From c0af6781a0075a0a3cedf352daa62a28eadccb33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 11 Jun 2026 07:38:11 +0200 Subject: [PATCH] build: wire nvrc + nvidia-gpu base/addon into CI and packaging Add the nvrc static-build target and make the NVIDIA rootfs targets depend on it (the rootfs build consumes kata-static-nvrc.tar.zst), and add the rootfs-image-nvidia-gpu-{base,addon} build targets to the local-build Makefile and the nvgpu bundle. Build nvrc and the base/addon rootfs images in the amd64/arm64 static tarball workflows (nvrc is baked into the rootfs and pruned from the release like the other guest components), and point the NVIDIA shim components at the composable base + gpu addon (+ coco addon for the confidential classes). The monolithic images are still built/shipped. --- .../build-kata-static-tarball-amd64.yaml | 4 ++++ .../build-kata-static-tarball-arm64.yaml | 4 ++++ .../kata-deploy/local-build/Makefile | 24 ++++++++++++++++--- .../kata-deploy/shim-components.json | 12 +++++----- 4 files changed, 35 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-kata-static-tarball-amd64.yaml b/.github/workflows/build-kata-static-tarball-amd64.yaml index 2f03d3ff33..44d9601b8e 100644 --- a/.github/workflows/build-kata-static-tarball-amd64.yaml +++ b/.github/workflows/build-kata-static-tarball-amd64.yaml @@ -53,6 +53,7 @@ jobs: - kernel-debug - kernel-dragonball-experimental - kernel-nvidia-gpu + - nvrc - nydus - ovmf - ovmf-sev @@ -211,6 +212,8 @@ jobs: - rootfs-image-mariner - rootfs-image-nvidia-gpu - rootfs-image-nvidia-gpu-confidential + - rootfs-image-nvidia-gpu-base + - rootfs-image-nvidia-gpu-addon - rootfs-initrd - rootfs-initrd-confidential concurrency: @@ -282,6 +285,7 @@ jobs: - busybox - coco-guest-components - kernel-nvidia-gpu-modules + - nvrc - pause-image concurrency: group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-amd64-${{ toJSON(matrix) }} diff --git a/.github/workflows/build-kata-static-tarball-arm64.yaml b/.github/workflows/build-kata-static-tarball-arm64.yaml index 564d7ffeb8..aebaac0dc2 100644 --- a/.github/workflows/build-kata-static-tarball-arm64.yaml +++ b/.github/workflows/build-kata-static-tarball-arm64.yaml @@ -54,6 +54,7 @@ jobs: - kernel-dragonball-experimental - kernel-nvidia-gpu - kernel-cca-confidential + - nvrc - nydus - ovmf - pause-image @@ -203,6 +204,8 @@ jobs: - rootfs-image - rootfs-image-coco-addon - rootfs-image-nvidia-gpu + - rootfs-image-nvidia-gpu-base + - rootfs-image-nvidia-gpu-addon - rootfs-initrd concurrency: group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }} @@ -272,6 +275,7 @@ jobs: - busybox - coco-guest-components - kernel-nvidia-gpu-modules + - nvrc - pause-image concurrency: group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-arm-${{ toJSON(matrix) }} diff --git a/tools/packaging/kata-deploy/local-build/Makefile b/tools/packaging/kata-deploy/local-build/Makefile index 97496738f4..bde1bb042f 100644 --- a/tools/packaging/kata-deploy/local-build/Makefile +++ b/tools/packaging/kata-deploy/local-build/Makefile @@ -84,6 +84,7 @@ NVGPU_BASE_TARBALLS = \ coco-guest-components-tarball \ $(PUBLISH_COMPONENT_TARBALLS) \ kernel-nvidia-gpu-tarball \ + nvrc-tarball \ ovmf-sev-tarball \ ovmf-tdx-tarball \ ovmf-tarball \ @@ -100,6 +101,7 @@ NVGPU_BASE_TARBALLS = \ coco-guest-components-tarball \ $(PUBLISH_COMPONENT_TARBALLS) \ kernel-nvidia-gpu-tarball \ + nvrc-tarball \ ovmf-tarball \ pause-image-tarball \ qemu-tarball \ @@ -123,6 +125,8 @@ NVGPU_FINAL_TARBALL_INPUTS = \ kata-static-virtiofsd.tar.zst \ kata-static-rootfs-image-nvidia-gpu.tar.zst \ kata-static-rootfs-image-nvidia-gpu-confidential.tar.zst \ + kata-static-rootfs-image-nvidia-gpu-base.tar.zst \ + kata-static-rootfs-image-nvidia-gpu-addon.tar.zst \ kata-static-shim-v2-go.tar.zst \ kata-static-shim-v2-rust.tar.zst @@ -131,7 +135,7 @@ ifneq ($(NVGPU_BASE_TARBALLS),) nvgpu-tarball: ${MAKE} -f $(MK_PATH) kata-tarball \ BASE_TARBALLS="$(NVGPU_BASE_TARBALLS)" \ - BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball" \ + BASE_SERIAL_TARBALLS="rootfs-image-nvidia-gpu-tarball rootfs-image-nvidia-gpu-confidential-tarball rootfs-image-nvidia-gpu-base-tarball rootfs-image-nvidia-gpu-addon-tarball" \ FINAL_TARBALL_INPUTS="$(NVGPU_FINAL_TARBALL_INPUTS)" \ FINAL_TARBALL_MERGE_MODE=passthrough \ DEPS= @@ -230,6 +234,9 @@ kernel-cca-confidential-tarball: nydus-tarball: ${MAKE} $@-build +nvrc-tarball: + ${MAKE} $@-build + ovmf-sev-tarball: ${MAKE} $@-build @@ -291,14 +298,25 @@ DEPS := agent-tarball rootfs-initrd-tarball: $(DEPS) ${MAKE} $@-build -DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball +DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball rootfs-image-nvidia-gpu-tarball: $(DEPS) ${MAKE} $@-build -DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball +DEPS := agent-tarball busybox-tarball pause-image-tarball coco-guest-components-tarball kernel-nvidia-gpu-tarball nvrc-tarball rootfs-image-nvidia-gpu-confidential-tarball: $(DEPS) ${MAKE} $@-build +# Composable NVIDIA stack: the driver-agnostic base-nvidia boot image and the +# driver-versioned gpu addon are both carved out of the same chiseled tree, so +# they share the monolith's (non-confidential) build dependencies. +DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball +rootfs-image-nvidia-gpu-base-tarball: $(DEPS) + ${MAKE} $@-build + +DEPS := agent-tarball busybox-tarball kernel-nvidia-gpu-tarball nvrc-tarball +rootfs-image-nvidia-gpu-addon-tarball: $(DEPS) + ${MAKE} $@-build + DEPS := agent-tarball pause-image-tarball coco-guest-components-tarball kernel-cca-confidential-tarball rootfs-cca-confidential-image-tarball: $(DEPS) ${MAKE} $@-build diff --git a/tools/packaging/kata-deploy/shim-components.json b/tools/packaging/kata-deploy/shim-components.json index e2cb253f88..dc5566aaa5 100644 --- a/tools/packaging/kata-deploy/shim-components.json +++ b/tools/packaging/kata-deploy/shim-components.json @@ -34,22 +34,22 @@ "s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"] }, "qemu-nvidia-gpu": { - "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"] + "x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "ovmf"] }, "qemu-nvidia-gpu-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"] + "x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "ovmf"] }, "qemu-nvidia-gpu-snp": { - "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"] + "x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-sev"] }, "qemu-nvidia-gpu-snp-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"] + "x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-sev"] }, "qemu-nvidia-gpu-tdx": { - "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"] + "x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-tdx"] }, "qemu-nvidia-gpu-tdx-runtime-rs": { - "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"] + "x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-base", "rootfs-image-nvidia-gpu-addon", "rootfs-image-coco-addon", "ovmf-tdx"] }, "qemu-coco-dev": { "x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-addon"],