build: wire nvrc + nvidia-gpu base/addon into CI and packaging

Add the nvrc static-build target and make the NVIDIA rootfs targets
depend on it (the rootfs build consumes kata-static-nvrc.tar.zst), and
add the rootfs-image-nvidia-gpu-{base,addon} build targets to the
local-build Makefile and the nvgpu bundle.

Build nvrc and the base/addon rootfs images in the amd64/arm64 static
tarball workflows (nvrc is baked into the rootfs and pruned from the
release like the other guest components), and point the NVIDIA shim
components at the composable base + gpu addon (+ coco addon for the
confidential classes). The monolithic images are still built/shipped.

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -53,6 +53,7 @@ jobs:
           - kernel-debug
           - kernel-dragonball-experimental
           - kernel-nvidia-gpu
+          - nvrc
           - nydus
           - ovmf
           - ovmf-sev
@@ -211,6 +212,8 @@ jobs:
           - rootfs-image-mariner
           - rootfs-image-nvidia-gpu
           - rootfs-image-nvidia-gpu-confidential
+          - rootfs-image-nvidia-gpu-base
+          - rootfs-image-nvidia-gpu-addon
           - rootfs-initrd
           - rootfs-initrd-confidential
     concurrency:
@@ -282,6 +285,7 @@ jobs:
           - busybox
           - coco-guest-components
           - kernel-nvidia-gpu-modules
+          - nvrc
           - pause-image
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-amd64-${{ toJSON(matrix) }}

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -54,6 +54,7 @@ jobs:
           - kernel-dragonball-experimental
           - kernel-nvidia-gpu
           - kernel-cca-confidential
+          - nvrc
           - nydus
           - ovmf
           - pause-image
@@ -203,6 +204,8 @@ jobs:
           - rootfs-image
           - rootfs-image-coco-addon
           - rootfs-image-nvidia-gpu
+          - rootfs-image-nvidia-gpu-base
+          - rootfs-image-nvidia-gpu-addon
           - rootfs-initrd
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}
@@ -272,6 +275,7 @@ jobs:
           - busybox
           - coco-guest-components
           - kernel-nvidia-gpu-modules
+          - nvrc
           - pause-image
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }}

tools/packaging/kata-deploy/local-build/Makefile

@@ -84,6 +84,7 @@ NVGPU_BASE_TARBALLS = \
 	coco-guest-components-tarball \
 	$(PUBLISH_COMPONENT_TARBALLS) \
 	kernel-nvidia-gpu-tarball \
+	nvrc-tarball \
 	ovmf-sev-tarball \
 	ovmf-tdx-tarball \
 	ovmf-tarball \
@@ -100,6 +101,7 @@ NVGPU_BASE_TARBALLS = \
 	coco-guest-components-tarball \
 	$(PUBLISH_COMPONENT_TARBALLS) \
 	kernel-nvidia-gpu-tarball \
+	nvrc-tarball \
 	ovmf-tarball \
 	pause-image-tarball \
 	qemu-tarball \
@@ -123,6 +125,8 @@ NVGPU_FINAL_TARBALL_INPUTS = \
 	kata-static-virtiofsd.tar.zst \
 	kata-static-rootfs-image-nvidia-gpu.tar.zst \
 	kata-static-rootfs-image-nvidia-gpu-confidential.tar.zst \
+	kata-static-rootfs-image-nvidia-gpu-base.tar.zst \
+	kata-static-rootfs-image-nvidia-gpu-addon.tar.zst \
 	kata-static-shim-v2-go.tar.zst \
 	kata-static-shim-v2-rust.tar.zst
 
@@ -131,7 +135,7 @@ ifneq ($(NVGPU_BASE_TARBALLS),)
 nvgpu-tarball:
 	${MAKE} -f $(MK_PATH) kata-tarball \
 		BASE_TARBALLS="$(NVGPU_BASE_TARBALLS)" \
-		BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball" \
+		BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball rootfs-image-nvidia-gpu-base-tarball rootfs-image-nvidia-gpu-addon-tarball" \
 		FINAL_TARBALL_INPUTS="$(NVGPU_FINAL_TARBALL_INPUTS)" \
 		FINAL_TARBALL_MERGE_MODE=passthrough \
 		DEPS=
@@ -230,6 +234,9 @@ kernel-cca-confidential-tarball:
 nydus-tarball:
 	${MAKE} $@-build
 
+nvrc-tarball:
+	${MAKE} $@-build
+
 ovmf-sev-tarball:
 	${MAKE} $@-build
 
@@ -291,14 +298,25 @@ DEPS := agent-tarball
 rootfs-initrd-tarball: $(DEPS)
 	${MAKE} $@-build
 
-DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball
+DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
 rootfs-image-nvidia-gpu-tarball: $(DEPS)
 	${MAKE} $@-build
 
-DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball
+DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball nvrc-tarball
 rootfs-image-nvidia-gpu-confidential-tarball: $(DEPS)
 	${MAKE} $@-build
 
+# Composable NVIDIA stack: the driver-agnostic base-nvidia boot image and the
+# driver-versioned gpu addon are both carved out of the same chiseled tree, so
+# they share the monolith's (non-confidential) build dependencies.
+DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
+rootfs-image-nvidia-gpu-base-tarball: $(DEPS)
+	${MAKE} $@-build
+
+DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball
+rootfs-image-nvidia-gpu-addon-tarball: $(DEPS)
+	${MAKE} $@-build
+
 DEPS := agent-tarball pause-image-tarball coco-guest-components-tarball kernel-cca-confidential-tarball
 rootfs-cca-confidential-image-tarball: $(DEPS)
 	${MAKE} $@-build

tools/packaging/kata-deploy/shim-components.json

@@ -34,22 +34,22 @@
       "s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
     },
     "qemu-nvidia-gpu": {
-      "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
+      "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "ovmf"]
     },
     "qemu-nvidia-gpu-runtime-rs": {
-      "x86_64":  ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
+      "x86_64":  ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "ovmf"]
     },
     "qemu-nvidia-gpu-snp": {
-      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-snp-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
+      "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-sev"]
     },
     "qemu-nvidia-gpu-tdx": {
-      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-tdx"]
     },
     "qemu-nvidia-gpu-tdx-runtime-rs": {
-      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
+      "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-tdx"]
     },
     "qemu-coco-dev": {
       "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-addon"],