1
0
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-05-10 09:27:03 +00:00
Commit Graph

15754 Commits

Author SHA1 Message Date
Hui Zhu
796eab3bef runtime-rs: Update swap option of configuration file
Remove swap configuration from qemu config file because runtime-rs
qemu support code doesn't support hotplug block device.
Add swap configuration to dragonball and cloud-hypervisor config file.

Fixes: 

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-12 13:51:35 +08:00
Dan Mihai
4f41989a6a
Merge pull request from mythi/e2e-skip-flaky-tests
tests: k8s: skip trusted storage tests for qemu-tdx
2025-03-11 12:13:35 -07:00
Dan Mihai
e40251d9f8
Merge pull request from ryansavino/fix-confidential-ssh-dockerfile
tests: fix confidential ssh Dockerfile
2025-03-11 11:22:23 -07:00
Aurélien Bombo
33f3a8cf5f
Merge pull request from microsoft/danmihai1/main
ci: temporarily avoid using the Mariner Host image
2025-03-11 10:24:00 -05:00
Steve Horsman
420b282279
Merge pull request from RuoqingHe/better-matrix
ci: Refactor matrix for `build-checks`
2025-03-11 14:13:10 +00:00
Mikko Ylinen
71531a82f4 tests: k8s: skip trusted storage tests for qemu-tdx
follow other TEEs to skip trusted storage tests due to .

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-11 15:14:03 +02:00
Hui Zhu
93cd30862d libs: Add AddSwapPath to service AgentService
AddSwap send the pci path to guest kernel to let it add swap device.
But some mmio device doesn't have pci path.  To support it add
AddSwapPath send virt_path to guest kernel as swap device.

Fixes: 

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 16:02:48 +08:00
Hui Zhu
7787340ab6 runtime-rs: Add guest swap support
This commit add guest swap support.

When configuration enable_guest_swap is enabled, runtime-rs will start a
swap task.
When the VM start or update the guest memory, the swap task will be
waked up to create and insert a swap file.

Before this job, swap task will sleep some seconds (set by configuration
guest_swap_create_threshold_secs) to reduce the impact on guest kernel
boot performance and prevent the insertion of multiple swap files due to
frequent memory elasticity within a short period.

The size of swap file is set by configuration guest_swap_size_percent.
The percentage of the total memory to be used as swap device.

Fixes: 

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 16:02:31 +08:00
Hui Zhu
4cd9d70c4d runtime-rs: Add is_direct to struct BlockConfig
Add is_direct to struct BlockConfig.
This option specifies cache-related options for block devices.
Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
If not set, use configurarion block_device_cache_direct.

Fixes: 

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 15:44:40 +08:00
Ryan Savino
1dbe3fb8bc tests: fix confidential ssh Dockerfile
Need to set correct permissions for ssh directories and files

Fixes: 

Signed-Off-By: Ryan Savino <ryan.savino@amd.com>
2025-03-10 18:31:05 -05:00
Dan Mihai
e8405590c1 ci: temporarily avoid using the Mariner Host image
Disable the Mariner host during CI, while investigating test failures
with new Cloud Hypervisor v43.0.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-10 20:15:09 +00:00
Steve Horsman
730e007abd
Merge pull request from microsoft/danmihai1/print-exec-output2
tests: k8s: log kubectl exec ouput
2025-03-10 09:31:41 +00:00
Fupan Li
df9c6ae9d7
Merge pull request from teawater/ma_config
runtime-rs: Add mem-agent config to clh and qemu config file
2025-03-10 16:23:20 +08:00
Dan Mihai
509e6da965 tests: k8s-env.bats: log exec output
Log the "kubectl exec" ouput, just in case it helps investigate sporadic
test errors like:

https://github.com/kata-containers/kata-containers/actions/runs/13724022494/job/38387329321?pr=10973

not ok 1 Environment variables
(in test file k8s-env.bats, line 37)
 `grep "HOST_IP=\([0-9]\+\(\.\|$\)\)\{4\}"' failed

It appears that the first exec from this test case produced the expected
output:

