry }}
+  #     DOCKER_REPO: ${{ inputs.repo }}
+  #     DOCKER_TAG: ${{ inputs.tag }}
+  #     GH_PR_NUMBER: ${{ inputs.pr-number }}
+  #     KATA_HYPERVISOR: ${{ matrix.vmm }}
+  #     KUBECONFIG: /home/kata/.kube/config
+  #     KUBERNETES: "vanilla"
+  #     USING_NFD: "false"
+  #     KBS: "true"
+  #     KBS_INGRESS: "nodeport"
+  #     K8S_TEST_HOST_TYPE: "baremetal"
+  #     SNAPSHOTTER: ${{ matrix.snapshotter }}
+  #     PULL_TYPE: ${{ matrix.pull-type }}
+  #     AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
+  #     AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
+  #     AUTO_GENERATE_POLICY: "yes"
+  #   steps:
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+  #       with:
+  #         ref: ${{ inputs.commit-hash }}
+  #         fetch-depth: 0
+  #         persist-credentials: false
+
+  #     - name: Rebase atop of the latest target branch
+  #       run: |
+  #         ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+  #       env:
+  #         TARGET_BRANCH: ${{ inputs.target-branch }}
+
+  #     - name: Deploy Snapshotter
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
+
+  #     - name: Deploy Kata
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-snp
+
+  #     - name: Uninstall previous `kbs-client`
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
+
+  #     - name: Deploy CoCo KBS
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
+
+  #     - name: Install `kbs-client`
+  #       timeout-minutes: 10
+  #       run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
+
+  #     - name: Deploy CSI driver
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
+
+  #     - name: Run tests
+  #       timeout-minutes: 50
+  #       run: bash tests/integration/kubernetes/gha-run.sh run-tests
+
+  #     - name: Delete kata-deploy
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh cleanup-snp
+
+  #     - name: Delete Snapshotter
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
+
+  #     - name: Delete CoCo KBS
+  #       if: always()
+  #       run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
+
+  #     - name: Delete CSI driver
+  #       timeout-minutes: 5
+  #       run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver

  # Generate jobs for testing CoCo on non-TEE environments
  run-k8s-tests-coco-nontee:
-    name: run-k8s-tests-coco-nontee
    strategy:
      fail-fast: false
      matrix:
        vmm:
          - qemu-coco-dev
-          - qemu-coco-dev-runtime-rs
        snapshotter:
          - nydus
        pull-type:
          - guest-pull
-        include:
-          - pull-type: experimental-force-guest-pull
-            vmm: qemu-coco-dev
-            snapshotter: ""
    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write # Used for OIDC access to log into Azure
    environment: ci
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
@@ -170,12 +279,13 @@ jobs:
      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.pull-type == 'experimental-force-guest-pull' && matrix.vmm || '' }}
      # Caution: current ingress controller used to expose the KBS service
      # requires much vCPUs, lefting only a few for the tests. Depending on the
      # host type chose it will result on the creation of a cluster with
      # insufficient resources.
      K8S_TEST_HOST_TYPE: "all"
+      USING_NFD: "false"
+      AUTO_GENERATE_POLICY: "yes"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -189,14 +299,20 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: get-kata-tools-tarball
+      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository}}
+          path: kata-artifacts

-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
+      - name: Install kata
+        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
+
+      - name: Download Azure CLI
+        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli

      - name: Log into the Azure account
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
@@ -225,12 +341,13 @@ jobs:
      - name: Download credentials for the Kubernetes CLI to use them
        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials

+      - name: Deploy Snapshotter
+        timeout-minutes: 5
+        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
+
      - name: Deploy Kata
-        timeout-minutes: 20
+        timeout-minutes: 10
        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-        env:
-          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ env.SNAPSHOTTER == 'nydus' }}
-          AUTO_GENERATE_POLICY: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && 'no' || 'yes' }}

      - name: Deploy CoCo KBS
        timeout-minutes: 10
@@ -252,114 +369,6 @@ jobs:
        if: always()
        run: bash tests/integration/kubernetes/gha-run.sh report-tests

-      - name: Refresh OIDC token in case access token expired
-        if: always()
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-        with:
-          client-id: ${{ secrets.AZ_APPID }}
-          tenant-id: ${{ secrets.AZ_TENANT_ID }}
-          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
      - name: Delete AKS cluster
        if: always()
-        timeout-minutes: 15
        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster
-
-  # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter
-  run-k8s-tests-coco-nontee-with-erofs-snapshotter:
-    name: run-k8s-tests-coco-nontee-with-erofs-snapshotter
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-coco-dev
-        snapshotter:
-          - erofs
-        pull-type:
-          - default
-    runs-on: ubuntu-24.04
-    environment: ci
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      # Some tests rely on that variable to run (or not)
-      KBS: "false"
-      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: ""
-      KUBERNETES: "vanilla"
-      CONTAINER_ENGINE: "containerd"
-      CONTAINER_ENGINE_VERSION: "v2.2"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: "true"
-      K8S_TEST_HOST_TYPE: "all"
-      # We are skipping the auto generated policy tests for now,
-      # but those should be enabled as soon as we work on that.
-      AUTO_GENERATE_POLICY: "no"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
-
-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
-      - name: Deploy kubernetes
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-
-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
-
-      - name: Run tests
-        timeout-minutes: 80
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
--- a/.github/workflows/run-kata-deploy-tests-on-aks.yaml
+++ b/.github/workflows/run-kata-deploy-tests-on-aks.yaml
@@ -29,11 +29,12 @@ on:
      AZ_SUBSCRIPTION_ID:
        required: true

-permissions: {}
+permissions:
+  contents: read
+  id-token: write

 jobs:
  run-kata-deploy-tests:
-    name: run-kata-deploy-tests
    strategy:
      fail-fast: false
      matrix:
@@ -49,8 +50,6 @@ jobs:
            vmm: clh
    runs-on: ubuntu-22.04
    environment: ci
-    permissions:
-      id-token: write # Used for OIDC access to log into Azure
    env:
      DOCKER_REGISTRY: ${{ inputs.registry }}
      DOCKER_REPO: ${{ inputs.repo }}
@@ -59,6 +58,7 @@ jobs:
      KATA_HOST_OS: ${{ matrix.host_os }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: "vanilla"
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -72,6 +72,9 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

+      - name: Download Azure CLI
+        run: bash tests/functional/kata-deploy/gha-run.sh install-azure-cli
+
      - name: Log into the Azure account
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
@@ -102,18 +105,6 @@ jobs:
      - name: Run tests
        run: bash tests/functional/kata-deploy/gha-run.sh run-tests

-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Refresh OIDC token in case access token expired
-        if: always()
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
-        with:
-          client-id: ${{ secrets.AZ_APPID }}
-          tenant-id: ${{ secrets.AZ_TENANT_ID }}
-          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
      - name: Delete AKS cluster
        if: always()
        run: bash tests/functional/kata-deploy/gha-run.sh delete-cluster
--- a/.github/workflows/run-kata-deploy-tests.yaml
+++ b/.github/workflows/run-kata-deploy-tests.yaml
@@ -22,11 +22,11 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-kata-deploy-tests:
-    name: run-kata-deploy-tests
    strategy:
      fail-fast: false
      matrix:
@@ -45,6 +45,7 @@ jobs:
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      KATA_HYPERVISOR: ${{ matrix.vmm }}
      KUBERNETES: ${{ matrix.k8s }}
+      USING_NFD: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
@@ -58,24 +59,6 @@ jobs:
        env:
          TARGET_BRANCH: ${{ inputs.target-branch }}

-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
      - name: Deploy ${{ matrix.k8s }}
        run:  bash tests/functional/kata-deploy/gha-run.sh deploy-k8s

@@ -84,7 +67,3 @@ jobs:

      - name: Run tests
        run: bash tests/functional/kata-deploy/gha-run.sh run-tests
-
-      - name: Report tests
-        if: always()
-        run: bash tests/functional/kata-deploy/gha-run.sh report-tests
--- a/.github/workflows/run-kata-monitor-tests.yaml
+++ b/.github/workflows/run-kata-monitor-tests.yaml
@@ -2,6 +2,11 @@ name: CI | Run kata-monitor tests
 on:
  workflow_call:
    inputs:
+      artifact-run-id:
+        description: "The run id where the artifact was uploaded"
+        required: false
+        type: string
+        default: ${{ github.run_id }}
      tarball-suffix:
        required: false
        type: string
@@ -12,12 +17,31 @@ on:
        required: false
        type: string
        default: ""
+  workflow_dispatch:
+    inputs:
+      artifact-run-id:
+        description: "The workflow run id where the artifact was uploaded"
+        required: true
+        type: string
+      tarball-suffix:
+        description: "Identifier used to distinguish between PRs/dev/nightly tests"
+        required: false
+        type: string
+      commit-hash:
+        description: "The code to checkout for testing"
+        required: false
+        type: string
+      target-branch:
+        description: "The target branch to rebase on and ensure the tests are up-to-date"
+        required: false
+        type: string
+        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-monitor:
-    name: run-monitor
    strategy:
      fail-fast: false
      matrix:
@@ -54,13 +78,14 @@ jobs:

      - name: Install dependencies
        run: bash tests/functional/kata-monitor/gha-run.sh install-dependencies
-        env:
-          GH_TOKEN: ${{ github.token }}

      - name: get-kata-tarball
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository}}
          path: kata-artifacts

      - name: Install kata
--- a/.github/workflows/run-metrics.yaml
+++ b/.github/workflows/run-metrics.yaml
@@ -22,11 +22,11 @@ on:
        type: string
        default: ""

-permissions: {}
+permissions:
+  contents: read

 jobs:
  run-metrics:
-    name: run-metrics
    strategy:
      # We can set this to true whenever we're 100% sure that
      # the all the tests are not flaky, otherwise we'll fail
@@ -44,6 +44,7 @@ jobs:
      DOCKER_TAG: ${{ inputs.tag }}
      GH_PR_NUMBER: ${{ inputs.pr-number }}
      K8S_TEST_HOST_TYPE: "baremetal"
+      USING_NFD: "false"
      KUBERNETES: kubeadm
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
--- a/.github/workflows/run-runk-tests.yaml
+++ b/.github/workflows/run-runk-tests.yaml
@@ -0,0 +1,52 @@
+name: CI | Run runk tests
+on:
+  workflow_call:
+    inputs:
+      tarball-suffix:
+        required: false
+        type: string
+      commit-hash:
+        required: false
+        type: string
+      target-branch:
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  run-runk:
+    # Skip runk tests as we have no maintainers. TODO: Decide when to remove altogether
+    if: false
+    runs-on: ubuntu-22.04
+    env:
+      CONTAINERD_VERSION: lts
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ inputs.commit-hash }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Rebase atop of the latest target branch
+        run: |
+          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
+        env:
+          TARGET_BRANCH: ${{ inputs.target-branch }}
+
+      - name: Install dependencies
+        run: bash tests/integration/runk/gha-run.sh install-dependencies
+
+      - name: get-kata-tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
+          path: kata-artifacts
+
+      - name: Install kata
+        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
+
+      - name: Run runk tests
+        run: bash tests/integration/runk/gha-run.sh run
--- a/.github/workflows/shellcheck.yaml
+++ b/.github/workflows/shellcheck.yaml
@@ -10,7 +10,8 @@ on:
      - reopened
      - synchronize

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,7 +19,6 @@ concurrency:

 jobs:
  shellcheck:
-    name: shellcheck
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout the code
@@ -27,6 +27,6 @@ jobs:
          fetch-depth: 0
          persist-credentials: false
      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master (2024-06-20)
        with:
          ignore_paths: "**/vendor/**"
--- a/.github/workflows/shellcheck_required.yaml
+++ b/.github/workflows/shellcheck_required.yaml
@@ -11,7 +11,8 @@ on:
      - reopened
      - synchronize

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -19,7 +20,6 @@ concurrency:

 jobs:
  shellcheck-required:
-    name: shellcheck-required
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout the code
@@ -29,7 +29,7 @@ jobs:
          persist-credentials: false

      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
+        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master (2024-06-20)
        with:
          severity: error
          ignore_paths: "**/vendor/**"
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -4,23 +4,16 @@ on:
    - cron: '0 0 * * *'
  workflow_dispatch:

-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+permissions:
+  contents: read

 jobs:
  stale:
-    name: stale
    runs-on: ubuntu-22.04
-    permissions:
-      actions: write # Needed to manage caches for state persistence across runs
-      pull-requests: write # Needed to add/remove labels, post comments, or close PRs
    steps:
      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
        with:
-          stale-pr-message: 'This PR has been opened without activity for 180 days. Please comment on the issue or it will be closed in 7 days.'
+          stale-pr-message: 'This PR has been opened without with no activity for 180 days. Comment on the issue otherwise it will be closed in 7 days'
          days-before-pr-stale: 180
          days-before-pr-close: 7
          days-before-issue-stale: -1
--- a/.github/workflows/static-checks-self-hosted.yaml
+++ b/.github/workflows/static-checks-self-hosted.yaml
@@ -6,7 +6,8 @@ on:
      - reopened
      - labeled # a workflow runs only when the 'ok-to-test' label is added

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -28,9 +29,21 @@ jobs:
      fail-fast: false
      matrix:
        instance:
-          - "ubuntu-24.04-arm"
-          - "ubuntu-24.04-s390x"
-          - "ubuntu-24.04-ppc64le"
+          - "ubuntu-22.04-arm"
+          - "s390x"
+          - "ppc64le"
    uses: ./.github/workflows/build-checks.yaml
    with:
      instance: ${{ matrix.instance }}
+
+  build-checks-preview:
+    needs: skipper
+    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        instance:
+          - "riscv-builder"
+    uses: ./.github/workflows/build-checks-preview-riscv64.yaml
+    with:
+      instance: ${{ matrix.instance }}
--- a/.github/workflows/static-checks.yaml
+++ b/.github/workflows/static-checks.yaml
@@ -7,7 +7,8 @@ on:
      - synchronize
  workflow_dispatch:

