github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-17 14:58:16 +00:00
Code Issues Projects Releases Wiki Activity

genpolicy: add initdata support

Browse Source 
Encode policy inside initdata and encode as annotation (base64(gzip(toml))).

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
This commit is contained in:
Saul Paredes
2025-09-05 11:18:09 -07:00
parent 10de56a749
commit a427537914
17 changed files with 578 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

550
src/tools/genpolicy/Cargo.lock generated
View File

@@ -17,6 +17,17 @@ version = "1.0.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
[[package]]
name = "ahash"
version = "0.7.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
dependencies = [
"getrandom 0.2.12",
"once_cell",
"version_check",
]
[[package]]
name = "aho-corasick"
version = "1.1.3"
@@ -103,6 +114,12 @@ version = "1.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
[[package]]
name = "arrayvec"
version = "0.7.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
[[package]]
name = "assert_cmd"
version = "2.0.17"
@@ -222,9 +239,31 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "bitflags"
version = "2.4.1"
version = "2.9.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
[[package]]
name = "bitmask-enum"
version = "2.2.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e6cbbb8f56245b5a479b30a62cdc86d26e2f35c2b9f594bc4671654b03851380"
dependencies = [
"quote",
"syn 2.0.104",
]
[[package]]
name = "bitvec"
version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
dependencies = [
"funty",
"radium",
"tap",
"wyz",
]
[[package]]
name = "block-buffer"
@@ -235,6 +274,29 @@ dependencies = [
"generic-array",
]
[[package]]
name = "borsh"
version = "1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ad8646f98db542e39fc66e68a20b2144f6a732636df7c2354e74645faaa433ce"
dependencies = [
"borsh-derive",
"cfg_aliases",
]
[[package]]
name = "borsh-derive"
version = "1.5.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fdd1d3c0c2f5833f22386f252fe8ed005c7f59fdcddeef025c01b4c3b9fd9ac3"
dependencies = [
"once_cell",
"proc-macro-crate",
"proc-macro2",
"quote",
"syn 2.0.104",
]
[[package]]
name = "bstr"
version = "1.12.0"
@@ -252,6 +314,39 @@ version = "3.12.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
[[package]]
name = "byte-unit"
version = "5.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e1cd29c3c585209b0cbc7309bfe3ed7efd8c84c21b7af29c8bfae908f8777174"
dependencies = [
"rust_decimal",
"serde",
"utf8-width",
]
[[package]]
name = "bytecheck"
version = "0.6.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "23cdc57ce23ac53c931e88a43d06d070a6fd142f2617be5855eb75efc9beb1c2"
dependencies = [
"bytecheck_derive",
"ptr_meta",
"simdutf8",
]
[[package]]
name = "bytecheck_derive"
version = "0.6.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3db406d29fbcd95542e92559bed4d8ad92636d1ca8b3b72ede10b4bcc010e659"
dependencies = [
"proc-macro2",
"quote",
"syn 1.0.109",
]
[[package]]
name = "byteorder"
version = "1.4.3"
@@ -279,6 +374,12 @@ version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
[[package]]
name = "cfg_aliases"
version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
[[package]]
name = "chrono"
version = "0.4.31"
@@ -483,14 +584,37 @@ dependencies = [
"typenum",
]
[[package]]
name = "darling"
version = "0.14.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850"
dependencies = [
"darling_core 0.14.4",
