mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-25 14:18:54 +00:00
packaging: wire Go runtime to base+extension tarballs
With the Go runtime confidential/GPU configs now booting the composable
base image plus cold-plugged guest extensions, teach the packaging layer
to ship and measure the matching tarballs:
- shim-components.json: point the qemu-snp, qemu-tdx, qemu-coco-dev,
qemu-nvidia-gpu and qemu-nvidia-gpu-{snp,tdx} shim-v2-go entries at the
base image (rootfs-image / rootfs-image-nvidia) and the relevant
extension tarballs (rootfs-image-coco-extension,
rootfs-image-nvidia-gpu-extension) instead of the monolithic images.
- shim-v2/build.sh: rewire GO_EXTRA_OPTS to resolve dm-verity root hashes
from the base and extension images (via SPLIT_EXTRA_OPTS), mirroring the
logic already used for runtime-rs, so the generated configs get the
correct base/extension root hashes.
- kata-deploy-binaries.sh: update comments to note that the root hashes are
now consumed by both runtimes and that the monolithic images are no
longer built in CI nor referenced by the shipped configs (kept only as
manually buildable standalone targets).
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
This commit is contained in:
Fabiano Fidêncio
@@ -75,8 +75,9 @@ destdir="${workdir}/kata-static"
|
||||
default_binary_permissions='0744'
|
||||
|
||||
# Rootfs image variants that carry a dm-verity root hash (measured rootfs).
|
||||
# Their hashes are collected at build time and consumed by the Rust runtime,
|
||||
# so this list is walked in a few places - keep it in one spot to avoid drift.
|
||||
# Their hashes are collected at build time and consumed by both runtimes
|
||||
# (Go and Rust), so this list is walked in a few places - keep it in one spot to
|
||||
# avoid drift.
|
||||
readonly MEASURED_ROOTFS_VARIANTS=(
|
||||
base
|
||||
confidential
|
||||
@@ -536,8 +537,10 @@ install_image() {
|
||||
# Both the standard confidential image and the NVIDIA confidential
|
||||
# image bake the CoCo guest components + pause image into the
|
||||
# rootfs, so each stays a usable standalone monolithic CoCo image.
|
||||
# The runtime-rs split path instead ships these in the separate
|
||||
# CoCo extension image (rootfs-image-coco-extension).
|
||||
# These monolithic images are no longer built in CI nor consumed by
|
||||
# the shipped configs (both runtimes now use the composable split
|
||||
# path: base image + CoCo extension, rootfs-image-coco-extension);
|
||||
# they are retained only as manually buildable targets.
|
||||
if [[ "${variant}" == *confidential ]]; then
|
||||
COCO_GUEST_COMPONENTS_TARBALL="$(get_coco_guest_components_tarball_path)"