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -22,7 +23,6 @@ jobs:
      target-branch: ${{ github.event.pull_request.base.ref }}

  check-kernel-config-version:
-    name: check-kernel-config-version
    needs: skipper
    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
    runs-on: ubuntu-22.04
@@ -55,7 +55,6 @@ jobs:
      instance: ubuntu-22.04

  build-checks-depending-on-kvm:
-    name: build-checks-depending-on-kvm
    runs-on: ubuntu-22.04
    needs: skipper
    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
@@ -90,16 +89,13 @@ jobs:
      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
        run: |
          export PATH="$PATH:${HOME}/.cargo/bin"
-          cd "${COMPONENT_PATH}"
-          eval "${COMMAND}"
+          cd ${{ matrix.component-path }}
+          ${{ matrix.command }}
        env:
-          COMMAND: ${{ matrix.command }}
-          COMPONENT_PATH: ${{ matrix.component-path }}
          RUST_BACKTRACE: "1"
          RUST_LIB_BACKTRACE: "0"

  static-checks:
-    name: static-checks
    runs-on: ubuntu-22.04
    needs: skipper
    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
@@ -122,13 +118,13 @@ jobs:
          path: ./src/github.com/${{ github.repository }}
      - name: Install yq
        run: |
-          cd "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}"
+          cd "${GOPATH}/src/github.com/${{ github.repository }}"
          ./ci/install_yq.sh
        env:
          INSTALL_IN_GOPATH: false
      - name: Install golang
        run: |
-          cd "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}"
+          cd "${GOPATH}/src/github.com/${{ github.repository }}"
          ./tests/install_go.sh -f -p
          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
      - name: Install system dependencies
@@ -136,7 +132,7 @@ jobs:
          sudo apt-get update && sudo apt-get -y install moreutils hunspell hunspell-en-gb hunspell-en-us pandoc
      - name: Install open-policy-agent
        run: |
-          cd "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}"
+          cd "${GOPATH}/src/github.com/${{ github.repository }}"
          ./tests/install_opa.sh
      - name: Install regorus
        env:
@@ -144,49 +140,13 @@ jobs:
          ARTEFACT_REGISTRY_USERNAME: "${{ github.actor }}"
          ARTEFACT_REGISTRY_PASSWORD: "${{ secrets.GITHUB_TOKEN }}"
        run: |
-          "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}/tests/install_regorus.sh"
+          "${GOPATH}/src/github.com/${{ github.repository }}/tests/install_regorus.sh"
      - name: Run check
-        env:
-          CMD: ${{ matrix.cmd }}
        run: |
          export PATH="${PATH}:${GOPATH}/bin"
-          cd "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}" && ${CMD}
+          cd "${GOPATH}/src/github.com/${{ github.repository }}" && ${{ matrix.cmd }}

  govulncheck:
    needs: skipper
    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
    uses: ./.github/workflows/govulncheck.yaml
-
-  codegen:
-    name: codegen
-    runs-on: ubuntu-22.04
-    needs: skipper
-    if: ${{ needs.skipper.outputs.skip_static != 'yes' }}
-    permissions:
-      contents: read  # for checkout
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: generate
-        run: make -C src/agent generate-protocols
-      - name: check for diff
-        run: |
-          diff=$(git diff)
-          if [[ -z "${diff}" ]]; then
-            echo "No diff detected."
-            exit 0
-          fi
-
-          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
-          Run \`make -C src/agent generate-protocols\` to update protobuf bindings.
-
-          \`\`\`diff
-          ${diff}
-          \`\`\`
-          EOF
-
-          echo "::error::Golang protobuf bindings need to be regenerated (see Github step summary for diff)."
-          exit 1
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -1,9 +1,12 @@
 name: GHA security analysis

 on:
+  push:
+    branches: ["main"]
  pull_request:

-permissions: {}
+permissions:
+  contents: read

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -11,8 +14,10 @@ concurrency:

 jobs:
  zizmor:
-    name: zizmor
    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -21,9 +26,4 @@ jobs:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1
-        with:
-          advanced-security: false
-          annotations: true
-          persona: auditor
-          version: v1.13.0
+        uses: zizmorcore/zizmor-action@f52a838cfabf134edcbaa7c8b3677dde20045018 # v0.1.1
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,3 +0,0 @@
-rules:
-  undocumented-permissions:
-    disable: true
--- a/.gitignore
+++ b/.gitignore
@@ -18,5 +18,3 @@ src/tools/log-parser/kata-log-parser
 tools/packaging/static-build/agent/install_libseccomp.sh
 .envrc
 .direnv
-**/.DS_Store
-site/
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,140 +0,0 @@
-[workspace.package]
-authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>"]
-edition = "2018"
-license = "Apache-2.0"
-rust-version = "1.88"
-
-[workspace]
-members = [
-  # Dragonball
-  "src/dragonball",
-  "src/dragonball/dbs_acpi",
-  "src/dragonball/dbs_address_space",
-  "src/dragonball/dbs_allocator",
-  "src/dragonball/dbs_arch",
-  "src/dragonball/dbs_boot",
-  "src/dragonball/dbs_device",
-  "src/dragonball/dbs_interrupt",
-  "src/dragonball/dbs_legacy_devices",
-  "src/dragonball/dbs_pci",
-  "src/dragonball/dbs_tdx",
-  "src/dragonball/dbs_upcall",
-  "src/dragonball/dbs_utils",
-  "src/dragonball/dbs_virtio_devices",
-
-  # runtime-rs
-  "src/runtime-rs",
-  "src/runtime-rs/crates/agent",
-  "src/runtime-rs/crates/hypervisor",
-  "src/runtime-rs/crates/persist",
-  "src/runtime-rs/crates/resource",
-  "src/runtime-rs/crates/runtimes",
-  "src/runtime-rs/crates/service",
-  "src/runtime-rs/crates/shim",
-  "src/runtime-rs/crates/shim-ctl",
-  "src/runtime-rs/tests/utils",
-]
-resolver = "2"
-
-# TODO: Add all excluded crates to root workspace
-exclude = [
-  "src/agent",
-  "src/tools",
-  "src/libs",
-
-  # kata-deploy binary is standalone and has its own Cargo.toml for now
-  "tools/packaging/kata-deploy/binary",
-
-  # We are cloning and building rust packages under
-  # "tools/packaging/kata-deploy/local-build/build" folder, which may mislead
-  # those packages to think they are part of the kata root workspace
-  "tools/packaging/kata-deploy/local-build/build",
-]
-
-[workspace.dependencies]
-# Rust-VMM crates
-event-manager = "0.2.1"
-kvm-bindings = "0.6.0"
-kvm-ioctls = "=0.12.1"
-linux-loader = "0.8.0"
-seccompiler = "0.5.0"
-vfio-bindings = "0.3.0"
-vfio-ioctls = "0.1.0"
-virtio-bindings = "0.1.0"
-virtio-queue = "0.7.0"
-vm-fdt = "0.2.0"
-vm-memory = "0.10.0"
-vm-superio = "0.5.0"
-vmm-sys-util = "0.11.0"
-
-# Local dependencies from Dragonball Sandbox crates
-dragonball = { path = "src/dragonball" }
-dbs-acpi = { path = "src/dragonball/dbs_acpi" }
-dbs-address-space = { path = "src/dragonball/dbs_address_space" }
-dbs-allocator = { path = "src/dragonball/dbs_allocator" }
-dbs-arch = { path = "src/dragonball/dbs_arch" }
-dbs-boot = { path = "src/dragonball/dbs_boot" }
-dbs-device = { path = "src/dragonball/dbs_device" }
-dbs-interrupt = { path = "src/dragonball/dbs_interrupt" }
-dbs-legacy-devices = { path = "src/dragonball/dbs_legacy_devices" }
-dbs-pci = { path = "src/dragonball/dbs_pci" }
-dbs-tdx = { path = "src/dragonball/dbs_tdx" }
-dbs-upcall = { path = "src/dragonball/dbs_upcall" }
-dbs-utils = { path = "src/dragonball/dbs_utils" }
-dbs-virtio-devices = { path = "src/dragonball/dbs_virtio_devices" }
-
-# Local dependencies from runtime-rs
-agent = { path = "src/runtime-rs/crates/agent" }
-hypervisor = { path = "src/runtime-rs/crates/hypervisor" }
-persist = { path = "src/runtime-rs/crates/persist" }
-resource = { path = "src/runtime-rs/crates/resource" }
-runtimes = { path = "src/runtime-rs/crates/runtimes" }
-service = { path = "src/runtime-rs/crates/service" }
-tests_utils = { path = "src/runtime-rs/tests/utils" }
-ch-config = { path = "src/runtime-rs/crates/hypervisor/ch-config" }
-common = { path = "src/runtime-rs/crates/runtimes/common" }
-linux_container = { path = "src/runtime-rs/crates/runtimes/linux_container" }
-virt_container = { path = "src/runtime-rs/crates/runtimes/virt_container" }
-wasm_container = { path = "src/runtime-rs/crates/runtimes/wasm_container" }
-
-# Local dependencies from `src/lib`
-kata-sys-util = { path = "src/libs/kata-sys-util" }
-kata-types = { path = "src/libs/kata-types", features = ["safe-path"] }
-logging = { path = "src/libs/logging" }
-protocols = { path = "src/libs/protocols", features = ["async"] }
-runtime-spec = { path = "src/libs/runtime-spec" }
-safe-path = { path = "src/libs/safe-path" }
-shim-interface = { path = "src/libs/shim-interface" }
-test-utils = { path = "src/libs/test-utils" }
-
-# Outside dependencies
-actix-rt = "2.7.0"
-anyhow = "1.0"
-async-trait = "0.1.48"
-containerd-shim = { version = "0.10.0", features = ["async"] }
-containerd-shim-protos = { version = "0.10.0", features = ["async"] }
-go-flag = "0.1.0"
-hyper = "0.14.20"
-hyperlocal = "0.8.0"
-lazy_static = "1.4"
-libc = "0.2"
-log = "0.4.14"
-netns-rs = "0.1.0"
-# Note: nix needs to stay sync'd with libs versions
-nix = "0.26.4"
-oci-spec = { version = "0.8.1", features = ["runtime"] }
-protobuf = "3.7.2"
-rand = "0.8.4"
-serde = { version = "1.0.145", features = ["derive"] }
-serde_json = "1.0.91"
-sha2 = "0.10.9"
-slog = "2.5.2"
-slog-scope = "4.4.0"
-strum = { version = "0.24.0", features = ["derive"] }
-tempfile = "3.19.1"
-thiserror = "1.0"
-tokio = "1.46.1"
-tracing = "0.1.41"
-tracing-opentelemetry = "0.18.0"
-ttrpc = "0.8.4"
-url = "2.5.4"
--- a/9
+++ b/9
@@ -18,6 +18,7 @@ TOOLS =
 TOOLS += agent-ctl
 TOOLS += kata-ctl
 TOOLS += log-parser
+TOOLS += runk
 TOOLS += trace-forwarder

 STANDARD_TARGETS = build check clean install static-checks-build test vendor
@@ -41,7 +42,7 @@ generate-protocols:

 # Some static checks rely on generated source files of components.
 static-checks: static-checks-build
-	bash tests/static-checks.sh
+	bash tests/static-checks.sh github.com/kata-containers/kata-containers

 docs-url-alive-check:
 	bash ci/docs-url-alive-check.sh
@@ -49,14 +50,10 @@ docs-url-alive-check:
 build-and-publish-kata-debug:
 	bash tools/packaging/kata-debug/kata-debug-build-and-upload-payload.sh ${KATA_DEBUG_REGISTRY} ${KATA_DEBUG_TAG} 

-docs-serve:
-	docker run --rm -p 8000:8000 -v ./docs:/docs:ro -v ${PWD}/zensical.toml:/zensical.toml:ro zensical/zensical serve --config-file /zensical.toml -a 0.0.0.0:8000 
-
 .PHONY: \
 	all \
 	kata-tarball \
 	install-tarball \
 	default \
 	static-checks \
-	docs-url-alive-check \
-	docs-serve
+	docs-url-alive-check
--- a/README.md
+++ b/README.md
@@ -139,6 +139,7 @@ The table below lists the remaining parts of the project:
 | [`agent-ctl`](src/tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
 | [`kata-ctl`](src/tools/kata-ctl) | utility | Tool that provides advanced commands and debug facilities. |
 | [`trace-forwarder`](src/tools/trace-forwarder) | utility | Agent tracing helper. |
+| [`runk`](src/tools/runk) | utility | Standard OCI container runtime based on the agent. |
 | [`ci`](.github/workflows) | CI | Continuous Integration configuration files and scripts. |
 | [`ocp-ci`](ci/openshift-ci/README.md) | CI | Continuous Integration configuration for the OpenShift pipelines. |
 | [`katacontainers.io`](https://github.com/kata-containers/www.katacontainers.io) | Source for the [`katacontainers.io`](https://www.katacontainers.io) site. |
--- a/2
+++ b/2
@@ -1 +1 @@
-3.26.0
+3.18.0
--- a/ci/README.md
+++ b/ci/README.md
@@ -306,7 +306,7 @@ tarball to the newly created VM that will be used for debugging purposes.
 > [!NOTE]
 > Those artifacts are only available (for 15 days) when all jobs are finished.

-Once you have the `kata-static.tar.zst` in your VM, you can login to the VM with
+Once you have the `kata-static.tar.xz` in your VM, you can login to the VM with
 `kcli ssh debug-nerdctl-pr8070`, go ahead and then clone your development branch

 ```bash
@@ -323,15 +323,15 @@ $ git config --global user.name "Your Name"
 $ git rebase upstream/main
 ```

-Now copy the `kata-static.tar.zst` into your `kata-containers/kata-artifacts` directory
+Now copy the `kata-static.tar.xz` into your `kata-containers/kata-artifacts` directory

 ```bash
 $ mkdir kata-artifacts
-$ cp ../kata-static.tar.zst kata-artifacts/
+$ cp ../kata-static.tar.xz kata-artifacts/
 ```

 > [!NOTE]
-> If you downloaded the .zip from GitHub you need to uncompress first to see `kata-static.tar.zst`
+> If you downloaded the .zip from GitHub you need to uncompress first to see `kata-static.tar.xz`

 And finally run the tests following what's in the yaml file for the test you're
 debugging.
@@ -363,11 +363,11 @@ and have fun debugging and hacking!

 Steps for debugging the Kubernetes tests are very similar to the ones for
 debugging non-Kubernetes tests, with the caveat that what you'll need, this
-time, is not the `kata-static.tar.zst` tarball, but rather a payload to be used
+time, is not the `kata-static.tar.xz` tarball, but rather a payload to be used
 with kata-deploy.

 In order to generate your own kata-deploy image you can generate your own
-`kata-static.tar.zst` and then take advantage of the following script.  Be aware
+`kata-static.tar.xz` and then take advantage of the following script.  Be aware
 that the image generated and uploaded must be accessible by the VM where you'll
 be performing your tests.