"darling_macro 0.14.4",
]
[[package]]
name = "darling"
version = "0.20.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "83b2eb4d90d12bdda5ed17de686c2acb4c57914f8f921b8da7e112b5a36f3fe1"
dependencies = [
"darling_core",
"darling_macro",
"darling_core 0.20.9",
"darling_macro 0.20.9",
]
[[package]]
name = "darling_core"
version = "0.14.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0"
dependencies = [
"fnv",
"ident_case",
"proc-macro2",
"quote",
"syn 1.0.109",
]
[[package]]
@@ -507,13 +631,24 @@ dependencies = [
"syn 2.0.104",
]
[[package]]
name = "darling_macro"
version = "0.14.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e"
dependencies = [
"darling_core 0.14.4",
"quote",
"syn 1.0.109",
]
[[package]]
name = "darling_macro"
version = "0.20.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "733cabb43482b1a1b53eee8583c2b9e8684d592215ea83efd305dd31bc2f0178"
dependencies = [
"darling_core",
"darling_core 0.20.9",
"quote",
"syn 2.0.104",
]
@@ -544,7 +679,7 @@ version = "0.20.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d48cda787f839151732d396ac69e3473923d54312c070ee21e9effcaa8ca0b1d"
dependencies = [
"darling",
"darling 0.20.9",
"proc-macro2",
"quote",
"syn 2.0.104",
@@ -678,6 +813,7 @@ checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
dependencies = [
"crc32fast",
"libz-ng-sys",
"libz-sys",
"miniz_oxide",
]
@@ -730,6 +866,12 @@ dependencies = [
"winapi",
]
[[package]]
name = "funty"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
[[package]]
name = "futures-channel"
version = "0.3.28"
@@ -817,6 +959,7 @@ dependencies = [
"fs2",
"k8s-cri",
"kata-agent-policy",
"kata-types",
"libz-ng-sys",
"log",
"oci-client",
@@ -879,6 +1022,12 @@ version = "0.28.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
[[package]]
name = "glob"
version = "0.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
[[package]]
name = "h2"
version = "0.3.26"
@@ -891,7 +1040,7 @@ dependencies = [
"futures-sink",
"futures-util",
"http 0.2.9",
"indexmap 2.2.3",
"indexmap 2.10.0",
"slab",
"tokio",
"tokio-util",
@@ -903,12 +1052,15 @@ name = "hashbrown"
version = "0.12.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
dependencies = [
"ahash",
]
[[package]]
name = "hashbrown"
version = "0.14.3"
version = "0.15.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
[[package]]
name = "heck"
@@ -937,6 +1089,18 @@ version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
[[package]]
name = "hermit-abi"
version = "0.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
[[package]]
name = "hex"
version = "0.4.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
[[package]]
name = "hmac"
version = "0.12.1"
@@ -1144,7 +1308,7 @@ dependencies = [
"iana-time-zone-haiku",
"js-sys",
"wasm-bindgen",
"windows-core",
"windows-core 0.50.0",
]
[[package]]
@@ -1281,12 +1445,12 @@ dependencies = [
[[package]]
name = "indexmap"
version = "2.2.3"
version = "2.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "233cf39063f058ea2caae4091bf4a3ef70a653afbc026f5c4a4135d114e3c177"
checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
dependencies = [
"equivalent",
"hashbrown 0.14.3",
"hashbrown 0.15.4",
]
[[package]]
@@ -1305,7 +1469,7 @@ version = "0.7.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b86e202f00093dcba4275d4636b93ef9dd75d025ae560d2521b45ea28ab49013"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
"cfg-if",
"libc",
]