MY_POD_NAME=test-env

but the second exec produced something else - that will be logged after
this change.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:37:20 +00:00
Dan Mihai
95d47e4d05 tests: k8s-configmap.bats: log exec output
Log the "kubectl exec" ouput, just in case it helps investigate sporadic
test errors like:

https://github.com/kata-containers/kata-containers/actions/runs/13724022494/job/38387329268?pr=10973

not ok 1 ConfigMap for a pod
(in test file k8s-configmap.bats, line 44)
`kubectl exec $pod_name -- "${exec_command[@]}" | grep "KUBE_CONFIG_2=value-2"' failed

It appears that the first exec from this test case produced the expected
output:

KUBE_CONFIG_1=value-1

but the second exec produced something else - that will be logged after
this change.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:35:45 +00:00
Dan Mihai
caee12c796 tests: k8s: add function to log exec output
grep_pod_exec_output invokes "kubectl exec", logs its output, and checks
that a grep pattern is present in the output.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:34:57 +00:00
Steve Horsman
014ff8476a
Merge pull request from microsoft/danmihai1/git-helper
gha: always delete workspace on rebase error
2025-03-07 14:26:00 +00:00
Steve Horsman
cb682ef3c8
Merge pull request from RuoqingHe/enable-docker-on-riscv
kata-deploy: Use docker.io for all architectures
2025-03-07 11:14:19 +00:00
Xuewei Niu
0671252466
Merge pull request from lifupan/route_flags_suport 2025-03-07 18:18:01 +08:00
Hui Zhu
691430ca95 runtime-rs: Add mem-agent config to clh and qemu config file
Add mem-agent config to clh and qemu config file.

Fixes: 

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-07 15:54:59 +08:00
Fupan Li
9a4c0a5c5c agent: add the route flags support when adding routes
Get the route entry's flags passed from host and
set it in the add route request.

Fixes: 

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
d929bc0224 agent: refactor the code of update routes/interfaces
We can use the netlink update method to add a route or an interface
address. There is no need to delete it first and then add it. This can
save two system commissions.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
aad915a7a1 agent: upgrade the netlink related crates
Upgrade rtnetlink and related crates to support
route flags.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
0995c6528e runtime-rs: add the route flags support
Get the route entry's flags from the host and
pass it into kata-agent to add route entries
with flags support.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
cda6d0e36c runtime-rs: upgrade the netlink related crates
Upgrade netlink-packet-route and rtnetlink to support
route flags.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
1ade2a874f runtime: add the flags support to the route setting
We should support the flags when add the route from
host to guest. Otherwise, some route would be set
failed.

Fixes: 

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Dan Mihai
7b63f256e5 gha: fix git-helper issues reported by shellcheck
./tests/git-helper.sh:20:5: note: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
./tests/git-helper.sh:22:26: note: Double quote to prevent globbing and word splitting. [SC2086]
./tests/git-helper.sh:23:7: note: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-06 20:28:41 +00:00
Dan Mihai
04adcdace6 gha: always delete workspace on rebase error
The workplace was already being deleted on non-x86_64 platforms, but
x86_64 can be affected by the same problem too. That might have been
the case with the SNP and TDX test runs from:

https://github.com/kata-containers/kata-containers/actions/runs/13687511270/job/38313758751?pr=10973
https://github.com/kata-containers/kata-containers/actions/runs/13687511270/job/38313760086?pr=10973

Rebase worked fine for the same patch/PR on other platforms.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-06 20:24:09 +00:00
Ruoqing He
3a8131349e kata-deploy: Use docker.io for all archietcutres
Switch to `docker.io` provided by Ubuntu sources. It is not necessary
for us to install docker through `get-docker.sh`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-07 02:22:31 +08:00
RuoqingHe
8ef8109b2f
Merge pull request from RuoqingHe/remove-s390x-conditional-compilation
runtime-rs: Remove s390x conditional compilation
2025-03-06 23:13:11 +08:00
Pavel Mores
133528a63c runtime-rs: remove snp_certs_path support
SNP certs were apparently obsoleted by AMD.

