For GCP and Azure and other clouds, all we upload is a blob to storage. The installer creates "bootable images" from that.
But for historical reasons, the RHCOS pipeline creates AMIs directly - the installer just uses them for the bootstrap node, creating a separate encrypted AMI for the actual cluster.
I think we should do the encryption bit before launching the bootstrap, and then RHCOS can stop publishing AMIs, and things will work more consistently across clouds.
For GCP and Azure and other clouds, all we upload is a blob to storage. The installer creates "bootable images" from that.
But for historical reasons, the RHCOS pipeline creates AMIs directly - the installer just uses them for the bootstrap node, creating a separate encrypted AMI for the actual cluster.
I think we should do the encryption bit before launching the bootstrap, and then RHCOS can stop publishing AMIs, and things will work more consistently across clouds.