--- a/ci/darwin-test.sh
+++ b/ci/darwin-test.sh
@@ -8,7 +8,6 @@ set -e

 cidir=$(dirname "$0")
 runtimedir=${cidir}/../src/runtime
-genpolicydir=${cidir}/../src/tools/genpolicy

 build_working_packages() {
 	# working packages:
@@ -41,11 +40,3 @@ build_working_packages() {
 }

 build_working_packages
-
-build_genpolicy() {
-	echo "building genpolicy"
-	pushd "${genpolicydir}" &>/dev/null
-	make TRIPLE=aarch64-apple-darwin build
-}
-
-build_genpolicy
--- a/ci/install_libseccomp.sh
+++ b/ci/install_libseccomp.sh
@@ -11,10 +11,6 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

 source "${script_dir}/../tests/common.bash"

-# Path to the ORAS cache helper for downloading tarballs (sourced when needed)
-# Use ORAS_CACHE_HELPER env var (set by build.sh in Docker) or fallback to repo path
-oras_cache_helper="${ORAS_CACHE_HELPER:-${script_dir}/../tools/packaging/scripts/download-with-oras-cache.sh}"
-
 # The following variables if set on the environment will change the behavior
 # of gperf and libseccomp configure scripts, that may lead this script to
 # fail. So let's ensure they are unset here.
@@ -48,9 +44,6 @@ fi
 gperf_tarball="gperf-${gperf_version}.tar.gz"
 gperf_tarball_url="${gperf_url}/${gperf_tarball}"

-# Use ORAS cache for gperf downloads (gperf upstream can be unreliable)
-USE_ORAS_CACHE="${USE_ORAS_CACHE:-yes}"
-
 # We need to build the libseccomp library from sources to create a static
 # library for the musl libc.
 # However, ppc64le, riscv64 and s390x have no musl targets in Rust. Hence, we do
@@ -75,23 +68,7 @@ trap finish EXIT
 build_and_install_gperf() {
 	echo "Build and install gperf version ${gperf_version}"
 	mkdir -p "${gperf_install_dir}"
-
-	# Use ORAS cache if available and enabled
-	if [[ "${USE_ORAS_CACHE}" == "yes" ]] && [[ -f "${oras_cache_helper}" ]]; then
-		echo "Using ORAS cache for gperf download"
-		source "${oras_cache_helper}"
-		local cached_tarball
-		cached_tarball=$(download_component gperf "$(pwd)")
-		if [[ -f "${cached_tarball}" ]]; then
-			gperf_tarball="${cached_tarball}"
-		else
-			echo "ORAS cache download failed, falling back to direct download"
-			curl -sLO "${gperf_tarball_url}"
-		fi
-	else
-		curl -sLO "${gperf_tarball_url}"
-	fi
-
+	curl -sLO "${gperf_tarball_url}"
 	tar -xf "${gperf_tarball}"
 	pushd "gperf-${gperf_version}"
 	# Unset $CC for configure, we will always use native for gperf
--- a/ci/openshift-ci/cleanup.sh
+++ b/ci/openshift-ci/cleanup.sh
@@ -46,12 +46,16 @@ fi
 [[ ${SELINUX_PERMISSIVE} == "yes" ]] && oc delete -f "${deployments_dir}/machineconfig_selinux.yaml.in"

 # Delete kata-containers
-helm uninstall kata-deploy --wait --namespace kube-system
+pushd "${katacontainers_repo_dir}/tools/packaging/kata-deploy" || { echo "Failed to push to ${katacontainers_repo_dir}/tools/packaging/kata-deploy"; exit 125; }
+oc delete -f kata-deploy/base/kata-deploy.yaml
 oc -n kube-system wait --timeout=10m --for=delete -l name=kata-deploy pod
+oc apply -f kata-cleanup/base/kata-cleanup.yaml
 echo "Wait for all related pods to be gone"
 ( repeats=1; for _ in $(seq 1 600); do
  oc get pods -l name="kubelet-kata-cleanup" --no-headers=true -n kube-system 2>&1 | grep "No resources found" -q && ((repeats++)) || repeats=1
  [[ "${repeats}" -gt 5 ]] && echo kata-cleanup finished && break
  sleep 1
 done) || { echo "There are still some kata-cleanup related pods after 600 iterations"; oc get all -n kube-system; exit 1; }
+oc delete -f kata-cleanup/base/kata-cleanup.yaml
+oc delete -f kata-rbac/base/kata-rbac.yaml
 oc delete -f runtimeclasses/kata-runtimeClasses.yaml
--- a/ci/openshift-ci/cluster/install_kata.sh
+++ b/ci/openshift-ci/cluster/install_kata.sh
@@ -43,22 +43,19 @@ WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
 # Leverage kata-deploy to install Kata Containers in the cluster.
 #
 apply_kata_deploy() {
-	if ! command -v helm &>/dev/null; then
-		echo "Helm not installed, installing in current location..."
-		PATH=".:${PATH}"
-		curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | HELM_INSTALL_DIR='.' bash -s -- --no-sudo
-	fi
+	local deploy_file="tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml"
+	pushd "${katacontainers_repo_dir}" || die
+	sed -ri "s#(\s+image:) .*#\1 ${KATA_DEPLOY_IMAGE}#" "${deploy_file}"

+	info "Applying kata-deploy"
+	oc apply -f tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
 	oc label --overwrite ns kube-system pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-	local version chart
-	version='0.0.0-dev'
-	chart="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy"
+	oc apply -f "${deploy_file}"
+	oc -n kube-system wait --timeout=10m --for=condition=Ready -l name=kata-deploy pod

-	# Ensure any potential leftover is cleaned up ... and this secret usually is not in case of previous failures
-	oc delete secret sh.helm.release.v1.kata-deploy.v1 -n kube-system || true
-
-	echo "Installing kata using helm ${chart} ${version} (sha printed in helm output)"
-	helm install kata-deploy --wait --namespace kube-system --set "image.reference=${KATA_DEPLOY_IMAGE%%:*},image.tag=${KATA_DEPLOY_IMAGE##*:}" "${chart}" --version "${version}"
+	info "Adding the kata runtime classes"
+	oc apply -f tools/packaging/kata-deploy/runtimeclasses/kata-runtimeClasses.yaml
+	popd || die
 }


@@ -177,13 +174,13 @@ wait_for_app_pods_message() {
 	local namespace="$5"
 	[[ -z "${pod_count}" ]] && pod_count=1
 	[[ -z "${timeout}" ]] && timeout=60
-	[[ -n "${namespace}" ]] && namespace=("-n" "${namespace}")
+	[[ -n "${namespace}" ]] && namespace=" -n ${namespace} "
 	local pod
 	local pods
 	local i
 	SECONDS=0
 	while :; do
-		mapfile -t pods < <(oc get pods -l app="${app}" --no-headers=true "${namespace[@]}" | awk '{print $1}')
+		mapfile -t pods < <(oc get pods -l app="${app}" --no-headers=true "${namespace}" | awk '{print $1}')
 		[[ "${#pods}" -ge "${pod_count}" ]] && break
 		if [[ "${SECONDS}" -gt "${timeout}" ]]; then
 			printf "Unable to find ${pod_count} pods for '-l app=\"${app}\"' in ${SECONDS}s (%s)" "${pods[@]}"
@@ -193,7 +190,7 @@ wait_for_app_pods_message() {
 	local log
 	for pod in "${pods[@]}"; do
 		while :; do
-			log=$(oc logs "${namespace[@]}" "${pod}")
+			log=$(oc logs "${namespace}" "${pod}")
 			echo "${log}" | grep "${message}" -q && echo "Found $(echo "${log}" | grep "${message}") in ${pod}'s log (${SECONDS})" && break;
 			if [[ "${SECONDS}" -gt "${timeout}" ]]; then
 				echo -n "Message '${message}' not present in '${pod}' pod of the '-l app=\"${app}\"' "
--- a/ci/openshift-ci/peer-pods-azure.sh
+++ b/ci/openshift-ci/peer-pods-azure.sh
@@ -12,33 +12,6 @@

 SCRIPT_DIR=$(dirname "$0")

-##################
-# Helper functions
-##################
-
-# Sparse "git clone" supporting old git version
-# $1  - origin
-# $2  - revision
-# $3- - sparse checkout paths
-# Note: uses pushd to change into the clonned directory!
-git_sparse_clone() {
-  local origin="$1"
-  local revision="$2"
-  shift 2
-  local sparse_paths=("$@")
-
-  local repo
-  repo=$(basename -s .git "${origin}")
-
-  git init "${repo}"
-  pushd "${repo}" || exit 1
-  git remote add origin "${origin}"
-  git fetch --depth 1 origin "${revision}"
-  git sparse-checkout init --cone
-  git sparse-checkout set "${sparse_paths[@]}"
-  git checkout FETCH_HEAD
-}
-
 ###############################
 # Disable security to allow e2e
 ###############################
@@ -143,50 +116,33 @@ az network vnet subnet update \
 for NODE_NAME in $(kubectl get nodes -o jsonpath='{.items[*].metadata.name}'); do [[ "${NODE_NAME}" =~ 'worker' ]] && kubectl label node "${NODE_NAME}" node.kubernetes.io/worker=; done

 # CAA artifacts
-if [[ -z "${CAA_TAG}" ]]; then
-	if [[ -n "${CAA_IMAGE}" ]]; then
-		echo "CAA_IMAGE (${CAA_IMAGE}) is set but CAA_TAG isn't, which is not supported. Please specify both or none"
-		exit 1
-	fi
-	TAGS="$(curl https://quay.io/api/v1/repository/confidential-containers/cloud-api-adaptor/tag/?onlyActiveTags=true)"
-	DIGEST=$(echo "${TAGS}" | jq -r '.tags[] | select(.name | contains("latest-amd64")) | .manifest_digest')
-	CAA_TAG="$(echo "${TAGS}" | jq -r '.tags[] | select(.manifest_digest | contains("'"${DIGEST}"'")) | .name' | grep -v "latest")"
-fi
-if [[ -z "${CAA_IMAGE}" ]]; then
-	CAA_IMAGE="quay.io/confidential-containers/cloud-api-adaptor"
-fi
+CAA_IMAGE="quay.io/confidential-containers/cloud-api-adaptor"
+TAGS="$(curl https://quay.io/api/v1/repository/confidential-containers/cloud-api-adaptor/tag/?onlyActiveTags=true)"
+DIGEST=$(echo "${TAGS}" | jq -r '.tags[] | select(.name | contains("latest-amd64")) | .manifest_digest')
+CAA_TAG="$(echo "${TAGS}" | jq -r '.tags[] | select(.manifest_digest | contains("'"${DIGEST}"'")) | .name' | grep -v "latest")"

 # Get latest PP image
-#
-# You can list the CI images by:
-#     az sig image-version list-community --location "eastus" --public-gallery-name "cocopodvm-d0e4f35f-5530-4b9c-8596-112487cdea85" --gallery-image-definition "podvm_image0" --output table
-# or the release images by:
-#     az sig image-version list-community --location "eastus" --public-gallery-name "cococommunity-42d8482d-92cd-415b-b332-7648bd978eff" --gallery-image-definition "peerpod-podvm-fedora" --output table
-# or the release debug images by:
-#     az sig image-version list-community --location "eastus" --public-gallery-name "cococommunity-42d8482d-92cd-415b-b332-7648bd978eff" --gallery-image-definition "peerpod-podvm-fedora-debug" --output table
-#
-# Note there are other flavours of the released images, you can list them by:
-#     az sig image-definition list-community --location "eastus" --public-gallery-name "cococommunity-42d8482d-92cd-415b-b332-7648bd978eff" --output table
-if [[ -z "${PP_IMAGE_ID}" ]]; then
-	SUCCESS_TIME=$(curl -s \
-	  -H "Accept: application/vnd.github+json" \
-	  "https://api.github.com/repos/confidential-containers/cloud-api-adaptor/actions/workflows/azure-nightly-build.yml/runs?status=success" \
-	  | jq -r '.workflow_runs[0].updated_at')
-	PP_IMAGE_ID="/CommunityGalleries/cocopodvm-d0e4f35f-5530-4b9c-8596-112487cdea85/Images/podvm_image0/Versions/$(date -u -jf "%Y-%m-%dT%H:%M:%SZ" "${SUCCESS_TIME}" "+%Y.%m.%d" 2>/dev/null || date -d "${SUCCESS_TIME}" +%Y.%m.%d)"
-fi
+SUCCESS_TIME=$(curl -s \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/confidential-containers/cloud-api-adaptor/actions/workflows/azure-nightly-build.yml/runs?status=success" \
+  | jq -r '.workflow_runs[0].updated_at')
+PP_IMAGE_ID="/CommunityGalleries/cocopodvm-d0e4f35f-5530-4b9c-8596-112487cdea85/Images/podvm_image0/Versions/$(date -u -jf "%Y-%m-%dT%H:%M:%SZ" "${SUCCESS_TIME}" "+%Y.%m.%d" 2>/dev/null || date -d "${SUCCESS_TIME}" +%Y.%m.%d)"

-echo "AZURE_REGION=\"${AZURE_REGION}\""
-echo "PP_REGION=\"${PP_REGION}\""
-echo "AZURE_RESOURCE_GROUP=\"${AZURE_RESOURCE_GROUP}\""
-echo "PP_RESOURCE_GROUP=\"${PP_RESOURCE_GROUP}\""
-echo "PP_SUBNET_ID=\"${PP_SUBNET_ID}\""
-echo "CAA_IMAGE=\"${CAA_IMAGE}\""
-echo "CAA_TAG=\"${CAA_TAG}\""
-echo "PP_IMAGE_ID=\"${PP_IMAGE_ID}\""
+echo "AZURE_REGION: \"${AZURE_REGION}\""
+echo "PP_REGION: \"${PP_REGION}\""
+echo "AZURE_RESOURCE_GROUP: \"${AZURE_RESOURCE_GROUP}\""
+echo "PP_RESOURCE_GROUP: \"${PP_RESOURCE_GROUP}\""
+echo "PP_SUBNET_ID: \"${PP_SUBNET_ID}\""
+echo "CAA_TAG: \"${CAA_TAG}\""
+echo "PP_IMAGE_ID: \"${PP_IMAGE_ID}\""

 # Clone and configure caa
-git_sparse_clone "https://github.com/confidential-containers/cloud-api-adaptor.git" "${CAA_GIT_SHA:-main}" "src/cloud-api-adaptor/install/"
-echo "CAA_GIT_SHA=\"$(git rev-parse HEAD)\""
+git clone --depth 1 --no-checkout https://github.com/confidential-containers/cloud-api-adaptor.git
+pushd cloud-api-adaptor
+git sparse-checkout init --cone
+git sparse-checkout set src/cloud-api-adaptor/install/
+git checkout
+echo "CAA_GIT_SHA: \"$(git rev-parse HEAD)\""
 pushd src/cloud-api-adaptor
 cat <<EOF > install/overlays/azure/workload-identity.yaml
 apiVersion: apps/v1
@@ -252,8 +208,12 @@ echo "AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}" >> install/overlays/azure/serv
 echo "AZURE_TENANT_ID=${AZURE_TENANT_ID}" >> install/overlays/azure/service-principal.env

 # Deploy Operator
-git_sparse_clone "https://github.com/confidential-containers/operator" "${OPERATOR_SHA:-main}" "config/"
-echo "OPERATOR_SHA=\"$(git rev-parse HEAD)\""
+git clone --depth 1 --no-checkout https://github.com/confidential-containers/operator
+pushd operator
+git sparse-checkout init --cone
+git sparse-checkout set "config/"
+git checkout
+echo "OPERATOR_SHA: \"$(git rev-parse HEAD)\""
 oc apply -k "config/release"
 oc apply -k "config/samples/ccruntime/peer-pods"
 popd
@@ -267,7 +227,7 @@ popd
 SECONDS=0
 ( while [[ "${SECONDS}" -lt 360 ]]; do
    kubectl get runtimeclass | grep -q kata-remote && exit 0
-done; exit 1 ) || { echo "kata-remote runtimeclass not initialized in 60s"; kubectl -n confidential-containers-system get all; echo; echo "kubectl -n confidential-containers-system describe all"; kubectl -n confidential-containers-system describe all; echo; echo CAA; kubectl -n confidential-containers-system logs daemonset.apps/cloud-api-adaptor-daemonset; echo pre-install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-pre-install-daemon; echo install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-daemon-install; exit 1; }
+done; exit 1 ) || { echo "kata-remote runtimeclass not initialized in 60s"; kubectl -n confidential-containers-system get all; echo; echo CAA; kubectl -n confidential-containers-system logs daemonset.apps/cloud-api-adaptor-daemonset; echo pre-install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-pre-install-daemon; echo install; kubectl -n confidential-containers-system logs daemonset.apps/cc-operator-daemon-install; exit 1; }


 ################
--- a/docs/Developer-Guide.md
+++ b/docs/Developer-Guide.md
@@ -125,7 +125,7 @@ If you want to enable SELinux in Permissive mode, add `enforcing=0` to the kerne
 Enable full debug as follows:

 ```bash
-$ sudo sed -i -E 's/^(\s*enable_debug\s*=\s*)false/\1true/' /etc/kata-containers/configuration.toml
+$ sudo sed -i -e 's/^# *\(enable_debug\).*=.*$/\1 = true/g' /etc/kata-containers/configuration.toml
 $ sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.log=debug initcall_debug"/g' /etc/kata-containers/configuration.toml
 ```

@@ -450,7 +450,7 @@ You can build and install the guest kernel image as shown [here](../tools/packag
 # Install a hypervisor

 When setting up Kata using a [packaged installation method](install/README.md#installing-on-a-linux-system), the
-`QEMU` VMM is installed automatically. Cloud-Hypervisor, Firecracker and StratoVirt VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/helm-chart/README.md).
+`QEMU` VMM is installed automatically. Cloud-Hypervisor, Firecracker and StratoVirt VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/README.md).
 You may choose to manually build your VMM/hypervisor.

