From 271a797600d67e32e4b3d8ed5ef14dd6889f1a6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Sat, 18 Jul 2026 12:31:29 +0200
Subject: [PATCH] tests: run k8s-termination-log on the NVIDIA CPU runtime-rs
 handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The termination-log tests exercise termination-message propagation over
the agent GetDiagnosticData RPC, which only matters when the host cannot
read guest files directly, i.e. on shared_fs=none configurations. They
previously gated on is_confidential_runtime_class and therefore skipped
on the NVIDIA CPU runtime-rs handler, which now also runs with
shared_fs=none.

Add an is_shared_fs_none_runtime_class helper (confidential runtime
classes plus qemu-nvidia-cpu-runtime-rs) and use it for the setup and
teardown gating so the tests run on the NVIDIA CPU runtime-rs handler as
well. The plain Go qemu-nvidia-cpu class still uses virtio-fs and is
intentionally excluded. Keep the "blocked by default CoCo policy"
assertion confidential-only, since non-confidential shared_fs=none
classes do not ship a default policy that denies the RPC.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor with Claude Opus 4.8
---
 tests/hypervisor_helpers.sh                   | 15 +++++++++++++
 .../kubernetes/k8s-termination-log.bats       | 22 ++++++++++++++-----
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/tests/hypervisor_helpers.sh b/tests/hypervisor_helpers.sh
index db60c976dc..209ecbcf15 100644
--- a/tests/hypervisor_helpers.sh
+++ b/tests/hypervisor_helpers.sh
@@ -122,6 +122,21 @@ function is_confidential_runtime_class() {
 	fi
 }
 
+# Runtime classes that boot with shared_fs=none, where the host cannot read
+# guest files directly. Data such as a container's termination log must then be
+# retrieved over the agent GetDiagnosticData RPC instead of a shared filesystem.
+# This covers the confidential runtime classes and the non-confidential NVIDIA
+# CPU runtime-rs handler. The plain qemu-nvidia-cpu (Go) class still uses
+# virtio-fs, so it is intentionally excluded.
+function is_shared_fs_none_runtime_class() {
+	local hypervisor="${1:-${KATA_HYPERVISOR}}"
+	if is_confidential_runtime_class "${hypervisor}"; then
+		return 0
+	fi
+	[[ "${hypervisor}" == "qemu-nvidia-cpu-runtime-rs" ]] && return 0
+	return 1
+}
+
 # Runtime classes that boot a measured (dm-verity) rootfs: the confidential
 # classes plus the CPU-only NVIDIA classes, which boot the verity-backed
 # nvidia base image without being confidential.
diff --git a/tests/integration/kubernetes/k8s-termination-log.bats b/tests/integration/kubernetes/k8s-termination-log.bats
index 2c398f518b..3c0ae2ab5c 100644
--- a/tests/integration/kubernetes/k8s-termination-log.bats
+++ b/tests/integration/kubernetes/k8s-termination-log.bats
@@ -5,8 +5,9 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Test termination log propagation via GetDiagnosticData RPC.
-# These tests target shared_fs=none configurations (e.g. qemu-coco-dev)
-# where the host cannot directly read guest files.
+# These tests target shared_fs=none configurations (e.g. qemu-coco-dev or the
+# NVIDIA CPU runtime-rs handler) where the host cannot directly read guest
+# files.
 
 load "${BATS_TEST_DIRNAME}/lib.sh"
 load "${BATS_TEST_DIRNAME}/../../common.bash"
@@ -14,9 +15,11 @@ load "${BATS_TEST_DIRNAME}/tests_common.sh"
 load "${BATS_TEST_DIRNAME}/confidential_common.sh"
 
 setup() {
-	# These tests only make sense on CoCo platforms (shared_fs=none).
-	if ! is_confidential_runtime_class; then
-		skip "Test requires a CoCo runtime class (shared_fs=none)"
+	# These tests only make sense on shared_fs=none configurations, where the
+	# host cannot read guest files directly and the termination log has to be
+	# fetched over the agent GetDiagnosticData RPC.
+	if ! is_shared_fs_none_runtime_class; then
+		skip "Test requires a shared_fs=none runtime class"
 	fi
 
 	setup_common || die "setup_common failed"
@@ -95,6 +98,13 @@ wait_for_pod_terminated() {
 }
 
 @test "Termination log: request blocked by default CoCo policy" {
+	# The default-deny behaviour is specific to the confidential runtime
+	# classes; non-confidential shared_fs=none classes (e.g. NVIDIA CPU
+	# runtime-rs) do not ship a default policy that blocks the RPC.
+	if ! is_confidential_runtime_class; then
+		skip "Default-deny policy check only applies to CoCo runtime classes"
+	fi
+
 	if ! auto_generate_policy_enabled; then
 		echo "# Skipping default CoCo policy check: requires AUTO_GENERATE_POLICY=yes" >&3
 		return 0
@@ -128,7 +138,7 @@ wait_for_pod_terminated() {
 }
 
 teardown() {
-	if ! is_confidential_runtime_class; then
+	if ! is_shared_fs_none_runtime_class; then
 		return
 	fi