github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-05-02 21:47:29 +00:00
Code Issues Projects Releases Wiki Activity

gha: enable autogenerated policy testing on SEV

Browse Source 
Enable autogenerated policy testing on SEV

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
This commit is contained in:
Saul Paredes 2024-06-10 12:10:17 -07:00
parent f31c1b121e
commit b3cc8b200f
3 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tests/integration/kubernetes/gha-run.sh
View File

@ -272,7 +272,9 @@ function run_tests() {
export KUBECONFIG="$HOME/.kcli/clusters/${CLUSTER_NAME:-kata-k8s}/auth/kubeconfig" export KUBECONFIG="$HOME/.kcli/clusters/${CLUSTER_NAME:-kata-k8s}/auth/kubeconfig"
# TODO: enable testing auto-generated policy for other types of hosts too. # TODO: enable testing auto-generated policy for other types of hosts too.
if [ "${KATA_HOST_OS}" = "cbl-mariner" ] || [ "${KATA_HYPERVISOR}" = "qemu-tdx" ]; then if [ "${KATA_HOST_OS}" = "cbl-mariner" ] || \
[ "${KATA_HYPERVISOR}" = "qemu-tdx" ] || \
[ "${KATA_HYPERVISOR}" = "qemu-sev" ]; then
export AUTO_GENERATE_POLICY="yes" export AUTO_GENERATE_POLICY="yes"
fi fi

4
tests/integration/kubernetes/k8s-policy-pvc.bats
View File

@ -10,7 +10,7 @@ load "${BATS_TEST_DIRNAME}/tests_common.sh"
setup() { setup() {
auto_generate_policy_enabled || skip "Auto-generated policy tests are disabled." auto_generate_policy_enabled || skip "Auto-generated policy tests are disabled."
( [ "${KATA_HYPERVISOR}" == "qemu-tdx" ] ) && skip "https://github.com/kata-containers/kata-containers/issues/9846" ( [ "${KATA_HYPERVISOR}" == "qemu-tdx" ] || [ "${KATA_HYPERVISOR}" == "qemu-sev" ] ) && skip "https://github.com/kata-containers/kata-containers/issues/9846"
pod_name="policy-pod-pvc" pod_name="policy-pod-pvc"
pvc_name="policy-dev" pvc_name="policy-dev"
@ -55,7 +55,7 @@ test_pod_policy_error() {
teardown() { teardown() {
auto_generate_policy_enabled || skip "Auto-generated policy tests are disabled." auto_generate_policy_enabled || skip "Auto-generated policy tests are disabled."
( [ "${KATA_HYPERVISOR}" == "qemu-tdx" ] ) && skip "https://github.com/kata-containers/kata-containers/issues/9846" ( [ "${KATA_HYPERVISOR}" == "qemu-tdx" ] || [ "${KATA_HYPERVISOR}" == "qemu-sev" ] ) && skip "https://github.com/kata-containers/kata-containers/issues/9846"
# Debugging information. Don't print the "Message:" line because it contains a truncated policy log. # Debugging information. Don't print the "Message:" line because it contains a truncated policy log.
kubectl describe pod "${pod_name}" | grep -v "Message:" kubectl describe pod "${pod_name}" | grep -v "Message:"

13
tests/integration/kubernetes/tests_common.sh
View File

@ -139,6 +139,15 @@ adapt_common_policy_settings_for_tdx() {
jq '.common.cpath = "/run/kata-containers" | .volumes.configMap.mount_point = "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-"' "${settings_dir}/genpolicy-settings.json" > temp.json && sudo mv temp.json "${settings_dir}/genpolicy-settings.json" jq '.common.cpath = "/run/kata-containers" | .volumes.configMap.mount_point = "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-"' "${settings_dir}/genpolicy-settings.json" > temp.json && sudo mv temp.json "${settings_dir}/genpolicy-settings.json"
} }
# adapt common policy settings for qemu-sev
adapt_common_policy_settings_for_sev() {
local settings_dir=$1
info "Adapting common policy settings for SEV"
jq '.kata_config.oci_version = "1.1.0-rc.1" | .common.cpath = "/run/kata-containers" | .volumes.configMap.mount_point = "^$(cpath)/$(bundle-id)-[a-z0-9]{16}-"' "${settings_dir}/genpolicy-settings.json" > temp.json && sudo mv temp.json "${settings_dir}/genpolicy-settings.json"
}
# adapt common policy settings for various platforms # adapt common policy settings for various platforms
adapt_common_policy_settings() { adapt_common_policy_settings() {
@ -147,6 +156,10 @@ adapt_common_policy_settings() {
case "${KATA_HYPERVISOR}" in case "${KATA_HYPERVISOR}" in
"qemu-tdx") "qemu-tdx")
adapt_common_policy_settings_for_tdx "${settings_dir}" adapt_common_policy_settings_for_tdx "${settings_dir}"
;;
"qemu-sev")
adapt_common_policy_settings_for_sev "${settings_dir}"
;;
esac esac
} }