@@ -1332,7 +1496,7 @@ version = "0.4.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "21b6b32576413a8e69b90e952e4a026476040d81017b80445deda5f2d3921857"
dependencies = [
"hermit-abi",
"hermit-abi 0.3.1",
"io-lifetimes",
"rustix 0.36.17",
"windows-sys 0.45.0",
@@ -1433,6 +1597,33 @@ dependencies = [
"tokio",
]
[[package]]
name = "kata-types"
version = "0.1.0"
dependencies = [
"anyhow",
"base64 0.13.1",
"bitmask-enum",
"byte-unit",
"flate2",
"glob",
"hex",
"lazy_static",
"num_cpus",
"oci-spec",
"regex",
"safe-path",
"serde",
"serde-enum-str",
"serde_json",
"sha2",
"slog",
"slog-scope",
"sysinfo",
"thiserror 1.0.40",
"toml",
]
[[package]]
name = "lazy_static"
version = "1.4.0"
@@ -1455,6 +1646,17 @@ dependencies = [
"libc",
]
[[package]]
name = "libz-sys"
version = "1.1.22"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8b70e7a7df205e92a1a4cd9aaae7898dac0aa555503cc0a649494d0d60e7651d"
dependencies = [
"cc",
"pkg-config",
"vcpkg",
]
[[package]]
name = "linked-hash-map"
version = "0.5.6"
@@ -1585,6 +1787,15 @@ dependencies = [
"pin-utils",
]
[[package]]
name = "ntapi"
version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e8a3895c6391c39d7fe7ebc444a87eb2991b2a0bc718fdabd071eec617fc68e4"
dependencies = [
"winapi",
]
[[package]]
name = "num-traits"
version = "0.2.19"
@@ -1594,6 +1805,25 @@ dependencies = [
"autocfg",
]
[[package]]
name = "num_cpus"
version = "1.17.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
dependencies = [
"hermit-abi 0.5.2",
"libc",
]
[[package]]
name = "objc2-core-foundation"
version = "0.3.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1c10c2894a6fed806ade6027bcd50662746363a9589d3ec9d9bef30a4e4bc166"
dependencies = [
"bitflags 2.9.1",
]
[[package]]
name = "object"
version = "0.32.1"
@@ -1674,7 +1904,7 @@ version = "0.10.73"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
"cfg-if",
"foreign-types",
"libc",
@@ -1768,7 +1998,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
dependencies = [
"fixedbitset 0.4.2",
"indexmap 2.2.3",
"indexmap 2.10.0",
]
[[package]]
@@ -1861,6 +2091,15 @@ dependencies = [
"syn 1.0.109",
]
[[package]]
name = "proc-macro-crate"
version = "3.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8ecf48c7ca261d60b74ab1a7b20da18bede46776b2e55535cb958eb595c5fa7b"
dependencies = [
"toml_edit",
]
[[package]]
name = "proc-macro-error-attr2"
version = "2.0.0"
@@ -2030,7 +2269,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b4aeaa1f2460f1d348eeaeed86aea999ce98c1bded6f089ff8514c9d9dbdc973"
dependencies = [
"anyhow",
"indexmap 2.2.3",
"indexmap 2.10.0",
"log",
"protobuf",
"protobuf-support",
@@ -2060,6 +2299,26 @@ dependencies = [
"ttrpc-codegen",
]
[[package]]
name = "ptr_meta"
version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0738ccf7ea06b608c10564b31debd4f5bc5e197fc8bfe088f68ae5ce81e7a4f1"
dependencies = [
"ptr_meta_derive",
]
[[package]]
name = "ptr_meta_derive"
version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac"
dependencies = [
"proc-macro2",
"quote",
"syn 1.0.109",
]
[[package]]
name = "quote"
version = "1.0.36"
@@ -2075,6 +2334,12 @@ version = "5.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
[[package]]
name = "radium"
version = "0.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
[[package]]
name = "rand"
version = "0.8.5"
@@ -2120,7 +2385,7 @@ version = "0.5.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
]
[[package]]
@@ -2167,6 +2432,15 @@ dependencies = [
"serde_json",
]
[[package]]