 ## Build a custom QEMU
--- a/docs/Kata-Containers-Lifecycle-Management.md
+++ b/docs/Kata-Containers-Lifecycle-Management.md
@@ -1,118 +0,0 @@
-# Kata Containers Lifecycle Management
-
-## Overview
-
-Kata Containers lifecycle management in Kubernetes consists of two operations:
-
-1. **Installation** - Deploy Kata Containers to cluster nodes
-2. **Upgrades** - Update Kata Containers to newer versions without disrupting workloads
-
-The Kata Containers project provides two Helm charts to address these needs:
-
-| Chart | Purpose |
-|-------|---------|
-| `kata-deploy` | Initial installation and configuration |
-| `kata-lifecycle-manager` | Orchestrated rolling upgrades with verification |
-
---
-
-## Installation with kata-deploy
-
-The `kata-deploy` Helm chart installs Kata Containers across all (or selected) nodes using a Kubernetes DaemonSet. When deployed, it:
-
- Installs Kata runtime binaries on each node
- Configures the container runtime (containerd) to use Kata
- Registers RuntimeClasses (`kata-qemu-nvidia-gpu-snp`, `kata-qemu-nvidia-gpu-tdx`, `kata-qemu-nvidia-gpu`, etc.)
-
-After installation, workloads can use Kata isolation by specifying `runtimeClassName: kata-qemu-nvidia-gpu-snp` (or another Kata RuntimeClass) in their pod spec.
-
---
-
-## Upgrades with kata-lifecycle-manager
-
-### The Problem
-
-Standard `helm upgrade kata-deploy` updates all nodes simultaneously via the DaemonSet. This approach:
-
- Provides no per-node verification
- Offers no controlled rollback mechanism
- Can leave the cluster in an inconsistent state if something fails
-
-### The Solution
-
-The `kata-lifecycle-manager` Helm chart uses Argo Workflows to orchestrate upgrades with the following guarantees:
-
-| Guarantee | Description |
-|-----------|-------------|
-| **Sequential Processing** | Nodes are upgraded one at a time |
-| **Per-Node Verification** | A user-provided pod validates Kata functionality after each node upgrade |
-| **Fail-Fast** | If verification fails, the workflow stops immediately |
-| **Automatic Rollback** | On failure, Helm rollback is executed and the node is restored |
-
-### Upgrade Flow
-
-For each node in the cluster:
-
-1. **Cordon** - Mark node as unschedulable
-2. **Drain** (optional) - Evict existing workloads
-3. **Upgrade** - Run `helm upgrade kata-deploy` targeting this node
-4. **Wait** - Ensure kata-deploy DaemonSet pod is ready
-5. **Verify** - Run verification pod to confirm Kata works
-6. **Uncordon** - Mark node as schedulable again
-
-If verification fails on any node, the workflow:
- Rolls back the Helm release
- Uncordons the node
- Stops processing (remaining nodes are not upgraded)
-
-### Verification Pod
-
-Users must provide a verification pod that tests Kata functionality. This pod:
-
- Uses a Kata RuntimeClass
- Is scheduled on the specific node being verified
- Runs whatever validation logic the user requires (smoke tests, attestation checks, etc.)
-
-**Basic GPU Verification Example:**
-
-For clusters with NVIDIA GPUs, the CUDA VectorAdd sample provides a more comprehensive verification:
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: ${TEST_POD}
-spec:
-  runtimeClassName: kata-qemu-nvidia-gpu-snp # or kata-qemu-nvidia-gpu-tdx
-  restartPolicy: Never
-  nodeSelector:
-    kubernetes.io/hostname: ${NODE}
-  containers:
-  - name: cuda-vectoradd
-    image: nvcr.io/nvidia/k8s/cuda-sample:vectoradd-cuda12.5.0-ubuntu22.04
-    resources:
-      limits:
-        nvidia.com/pgpu: "1"
-        memory: 16Gi
-```
-
-This verifies that GPU passthrough works correctly with the upgraded Kata runtime.
-
-The placeholders `${NODE}` and `${TEST_POD}` are substituted at runtime.
-
---
-
-## Demo Recordings
-
-| Demo | Description | Link |
-|------|-------------|------|
-| Sunny Path | Successful upgrade from 3.24.0 to 3.25.0 | [TODO] |
-| Rainy Path | Failed verification triggers rollback | [TODO] |
-
---
-
-## References
-
- [kata-deploy Helm Chart](tools/packaging/kata-deploy/helm-chart/README.md)
- [kata-lifecycle-manager Helm Chart](tools/packaging/kata-deploy/helm-chart/kata-lifecycle-manager/README.md)
- [kata-lifecycle-manager Design Document](docs/design/kata-lifecycle-manager-design.md)
--- a/docs/Limitations.md
+++ b/docs/Limitations.md
@@ -166,65 +166,19 @@ moment.
 See [this issue](https://github.com/kata-containers/runtime/issues/2812) for more details.
 [Another issue](https://github.com/kata-containers/kata-containers/issues/1728) focuses on the case of `emptyDir`.

-### Kubernetes [hostPath][k8s-hostpath] volumes
+## Host resource sharing

-In Kata, Kubernetes hostPath volumes can mount host directories and
-regular files into the guest VM via filesystem sharing, if it is enabled
-through the `shared_fs` [configuration][runtime-config] flag.
-
-By default:
-
- - Non-TEE environment: Filesystem sharing is used to mount host files.
- - TEE environment: Filesystem sharing is disabled. Instead, host files
-   are copied into the guest VM when the container starts, and file
-   changes are *not* synchronized between the host and the guest.
-
-In some cases, the behavior of hostPath volumes in Kata is further
-different compared to `runc` containers:
-
-**Mounting host block devices**: When a hostPath volume is of type
-[`BlockDevice`][k8s-blockdevice], Kata hotplugs the host block device
-into the guest and exposes it directly to the container.
-
-**Mounting guest devices**: When the source path of a hostPath volume is
-under `/dev`, and the path either corresponds to a host device or is not
-accessible by the Kata shim, the Kata agent bind mounts the source path
-directly from the *guest* filesystem into the container.
-
-[runtime-config]: /src/runtime/README.md#configuration
-[k8s-hostpath]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
-[k8s-blockdevice]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath-volume-types
-
-### Mounting `procfs` and `sysfs`
-
-For security reasons, the following mounts are disallowed:
-
-| Type              | Source    | Destination                      | Rationale      |
-|-------------------|-----------|----------------------------------|----------------|
-| `bind`            | `!= proc` | `/proc`                          | CVE-2019-16884 |
-| `bind`            | `*`       | `/proc/*` (see exceptions below) | CVE-2019-16884 |
-| `proc \|\| sysfs` | `*`       | not a directory (e.g. symlink)   | CVE-2019-19921 |
-
-For bind mounts under /proc, these destinations are allowed:
-	
- * `/proc/cpuinfo`
- * `/proc/diskstats`
- * `/proc/meminfo`
- * `/proc/stat`
- * `/proc/swaps`
- * `/proc/uptime`
- * `/proc/loadavg`
- * `/proc/net/dev`
-
-## Privileged containers
+### Privileged containers

 Privileged support in Kata is essentially different from `runc` containers.
-The container runs with elevated capabilities within the guest.
+The container runs with elevated capabilities within the guest and is granted
+access to guest devices instead of the host devices.
 This is also true with using `securityContext privileged=true` with Kubernetes.

-Importantly, the default behavior to pass the host devices to a
-privileged container is not supported in Kata Containers and needs to be
-disabled, see [Privileged Kata Containers](how-to/privileged.md).
+The container may also be granted full access to a subset of host devices
+(https://github.com/kata-containers/runtime/issues/1568).
+
+See [Privileged Kata Containers](how-to/privileged.md) for how to configure some of this behavior.

 # Appendices

--- a/docs/README.md
+++ b/docs/README.md
@@ -83,7 +83,3 @@ Documents that help to understand and contribute to Kata Containers.
 If you have a suggestion for how we can improve the
 [website](https://katacontainers.io), please raise an issue (or a PR) on
 [the repository that holds the source for the website](https://github.com/OpenStackweb/kata-netlify-refresh).
-
-### Toolchain Guidance
-
-* [Toolchain Guidance](./Toochain-Guidance.md)
--- a/docs/Release-Process.md
+++ b/docs/Release-Process.md
@@ -28,15 +28,13 @@ Bug fixes are released as part of `MINOR` or `MAJOR` releases only. `PATCH` is a

 ## Release Process

-### Bump the `VERSION` and `Chart.yaml` files
+### Bump the `VERSION` and `Chart.yaml` file

 When the `kata-containers/kata-containers` repository is ready for a new release,
 first create a PR to set the release in the [`VERSION`](./../VERSION) file and update the
-`version` and `appVersion` in the following `Chart.yaml` files:
- [`kata-deploy/Chart.yaml`](./../tools/packaging/kata-deploy/helm-chart/kata-deploy/Chart.yaml)
- [`kata-lifecycle-manager/Chart.yaml`](./../tools/packaging/kata-deploy/helm-chart/kata-lifecycle-manager/Chart.yaml)
-
-Have the PR merged before proceeding.
+`version` and `appVersion` in the
+[`Chart.yaml`](./../tools/packaging/kata-deploy/helm-chart/kata-deploy/Chart.yaml) file and
+have it merged.

 ### Lock the `main` branch

--- a/docs/Toochain-Guidance.md
+++ b/docs/Toochain-Guidance.md
@@ -1,39 +0,0 @@
-# Toolchains
-
-As a community we want to strike a balance between having up-to-date toolchains, to receive the
-latest security fixes and to be able to benefit from new features and packages, whilst not being
-too bleeding edge and disrupting downstream and other consumers. As a result we have the following
-guidelines (note, not hard rules) for our go and rust toolchains that we are attempting to try out:
-
-## Go toolchain
-
-Go is released [every six months](https://go.dev/wiki/Go-Release-Cycle) with support for the
-[last two major release versions](https://go.dev/doc/devel/release#policy). We always want to
-ensure that we are on a supported version so we receive security fixes. To try and make
-things easier for some of our users, we aim to be using the older of the two supported major
-versions, unless there is a compelling reason to adopt the newer version.
-
-In practice this means that we bump our major version of the go toolchain every six months to
-version (1.x-1) in response to a new version (1.x) coming out, which makes our current version
-(1.x-2) no longer supported. We will bump the minor version whenever required to satisfy
-dependency updates, or security fixes.
-
-Our go toolchain version is recorded in [`versions.yaml`](../versions.yaml) under
-`.languages.golang.version` and should match with the version in our `go.mod` files.
-
-## Rust toolchain
-
-Rust has a [six week](https://doc.rust-lang.org/book/appendix-05-editions.html#:~:text=The%20Rust%20language%20and%20compiler,these%20tiny%20changes%20add%20up.)
-release cycle and they only support the latest stable release, so if we wanted to remain on a
-supported release we would only ever build with the latest stable and bump every 6 weeks.
-However feedback from our community has indicated that this is a challenge as downstream consumers
-often want to get rust from their distro, or downstream fork and these struggle to keep up with
-the six week release schedule. As a result the community has agreed to try out a policy of
-"stable-2", where we aim to build with a rust version that is two versions behind the latest stable
-version.
-
-In practice this should mean that we bump our rust toolchain every six weeks, to version
-1.x-2 when 1.x is released as stable and we should be picking up the latest point release
-of that version, if there were any.
-
-The rust-toolchain that we are using is recorded in [`rust-toolchain.toml`](../rust-toolchain.toml).
--- a/docs/Unit-Test-Advice.md
+++ b/docs/Unit-Test-Advice.md
@@ -198,7 +198,7 @@ fn join_params_with_dash(str: &str, num: i32) -> Result<String> {
        return Err("number must be positive");
    }

-    let result = format!("{str}-{num}");
+    let result = format!("{}-{}", str, num);

    Ok(result)
 }
@@ -253,13 +253,13 @@ mod tests {
        // Run the tests
        for (i, d) in tests.iter().enumerate() {
            // Create a string containing details of the test
-            let msg = format!("test[{i}]: {d:?}");
+            let msg = format!("test[{}]: {:?}", i, d);

            // Call the function under test
            let result = join_params_with_dash(d.str, d.num);

            // Update the test details string with the results of the call
-            let msg = format!("{msg}, result: {result:?}");
+            let msg = format!("{}, result: {:?}", msg, result);

            // Perform the checks
            if d.result.is_ok() {
@@ -267,8 +267,8 @@ mod tests {
                continue;
            }