|
||||
export COCO_GUEST_COMPONENTS_TARBALL
|
||||
@@ -594,12 +597,11 @@ install_image_base() {
|
||||
|
||||
#Install guest image for confidential guests
|
||||
#
|
||||
# During the transition to composable (base + extension) images this monolithic
|
||||
# confidential image still bakes in the CoCo guest components and is the image
|
||||
# used by the Go runtime. The runtime-rs shims instead use the base image plus
|
||||
# the separately built CoCo extension image (rootfs-image-coco-extension),
|
||||
# attached as an extra block device. Once the split path is validated for the
|
||||
# Go runtime too, the components can stop being baked in here.
|
||||
# This monolithic confidential image bakes the CoCo guest components into the
|
||||
# rootfs. It is no longer built in CI nor referenced by the shipped configs:
|
||||
# both the Go runtime and runtime-rs now boot the measured base image plus the
|
||||
# separately built CoCo extension image (rootfs-image-coco-extension), attached
|
||||
# as an extra block device. It is kept as a manually buildable standalone image.
|
||||
install_image_confidential() {
|
||||
export CONFIDENTIAL_GUEST="yes"
|
||||
if [[ "${ARCH}" == "s390x" ]]; then
|
||||
|
||||
@@ -16,13 +16,13 @@
|
||||
"s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-image", "rootfs-initrd"]
|
||||
},
|
||||
"qemu-snp": {
|
||||
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"]
|
||||
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
|
||||
},
|
||||
"qemu-snp-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
|
||||
},
|
||||
"qemu-tdx": {
|
||||
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image-confidential", "ovmf-tdx"]
|
||||
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
|
||||
},
|
||||
"qemu-tdx-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
|
||||
@@ -34,7 +34,7 @@
|
||||
"s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
|
||||
},
|
||||
"qemu-nvidia-gpu": {
|
||||
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
|
||||
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
|
||||
},
|
||||
"qemu-nvidia-gpu-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "ovmf"]
|
||||
@@ -48,20 +48,20 @@
|
||||
"aarch64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia"]
|
||||
},
|
||||
"qemu-nvidia-gpu-snp": {
|
||||
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
|
||||
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
|
||||
},
|
||||
"qemu-nvidia-gpu-snp-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
|
||||
},
|
||||
"qemu-nvidia-gpu-tdx": {
|
||||
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
|
||||
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
|
||||
},
|
||||
"qemu-nvidia-gpu-tdx-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
|
||||
},
|
||||
"qemu-coco-dev": {
|
||||
"x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
|
||||
"s390x": ["shim-v2-go", "qemu", "kernel", "rootfs-image-confidential"]
|
||||
"x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
|
||||
"s390x": ["shim-v2-go", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-extension"]