name = "rend"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "71fe3824f5629716b1589be05dacd749f6aa084c87e00e016714a8cdfccc997c"
dependencies = [
"bytecheck",
]
[[package]]
name = "reqwest"
version = "0.12.22"
@@ -2206,6 +2480,51 @@ dependencies = [
"web-sys",
]
[[package]]
name = "rkyv"
version = "0.7.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9008cd6385b9e161d8229e1f6549dd23c3d022f132a2ea37ac3a10ac4935779b"
dependencies = [
"bitvec",
"bytecheck",
"bytes",
"hashbrown 0.12.3",
"ptr_meta",
"rend",
"rkyv_derive",
"seahash",
"tinyvec",
"uuid",
]
[[package]]
name = "rkyv_derive"
version = "0.7.45"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "503d1d27590a2b0a3a4ca4c94755aa2875657196ecbf401a42eff41d7de532c0"
dependencies = [
"proc-macro2",
"quote",
"syn 1.0.109",
]
[[package]]
name = "rust_decimal"
version = "1.37.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b203a6425500a03e0919c42d3c47caca51e79f1132046626d2c8871c5092035d"
dependencies = [
"arrayvec",
"borsh",
"bytes",
"num-traits",
"rand",
"rkyv",
"serde",
"serde_json",
]
[[package]]
name = "rustc-demangle"
version = "0.1.23"
@@ -2232,7 +2551,7 @@ version = "0.38.36"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3f55e80d50763938498dd5ebb18647174e0c76dc38c5505294bb224624f30f36"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
"errno",
"libc",
"linux-raw-sys 0.4.14",
@@ -2245,7 +2564,7 @@ version = "1.0.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
"errno",
"libc",
"linux-raw-sys 0.9.4",
@@ -2270,6 +2589,13 @@ version = "1.0.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
[[package]]
name = "safe-path"
version = "0.1.0"
dependencies = [
"libc",
]
[[package]]
name = "schannel"
version = "0.1.21"
@@ -2305,6 +2631,12 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
[[package]]
name = "seahash"
version = "4.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
[[package]]
name = "security-framework"
version = "2.8.2"
@@ -2337,6 +2669,36 @@ dependencies = [
"serde_derive",
]
[[package]]
name = "serde-attributes"
version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6eb8ec7724e4e524b2492b510e66957fe1a2c76c26a6975ec80823f2439da685"
dependencies = [
"darling_core 0.14.4",
"serde-rename-rule",
"syn 1.0.109",
]
[[package]]
name = "serde-enum-str"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "26416dc95fcd46b0e4b12a3758043a229a6914050aaec2e8191949753ed4e9aa"
dependencies = [
"darling 0.14.4",
"proc-macro2",
"quote",
"serde-attributes",
"syn 1.0.109",
]
[[package]]
name = "serde-rename-rule"
version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "794e44574226fc701e3be5c651feb7939038fc67fb73f6f4dd5c4ba90fd3be70"
[[package]]
name = "serde-transcode"
version = "1.1.1"
@@ -2404,9 +2766,9 @@ dependencies = [
[[package]]
name = "sha2"
version = "0.10.6"
version = "0.10.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
dependencies = [
"cfg-if",
"cpufeatures",
@@ -2428,6 +2790,12 @@ dependencies = [
"libc",
]
[[package]]
name = "simdutf8"
version = "0.1.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
[[package]]
name = "slab"
version = "0.4.11"
@@ -2552,6 +2920,25 @@ dependencies = [
"syn 2.0.104",
]
[[package]]
name = "sysinfo"
version = "0.34.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4b93974b3d3aeaa036504b8eefd4c039dced109171c1ae973f1dc63b2c7e4b2"
dependencies = [
"libc",
"memchr",
"ntapi",
"objc2-core-foundation",
"windows",
]
[[package]]
name = "tap"