-            let expected_error = format!("{d.result.as_ref().unwrap_err()}");
-            let actual_error = format!("{result.unwrap_err()}");
+            let expected_error = format!("{}", d.result.as_ref().unwrap_err());
+            let actual_error = format!("{}", result.unwrap_err());
            assert!(actual_error == expected_error, msg);
        }
    }
--- a/docs/assets/favicon.svg
+++ b/docs/assets/favicon.svg
@@ -1,9 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
-  <!-- Dark background matching the site -->
-  <rect width="32" height="32" rx="4" fill="#1a1a2e"/>
-  
-  <!-- Kata logo scaled and centered -->
-  <g transform="translate(-27, -2) scale(0.75)">
-    <path d="M70.925 25.22L58.572 37.523 46.27 25.22l2.192-2.192 10.11 10.11 10.11-10.11zm-6.575-.2l-3.188-3.188 3.188-3.188 3.188 3.188zm-4.93-2.54l3.736 3.736-3.736 3.736zm-1.694 7.422l-8.07-8.07 8.07-8.07zm1.694-16.14l3.686 3.686-3.686 3.686zm-13.15 4.682L58.572 6.143l12.353 12.303-2.192 2.192-10.16-10.11-10.11 10.11zm26.997 0L58.572 3.752 43.878 18.446l3.387 3.387-3.387 3.387 14.694 14.694L73.266 25.22l-3.337-3.387z" fill="#f15b3e"/>
-  </g>
-</svg>
--- a/docs/design/README.md
+++ b/docs/design/README.md
@@ -19,7 +19,6 @@ Kata Containers design documents:
 - [Design for direct-assigned volume](direct-blk-device-assignment.md)
 - [Design for core-scheduling](core-scheduling.md)
 - [Virtualization Reference Architecture](kata-vra.md)
- [Design for kata-lifecycle-manager Helm chart](kata-lifecycle-manager-design.md)
 ---

 - [Design proposals](proposals)
--- a/docs/design/architecture/storage.md
+++ b/docs/design/architecture/storage.md
@@ -51,7 +51,6 @@ containers started after the VM has been launched.
 Users can check to see if the container uses the `devicemapper` block
 device as its rootfs by calling `mount(8)` within the container. If
 the `devicemapper` block device is used, the root filesystem (`/`)
-will be mounted from `/dev/vda`. Users can enable direct mounting of
-the underlying block device by setting the runtime
-[configuration](README.md#configuration) flag `disable_block_device_use` to
-`false`.
+will be mounted from `/dev/vda`. Users can disable direct mounting of
+the underlying block device through the runtime
+[configuration](README.md#configuration).
--- a/docs/design/kata-lifecycle-manager-design.md
+++ b/docs/design/kata-lifecycle-manager-design.md
@@ -1,502 +0,0 @@
-# Kata Containers Lifecycle Manager Design
-
-## Summary
-
-This document proposes a Helm chart-based orchestration solution for Kata Containers that
-enables controlled, node-by-node upgrades with verification and rollback capabilities
-using Argo Workflows.
-
-## Motivation
-
-### Problem Statement
-
-Upgrading Kata Containers in a production Kubernetes cluster presents several challenges:
-
-1. **Workload Scheduling Control**: New Kata workloads should not be scheduled on a node
-   during upgrade until the new runtime is verified.
-
-2. **Verification Gap**: There is no standardized way to verify that Kata is working correctly
-   after an upgrade before allowing workloads to return to the node. This solution addresses
-   the gap by running a user-provided verification pod on each upgraded node.
-
-3. **Rollback Complexity**: If an upgrade fails, administrators must manually coordinate
-   rollback across multiple nodes.
-
-4. **Controlled Rollout**: Operators need the ability to upgrade nodes incrementally
-   (canary approach) with fail-fast behavior if any node fails verification.
-
-5. **Multi-Architecture Support**: The upgrade tooling must work across all architectures
-   supported by Kata Containers (amd64, arm64, s390x, ppc64le).
-
-### Current State
-
-The `kata-deploy` Helm chart provides installation and configuration of Kata Containers,
-including a post-install verification job. However, there is no built-in mechanism for
-orchestrating upgrades across nodes in a controlled manner.
-
-## Goals
-
-1. Provide a standardized, automated way to upgrade Kata Containers node-by-node
-2. Ensure each node is verified before returning to service
-3. Support user-defined verification logic
-4. Automatically rollback if verification fails
-5. Work with the existing `kata-deploy` Helm chart
-6. Support all Kata-supported architectures
-
-## Non-Goals
-
-1. Initial Kata Containers installation (use kata-deploy Helm chart for that)
-2. Managing Kubernetes cluster upgrades
-3. Providing Kata-specific verification logic (this is user responsibility)
-4. Managing Argo Workflows installation
-
-## Argo Workflows Dependency
-
-### What Works Without Argo
-
-The following components work independently of Argo Workflows:
-
-| Component | Description |
-|-----------|-------------|
-| **kata-deploy Helm chart** | Full installation, configuration, `RuntimeClasses` |
-| **Post-install verification** | Helm hook runs verification pod after install |
-| **Label-gated deployment** | Progressive rollout via node labels |
-| **Manual upgrades** | User can script: cordon, helm upgrade, verify, `uncordon` |
-
-Users who do not want Argo can still:
- Install and configure Kata via kata-deploy
- Perform upgrades manually or with custom scripts
- Use the verification pod pattern in their own automation
-
-### What Requires Argo
-
-The kata-lifecycle-manager Helm chart provides orchestration via Argo Workflows:
-
-| Feature | Description |
-|---------|-------------|
-| **Automated node-by-node upgrades** | Sequential processing with fail-fast |
-| **Taint-based node selection** | Select nodes by taint key/value |
-| **`WorkflowTemplate`** | Reusable upgrade workflow |
-| **Rollback entrypoint** | `argo submit --entrypoint rollback-node` |
-| **Status tracking** | Node annotations updated at each phase |
-
-### For Users Already Using Argo
-
-If your cluster already has Argo Workflows installed:
-
-```bash
-# Install kata-lifecycle-manager - integrates with your existing Argo installation
-helm install kata-lifecycle-manager oci://ghcr.io/kata-containers/kata-deploy-charts/kata-lifecycle-manager \
-  --set argoNamespace=argo \
-  --set-file defaults.verificationPod=./verification-pod.yaml
-
-# Trigger upgrades via argo CLI or integrate with existing workflows
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager -p target-version=3.25.0
-```
-
-kata-lifecycle-manager can also be triggered by other Argo workflows, CI/CD pipelines, or `GitOps`
-tools that support Argo.
-
-### For Users Not Wanting Argo
-
-If you prefer not to use Argo Workflows:
-
-1. **Use kata-deploy directly** - handles installation and basic verification
-2. **Script your own orchestration** - example approach:
-
-```bash
-#!/bin/bash
-# Manual upgrade script (no Argo required)
-set -euo pipefail
-
-VERSION="3.25.0"
-
-# Upgrade each node with Kata runtime
-kubectl get nodes -l katacontainers.io/kata-runtime=true -o name | while read -r node_path; do
-  NODE="${node_path#node/}"
-  echo "Upgrading $NODE..."
-  kubectl cordon "$NODE"
-  
-  helm upgrade kata-deploy oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy \
-    --namespace kube-system \
-    --version "$VERSION" \
-    --reuse-values \
-    --wait
-  
-  # Wait for DaemonSet pod on this node
-  kubectl rollout status daemonset/kata-deploy -n kube-system
-  
-  # Run verification (apply your pod, wait, check exit code)
-  kubectl apply -f verification-pod.yaml
-  kubectl wait pod/kata-verify --for=jsonpath='{.status.phase}'=Succeeded --timeout=180s
-  kubectl delete pod/kata-verify
-  
-  kubectl uncordon "$NODE"
-  echo "$NODE upgraded successfully"
-done
-```
-
-This approach requires more manual effort but avoids the Argo dependency.
-
-## Proposed Design
-
-### Architecture Overview
-
-```text
-┌─────────────────────────────────────────────────────────────────┐
-│                    Argo Workflows Controller                    │
-│                         (pre-installed)                         │
-└────────────────────────────┬────────────────────────────────────┘
-                             │
-                             ▼
-┌──────────────────────────────────────────────────────────────┐
-│                    kata-lifecycle-manager Helm Chart                   │
-│  ┌────────────────────────────────────────────────────────┐  │
-│  │                   WorkflowTemplate                     │  │
-│  │  - upgrade-all-nodes (entrypoint)                      │  │
-│  │  - upgrade-single-node (per-node steps)                │  │
-│  │  - rollback-node (manual recovery)                     │  │
-│  └────────────────────────────────────────────────────────┘  │
-│  ┌────────────────────────────────────────────────────────┐  │
-│  │                   RBAC Resources                       │  │
-│  │  - ServiceAccount                                      │  │
-│  │  - ClusterRole (node, pod, helm operations)            │  │
-│  │  - ClusterRoleBinding                                  │  │
-│  └────────────────────────────────────────────────────────┘  │
-└──────────────────────────────────────────────────────────────┘
-                             │
-                             ▼
-┌─────────────────────────────────────────────────────────────────┐
-│                    kata-deploy Helm Chart                       │
-│                   (existing installation)                       │
-└─────────────────────────────────────────────────────────────────┘
-```
-
-### Upgrade Flow
-
-For each node selected by the upgrade label:
-
-```text
-┌────────────┐    ┌──────────────┐    ┌────────────┐    ┌────────────┐
-│  Prepare   │───▶│  Cordon      │───▶│  Upgrade   │───▶│Wait Ready  │
-│ (annotate) │    │  (mark       │    │  (helm     │    │(kata-deploy│
-│            │    │unschedulable)│    │ upgrade)   │    │ DaemonSet) │
-└────────────┘    └──────────────┘    └────────────┘    └────────────┘
-                                                               │
-                                                               ▼
-                  ┌────────────┐    ┌──────────────┐    ┌────────────┐
-                  │  Complete  │◀───│   Uncordon   │◀───│  Verify    │
-                  │ (annotate  │    │  (mark       │    │  (user pod)│
-                  │  version)  │    │schedulable)  │    │            │
-                  └────────────┘    └──────────────┘    └────────────┘
-```
-
-**Note:** Drain is not required for Kata upgrades. Running Kata VMs continue using
-the in-memory binaries. Only new workloads use the upgraded binaries. Cordon ensures
-the verification pod runs before any new workloads are scheduled with the new runtime.
-
-**Optional Drain:** For users who prefer to evict workloads before any maintenance
-operation, an optional drain step can be enabled via `drain-enabled=true`. When
-enabled, an additional drain step runs after cordon and before upgrade.
-
-### Node Selection Model
-
-Nodes can be selected for upgrade using **labels**, **taints**, or **both**.
-
-**Label-based selection:**
-
-```bash
-# Select nodes by label
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  -p target-version=3.25.0 \
-  -p node-selector="katacontainers.io/kata-lifecycle-manager-window=true"
-```
-
-**Taint-based selection:**
-
-Some organizations use taints to mark nodes for maintenance. The workflow supports
-selecting nodes by taint key and optionally taint value:
-
-```bash
-# Select nodes with a specific taint
-kubectl taint nodes worker-1 kata-lifecycle-manager=pending:NoSchedule
-
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  -p target-version=3.25.0 \
-  -p node-taint-key=kata-lifecycle-manager \
-  -p node-taint-value=pending
-```
-
-**Combined selection:**
-
-Labels and taints can be used together for precise targeting:
-
-```bash
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  -p target-version=3.25.0 \
-  -p node-selector="node-pool=kata-pool" \
-  -p node-taint-key=maintenance
-```
-
-This allows operators to:
-1. Upgrade a single canary node first
-2. Gradually add nodes to the upgrade window
-3. Control upgrade timing via `GitOps` or automation
-4. Integrate with existing taint-based maintenance workflows
-
-### Node Pool Support
-
-The node selector and taint selector parameters enable basic node pool targeting:
-
-```bash
-# Upgrade only nodes matching a specific node pool label
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  -p target-version=3.25.0 \
-  -p node-selector="node-pool=kata-pool"
-```
-
-**Current Capabilities:**
-
-| Feature | Status | Chart | Notes |
-|---------|--------|-------|-------|
-| Label-based selection | Supported | kata-lifecycle-manager | Works with any label combination |
-| Taint-based selection | Supported | kata-lifecycle-manager | Select by taint key/value |
-| Sequential upgrades | Supported | kata-lifecycle-manager | One node at a time with fail-fast |
-| Pool-specific verification pods | Not supported | kata-lifecycle-manager | Same verification for all nodes |
-| Pool-ordered upgrades | Not supported | kata-lifecycle-manager | Upgrade pool A before pool B |
-
-See the [Potential Enhancements](#potential-enhancements) section for future work.
-
-### Verification Model
-
-**Verification runs on each node that is upgraded.** The node is only `uncordoned` after
-its verification pod succeeds. If verification fails, automatic rollback is triggered
-to restore the previous version before `uncordoning` the node.
-
-**Common failure modes detected by verification:**
- Pod stuck in Pending/`ContainerCreating` (runtime can't start VM)
- Pod crashes immediately (containerd/CRI-O configuration issues)
- Pod times out (resource issues, image pull failures)
- Pod exits with non-zero code (verification logic failed)
-
-All of these trigger automatic rollback. The workflow logs include pod status, events,
-and logs to help diagnose the issue.
-
-The user provides a complete Pod YAML that:
- Uses the Kata runtime class they want to verify
- Contains their verification logic (e.g., attestation checks)
- Exits 0 on success, non-zero on failure
- Includes tolerations for cordoned nodes (verification runs while node is cordoned)
- Includes a `nodeSelector` to ensure it runs on the specific node being upgraded
-
-When upgrading multiple nodes (via label selector), nodes are processed sequentially.
-For each node, the following placeholders are substituted with that node's specific values,
-ensuring the verification pod runs on the exact node that was just upgraded:
-
- `${NODE}` - The hostname of the node being upgraded/verified
- `${TEST_POD}` - A generated unique pod name
-
-Example verification pod:
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: ${TEST_POD}
-spec:
-  runtimeClassName: kata-qemu
-  restartPolicy: Never
-  nodeSelector:
-    kubernetes.io/hostname: ${NODE}
-  tolerations:
-    - operator: Exists    # Required: node is cordoned during verification
-  containers:
-    - name: verify
-      image: quay.io/kata-containers/alpine-bash-curl:latest
-      command: ["uname", "-a"]
-```
-
-This design keeps verification logic entirely in the user's domain, supporting:
- Different runtime classes (`kata-qemu`, `kata-qemu-snp`, `kata-qemu-tdx`, etc.)
- TEE-specific attestation verification
- GPU/accelerator validation
- Custom application smoke tests
-
-### Sequential Execution with Fail-Fast
-
-Nodes are upgraded strictly sequentially using recursive Argo templates. This design
-ensures that if any node fails verification, the workflow stops immediately before
-touching remaining nodes, preventing a mixed-version fleet.
-
-Alternative approaches considered:
- **`withParam` + semaphore**: Provides cleaner UI but semaphore only controls concurrency,
-  not failure propagation. Other nodes would still proceed after one fails.
- **`withParam` + `failFast`**: Would be ideal, but Argo only supports `failFast` for DAG
-  tasks, not for steps with `withParam`.
-
-The recursive template approach (`upgrade-node-chain`) naturally provides fail-fast
-behavior because if any step in the chain fails, the recursion stops.
-
-### Status Tracking
-
-Node upgrade status is tracked via Kubernetes annotations:
-
-| Annotation | Values |
-|------------|--------|
-| `katacontainers.io/kata-lifecycle-manager-status` | preparing, cordoned, draining, upgrading, verifying, completed, rolling-back, rolled-back |
-| `katacontainers.io/kata-current-version` | Version string (e.g., "3.25.0") |
-
-This enables:
- Monitoring upgrade progress via `kubectl get nodes`
- Integration with external monitoring systems
- Recovery from interrupted upgrades
-
-### Rollback Support
-
-**Automatic rollback on verification failure:** If the verification pod fails (non-zero exit),
-kata-lifecycle-manager automatically:
-1. Runs `helm rollback` to revert to the previous Helm release
-2. Waits for kata-deploy DaemonSet to be ready with the previous version
-3. `Uncordons` the node
-4. Annotates the node with `rolled-back` status
-
-This ensures nodes are never left in a broken state.
-
-**Manual rollback:** For cases where you need to rollback a successfully upgraded node:
-
-```bash
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  --entrypoint rollback-node \
-  -p node-name=worker-1
-```
-
-## Components
-
-### Container Images
-
-Two multi-architecture container images are built and published:
-
-| Image | Purpose | Architectures |
-|-------|---------|---------------|
-| `quay.io/kata-containers/kubectl:latest` | Kubernetes operations | amd64, arm64, s390x, ppc64le |
-| `quay.io/kata-containers/helm:latest` | Helm operations | amd64, arm64, s390x, ppc64le |
-
-Images are rebuilt weekly to pick up security updates and tool version upgrades.
-
-### Helm Chart Structure
-
-```text
-kata-lifecycle-manager/
-├── Chart.yaml                  # Chart metadata
-├── values.yaml                 # Configurable defaults
-├── README.md                   # Usage documentation
-└── templates/
-    ├── _helpers.tpl            # Template helpers
-    ├── rbac.yaml               # ServiceAccount, ClusterRole, ClusterRoleBinding
-    └── workflow-template.yaml  # Argo `WorkflowTemplate`
-```
-
-### RBAC Requirements
-
-The workflow requires the following permissions:
-
-| Resource | Verbs | Purpose |
-|----------|-------|---------|
-| nodes | get, list, watch, patch | `cordon`/`uncordon`, annotations |
-| pods | get, list, watch, create, delete | Verification pods |
-| pods/log | get | Verification output |
-| `daemonsets` | get, list, watch | Wait for `kata-deploy` |
-
-## User Experience
-
-### Installation
-
-```bash
-# Install kata-lifecycle-manager with verification config
-helm install kata-lifecycle-manager oci://ghcr.io/kata-containers/kata-deploy-charts/kata-lifecycle-manager \
-  --set-file defaults.verificationPod=/path/to/verification-pod.yaml
-```
-
-### Triggering an Upgrade
-
-```bash
-# Label nodes for upgrade
-kubectl label node worker-1 katacontainers.io/kata-lifecycle-manager-window=true
-
-# Submit upgrade workflow
-argo submit -n argo --from workflowtemplate/kata-lifecycle-manager \
-  -p target-version=3.25.0
-
-# Watch progress
-argo watch @latest
-```
-
-### Monitoring
-
-```bash
-kubectl get nodes \
-  -L katacontainers.io/kata-runtime \
-  -L katacontainers.io/kata-lifecycle-manager-status \
-  -L katacontainers.io/kata-current-version
-```
-
-## Security Considerations
-
-1. **Namespace-Scoped Templates**: The chart creates a `WorkflowTemplate` (namespace-scoped)
-   rather than `ClusterWorkflowTemplate` by default, reducing blast radius.
-
-2. **Required Verification**: The chart fails to install if `defaults.verificationPod` is
-   not provided, ensuring upgrades are always verified.
-
-3. **Minimal RBAC**: The `ServiceAccount` has only the permissions required for upgrade
-   operations.
-
-4. **User-Controlled Verification**: Verification logic is entirely user-defined, avoiding
-   any hardcoded assumptions about what "working" means.
-
-## Integration with Release Process
-
-The `kata-lifecycle-manager` chart is:
- Packaged alongside `kata-deploy` during releases
- Published to the same OCI registries (`quay.io`, `ghcr.io`)
- Versioned to match `kata-deploy`
-
-## Potential Enhancements
-
-The following enhancements could be considered if needed:
-
-### kata-lifecycle-manager
-
-1. **Pool-Specific Verification**: Different verification pods for different node pools
-   (e.g., GPU nodes vs. CPU-only nodes).
-
-2. **Ordered Pool Upgrades**: Upgrade node pool A completely before starting pool B.
-
-## Alternatives Considered
-
-### 1. DaemonSet-Based Upgrades
-
-Using a DaemonSet to coordinate upgrades on each node.
-
-**Rejected because**: DaemonSets don't provide the node-by-node sequencing and
-verification workflow needed for controlled upgrades.
-
-### 2. Operator Pattern
-
-Building a Kubernetes Operator to manage upgrades.
-
-**Rejected because**: Adds significant complexity and maintenance burden. Argo Workflows
-is already widely adopted and provides the orchestration primitives needed.
-
-### 3. Shell Script Orchestration
-
-Providing a shell script that loops through nodes.
-
-**Rejected because**: Less reliable, harder to monitor, no built-in retry/recovery,
-and doesn't integrate with Kubernetes-native tooling.
-
-## References
-
- [kata-deploy Helm Chart](https://github.com/kata-containers/kata-containers/tree/main/tools/packaging/kata-deploy/helm-chart/kata-deploy)
- [Argo Workflows](https://argoproj.github.io/argo-workflows/)
- [Helm Documentation](https://helm.sh/docs/)
--- a/docs/how-to/README.md
+++ b/docs/how-to/README.md
@@ -31,7 +31,6 @@
 - [Setting Sysctls with Kata](how-to-use-sysctls-with-kata.md)
 - [What Is VMCache and How To Enable It](what-is-vm-cache-and-how-do-I-use-it.md)
 - [What Is VM Templating and How To Enable It](what-is-vm-templating-and-how-do-I-use-it.md)
- [How to Use Template in runtime-rs](how-to-use-template-in-runtime-rs.md)
 - [Privileged Kata Containers](privileged.md)
 - [How to load kernel modules in Kata Containers](how-to-load-kernel-modules-with-kata.md)
 - [How to use Kata Containers with `virtio-mem`](how-to-use-virtio-mem-with-kata.md)
@@ -49,4 +48,3 @@
 - [How to use the Kata Agent Policy](how-to-use-the-kata-agent-policy.md)
 - [How to pull images in the guest](how-to-pull-images-in-guest-with-kata.md)
 - [How to use mem-agent to decrease the memory usage of Kata container](how-to-use-memory-agent.md)
- [How to use seccomp with runtime-rs](how-to-use-seccomp-with-runtime-rs.md)
--- a/docs/how-to/how-to-pull-images-in-guest-with-kata.md
+++ b/docs/how-to/how-to-pull-images-in-guest-with-kata.md
@@ -256,7 +256,7 @@ spec:
            values:
            - NODE_NAME
  volumes:
-    - name: trusted-image-storage
+    - name: trusted-storage
      persistentVolumeClaim:
        claimName: trusted-pvc
  containers:
--- a/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md
+++ b/docs/how-to/how-to-run-kata-containers-with-SE-VMs.md
@@ -89,16 +89,16 @@ However, if any of these components are absent, they must be built from the
 $ # Assume that the project is cloned at $GOPATH/src/github.com/kata-containers
 $ cd $GOPATH/src/github.com/kata-containers/kata-containers
 $ make rootfs-initrd-confidential-tarball
-$ tar --zstd -tf build/kata-static-kernel-confidential.tar.zst | grep vmlinuz
+$ tar -tf build/kata-static-kernel-confidential.tar.xz | grep vmlinuz
 ./opt/kata/share/kata-containers/vmlinuz-confidential.container
 ./opt/kata/share/kata-containers/vmlinuz-6.7-136-confidential
 $ kernel_version=6.7-136
-$ tar --zstd -tf build/kata-static-rootfs-initrd-confidential.tar.zst | grep initrd
+$ tar -tf build/kata-static-rootfs-initrd-confidential.tar.xz | grep initrd
 ./opt/kata/share/kata-containers/kata-containers-initrd-confidential.img
 ./opt/kata/share/kata-containers/kata-ubuntu-20.04-confidential.initrd
 $ mkdir artifacts
-$ tar --zstd -xvf build/kata-static-kernel-confidential.tar.zst -C artifacts ./opt/kata/share/kata-containers/vmlinuz-${kernel_version}-confidential
-$ tar --zstd -xvf build/kata-static-rootfs-initrd-confidential.tar.zst -C artifacts ./opt/kata/share/kata-containers/kata-ubuntu-20.04-confidential.initrd
+$ tar -xvf build/kata-static-kernel-confidential.tar.xz -C artifacts ./opt/kata/share/kata-containers/vmlinuz-${kernel_version}-confidential
+$ tar -xvf build/kata-static-rootfs-initrd-confidential.tar.xz -C artifacts ./opt/kata/share/kata-containers/kata-ubuntu-20.04-confidential.initrd
 $ ls artifacts/opt/kata/share/kata-containers/
 kata-ubuntu-20.04-confidential.initrd  vmlinuz-${kernel_version}-confidential
 ```
@@ -190,8 +190,8 @@ can be easily accomplished by issuing the following make target:
 $ cd $GOPATH/src/github.com/kata-containers/kata-containers
 $ mkdir hkd_dir && cp $host_key_document hkd_dir
 $ HKD_PATH=hkd_dir SE_KERNEL_PARAMS="agent.log=debug" make boot-image-se-tarball
-$ ls build/kata-static-boot-image-se.tar.zst
-build/kata-static-boot-image-se.tar.zst
+$ ls build/kata-static-boot-image-se.tar.xz
+build/kata-static-boot-image-se.tar.xz
 ```