Signed-off-by: Pavel Mores <pmores@redhat.com>
2025-03-06 15:53:24 +01:00
stevenhorsman
a40d5d3daa ci: Add arm64 K8s tests as required
This is based on the request from @fidencio, who
is one of the maintainers
2025-03-06 14:39:04 +00:00
stevenhorsman
f45b398170 ci: Add coco required tests
Add the zvsi and nontee coco tests to the required jobs list

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-06 14:38:52 +00:00
stevenhorsman
ee0f0b7bfe workflows: shellcheck: Expand vendor ignore
- In the previous PR I only skipped the runtime/vendor
directory, but errors are showing up in other vendor
packages, so try a wildcard skip
- Also update the job step was we can distinguish between the
required and non-required versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-06 14:35:12 +00:00
Manuel Huber
c05b976ebe runtime: upgrade grpc vendor dependency
- remove hard link to v.1.47.0 in go.mod
- run go mod tidy, go mod vendor to actually update to v1.58.3
- addresses CVE-2023-44487

Signed-off-by: Manuel Huber <mahuber@microsoft.com>
2025-03-06 10:00:49 +00:00
Xuewei Niu
644af52968
Merge pull request from lifupan/fupan_containerd
ci: cri-containerd: upgrade the LTS / Active versions for containerd
2025-03-06 17:08:40 +08:00
Hyounggyu Choi
bf41618a84
Merge pull request from BbolroC/enable-ibm-se-for-qemu-runtime-rs
runtime-rs: Enable IBM SE for QEMU
2025-03-06 05:38:13 +01:00
Ruoqing He
ed6f57f8f6 runtime-rs: Restrict cloud-hypervisor feature
Cloud-Hypervisor currently only supports `x86_64` and `aarch64`, this
features should not be avaiable even if other architectures explicitly
requires it.

Restrict `cloud-hypervisor` feature to only `x86_64` and `aarch64`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-06 11:21:57 +08:00
Ruoqing He
6f894450fe runtime-rs: Drop s390x target predicates
Drop `target_arch = "s390x"` all over `runtime-rs`, it is strange to
have such predicates on features and code while we do not support it.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-06 11:20:28 +08:00
Xuewei Niu
a54eed6bab
Merge pull request from teawater/fix_log_level
runtime-rs: Fix log_level's comments in configuration-dragonball.toml.in
2025-03-06 10:05:09 +08:00
Alex Lyn
2619b57411
Merge pull request from Apokleos/bugfix-useless-annotation
kata-types: Fix bugs related to annotations in kata-types
2025-03-06 09:37:29 +08:00
Hyounggyu Choi
c3e3ef7b25
Merge pull request from BbolroC/remove-sclp-console-s390x
runtime: Remove console=ttysclp0 for s390x
2025-03-05 21:43:57 +01:00
Fabiano Fidêncio
80e95bd264
Merge pull request from kata-containers/topic/tests-bring-back-kata-deploy-tests
tests: Bring back kata-deploy tests
2025-03-05 21:11:21 +01:00
Zvonko Kaiser
ae63bbb824
Merge pull request from zvonkok/fix-zvonkos-fix
agent: fix permisssion according to runc
2025-03-05 15:08:48 -05:00
Fabiano Fidêncio
545780a83a shellcheck: tests: k8s: Fix gha-run.sh warnings
As we'll touch this file during this series, let's already make sure we
solve all the needed warnings.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00
Fabiano Fidêncio
50f765b19c shellcheck: tests: Fix gha-run-k8s-common.sh warnings
Let's fix all the warnings caught in this file, as we're already
touching it.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00
Fabiano Fidêncio
219db60071 tests: kata-deploy: microk8s: Re-work installation
So we can ensure that the user has enough permissions to access
microk8s.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00
Fabiano Fidêncio
c337a21a4e shellcheck: kata-deploy: Fix warnings
He were fixing the few warnings we found in the files present in the
functional tests for kata-deploy.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00
Fabiano Fidêncio
fd832d0feb tests: kata-deploy: Run installation with only one VMM
It doesn't make much sense to test different VMMs as that wouldn't
trigger a different code path.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00
Fabiano Fidêncio
14bf653c35 tests: kata-deploy: Re-add tests, now using github runners
As GitHub runners now support nested virt, we're don't depend on garm
for those anymore.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-05 19:44:27 +01:00