version = "1.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
[[package]]
name = "tar"
version = "0.4.41"
@@ -2731,6 +3118,32 @@ dependencies = [
"tokio",
]
[[package]]
name = "toml"
version = "0.5.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
dependencies = [
"serde",
]
[[package]]
name = "toml_datetime"
version = "0.6.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
[[package]]
name = "toml_edit"
version = "0.22.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "583c44c02ad26b0c3f3066fe629275e50627026c51ac2e595cca4c230ce1ce1d"
dependencies = [
"indexmap 2.10.0",
"toml_datetime",
"winnow",
]
[[package]]
name = "tonic"
version = "0.9.2"
@@ -2826,7 +3239,7 @@ version = "0.6.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
"bytes",
"futures-util",
"http 1.2.0",
@@ -2986,6 +3399,12 @@ dependencies = [
"percent-encoding",
]
[[package]]
name = "utf8-width"
version = "0.1.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "86bd8d4e895da8537e5315b8254664e6b769c4ff3db18321b297a1e7004392e3"
[[package]]
name = "utf8_iter"
version = "1.0.4"
@@ -2998,6 +3417,16 @@ version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
[[package]]
name = "uuid"
version = "1.17.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
dependencies = [
"js-sys",
"wasm-bindgen",
]
[[package]]
name = "vcpkg"
version = "0.2.15"
@@ -3181,6 +3610,16 @@ version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
[[package]]
name = "windows"
version = "0.57.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "12342cb4d8e3b046f3d80effd474a7a02447231330ef77d71daa6fbc40681143"
dependencies = [
"windows-core 0.57.0",
"windows-targets 0.52.6",
]
[[package]]
name = "windows-core"
version = "0.50.0"
@@ -3190,6 +3629,49 @@ dependencies = [
"windows-targets 0.48.0",
]
[[package]]
name = "windows-core"
version = "0.57.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d2ed2439a290666cd67ecce2b0ffaad89c2a56b976b736e6ece670297897832d"
dependencies = [
"windows-implement",
"windows-interface",
"windows-result",
"windows-targets 0.52.6",
]
[[package]]
name = "windows-implement"
version = "0.57.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9107ddc059d5b6fbfbffdfa7a7fe3e22a226def0b2608f72e9d552763d3e1ad7"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.104",
]
[[package]]
name = "windows-interface"
version = "0.57.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "29bee4b38ea3cde66011baa44dba677c432a78593e202392d1e9070cf2a7fca7"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.104",
]
[[package]]
name = "windows-result"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e383302e8ec8515204254685643de10811af0ed97ea37210dc26fb0032647f8"
dependencies = [
"windows-targets 0.52.6",
]
[[package]]
name = "windows-sys"
version = "0.42.0"
@@ -3419,13 +3901,22 @@ version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
[[package]]
name = "winnow"
version = "0.6.26"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e90edd2ac1aa278a5c4599b1d89cf03074b610800f866d4026dc199d7929a28"
dependencies = [
"memchr",
]
[[package]]
name = "wit-bindgen-rt"
version = "0.39.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
dependencies = [
"bitflags 2.4.1",
"bitflags 2.9.1",
]
[[package]]
@@ -3434,6 +3925,15 @@ version = "0.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
[[package]]
name = "wyz"
version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
dependencies = [
"tap",
]
[[package]]
name = "xattr"
version = "1.3.1"