 `SE_KERNEL_PARAMS` could be used to add any extra kernel parameters. If no additional kernel configuration is required, this can be omitted.
@@ -318,7 +318,7 @@ Finally, an operational kata container with IBM Secure Execution is now running.

 It is reasonable to expect that the manual steps mentioned above can be easily executed.
 Typically, you can use
-[kata-deploy](https://github.com/kata-containers/kata-containers/blob/main/tools/packaging/kata-deploy/helm-chart/README.md)
+[kata-deploy](https://github.com/kata-containers/kata-containers/blob/main/tools/packaging/kata-deploy/README.md)
 to install Kata Containers on a Kubernetes cluster. However, when leveraging IBM Secure Execution,
 you need to employ the confidential container's
 [operator](https://github.com/confidential-containers/operator).
@@ -344,18 +344,18 @@ $ make virtiofsd-tarball
 $ make shim-v2-tarball
 $ mkdir kata-artifacts
 $ build_dir=$(readlink -f build)
-$ cp -r $build_dir/*.tar.zst kata-artifacts
+$ cp -r $build_dir/*.tar.xz kata-artifacts
 $ ls -1 kata-artifacts
-kata-static-agent.tar.zst
-kata-static-boot-image-se.tar.zst
-kata-static-coco-guest-components.tar.zst
-kata-static-kernel-confidential-modules.tar.zst
-kata-static-kernel-confidential.tar.zst
-kata-static-pause-image.tar.zst
-kata-static-qemu.tar.zst
-kata-static-rootfs-initrd-confidential.tar.zst
-kata-static-shim-v2.tar.zst
-kata-static-virtiofsd.tar.zst
+kata-static-agent.tar.xz
+kata-static-boot-image-se.tar.xz
+kata-static-coco-guest-components.tar.xz
+kata-static-kernel-confidential-modules.tar.xz
+kata-static-kernel-confidential.tar.xz
+kata-static-pause-image.tar.xz
+kata-static-qemu.tar.xz
+kata-static-rootfs-initrd-confidential.tar.xz
+kata-static-shim-v2.tar.xz
+kata-static-virtiofsd.tar.xz
 $ ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
 ```

@@ -369,7 +369,7 @@ command before running `kata-deploy-merge-builds.sh`:
 $ make rootfs-image-tarball
 ```

-At this point, you should have an archive file named `kata-static.tar.zst` at the project root,
+At this point, you should have an archive file named `kata-static.tar.xz` at the project root,
 which will be used to build a payload image. If you are using a local container registry at
 `localhost:5000`, proceed with the following:

