mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-09 22:24:51 +00:00
build: wire nvrc + nvidia-gpu base/extension into CI and packaging
Add the nvrc static-build target and make the NVIDIA rootfs targets
depend on it (the rootfs build consumes kata-static-nvrc.tar.zst), and
add the rootfs-image-nvidia-gpu-{base,extension} build targets to the
local-build Makefile and the nvgpu bundle.
Build nvrc and the base/extension rootfs images in the amd64/arm64 static
tarball workflows (nvrc is baked into the rootfs and pruned from the
release like the other guest components), and point the runtime-rs NVIDIA
shim components at the composable base + gpu extension (+ coco extension for
the confidential classes). The Go shim components keep the monolithic
nvidia-gpu / nvidia-gpu-confidential images.
Ship cryptsetup in the CoCo guest-components extension (and bundle
libnvat's non-glibc dependency closure next to the nvidia attester): the
chiseled base-nvidia image carries only veritysetup, so the coco-extension
manifest's usr/sbin PATH entry needs a cryptsetup to resolve for NVIDIA
confidential encrypted-storage.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Fabiano Fidêncio
@@ -53,6 +53,7 @@ jobs:
|
||||
- kernel-debug
|
||||
- kernel-dragonball-experimental
|
||||
- kernel-nvidia-gpu
|
||||
- nvrc
|
||||
- nydus
|
||||
- ovmf
|
||||
- ovmf-sev
|
||||
@@ -213,6 +214,8 @@ jobs:
|
||||
- rootfs-image-mariner
|
||||
- rootfs-image-nvidia-gpu
|
||||
- rootfs-image-nvidia-gpu-confidential
|
||||
- rootfs-image-nvidia-gpu-base
|
||||
- rootfs-image-nvidia-gpu-extension
|
||||
- rootfs-initrd
|
||||
- rootfs-initrd-confidential
|
||||
concurrency:
|
||||
@@ -284,6 +287,7 @@ jobs:
|
||||
- busybox
|
||||
- coco-guest-components
|
||||
- kernel-nvidia-gpu-modules
|
||||
- nvrc
|
||||
- pause-image
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-amd64-${{ toJSON(matrix) }}
|
||||
|
||||
@@ -54,6 +54,7 @@ jobs:
|
||||
- kernel-dragonball-experimental
|
||||
- kernel-nvidia-gpu
|
||||
- kernel-cca-confidential
|
||||
- nvrc
|
||||
- nydus
|
||||
- ovmf
|
||||
- pause-image
|
||||
@@ -205,6 +206,8 @@ jobs:
|
||||
- rootfs-image-confidential
|
||||
- rootfs-image-coco-extension
|
||||
- rootfs-image-nvidia-gpu
|
||||
- rootfs-image-nvidia-gpu-base
|
||||
- rootfs-image-nvidia-gpu-extension
|
||||
- rootfs-initrd
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}
|
||||
@@ -274,6 +277,7 @@ jobs:
|
||||
- busybox
|
||||
- coco-guest-components
|
||||
- kernel-nvidia-gpu-modules
|
||||
- nvrc
|
||||
- pause-image
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}
|
||||
|
||||
@@ -84,6 +84,7 @@ NVGPU_BASE_TARBALLS = \
|
||||
coco-guest-components-tarball \
|
||||
$(PUBLISH_COMPONENT_TARBALLS) \
|
||||
kernel-nvidia-gpu-tarball \
|
||||
nvrc-tarball \
|
||||
ovmf-sev-tarball \
|
||||
ovmf-tdx-tarball \
|
||||
ovmf-tarball \
|
||||
@@ -100,6 +101,7 @@ NVGPU_BASE_TARBALLS = \
|
||||
coco-guest-components-tarball \
|
||||
$(PUBLISH_COMPONENT_TARBALLS) \
|
||||
kernel-nvidia-gpu-tarball \
|
||||
nvrc-tarball \
|
||||
ovmf-tarball \
|
||||
pause-image-tarball \
|
||||
qemu-tarball \
|
||||
@@ -123,6 +125,8 @@ NVGPU_FINAL_TARBALL_INPUTS = \
|
||||
kata-static-virtiofsd.tar.zst \
|
||||
kata-static-rootfs-image-nvidia-gpu.tar.zst \
|
||||
kata-static-rootfs-image-nvidia-gpu-confidential.tar.zst \
|
||||
kata-static-rootfs-image-nvidia-gpu-base.tar.zst \
|
||||
kata-static-rootfs-image-nvidia-gpu-extension.tar.zst \
|
||||
kata-static-shim-v2-go.tar.zst \
|
||||
kata-static-shim-v2-rust.tar.zst
|
||||
|
||||
@@ -131,7 +135,7 @@ ifneq ($(NVGPU_BASE_TARBALLS),)
|
||||
nvgpu-tarball:
|
||||
${MAKE} -f $(MK_PATH) kata-tarball \
|
||||
BASE_TARBALLS="$(NVGPU_BASE_TARBALLS)" \
|
||||
BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball" \
|
||||
BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball rootfs-image-nvidia-gpu-base-tarball rootfs-image-nvidia-gpu-extension-tarball" \
|
||||
FINAL_TARBALL_INPUTS="$(NVGPU_FINAL_TARBALL_INPUTS)" \
|
||||
FINAL_TARBALL_MERGE_MODE=passthrough \
|
||||
DEPS=
|
||||
@@ -230,6 +234,9 @@ kernel-cca-confidential-tarball:
|
||||
nydus-tarball:
|
||||
${MAKE} $@-build
|
||||
|
||||
nvrc-tarball:
|
||||
${MAKE} $@-build
|
||||
|
||||
ovmf-sev-tarball:
|
||||
${MAKE} $@-build
|
||||
|
||||
@@ -291,14 +298,25 @@ DEPS := agent-tarball
|
||||
rootfs-initrd-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball
|
||||
DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
|
||||
rootfs-image-nvidia-gpu-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball
|
||||
DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball nvrc-tarball
|
||||
rootfs-image-nvidia-gpu-confidential-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
