From 41361ce93e00eea5be763cccd736bf513915a52c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Sun, 10 May 2026 19:04:30 +0200 Subject: [PATCH] config: switch CoCo templates from monolithic image to base + addon MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update all six CoCo configuration templates (coco-dev, snp, tdx for both Go and Rust runtimes) to use the standard base image instead of the monolithic confidential image, and add an [[extra_images]] section for the CoCo addon: image = "@IMAGEPATH@" (was @IMAGECONFIDENTIALPATH@) [[hypervisor.qemu.extra_images]] name = "coco" path = "@COCOIMAGEPATH@" verity_params = "@COCOVERITYPARAMS@" Add COCOIMAGENAME (kata-containers-coco-addon.img), COCOIMAGEPATH, and COCOVERITYPARAMS to both runtime Makefiles so the placeholders are substituted at install time. Signed-off-by: Fabiano Fidêncio Assisted-by: Cursor --- src/runtime-rs/Makefile | 6 ++++++ ...figuration-qemu-coco-dev-runtime-rs.toml.in | 7 ++++++- .../configuration-qemu-snp-runtime-rs.toml.in | 7 ++++++- .../configuration-qemu-tdx-runtime-rs.toml.in | 7 ++++++- src/runtime/Makefile | 6 ++++++ .../config/configuration-qemu-coco-dev.toml.in | 7 ++++++- .../config/configuration-qemu-snp.toml.in | 7 ++++++- .../config/configuration-qemu-tdx.toml.in | 7 ++++++- .../packaging/kata-deploy/shim-components.json | 18 +++++++++--------- tools/packaging/static-build/shim-v2/build.sh | 10 ++++++++-- 10 files changed, 65 insertions(+), 17 deletions(-) diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile index 9febef291c..9d40132f14 100644 --- a/src/runtime-rs/Makefile +++ b/src/runtime-rs/Makefile @@ -105,6 +105,9 @@ PKGRUNDIR := $(LOCALSTATEDIR)/run/$(PROJECT_DIR) KERNELDIR := $(PKGDATADIR) IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME) IMAGECONFIDENTIALPATH := $(PKGDATADIR)/$(IMAGECONFIDENTIALNAME) +COCOIMAGENAME := $(PROJECT_TAG)-coco-addon.img +COCOIMAGEPATH := $(PKGDATADIR)/$(COCOIMAGENAME) +COCOVERITYPARAMS := INITRDPATH := $(PKGDATADIR)/$(INITRDNAME) INITRDCONFIDENTIALPATH := $(PKGDATADIR)/$(INITRDCONFIDENTIALNAME) @@ -626,6 +629,9 @@ USER_VARS += IMAGEPATH USER_VARS += IMAGEPATH_CLH_AZURE USER_VARS += IMAGEPATH_NV USER_VARS += IMAGECONFIDENTIALPATH +USER_VARS += COCOIMAGENAME +USER_VARS += COCOIMAGEPATH +USER_VARS += COCOVERITYPARAMS USER_VARS += INITRDNAME USER_VARS += INITRDCONFIDENTIALNAME USER_VARS += INITRDPATH diff --git a/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in b/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in index f4e7517a79..caa1c073cc 100644 --- a/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in +++ b/src/runtime-rs/config/configuration-qemu-coco-dev-runtime-rs.toml.in @@ -15,7 +15,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELPATH_COCO@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" # rootfs filesystem type: @@ -805,3 +805,8 @@ experimental = @DEFAULTEXPFEATURES@ # If enabled, user can run pprof tools with shim v2 process through kata-monitor. # (default: false) enable_pprof = false + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in b/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in index b489ff280a..bec4146e8c 100644 --- a/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in +++ b/src/runtime-rs/config/configuration-qemu-snp-runtime-rs.toml.in @@ -16,7 +16,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELPATH_COCO@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" # Enable confidential guest support. @@ -739,3 +739,8 @@ enable_pprof = false # to the hypervisor. # (default: /run/kata-containers/dans) dan_conf = "@DEFDANCONF@" + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in b/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in index a9231ae453..48d49e78a0 100644 --- a/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in +++ b/src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in @@ -15,7 +15,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELPATH_COCO@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" # initrd = "@INITRDPATH@" machine_type = "@MACHINETYPE@" # Set to 0 to use Unix Domain Socket (/var/run/tdx-qgs/qgs.socket) instead of vsock. @@ -717,3 +717,8 @@ enable_pprof = false # to the hypervisor. # (default: /run/kata-containers/dans) dan_conf = "@DEFDANCONF@" + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/src/runtime/Makefile b/src/runtime/Makefile index b197a0ff7a..93a034f1c5 100644 --- a/src/runtime/Makefile +++ b/src/runtime/Makefile @@ -129,6 +129,9 @@ KERNELDIR := $(PKGDATADIR) IMAGEPATH := $(PKGDATADIR)/$(IMAGENAME) IMAGECONFIDENTIALPATH := $(PKGDATADIR)/$(IMAGECONFIDENTIALNAME) +COCOIMAGENAME := $(PROJECT_TAG)-coco-addon.img +COCOIMAGEPATH := $(PKGDATADIR)/$(COCOIMAGENAME) +COCOVERITYPARAMS := INITRDPATH := $(PKGDATADIR)/$(INITRDNAME) INITRDCONFIDENTIALPATH := $(PKGDATADIR)/$(INITRDCONFIDENTIALNAME) @@ -681,6 +684,9 @@ USER_VARS += IMAGECONFIDENTIALNAME USER_VARS += IMAGEPATH USER_VARS += IMAGEPATH_CLH_AZURE USER_VARS += IMAGECONFIDENTIALPATH +USER_VARS += COCOIMAGENAME +USER_VARS += COCOIMAGEPATH +USER_VARS += COCOVERITYPARAMS USER_VARS += INITRDNAME USER_VARS += INITRDCONFIDENTIALNAME USER_VARS += INITRDPATH diff --git a/src/runtime/config/configuration-qemu-coco-dev.toml.in b/src/runtime/config/configuration-qemu-coco-dev.toml.in index 95f6919c25..8012a215a7 