@@ -381,7 +381,7 @@ Build and push a payload image with the name `localhost:5000/build-kata-deploy`
 `latest` using the following:

 ```
-$ ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh kata-static.tar.zst localhost:5000/build-kata-deploy latest
+$ ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh kata-static.tar.xz localhost:5000/build-kata-deploy latest
 ... logs ...
 Pushing the image localhost:5000/build-kata-deploy:latest to the registry
 The push refers to repository [localhost:5000/build-kata-deploy]
--- a/docs/how-to/how-to-set-sandbox-config-kata.md
+++ b/docs/how-to/how-to-set-sandbox-config-kata.md
@@ -50,7 +50,7 @@ There are several kinds of Kata configurations and they are listed below.
 | `io.katacontainers.config.hypervisor.default_max_vcpus` | uint32| the maximum number of vCPUs allocated for the VM by the hypervisor |
 | `io.katacontainers.config.hypervisor.default_memory` | uint32| the memory assigned for a VM by the hypervisor in `MiB` |
 | `io.katacontainers.config.hypervisor.default_vcpus` | float32| the default vCPUs assigned for a VM by the hypervisor |
-| `io.katacontainers.config.hypervisor.disable_block_device_use` | `boolean` | disable hotplugging host block devices to guest VMs for container rootfs |
+| `io.katacontainers.config.hypervisor.disable_block_device_use` | `boolean` | disallow a block device from being used |
 | `io.katacontainers.config.hypervisor.disable_image_nvdimm` | `boolean` | specify if a `nvdimm` device should be used as rootfs for the guest (QEMU) |
 | `io.katacontainers.config.hypervisor.disable_vhost_net` | `boolean` | specify if `vhost-net` is not available on the host |
 | `io.katacontainers.config.hypervisor.enable_hugepages` | `boolean` | if the memory should be `pre-allocated` from huge pages |
@@ -97,8 +97,6 @@ There are several kinds of Kata configurations and they are listed below.
 | `io.katacontainers.config.hypervisor.use_legacy_serial` | `boolean` | uses legacy serial device for guest's console (QEMU) |
 | `io.katacontainers.config.hypervisor.default_gpus` | uint32 | the minimum number of GPUs required for the VM. Only used by remote hypervisor to help with instance selection |
 | `io.katacontainers.config.hypervisor.default_gpu_model` | string | the GPU model required for the VM. Only used by remote hypervisor to help with instance selection |
-| `io.katacontainers.config.hypervisor.block_device_num_queues` | `usize` | The number of queues to use for block devices (runtime-rs only) |
-| `io.katacontainers.config.hypervisor.block_device_queue_size` | uint32 | The size of the of the queue to use for block devices (runtime-rs only) |

 ## Container Options
 | Key | Value Type | Comments |
--- a/docs/how-to/how-to-use-kata-containers-with-firecracker.md
+++ b/docs/how-to/how-to-use-kata-containers-with-firecracker.md
@@ -104,20 +104,12 @@ LOW_WATER_MARK=32768
 sudo dmsetup create "${POOL_NAME}" \
    --table "0 ${LENGTH_IN_SECTORS} thin-pool ${META_DEV} ${DATA_DEV} ${DATA_BLOCK_SIZE} ${LOW_WATER_MARK}"

-# Determine plugin name based on containerd config version
-CONFIG_VERSION=$(containerd config dump | awk '/^version/ {print $3}')
-if [ "$CONFIG_VERSION" -ge 2 ]; then
-    PLUGIN="io.containerd.snapshotter.v1.devmapper"
-else
-    PLUGIN="devmapper"
-fi
-
 cat << EOF
 #
 # Add this to your config.toml configuration file and restart containerd daemon
 #
 [plugins]
-  [plugins."${PLUGIN}"]
+  [plugins.devmapper]
    pool_name = "${POOL_NAME}"
    root_path = "${DATA_DIR}"
    base_image_size = "10GB"
--- a/docs/how-to/how-to-use-seccomp-with-runtime-rs.md
+++ b/docs/how-to/how-to-use-seccomp-with-runtime-rs.md
@@ -1,44 +0,0 @@
-## Introduction
-
-To enhance security, Kata Containers supports using seccomp to restrict the hypervisor's system calls. Previously, this was only supported for a subset of hypervisors in runtime-go. Now, the runtime-rs also supports seccomp. This document describes how to enable/disable the seccomp feature for the corresponding hypervisor in runtime-rs.
-
-## Pre-requisites
-
-1. Ensure your system's kernel supports **seccomp**.
-2. Confirm that each of the following virtual machines can run correctly on your system.
-
-## Configure seccomp
-
-With the exception of `qemu`, seccomp is enabled by default for all other supported hypervisors. Their corresponding built-in functionalities are also enabled by default.
-
-### QEMU
-
-As with runtime-go, you need to modify the following in your **configuration file**. These parameters will be passed directly to the `qemu` startup command line. For more details on the parameters, you can refer to: [https://www.qemu.org/docs/master/system/qemu-manpage.html](https://www.qemu.org/docs/master/system/qemu-manpage.html)
-
-``` toml
-# Qemu seccomp sandbox feature
-# comma-separated list of seccomp sandbox features to control the syscall access.
-# For example, `seccompsandbox= "on,obsolete=deny,spawn=deny,resourcecontrol=deny"`
-# Note: "elevateprivileges=deny" doesn't work with daemonize option, so it's removed from the seccomp sandbox
-# Another note: enabling this feature may reduce performance, you may enable
-# /proc/sys/net/core/bpf_jit_enable to reduce the impact. see https://man7.org/linux/man-pages/man8/bpfc.8.html
-seccompsandbox="on,obsolete=deny,spawn=deny,resourcecontrol=deny"
-```
-### Cloud Hypervisor, Firecracker and Dragonball
-
-The **seccomp** functionality is enabled by default for the following three hypervisors: `cloud hypervisor`, `firecracker`, and `dragonball`.
-
-The seccomp rules for `cloud hypervisor` and `firecracker` are built directly into their executable files. For `dragonball`, the relevant configuration is currently located at `src/runtime-rs/crates/hypervisor/src/dragonball/seccomp.rs`.
-
-To disable this functionality for these hypervisors, you can modify the following configuration options in your **configuration file**.
-
-``` toml
-# Disable the 'seccomp' feature from Cloud Hypervisor, firecracker or dragonball, default false
-disable_seccomp = true
-```
-
-## Implementation details
-
-For `qemu`, `cloud hypervisor`, and `firecracker`, their **seccomp** functionality is built into the respective executable files you are using. **runtime-rs** simply provides command-line arguments for their launch based on the configuration file.
-
-For `dragonball`, a set of allowed system calls is currently provided for the entire **runtime-rs** process, and the process is prevented from using any system calls outside of this whitelist. As mentioned above, this set is located at `src/runtime-rs/crates/hypervisor/src/dragonball/seccomp.rs`.
--- a/docs/how-to/how-to-use-template-in-runtime-rs.md
+++ b/docs/how-to/how-to-use-template-in-runtime-rs.md
@@ -1,119 +0,0 @@
-# How to Use Template in runtime-rs
-
-## What is VM Templating
-
-VM templating is a Kata Containers feature that enables new VM creation using a cloning technique. When enabled, new VMs are created by cloning from a pre-created template VM, and they will share the same initramfs, kernel and agent memory in readonly mode. It is very much like a process fork done by the kernel but here we *fork* VMs.
-
-For more details on VM templating, refer to the [What is VM templating and how do I use it](./what-is-vm-templating-and-how-do-I-use-it.md) article.
-
-## How to Enable VM Templating
-
-VM templating can be enabled by changing your Kata Containers config file (`/opt/kata/share/defaults/kata-containers/runtime-rs/configuration.toml`, overridden by `/etc/kata-containers/configuration.toml` if provided) such that:
-
- `qemu` version `v4.1.0` or above is specified in `hypervisor.qemu`->`path` section
- `enable_template = true`
- `template_path = "/run/vc/vm/template"` (default value, can be customized as needed)
- `initrd =` is set
- `image =` option is commented out or removed
- `shared_fs =` option is commented out or removed
- `default_memory =` should be set to more than 256MB
-
-Then you can create a VM template for later usage by calling:
-
-### Initialize and create the VM template
-The `factory init` command creates a VM template by launching a new VM, initializing the Kata Agent, then pausing and saving its state (memory and device snapshots) to the template directory. This saved template is used to rapidly clone new VMs using QEMU's memory sharing capabilities.
-
-```bash
-sudo kata-ctl factory init
-```
-
-### Check the status of the VM template
-
-The `factory status` command checks whether a VM template currently exists by verifying the presence of template files (memory snapshot and device state). It will output "VM factory is on" if the template exists, or "VM factory is off" otherwise.
-
-```bash
-sudo kata-ctl factory status
-```
-
-### Destroy and clean up the VM template
-
-The `factory destroy` command removes the VM template by remove the `tmpfs` filesystem and deleting the template directory along with all its contents.
-
-```bash
-sudo kata-ctl factory destroy
-```
-
-## How to Create a New VM from VM Template
-In the Go version of Kata Containers, the VM templating mechanism is implemented using virtio-9p (9pfs). However, 9pfs is not supported in runtime-rs due to its poor performance, limited cache coherence, and security risks. Instead, runtime-rs adopts `VirtioFS` as the default mechanism to provide rootfs for containers and VMs.
-
-Yet, when enabling the VM template mechanism, `VirtioFS` introduces conflicts in memory sharing because its DAX-based shared memory mapping overlaps with the template's page-sharing design. To resolve these conflicts and ensure strict isolation between cloned VMs, runtime-rs replaces `VirtioFS` with the snapshotter approach — specifically, the `blockfile` snapshotter.
-
-The `blockfile` snapshotter is used in runtime-rs because it provides each VM with an independent block-based root filesystem, ensuring strong isolation and full compatibility with the VM templating mechanism.
-
-### Configure Snapshotter
-
-#### Check if `Blockfile` Snapshotter is Available
-```bash
-ctr plugins ls | grep blockfile
-```
-
-If not available, continue with the following steps:
-
-#### Create Scratch File
-```bash
-dd if=/dev/zero of=/opt/containerd/blockfile bs=1M count=500
-sudo mkfs.ext4 /opt/containerd/blockfile
-```
-
-#### Configure containerd
-Edit the containerd configuration file:
-```bash
-sudo vim /etc/containerd/config.toml
-```
-Add or modify the following configuration for the `blockfile` snapshotter:
-```toml
-[plugins."io.containerd.snapshotter.v1.blockfile"]
-  scratch_file = "/opt/containerd/blockfile"
-  root_path = ""
-  fs_type = "ext4"
-  mount_options = []
-  recreate_scratch = true
-```
-
-#### Restart containerd
-After modifying the configuration, restart containerd to apply changes:
-
-```bash
-sudo systemctl restart containerd
-```
-
-### Run Container with `blockfile` Snapshotter
-After the VM template is created, you can pull an image and run a container using the `blockfile` snapshotter:
-
-```bash
-ctr run --rm -t --snapshotter blockfile docker.io/library/busybox:latest template sh
-```
-
-We can verify whether a VM was launched from a template or started normally by checking the launch parameters — if the parameters contain `incoming`, it indicates that the VM was started from a template rather than created directly.
-
-## Performance Test
-
-The comparative experiment between **template-based VM** creation and **direct VM** creation showed that the template-based approach achieved a ≈ **73.2%** reduction in startup latency (average launch time of **0.6s** vs. **0.82s**) and a ≈ **79.8%** reduction in memory usage (average memory usage of **178.2 MiB** vs. **223.2 MiB**), demonstrating significant improvements in VM startup efficiency and resource utilization.
-
-The test script is as follows:
-
-```bash
-# Clear the page cache, dentries, and inodes to free up memory
-echo 3 | sudo tee /proc/sys/vm/drop_caches
-
-# Display the current memory usage
-free -h
-
-# Create 100 normal VMs and template-based VMs, and track the time
-time for I in $(seq 100); do
-  echo -n " ${I}th"  # Display the iteration number
-  ctr run -d --runtime io.containerd.kata.v2 --snapshotter blockfile docker.io/library/busybox:latest normal/template${I}
-done
-
-# Display the memory usage again after running the test
-free -h
--- a/docs/how-to/how-to-use-the-kata-agent-policy.md
+++ b/docs/how-to/how-to-use-the-kata-agent-policy.md
@@ -32,24 +32,11 @@ Kubernetes users can encode in `base64` format their Policy documents, and add t

 ### Encode a Policy file

-For example, the [`allow-all-except-exec-process.rego`](../../src/kata-opa/allow-all-except-exec-process.rego) sample policy file is different from the [default Policy](../../src/kata-opa/allow-all.rego) because it rejects any `ExecProcess` requests. To encode this policy file, you need to:
- Embed the policy inside an init data struct
- Compress
- Base64 encode 
-For example:
+For example, the [`allow-all-except-exec-process.rego`](../../src/kata-opa/allow-all-except-exec-process.rego) sample policy file is different from the [default Policy](../../src/kata-opa/allow-all.rego) because it rejects any `ExecProcess` requests. You can encode this policy file:

 ```bash
-$ STRING="$(< allow-all-except-exec-process.rego)"
-$ cat <<EOF | gzip -c | base64 -w0
-version = "0.1.0"
-algorithm = "sha256"
-
-[data]
-"policy.rego" = '''
-$STRING
-'''
-EOF
-H4sIAAAAAAAAA42UTW/TQBCG7/4Vq/QQOCQKQXCo1ENIAkRqiGWnpBJCaGKP7RXrXTM7DnV/PRMiVUh07R582J3H8/XO7AnJa2fVjRrNpm+ms1EEpnSkuarPd76C+bv3oyj6lgPD92jUOKOzbkpYupEA4/E4ulJL13Sky4rVq+y1ms/mb9VWZ+S8K1iM1DgClijRlcBpvLqf3OoMrcfJJkfLutBI12rRQFbhZD6dCRfJ4SeUqOSz/OMSNopyLKA1rBZ5vkjiLyhBj458gr9a9KyubxRTi/9i6W9oQualcR5TzrUNElLZR20waCcExqWzDNoi9WMp2PzoHkLQSi7JdQPUJ+QtMuksWLQQu912fZK+BZHz7QolaRN0c6s9bywjFZBhL5W4lsPEFuvPjhvTlh+6mNwx2MudNdLDZXwnf4SYGFo/3O64NWZTy+SEgAQhT1lECQZKsHan4UgXLGUw+FWTzHjh0woIt661HGxJgh4xT0RoV6/w1IO19XAOKfJFTxmxva6DRQsX/12jIKBLC0Y0Er2DuUutxMM5nak9QaZt2cOwf4En1ww42nN3OK+w14/B4u+a/CWLesHWTYU1Eph+GS/w0470Y/1LcgDNA40/yKOMzw/tE7N+wOx/NwUYj9H5qf4DsX93tO4FAAA=
+$ base64 -w 0 allow-all-except-exec-process.rego
+cGFja2FnZSBhZ2VudF9wb2xpY3kKCmRlZmF1bHQgQWRkQVJQTmVpZ2hib3JzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgQWRkU3dhcFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENsb3NlU3RkaW5SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBDb3B5RmlsZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZVNhbmRib3hSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBEZXN0cm95U2FuZGJveFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEdldE1ldHJpY3NSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBHZXRPT01FdmVudFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEd1ZXN0RGV0YWlsc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IExpc3RJbnRlcmZhY2VzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTGlzdFJvdXRlc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IE1lbUhvdHBsdWdCeVByb2JlUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgT25saW5lQ1BVTWVtUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUGF1c2VDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBQdWxsSW1hZ2VSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZWFkU3RyZWFtUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVtb3ZlQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVtb3ZlU3RhbGVWaXJ0aW9mc1NoYXJlTW91bnRzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVzZWVkUmFuZG9tRGV2UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVzdW1lQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2V0R3Vlc3REYXRlVGltZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFNldFBvbGljeVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFNpZ25hbFByb2Nlc3NSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTdGFydENvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXJ0VHJhY2luZ1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXRzQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RvcFRyYWNpbmdSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBUdHlXaW5SZXNpemVSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVFcGhlbWVyYWxNb3VudHNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVJbnRlcmZhY2VSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVSb3V0ZXNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBXYWl0UHJvY2Vzc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFdyaXRlU3RyZWFtUmVxdWVzdCA6PSB0cnVlCgpkZWZhdWx0IEV4ZWNQcm9jZXNzUmVxdWVzdCA6PSBmYWxzZQo=
 ```

 ### Attach the Policy to a pod
@@ -62,7 +49,7 @@ kind: Pod
 metadata:
  name: policy-exec-rejected
  annotations:
-    io.katacontainers.config.hypervisor.cc_init_data: H4sIAAAAAAAAA42UTW/TQBCG7/4Vq/QQOCQKQXCo1ENIAkRqiGWnpBJCaGKP7RXrXTM7DnV/PRMiVUh07R582J3H8/XO7AnJa2fVjRrNpm+ms1EEpnSkuarPd76C+bv3oyj6lgPD92jUOKOzbkpYupEA4/E4ulJL13Sky4rVq+y1ms/mb9VWZ+S8K1iM1DgClijRlcBpvLqf3OoMrcfJJkfLutBI12rRQFbhZD6dCRfJ4SeUqOSz/OMSNopyLKA1rBZ5vkjiLyhBj458gr9a9KyubxRTi/9i6W9oQualcR5TzrUNElLZR20waCcExqWzDNoi9WMp2PzoHkLQSi7JdQPUJ+QtMuksWLQQu912fZK+BZHz7QolaRN0c6s9bywjFZBhL5W4lsPEFuvPjhvTlh+6mNwx2MudNdLDZXwnf4SYGFo/3O64NWZTy+SEgAQhT1lECQZKsHan4UgXLGUw+FWTzHjh0woIt661HGxJgh4xT0RoV6/w1IO19XAOKfJFTxmxva6DRQsX/12jIKBLC0Y0Er2DuUutxMM5nak9QaZt2cOwf4En1ww42nN3OK+w14/B4u+a/CWLesHWTYU1Eph+GS/w0470Y/1LcgDNA40/yKOMzw/tE7N+wOx/NwUYj9H5qf4DsX93tO4FAAA=
+    io.katacontainers.config.agent.policy: cGFja2FnZSBhZ2VudF9wb2xpY3kKCmRlZmF1bHQgQWRkQVJQTmVpZ2hib3JzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgQWRkU3dhcFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENsb3NlU3RkaW5SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBDb3B5RmlsZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZVNhbmRib3hSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBEZXN0cm95U2FuZGJveFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEdldE1ldHJpY3NSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBHZXRPT01FdmVudFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEd1ZXN0RGV0YWlsc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IExpc3RJbnRlcmZhY2VzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTGlzdFJvdXRlc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IE1lbUhvdHBsdWdCeVByb2JlUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgT25saW5lQ1BVTWVtUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUGF1c2VDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBQdWxsSW1hZ2VSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZWFkU3RyZWFtUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVtb3ZlQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVtb3ZlU3RhbGVWaXJ0aW9mc1NoYXJlTW91bnRzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVzZWVkUmFuZG9tRGV2UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgUmVzdW1lQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2V0R3Vlc3REYXRlVGltZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFNldFBvbGljeVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFNpZ25hbFByb2Nlc3NSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTdGFydENvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXJ0VHJhY2luZ1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXRzQ29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RvcFRyYWNpbmdSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBUdHlXaW5SZXNpemVSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVFcGhlbWVyYWxNb3VudHNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVJbnRlcmZhY2VSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBVcGRhdGVSb3V0ZXNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBXYWl0UHJvY2Vzc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFdyaXRlU3RyZWFtUmVxdWVzdCA6PSB0cnVlCgpkZWZhdWx0IEV4ZWNQcm9jZXNzUmVxdWVzdCA6PSBmYWxzZQo=
 spec:
  runtimeClassName: kata
  containers:
@@ -79,7 +66,7 @@ Create the pod:
 $ kubectl apply -f pod1.yaml
 ```