# Composable NVIDIA stack: the driver-agnostic base-nvidia boot image and the
|
||||
# driver-versioned gpu extension are both carved out of the same chiseled tree, so
|
||||
# they share the monolith's (non-confidential) build dependencies.
|
||||
DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
|
||||
rootfs-image-nvidia-gpu-base-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
|
||||
rootfs-image-nvidia-gpu-extension-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
DEPS := agent-tarball pause-image-tarball coco-guest-components-tarball kernel-cca-confidential-tarball
|
||||
rootfs-cca-confidential-image-tarball: $(DEPS)
|
||||
${MAKE} $@-build
|
||||
|
||||
@@ -37,19 +37,19 @@
|
||||
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
|
||||
},
|
||||
"qemu-nvidia-gpu-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
|
||||
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-extension", "ovmf"]
|
||||
},
|
||||
"qemu-nvidia-gpu-snp": {
|
||||
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
|
||||
},
|
||||
"qemu-nvidia-gpu-snp-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
|
||||
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-sev"]
|
||||
},
|
||||
"qemu-nvidia-gpu-tdx": {
|
||||
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
|
||||
},
|
||||
"qemu-nvidia-gpu-tdx-runtime-rs": {
|
||||
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
|
||||
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-extension", "rootfs-image-coco-extension", "ovmf-tdx"]
|
||||
},
|
||||
"qemu-coco-dev": {
|
||||
"x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
|
||||
|
||||
@@ -22,6 +22,7 @@ RUN apt-get update && \
|
||||
curl \
|
||||
binutils \
|
||||
clang \
|
||||
cryptsetup-bin \
|
||||
g++ \
|
||||
gcc \
|
||||
git \
|
||||
|
||||
@@ -42,6 +42,16 @@ build_coco_guest_components_from_source() {
|
||||
|
||||
install -D -m0644 "confidential-data-hub/hub/src/image/ocicrypt_config.json" "${DESTDIR}/etc/ocicrypt_config.json"
|
||||
|
||||
# CDH's secure_mount LUKS-formats encrypted scratch volumes by exec'ing
|
||||
# cryptsetup. Encrypted storage is a CoCo-only feature, so cryptsetup ships
|
||||
# in this extension rather than the guest rootfs (the base-nvidia image carries
|
||||
# only veritysetup plus the plain mke2fs/mkfs.ext4/dd storage tooling).
|
||||
# cryptsetup's shared-library closure is identical to veritysetup's, which
|
||||
# the base already ships unconditionally, so bundle just the binary; the
|
||||
# coco-extension manifest puts ${extension_root}/usr/sbin on CDH's PATH so the
|
||||
# runtime lookup resolves (see kata-deploy-binaries.sh).
|
||||
install -D -m0755 /usr/sbin/cryptsetup "${DESTDIR}/usr/sbin/cryptsetup"
|
||||
|
||||
if [[ -n "${NV_ATTESTER:-}" ]]; then
|
||||
echo "build attestation-agent-nv with nvidia-attester support"
|
||||
|
||||
@@ -55,6 +65,18 @@ build_coco_guest_components_from_source() {
|
||||
|
||||
mkdir -p "${DESTDIR}/usr/local/lib"
|
||||
cp -a /usr/local/lib/libnvat.so* "${DESTDIR}/usr/local/lib/"
|
||||
|
||||
# attestation-agent-nv links libnvat.so, which in turn pulls in
|
||||
# libxml2/zlib/lzma and the C++ runtime. None of those ship in the
|
||||
# guest rootfs, so bundle every non-glibc dependency next to
|
||||
# libnvat.so. The coco-extension manifest points the nvidia attester's
|
||||
# LD_LIBRARY_PATH here, so the dynamic linker resolves them at runtime.
|
||||
ldd /usr/local/lib/libnvat.so | awk '/=> \// { print $3 }' | while read -r dep; do
|
||||
case "$(basename "${dep}")" in
|
||||
libc.so.*|libm.so.*|libdl.so.*|libpthread.so.*|librt.so.*|ld-linux*|linux-vdso*) continue ;;
|
||||
esac
|
||||
install -D -m0755 "${dep}" "${DESTDIR}/usr/local/lib/$(basename "${dep}")"
|
||||
done
|
||||
fi
|
||||
|
||||
popd
|
||||
|
||||
Reference in New Issue
Block a user