github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-16 06:18:58 +00:00
Code Issues Projects Releases Wiki Activity

gha: enable AUTO_GENERATE_POLICY where needed

Browse Source 
The behavior of Kata CI doesn't change.

For local testing using kubernetes/gha-run.sh:

1. Before these changes:
- AUTO_GENERATE_POLICY=yes was always used by the users of SEV, SNP,
  TDX, or KATA_HOST_OS=cbl-mariner.

2. After these changes:
- Users of SEV, SNP, TDX, or KATA_HOST_OS=cbl-mariner must specify
  AUTO_GENERATE_POLICY=yes if they want to auto-generate policy.
- These users have the option to test just using hard-coded policies
  (e.g., using the default policy built into the Guest rootfs) by
  using AUTO_GENERATE_POLICY=no. AUTO_GENERATE_POLICY=no is the default
  value of this env variable.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
This commit is contained in:
Dan Mihai
2024-09-13 18:54:38 +00:00
parent 9a8341f431
commit 1a4928e710
3 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/integration/kubernetes/gha-run.sh
View File

@@ -277,14 +277,6 @@ function run_tests() {
[ "$platform" = "kcli" ] && \
export KUBECONFIG="$HOME/.kcli/clusters/${CLUSTER_NAME:-kata-k8s}/auth/kubeconfig"
# TODO: enable testing auto-generated policy for other types of hosts too.
if [ "${KATA_HOST_OS}" = "cbl-mariner" ] || \
[ "${KATA_HYPERVISOR}" = "qemu-tdx" ] || \
[ "${KATA_HYPERVISOR}" = "qemu-sev" ] || \
[ "${KATA_HYPERVISOR}" = "qemu-snp" ]; then
export AUTO_GENERATE_POLICY="yes"
fi
if [ "${AUTO_GENERATE_POLICY}" = "yes" ] && [ "${GENPOLICY_PULL_METHOD}" = "containerd" ]; then
# containerd's config on the local machine (where kubectl and genpolicy are executed by CI),
# might have been provided by a distro-specific package that disables the cri plug-in by using: