diff --git a/.github/workflows/cc-payload-after-push-amd64.yaml b/.github/workflows/cc-payload-after-push-amd64.yaml new file mode 100644 index 0000000000..d753dd4117 --- /dev/null +++ b/.github/workflows/cc-payload-after-push-amd64.yaml @@ -0,0 +1,102 @@ +name: CI | Publish CC runtime payload for amd64 +on: + workflow_call: + inputs: + target-arch: + required: true + type: string + +jobs: + build-asset: + runs-on: ubuntu-latest + strategy: + matrix: + asset: + - cc-cloud-hypervisor + - cc-kernel + - cc-qemu + - cc-rootfs-image + - cc-shim-v2 + - cc-virtiofsd + - cc-sev-kernel + - cc-sev-ovmf + - cc-sev-rootfs-initrd + - cc-tdx-kernel + - cc-tdx-rootfs-image + - cc-tdx-qemu + - cc-tdx-td-shim + - cc-tdx-tdvf + steps: + - name: Login to Kata Containers quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.QUAY_DEPLOYER_USERNAME }} + password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} + + - uses: actions/checkout@v3 + with: + fetch-depth: 0 # This is needed in order to keep the commit ids history + - name: Build ${{ matrix.asset }} + run: | + make "${KATA_ASSET}-tarball" + build_dir=$(readlink -f build) + # store-artifact does not work with symlink + sudo cp -r "${build_dir}" "kata-build" + env: + KATA_ASSET: ${{ matrix.asset }} + TAR_OUTPUT: ${{ matrix.asset }}.tar.gz + PUSH_TO_REGISTRY: yes + + - name: store-artifact ${{ matrix.asset }} + uses: actions/upload-artifact@v3 + with: + name: kata-artifacts + path: kata-build/kata-static-${{ matrix.asset }}.tar.xz + retention-days: 1 + if-no-files-found: error + + create-kata-tarball: + runs-on: ubuntu-latest + needs: build-asset + steps: + - uses: actions/checkout@v3 + - name: get-artifacts + uses: actions/download-artifact@v3 + with: + name: kata-artifacts + path: kata-artifacts + - name: merge-artifacts + run: | + ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts + - name: store-artifacts + uses: actions/upload-artifact@v3 + with: + name: kata-static-tarball + path: kata-static.tar.xz + retention-days: 1 + if-no-files-found: error + + kata-payload: + needs: create-kata-tarball + runs-on: ubuntu-latest + steps: + - name: Login to Confidential Containers quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.COCO_QUAY_DEPLOYER_USERNAME }} + password: ${{ secrets.COCO_QUAY_DEPLOYER_PASSWORD }} + + - uses: actions/checkout@v3 + - name: get-kata-tarball + uses: actions/download-artifact@v3 + with: + name: kata-static-tarball + + - name: build-and-push-kata-payload + id: build-and-push-kata-payload + run: | + ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \ + $(pwd)/kata-static.tar.xz "quay.io/confidential-containers/runtime-payload-ci" \ + "kata-containers-${{ inputs.target-arch }}" diff --git a/.github/workflows/cc-payload-after-push-s390x.yaml b/.github/workflows/cc-payload-after-push-s390x.yaml new file mode 100644 index 0000000000..9b94c8bce4 --- /dev/null +++ b/.github/workflows/cc-payload-after-push-s390x.yaml @@ -0,0 +1,101 @@ +name: CI | Publish CC runtime payload for s390x +on: + workflow_call: + inputs: + target-arch: + required: true + type: string + +jobs: + build-asset: + runs-on: s390x + strategy: + matrix: + asset: + - cc-kernel + - cc-qemu + - cc-rootfs-image + - cc-shim-v2 + steps: + - name: Login to Kata Containers quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.QUAY_DEPLOYER_USERNAME }} + password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} + + - name: Adjust a permission for repo + run: | + sudo chown -R $USER:$USER $GITHUB_WORKSPACE + + - uses: actions/checkout@v3 + with: + fetch-depth: 0 # This is needed in order to keep the commit ids history + - name: Build ${{ matrix.asset }} + run: | + make "${KATA_ASSET}-tarball" + build_dir=$(readlink -f build) + # store-artifact does not work with symlink + sudo cp -r "${build_dir}" "kata-build" + sudo chown -R $(id -u):$(id -g) "kata-build" + env: + KATA_ASSET: ${{ matrix.asset }} + TAR_OUTPUT: ${{ matrix.asset }}.tar.gz + PUSH_TO_REGISTRY: yes + + - name: store-artifact ${{ matrix.asset }} + uses: actions/upload-artifact@v3 + with: + name: kata-artifacts + path: kata-build/kata-static-${{ matrix.asset }}.tar.xz + retention-days: 1 + if-no-files-found: error + + create-kata-tarball: + runs-on: s390x + needs: build-asset + steps: + - name: Adjust a permission for repo + run: | + sudo chown -R $USER:$USER $GITHUB_WORKSPACE + + - uses: actions/checkout@v3 + - name: get-artifacts + uses: actions/download-artifact@v3 + with: + name: kata-artifacts + path: kata-artifacts + - name: merge-artifacts + run: | + ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts + - name: store-artifacts + uses: actions/upload-artifact@v3 + with: + name: kata-static-tarball + path: kata-static.tar.xz + retention-days: 1 + if-no-files-found: error + + kata-payload: + needs: create-kata-tarball + runs-on: s390x + steps: + - name: Login to Confidential Containers quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.COCO_QUAY_DEPLOYER_USERNAME }} + password: ${{ secrets.COCO_QUAY_DEPLOYER_PASSWORD }} + + - uses: actions/checkout@v3 + - name: get-kata-tarball + uses: actions/download-artifact@v3 + with: + name: kata-static-tarball + + - name: build-and-push-kata-payload + id: build-and-push-kata-payload + run: | + ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \ + $(pwd)/kata-static.tar.xz "quay.io/confidential-containers/runtime-payload-ci" \ + "kata-containers-${{ inputs.target-arch }}" diff --git a/.github/workflows/cc-payload-after-push.yaml b/.github/workflows/cc-payload-after-push.yaml index 7d524de881..fb047272b0 100644 --- a/.github/workflows/cc-payload-after-push.yaml +++ b/.github/workflows/cc-payload-after-push.yaml @@ -5,80 +5,25 @@ on: - CCv0 jobs: - build-asset: + build-assets-amd64: + uses: ./.github/workflows/cc-payload-after-push-amd64.yaml + with: + target-arch: amd64 + secrets: inherit + + build-assets-s390x: + uses: ./.github/workflows/cc-payload-after-push-s390x.yaml + with: + target-arch: s390x + secrets: inherit + + publish: runs-on: ubuntu-latest - strategy: - matrix: - asset: - - cc-cloud-hypervisor - - cc-kernel - - cc-qemu - - cc-rootfs-image - - cc-shim-v2 - - cc-virtiofsd - - cc-sev-kernel - - cc-sev-ovmf - - cc-sev-rootfs-initrd - - cc-tdx-kernel - - cc-tdx-rootfs-image - - cc-tdx-qemu - - cc-tdx-td-shim - - cc-tdx-tdvf + needs: [build-assets-amd64, build-assets-s390x] steps: - - name: Login to Kata Containers quay.io - uses: docker/login-action@v2 - with: - registry: quay.io - username: ${{ secrets.QUAY_DEPLOYER_USERNAME }} - password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} + - name: Checkout repository + uses: actions/checkout@v3 - - uses: actions/checkout@v3 - with: - fetch-depth: 0 # This is needed in order to keep the commit ids history - - name: Build ${{ matrix.asset }} - run: | - make "${KATA_ASSET}-tarball" - build_dir=$(readlink -f build) - # store-artifact does not work with symlink - sudo cp -r "${build_dir}" "kata-build" - env: - KATA_ASSET: ${{ matrix.asset }} - TAR_OUTPUT: ${{ matrix.asset }}.tar.gz - PUSH_TO_REGISTRY: yes - - - name: store-artifact ${{ matrix.asset }} - uses: actions/upload-artifact@v3 - with: - name: kata-artifacts - path: kata-build/kata-static-${{ matrix.asset }}.tar.xz - retention-days: 1 - if-no-files-found: error - - create-kata-tarball: - runs-on: ubuntu-latest - needs: build-asset - steps: - - uses: actions/checkout@v3 - - name: get-artifacts - uses: actions/download-artifact@v3 - with: - name: kata-artifacts - path: kata-artifacts - - name: merge-artifacts - run: | - ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts - - name: store-artifacts - uses: actions/upload-artifact@v3 - with: - name: kata-static-tarball - path: kata-static.tar.xz - retention-days: 1 - if-no-files-found: error - - kata-payload: - needs: create-kata-tarball - runs-on: ubuntu-latest - steps: - name: Login to Confidential Containers quay.io uses: docker/login-action@v2 with: @@ -86,13 +31,9 @@ jobs: username: ${{ secrets.COCO_QUAY_DEPLOYER_USERNAME }} password: ${{ secrets.COCO_QUAY_DEPLOYER_PASSWORD }} - - uses: actions/checkout@v3 - - name: get-kata-tarball - uses: actions/download-artifact@v3 - with: - name: kata-static-tarball - - - name: build-and-push-kata-payload - id: build-and-push-kata-payload + - name: Push multi-arch manifest run: | - ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh $(pwd)/kata-static.tar.xz "quay.io/confidential-containers/runtime-payload-ci" "kata-containers-latest" + docker manifest create quay.io/confidential-containers/runtime-payload-ci:kata-containers-latest \ + --amend quay.io/confidential-containers/runtime-payload-ci:kata-containers-amd64 \ + --amend quay.io/confidential-containers/runtime-payload-ci:kata-containers-s390x + docker manifest push quay.io/confidential-containers/runtime-payload-ci:kata-containers-latest diff --git a/tools/packaging/kata-deploy-cc/Dockerfile b/tools/packaging/kata-deploy-cc/Dockerfile index a8d32ef14d..5b78ea41c2 100644 --- a/tools/packaging/kata-deploy-cc/Dockerfile +++ b/tools/packaging/kata-deploy-cc/Dockerfile @@ -3,8 +3,9 @@ # SPDX-License-Identifier: Apache-2.0 # Specify alternative base image, e.g. clefos for s390x -ARG IMAGE -FROM ${IMAGE:-registry.centos.org/centos}:7 +ARG IMG_NAME=registry.centos.org/centos +ARG IMG_TAG=7 +FROM $IMG_NAME:$IMG_TAG ARG KATA_ARTIFACTS=./kata-static.tar.xz ARG DESTINATION=/opt/kata-artifacts diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh index 4e0d2393c4..221a847531 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh @@ -15,10 +15,17 @@ cp ${KATA_DEPLOY_ARTIFACT} ${KATA_DEPLOY_DIR} pushd ${KATA_DEPLOY_DIR} -IMAGE_TAG="${REGISTRY}:kata-containers-$(git rev-parse HEAD)" +IMAGE_TAG="${REGISTRY}:kata-containers-$(git rev-parse HEAD)-$(uname -m)" echo "Building the image" -docker build --tag ${IMAGE_TAG} . +if [ "$(uname -m)" = "s390x" ]; then + docker build \ + --build-arg IMG_NAME=clefos \ + --build-arg IMG_TAG=7 \ + --tag ${IMAGE_TAG} . +else + docker build --tag ${IMAGE_TAG} . +fi echo "Pushing the image to quay.io" docker push ${IMAGE_TAG} @@ -27,7 +34,14 @@ if [ -n "${TAG}" ]; then ADDITIONAL_TAG="${REGISTRY}:${TAG}" echo "Building the ${ADDITIONAL_TAG} image" - docker build --tag ${ADDITIONAL_TAG} . + if [ "$(uname -m)" = "s390x" ]; then + docker build \ + --build-arg IMG_NAME=clefos \ + --build-arg IMG_TAG=7 \ + --tag ${ADDITIONAL_TAG} . + else + docker build --tag ${ADDITIONAL_TAG} . + fi echo "Pushing the image ${ADDITIONAL_TAG} to quay.io" docker push ${ADDITIONAL_TAG}