3
src/tools/genpolicy/Cargo.toml
View File

@@ -69,6 +69,9 @@ containerd-client = "0.4.0"
# username to UID:GID mapping support
tar = "0.4.41"
# init data support
kata-types = { path = "../../libs/kata-types" }
[dev-dependencies]
kata-agent-policy = { path = "../../agent/policy" }
slog = "2.5.2"

2
src/tools/genpolicy/src/config_map.rs
View File

@@ -104,7 +104,7 @@ impl yaml::K8sResource for ConfigMap {
self.doc_mapping = doc_mapping.clone();
}
fn generate_policy(&self, _agent_policy: &policy::AgentPolicy) -> String {
fn generate_initdata_anno(&self, _agent_policy: &policy::AgentPolicy) -> String {
"".to_string()
}

4
src/tools/genpolicy/src/cronjob.rs
View File

@@ -103,8 +103,8 @@ impl yaml::K8sResource for CronJob {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

4
src/tools/genpolicy/src/daemon_set.rs
View File

@@ -105,8 +105,8 @@ impl yaml::K8sResource for DaemonSet {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

4
src/tools/genpolicy/src/deployment.rs
View File

@@ -103,8 +103,8 @@ impl yaml::K8sResource for Deployment {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

4
src/tools/genpolicy/src/job.rs
View File

@@ -77,8 +77,8 @@ impl yaml::K8sResource for Job {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

8
src/tools/genpolicy/src/list.rs
View File

@@ -58,12 +58,12 @@ impl yaml::K8sResource for List {
) {
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
let mut policies: Vec<String> = Vec::new();
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
let mut annotations: Vec<String> = Vec::new();
for resource in &self.resources {
policies.push(resource.generate_policy(agent_policy));
annotations.push(resource.generate_initdata_anno(agent_policy));
}
policies.join(":")
annotations.join(":")
}
fn serialize(&mut self, policy: &str) -> String {

2
src/tools/genpolicy/src/no_policy.rs
View File

@@ -27,7 +27,7 @@ impl yaml::K8sResource for NoPolicyResource {
) {
}
fn generate_policy(&self, _agent_policy: &policy::AgentPolicy) -> String {
fn generate_initdata_anno(&self, _agent_policy: &policy::AgentPolicy) -> String {
"".to_string()
}

4
src/tools/genpolicy/src/pod.rs
View File

@@ -884,8 +884,8 @@ impl yaml::K8sResource for Pod {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

14
src/tools/genpolicy/src/policy.rs
View File

@@ -17,7 +17,6 @@ use crate::utils;
use crate::yaml;
use anyhow::Result;
use base64::{engine::general_purpose, Engine as _};
use log::debug;
use oci_spec::runtime as oci;
use protocols::agent;
@@ -536,11 +535,11 @@ impl AgentPolicy {
pub fn export_policy(&mut self) {
let mut yaml_string = String::new();
for i in 0..self.resources.len() {
let policy = self.resources[i].generate_policy(self);
let annotation = self.resources[i].generate_initdata_anno(self);
if self.config.base64_out {
println!("{}", policy);
println!("{}", annotation);
}
yaml_string += &self.resources[i].serialize(&policy);
yaml_string += &self.resources[i].serialize(&annotation);
}
if let Some(yaml_file) = &self.config.yaml_file {
@@ -558,7 +557,7 @@ impl AgentPolicy {
}
}
pub fn generate_policy(&self, resource: &dyn yaml::K8sResource) -> String {
pub fn generate_initdata_anno(&self, resource: &dyn yaml::K8sResource) -> String {
let yaml_containers = resource.get_containers();
let mut policy_containers = Vec::new();
@@ -578,7 +577,10 @@ impl AgentPolicy {
if self.config.raw_out {
std::io::stdout().write_all(policy.as_bytes()).unwrap();
}
general_purpose::STANDARD.encode(policy.as_bytes())
let mut initdata = kata_types::initdata::InitData::new("sha256", "0.1.0");
initdata.insert_data("policy.rego", policy);
kata_types::initdata::encode_initdata(&initdata)
}
pub fn get_container_policy(

4
src/tools/genpolicy/src/replica_set.rs
View File

@@ -75,8 +75,8 @@ impl yaml::K8sResource for ReplicaSet {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

4
src/tools/genpolicy/src/replication_controller.rs
View File

@@ -77,8 +77,8 @@ impl yaml::K8sResource for ReplicationController {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

2
src/tools/genpolicy/src/secret.rs
View File

@@ -103,7 +103,7 @@ impl yaml::K8sResource for Secret {
self.doc_mapping = doc_mapping.clone();
}
fn generate_policy(&self, _agent_policy: &policy::AgentPolicy) -> String {
fn generate_initdata_anno(&self, _agent_policy: &policy::AgentPolicy) -> String {
"".to_string()
}

4
src/tools/genpolicy/src/stateful_set.rs
View File

@@ -150,8 +150,8 @@ impl yaml::K8sResource for StatefulSet {
);
}
fn generate_policy(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_policy(self)
fn generate_initdata_anno(&self, agent_policy: &policy::AgentPolicy) -> String {
agent_policy.generate_initdata_anno(self)
}
fn serialize(&mut self, policy: &str) -> String {