|
||||
},
|
||||
"qemu-coco-dev-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
|
||||
|
||||
@@ -39,22 +39,17 @@ esac
|
||||
|
||||
# Variants (targets) that build a measured rootfs as of now are:
|
||||
# - rootfs-image (the base image, measured; root hash labelled "base")
|
||||
# - rootfs-image-confidential (monolithic CoCo image, root hash "confidential")
|
||||
# - rootfs-image-coco-extension
|
||||
# - rootfs-image-nvidia-gpu / rootfs-image-nvidia-gpu-confidential (monolithic)
|
||||
# - rootfs-image-coco-extension (the CoCo guest-components extension)
|
||||
# - rootfs-image-nvidia (the driver-agnostic NVIDIA boot image)
|
||||
# - rootfs-image-nvidia-gpu-extension (the driver-versioned gpu extension)
|
||||
#
|
||||
# Both the CoCo and the NVIDIA GPU configs come in two flavours during the
|
||||
# transition to split images, and the two runtimes are built in separate `make`
|
||||
# invocations so each maps the same make var to a different root hash:
|
||||
# - runtime-rs (Rust) uses the split layout: the measured base image
|
||||
# (@KERNELVERITYPARAMS@) plus the CoCo extension (@COCOVERITYPARAMS@), and for
|
||||
# NVIDIA the nvidia base image (@KERNELVERITYPARAMS_NV@) plus the gpu extension
|
||||
# Both runtimes now boot the composable split layout (base image plus
|
||||
# cold-plugged extensions), so the Go and Rust `make` invocations map the same
|
||||
# make vars to the same root hashes:
|
||||
# - the measured base image (@KERNELVERITYPARAMS@) plus the CoCo extension
|
||||
# (@COCOVERITYPARAMS@), and for NVIDIA the nvidia base image
|
||||
# (@KERNELVERITYPARAMS_NV@) plus the gpu extension
|
||||
# (@NVIDIAGPUEXTENSIONVERITYPARAMS@).
|
||||
# - runtime (Go) still uses the monolithic images: the confidential image
|
||||
# (@KERNELVERITYPARAMS@) and, for NVIDIA, nvidia-gpu (@KERNELVERITYPARAMS_NV@)
|
||||
# and nvidia-gpu-confidential (@KERNELVERITYPARAMS_CONFIDENTIAL_NV@).
|
||||
#
|
||||
# shellcheck disable=SC2154
|
||||
root_hash_dir="${repo_root_dir}/tools/packaging/kata-deploy/local-build/build"
|
||||
@@ -76,27 +71,22 @@ read_verity_param() {
|
||||
printf ' %s=%s' "${param_var}" "${root_measure_config}"
|
||||
}
|
||||
|
||||
# The NVIDIA GPU verity params differ per runtime: runtime-rs boots the
|
||||
# composable split layout (nvidia base + gpu extension) while the Go runtime
|
||||
# still boots the monolithic nvidia-gpu / nvidia-gpu-confidential images. Since
|
||||
# both runtimes reuse KERNELVERITYPARAMS_NV but map it to different root hashes,
|
||||
# the reads live in each runtime's own EXTRA_OPTS rather than the shared one.
|
||||
# Both runtimes boot the composable split layout, so they share the same
|
||||
# root-hash-to-make-var mapping: the measured base image plus the CoCo extension,
|
||||
# and for NVIDIA the nvidia base image plus the gpu extension. qemu-nvidia-cpu
|
||||
# (Go) also boots the driver-agnostic nvidia base image verity-backed and reads
|
||||
# it through its own KERNELVERITYPARAMS_NV_BASE var.
|
||||
SPLIT_EXTRA_OPTS="$(read_verity_param "base" "KERNELVERITYPARAMS")"
|
||||
SPLIT_EXTRA_OPTS+="$(read_verity_param "coco-extension" "COCOVERITYPARAMS")"
|
||||
SPLIT_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV")"
|
||||
SPLIT_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSIONVERITYPARAMS")"
|
||||
|
||||
# runtime-rs (Rust): split images -> base hash + CoCo extension hash, plus the
|
||||
# nvidia base and gpu extension hashes for the NVIDIA GPU configs.
|
||||
RUST_EXTRA_OPTS="$(read_verity_param "base" "KERNELVERITYPARAMS")"
|
||||
RUST_EXTRA_OPTS+="$(read_verity_param "coco-extension" "COCOVERITYPARAMS")"
|
||||
RUST_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV")"
|
||||
RUST_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-extension" "NVIDIAGPUEXTENSIONVERITYPARAMS")"
|
||||
# runtime-rs (Rust): composable split layout.
|
||||
RUST_EXTRA_OPTS="${SPLIT_EXTRA_OPTS}"
|
||||
|
||||
# runtime (Go): monolithic confidential image -> confidential hash, plus the
|
||||
# monolithic nvidia-gpu / nvidia-gpu-confidential hashes for the NVIDIA configs.
|
||||
GO_EXTRA_OPTS="$(read_verity_param "confidential" "KERNELVERITYPARAMS")"
|
||||
GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu" "KERNELVERITYPARAMS_NV")"
|
||||
GO_EXTRA_OPTS+="$(read_verity_param "nvidia-gpu-confidential" "KERNELVERITYPARAMS_CONFIDENTIAL_NV")"
|
||||
# qemu-nvidia-cpu (Go) boots the driver-agnostic nvidia base image verity-backed;
|
||||
# it needs the "nvidia" base hash in its own var since KERNELVERITYPARAMS_NV
|
||||
# above is the monolithic nvidia-gpu hash.
|
||||
# runtime (Go): also the composable split layout, plus the nvidia base hash in
|
||||
# KERNELVERITYPARAMS_NV_BASE consumed by the qemu-nvidia-cpu config.
|
||||
GO_EXTRA_OPTS="${SPLIT_EXTRA_OPTS}"
|
||||
GO_EXTRA_OPTS+="$(read_verity_param "nvidia" "KERNELVERITYPARAMS_NV_BASE")"
|
||||
|
||||
# shellcheck disable=SC2154,SC2086
|
||||
|
||||
Reference in New Issue
Block a user