-While creating the Pod sandbox, the Kata Shim will notice the `io.katacontainers.config.hypervisor.cc_init_data` annotation and will create the init data device on the host and mount it on the guest as a block device. The agent then reads the init data struct from this device and sets the policy if present.
+While creating the Pod sandbox, the Kata Shim will notice the `io.katacontainers.config.agent.policy` annotation and will send the Policy document to the Kata Agent - by sending a `SetPolicy` request. Note that this request will fail if the default Policy, included in the Guest image, doesn't allow this `SetPolicy` request. If the `SetPolicy` request is rejected by the Guest, the Kata Shim will fail to start the Pod sandbox.

 # How is the Policy being enforced?

--- a/docs/how-to/how-to-use-virtio-fs-with-kata.md
+++ b/docs/how-to/how-to-use-virtio-fs-with-kata.md
@@ -6,4 +6,4 @@ Container deployments utilize explicit or implicit file sharing between host fil

 As of the 2.0 release of Kata Containers, [virtio-fs](https://virtio-fs.gitlab.io/) is the default filesystem sharing mechanism.

-virtio-fs support works out of the box for `cloud-hypervisor` and `qemu`, when Kata Containers is deployed using `kata-deploy`. Learn more about `kata-deploy` and how to use `kata-deploy` in Kubernetes [here](../../tools/packaging/kata-deploy/helm-chart/README.md).
+virtio-fs support works out of the box for `cloud-hypervisor` and `qemu`, when Kata Containers is deployed using `kata-deploy`. Learn more about `kata-deploy` and how to use `kata-deploy` in Kubernetes [here](../../tools/packaging/kata-deploy/README.md#kubernetes-quick-start).
--- a/docs/how-to/privileged.md
+++ b/docs/how-to/privileged.md
@@ -1,25 +1,22 @@
 # Privileged Kata Containers

-> [!WARNING]
-> Whilst this functionality is supported, it can decrease the security of Kata Containers if not configured correctly.
-
 Kata Containers supports creation of containers that are "privileged" (i.e. have additional capabilities and access
 that is not normally granted).

-## Enabling privileged containers without host devices
+## Warnings

-> [!TIP]
-> When Kata Containers is installed through
-> [kata-deploy](/tools/packaging/kata-deploy/helm-chart/README.md#kata-deploy-helm-chart), this mitigation is configured
-> out of the box, hence there is no action required in that case.
+**Warning:** Whilst this functionality is supported, it can decrease the security of Kata Containers if not configured 
+correctly.

-By default, a privileged container attempts to expose all devices from the host. This is generally not supported in Kata
-Containers as the container is running a different kernel than the host.
+### Host Devices

-Instead, the following sections document how to disable this behavior in different container runtimes. Note that this
-mitigation does not affect a container's ability to mount *guest* devices.
+By default, when privileged is enabled for a container, all the `/dev/*` block devices from the host are mounted
+into the guest. This will allow the privileged container inside the Kata guest to gain access to mount any block device 
+from the host, a potentially undesirable side-effect that decreases the security of Kata.

-## Containerd
+The following sections document how to configure this behavior in different container runtimes.
+
+#### Containerd

 The Containerd allows configuring the privileged host devices behavior for each runtime in the containerd config. This is
 done with the `privileged_without_host_devices` option. Setting this to `true` will disable hot plugging of the host 
@@ -46,7 +43,7 @@ See below example config:
 - [How to use Kata Containers and containerd with Kubernetes](how-to-use-k8s-with-containerd-and-kata.md)
 - [Containerd CRI config documentation](https://github.com/containerd/containerd/blob/main/docs/cri/config.md)

-## CRI-O
+#### CRI-O

 Similar to containerd, CRI-O allows configuring the privileged host devices
 behavior for each runtime in the CRI config. This is done with the 
--- a/docs/install/README.md
+++ b/docs/install/README.md
@@ -8,11 +8,50 @@ Kata Containers requires nested virtualization or bare metal. Check
 [hardware requirements](./../../README.md#hardware-requirements) to see if your system is capable of running Kata 
 Containers.

-The Kata Deploy Helm chart is the preferred  way to install all of the binaries and
+## Packaged installation methods
+
+The packaged installation method uses your distribution's native package format (such as RPM or DEB).
+
+> **Note:**
+>
+> We encourage you to select an installation method that provides
+> automatic updates, to ensure you get the latest security updates and
+> bug fixes.
+
+| Installation method                                  | Description                                                                                  | Automatic updates | Use case                                                                                      |
+|------------------------------------------------------|----------------------------------------------------------------------------------------------|-------------------|-----------------------------------------------------------------------------------------------|
+| [Using official distro packages](#official-packages) | Kata packages provided by Linux distributions official repositories                          | yes               | Recommended for most users.                                                                   |
+| [Automatic](#automatic-installation)                 | Run a single command to install a full system                                                | **No!**           | For those wanting the latest release quickly.                                                 |
+| [Using kata-deploy Helm chart](#kata-deploy-helm-chart)       | The preferred way to deploy the Kata Containers distributed binaries on a Kubernetes cluster | **No!**           | Best way to give it a try on kata-containers on an already up and running Kubernetes cluster. |
+
+### Kata Deploy Helm Chart
+
+The Kata Deploy Helm chart is a convenient way to install all of the binaries and
 artifacts required to run Kata Containers on Kubernetes.

 [Use Kata Deploy Helm Chart](/tools/packaging/kata-deploy/helm-chart/README.md) to install Kata Containers on a Kubernetes Cluster.

+### Official packages
+
+Kata packages are provided by official distribution repositories for:
+
+| Distribution (link to installation guide)                | Minimum versions                                                               |
+|----------------------------------------------------------|--------------------------------------------------------------------------------|
+| [CentOS](centos-installation-guide.md)                   | 8                                                                              |
+| [Fedora](fedora-installation-guide.md)                   | 34                                                                             |
+
+### Automatic Installation
+
+[Use `kata-manager`](/utils/README.md) to automatically install a working Kata Containers system.
+
+## Installing on a Cloud Service Platform
+
+* [Amazon Web Services (AWS)](aws-installation-guide.md)
+* [Google Compute Engine (GCE)](gce-installation-guide.md)
+* [Microsoft Azure](azure-installation-guide.md)
+* [Minikube](minikube-installation-guide.md)
+* [VEXXHOST OpenStack Cloud](vexxhost-installation-guide.md)
+
 ## Further information

 * [upgrading document](../Upgrading.md)
--- a/docs/install/aws-installation-guide.md
+++ b/docs/install/aws-installation-guide.md
@@ -0,0 +1,135 @@
+# Install Kata Containers on Amazon Web Services
+
+Kata Containers on Amazon Web Services (AWS) makes use of [i3.metal](https://aws.amazon.com/ec2/instance-types/i3/) instances. Most of the installation procedure is identical to that for Kata on your preferred distribution, except that you have to run it on bare metal instances since AWS doesn't support nested virtualization yet. This guide walks you through creating an i3.metal instance.
+
+## Install and Configure AWS CLI
+
+### Requirements
+
+* Python:
+  * Python 2 version 2.6.5+
+  * Python 3 version 3.3+
+
+### Install
+
+Install with this command:
+
+```bash
+$ pip install awscli --upgrade --user
+```
+
+### Configure
+
+First, verify it:
+
+```bash
+$ aws --version
+```
+
+Then configure it:
+
+```bash
+$ aws configure
+```
+
+Specify the required parameters:
+
+```
+AWS Access Key ID []: <your-key-id-from-iam>
+AWS Secret Access Key []: <your-secret-access-key-from-iam>
+Default region name []: <your-aws-region-for-your-i3-metal-instance>
+Default output format [None]: <yaml-or-json-or-empty>
+```
+
+Alternatively, you can create the files: `~/.aws/credentials` and `~/.aws/config`:
+
+```bash
+$ cat <<EOF > ~/.aws/credentials
+[default]
+aws_access_key_id = <your-key-id-from-iam>
+aws_secret_access_key = <your-secret-access-key-from-iam>
+EOF
+$ cat <<EOF > ~/.aws/config
+[default]
+region = <your-aws-region-for-your-i3-metal-instance>
+EOF
+```
+
+For more information on how to get AWS credentials please refer to [this guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). Alternatively, you can ask the administrator of your AWS account to issue one with the AWS CLI:
+
+```sh
+$ aws_username="myusername"
+$ aws iam create-access-key --user-name="$aws_username"
+```
+
+More general AWS CLI guidelines can be found [here](https://docs.aws.amazon.com/cli/latest/userguide/installing.html).
+
+## Create or Import an EC2 SSH key pair
+
+You will need this to access your instance.
+
+To create:
+
+```bash
+$ aws ec2 create-key-pair --key-name MyKeyPair | grep KeyMaterial | cut -d: -f2- | tr -d ' \n\"\,' > MyKeyPair.pem
+$ chmod 400 MyKeyPair.pem
+```
+
+Alternatively to import using your public SSH key:
+
+```bash
+$ aws ec2 import-key-pair --key-name "MyKeyPair" --public-key-material file://MyKeyPair.pub
+```
+
+## Launch i3.metal instance
+
+Get the latest Bionic Ubuntu AMI (Amazon Image) or the latest AMI for the Linux distribution you would like to use. For example:
+
+```bash
+$ aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server*" --query 'sort_by(Images, &CreationDate)[].ImageId '
+```
+
+This command will produce output similar to the following:
+
+```
+[
+    ...
+    "ami-063aa838bd7631e0b",
+    "ami-03d5270fcb641f79b"
+]
+```
+
+Launch the EC2 instance and pick IP the `INSTANCEID`:
+
+```bash
+$ aws ec2 run-instances --image-id ami-03d5270fcb641f79b --count 1 --instance-type i3.metal --key-name MyKeyPair --associate-public-ip-address > /tmp/aws.json
+$ export INSTANCEID=$(grep InstanceId /tmp/aws.json | cut -d: -f2- | tr -d ' \n\"\,')
+```
+
+Wait for the instance to come up, the output of the following command should be `running`:
+
+```bash
+$ aws ec2 describe-instances --instance-id=${INSTANCEID} | grep running | cut -d: -f2- | tr -d ' \"\,'
+```
+
+Get the public IP address for the instances:
+
+```bash
+$ export IP=$(aws ec2 describe-instances --instance-id=${INSTANCEID} | grep PublicIpAddress | cut -d: -f2- | tr -d ' \n\"\,')
+```
+
+Refer to [this guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-ec2-launch.html) for more details on how to launch instances with the AWS CLI.
+
+SSH into the machine
+
+```bash
+$ ssh -i MyKeyPair.pem ubuntu@${IP}
+```
+
+Go onto the next step.
+
+## Install Kata
+
+The process for installing Kata itself on bare metal is identical to that of a virtualization-enabled VM.
+
+For detailed information to install Kata on your distribution of choice, see the [Kata Containers installation user guides](../install/README.md).
--- a/docs/install/azure-installation-guide.md
+++ b/docs/install/azure-installation-guide.md
@@ -0,0 +1,18 @@
+# Install Kata Containers on Microsoft Azure
+
+Kata Containers on Azure use nested virtualization to provide an identical installation
+experience to Kata on your preferred Linux distribution.
+
+This guide assumes you have an Azure account set up and tools to remotely login to your virtual
+machine (SSH). Instructions will use the Azure Portal to avoid
+local dependencies and setup.
+
+## Create a new virtual machine with nesting support
+
+Create a new virtual machine with:
+* Nesting support (v3 series)
+* your distro of choice
+
+## Set up with distribution specific quick start
+
+Follow distribution specific [install guides](../install/README.md#packaged-installation-methods).
--- a/docs/install/centos-installation-guide.md
+++ b/docs/install/centos-installation-guide.md
@@ -0,0 +1,21 @@
+# Install Kata Containers on CentOS
+
+1. Install the Kata Containers components with the following commands:
+
+   ```bash
+   $ sudo -E dnf install -y centos-release-advanced-virtualization
+   $ sudo -E dnf module disable -y virt:rhel
+   $ source /etc/os-release
+   $ cat <<EOF | sudo -E tee /etc/yum.repos.d/kata-containers.repo
+     [kata-containers]
+     name=Kata Containers
+     baseurl=http://mirror.centos.org/\$contentdir/\$releasever/virt/\$basearch/kata-containers
+     enabled=1
+     gpgcheck=1
+     skip_if_unavailable=1
+     EOF
+   $ sudo -E dnf install -y kata-containers
+   ```
+
+2. Decide which container manager to use and select the corresponding link that follows:
+   - [Kubernetes](../Developer-Guide.md#run-kata-containers-with-kubernetes)
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .26.0
 .18.0