10
src/tools/genpolicy/src/yaml.rs
View File

@@ -26,6 +26,7 @@ use crate::volume;
use async_trait::async_trait;
use core::fmt::Debug;
use kata_types::annotations::KATA_ANNO_CFG_HYPERVISOR_INIT_DATA;
use log::debug;
use protocols::agent;
use serde::{Deserialize, Serialize};
@@ -50,7 +51,7 @@ pub trait K8sResource {
silent_unsupported_fields: bool,
);
fn generate_policy(&self, _agent_policy: &policy::AgentPolicy) -> String {
fn generate_initdata_anno(&self, _agent_policy: &policy::AgentPolicy) -> String {
panic!("Unsupported");
}
@@ -318,7 +319,7 @@ pub fn get_container_mounts_and_storages(
}
}
/// Add the "io.katacontainers.config.agent.policy" annotation into
/// Add the [`KATA_ANNO_CFG_HYPERVISOR_INIT_DATA`] into
/// a serde representation of a K8s resource YAML.
pub fn add_policy_annotation(
mut ancestor: &mut serde_yaml::Value,
@@ -326,7 +327,7 @@ pub fn add_policy_annotation(
policy: &str,
) {
let annotations_key = serde_yaml::Value::String("annotations".to_string());
let policy_key = serde_yaml::Value::String("io.katacontainers.config.agent.policy".to_string());
let policy_key = serde_yaml::Value::String(KATA_ANNO_CFG_HYPERVISOR_INIT_DATA.to_string());
let policy_value = serde_yaml::Value::String(policy.to_string());
if !metadata_path.is_empty() {
@@ -367,8 +368,9 @@ pub fn add_policy_annotation(
}
}
/// Remove [`KATA_ANNO_CFG_HYPERVISOR_INIT_DATA`] annotation
pub fn remove_policy_annotation(annotations: &mut BTreeMap<String, String>) {
annotations.remove("io.katacontainers.config.agent.policy");
annotations.remove(KATA_ANNO_CFG_HYPERVISOR_INIT_DATA);
}
/// Report a fatal error if this app encounters an unsupported input YAML field,

18
src/tools/genpolicy/tests/policy/main.rs
View File

@@ -6,7 +6,6 @@
#[cfg(test)]
mod tests {
use anyhow::Context;
use base64::prelude::*;
use std::fmt::{self, Display};
use std::fs::{self, File};
use std::path;
@@ -112,12 +111,12 @@ mod tests {
// The container repos/network calls can be unreliable, so retry
// a few times before giving up.
let mut policy = String::new();
let mut initdata_anno = String::new();
for i in 0..6 {
policy = match genpolicy::policy::AgentPolicy::from_files(&config).await {
initdata_anno = match genpolicy::policy::AgentPolicy::from_files(&config).await {
Ok(policy) => {
assert_eq!(policy.resources.len(), 1);
policy.resources[0].generate_policy(&policy)
policy.resources[0].generate_initdata_anno(&policy)
}
Err(e) => {
if i == 5 {
@@ -131,7 +130,7 @@ mod tests {
};
break;
}
let policy = BASE64_STANDARD.decode(&policy).unwrap();
let policy = decode_policy(&initdata_anno);
// write policy to a file
fs::write(workdir.join("policy.rego"), &policy).unwrap();
@@ -178,6 +177,15 @@ mod tests {
}
}
fn decode_policy(initdata_anno: &str) -> String {
let initdata = kata_types::initdata::decode_initdata(initdata_anno)
.expect("should decode initdata anno");
initdata
.get_coco_data("policy.rego")
.expect("should read policy from initdata")
.to_string()
}
fn prepare_workdir(
test_case_dir: &str,
files_to_copy: &[&str],