100644 --- a/src/runtime/config/configuration-qemu-coco-dev.toml.in +++ b/src/runtime/config/configuration-qemu-coco-dev.toml.in @@ -15,7 +15,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELCONFIDENTIALPATH@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" # rootfs filesystem type: @@ -773,3 +773,8 @@ kubelet_root_dir = "@DEFKUBELETROOTDIR@" # cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet # based cold plug. pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@" + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/src/runtime/config/configuration-qemu-snp.toml.in b/src/runtime/config/configuration-qemu-snp.toml.in index 0b3f674522..a2f3b5625f 100644 --- a/src/runtime/config/configuration-qemu-snp.toml.in +++ b/src/runtime/config/configuration-qemu-snp.toml.in @@ -15,7 +15,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELCONFIDENTIALPATH@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" # rootfs filesystem type: @@ -781,3 +781,8 @@ kubelet_root_dir = "@DEFKUBELETROOTDIR@" # cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet # based cold plug. pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@" + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/src/runtime/config/configuration-qemu-tdx.toml.in b/src/runtime/config/configuration-qemu-tdx.toml.in index 479cd218be..29e3ce8824 100644 --- a/src/runtime/config/configuration-qemu-tdx.toml.in +++ b/src/runtime/config/configuration-qemu-tdx.toml.in @@ -14,7 +14,7 @@ [hypervisor.qemu] path = "@QEMUPATH@" kernel = "@KERNELCONFIDENTIALPATH@" -image = "@IMAGECONFIDENTIALPATH@" +image = "@IMAGEPATH@" machine_type = "@MACHINETYPE@" tdx_quote_generation_service_socket_port = @QEMUTDXQUOTEGENERATIONSERVICESOCKETPORT@ @@ -758,3 +758,8 @@ kubelet_root_dir = "@DEFKUBELETROOTDIR@" # cold_plug_vfio != no_port AND pod_resource_api_sock != "" => kubelet # based cold plug. pod_resource_api_sock = "@DEFPODRESOURCEAPISOCK@" + +[[hypervisor.qemu.extra_images]] +name = "coco" +path = "@COCOIMAGEPATH@" +verity_params = "@COCOVERITYPARAMS@" diff --git a/tools/packaging/kata-deploy/shim-components.json b/tools/packaging/kata-deploy/shim-components.json index 322047a429..e2cb253f88 100644 --- a/tools/packaging/kata-deploy/shim-components.json +++ b/tools/packaging/kata-deploy/shim-components.json @@ -16,16 +16,16 @@ "s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-image", "rootfs-initrd"] }, "qemu-snp": { - "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"] + "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-addon", "ovmf-sev"] }, "qemu-snp-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"] + "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-addon", "ovmf-sev"] }, "qemu-tdx": { - "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image-confidential", "ovmf-tdx"] + "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image", "rootfs-image-coco-addon", "ovmf-tdx"] }, "qemu-tdx-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image-confidential", "ovmf-tdx"] + "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image", "rootfs-image-coco-addon", "ovmf-tdx"] }, "qemu-se": { "s390x": ["shim-v2-go", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"] @@ -52,13 +52,13 @@ "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"] }, "qemu-coco-dev": { - "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"], - "s390x": ["shim-v2-go", "qemu", "kernel", "rootfs-image-confidential"] + "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-addon"], + "s390x": ["shim-v2-go", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-addon"] }, "qemu-coco-dev-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"], - "aarch64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential", "ovmf"], - "s390x": ["shim-v2-rust", "qemu", "kernel", "rootfs-image-confidential"] + "x86_64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-addon"], + "aarch64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-addon", "ovmf"], + "s390x": ["shim-v2-rust", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-addon"] }, "clh": { "x86_64": ["shim-v2-go", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"], diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh index 5650a0002f..a9c5e6fd2f 100755 --- a/tools/packaging/static-build/shim-v2/build.sh +++ b/tools/packaging/static-build/shim-v2/build.sh @@ -42,14 +42,20 @@ esac [[ "${CROSS_BUILD}" == "true" ]] && container_image_bk="${container_image}" && container_image="${container_image}-cross-build" # Variants (targets) that build a measured rootfs as of now are: -# - rootfs-image-confidential +# - rootfs-image (the base image, measured; root hash labelled "base") +# - rootfs-image-coco-addon # - rootfs-image-nvidia-gpu # - rootfs-image-nvidia-gpu-confidential # +# The base image is shared between non-confidential and confidential guests. +# Only confidential configurations enforce its dm-verity hash via +# @KERNELVERITYPARAMS@; non-confidential guests boot the data partition directly. +# # shellcheck disable=SC2154 root_hash_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build" verity_variants=( - "confidential:KERNELVERITYPARAMS" + "base:KERNELVERITYPARAMS" + "coco-addon:COCOVERITYPARAMS" "nvidia-gpu:KERNELVERITYPARAMS_NV" "nvidia-gpu-confidential:KERNELVERITYPARAMS_CONFIDENTIAL_NV" )