1597 Commits

Author SHA1 Message Date
GabyCT
4b257bcbb6 Merge pull request #10255 from Sumynwa/sumsharma/metrics_ci_kill_kata_components
ci: send SIGKILL to kill kata components
2024-09-05 12:04:57 -06:00
Aurélien Bombo
cc9aeee81a Merge pull request #10263 from Sumynwa/sumsharma/add_ci_workflow
ci: Add workflow to run kata-agent api tests using kata-agent-ctl
2024-09-05 09:32:34 -07:00
Dan Mihai
7ab95b56f1 Merge pull request #10251 from microsoft/saulparedes/support_readonly_hostpath
genpolicy: support readonly hostpath
2024-09-05 09:27:15 -07:00
GabyCT
deb6d12ff6 Merge pull request #10237 from GabyCT/topic/k8soakcoco
tests: Enable k8s soak stability test for Kata CoCo CI
2024-09-05 09:56:48 -06:00
Gabriela Cervantes
fcc35dd3a7 metrics: Update openVINO and oneDNN tests references
This PR updates the machine learning tests references or urls for the
openVINO and oneDNN scripts as currently they are refering to a different
performance benchmark.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-09-05 15:39:21 +00:00
Fabiano Fidêncio
70491ff29f Merge pull request #10244 from BbolroC/turn-on-kbs-qemu-coco-dev-s390x
gha: Turn on KBS for qemu-coco-dev on s390x
2024-09-05 13:02:42 +02:00
Sumedh Alok Sharma
ad66f4dfc9 ci: Add workflow to run kata-agent api tests using kata-agent-ctl
enable CI to add test cases for testing kata-agent APIs. This commit
introduces:
- a workflow to run tests
- setup scripts to prepare the test environment

Fixes #10262

Signed-off-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
2024-09-05 14:38:29 +05:30
Saul Paredes
24c2d13fd3 genpolicy: support readonly emptyDir mount
Set emptyDir access based on volume mount readOnly value

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
2024-09-04 15:05:44 -07:00
Saul Paredes
36a4104753 genpolicy: support readonly hostpath
Set hostpath access based on volume mount readOnly value

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
2024-09-04 14:55:22 -07:00
Sumedh Alok Sharma
4025468e27 ci: send SIGKILL to kill kata components
metrics tests sometimes fail with kata components still running.
sending SIGKILL and waiting for the processes to reap.

Fixes #8651

Signed-off-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
2024-09-04 18:58:17 +05:30
Fabiano Fidêncio
13517cf9c1 Merge pull request #10192 from fidencio/topic/helm-add-post-delete-job
helm: Several fixes, including some reasonable re-work on kata-deploy.sh script
2024-09-04 09:34:57 +02:00
Fabiano Fidêncio
a773797594 ci: Pass --debug to helm
Just to make ourlives a little bit easier.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-09-03 23:08:22 +02:00
Wainer dos Santos Moschetta
3b23d62635 tests/k8s: fix wait for pods on deploy-kata action
On commit 51690bc157 we switched the installation from kubectl to helm
and used its `--wait` expecting the execution would continue when all
kata-deploy Pods were Ready. It turns out that there is a limitation on
helm install that won't wait properly when the daemonset is made of a
single replica and maxUnavailable=1. In order to fix that issue, let's
revert the changes partially to keep using kubectl and waitForProcess
to the exection while Pods aren't Running.

Fixes #10168
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-09-03 23:08:22 +02:00
Fabiano Fidêncio
40f8aae6db Reapply "ci: make cleanup_kata_deploy really simple"
This reverts commit 21f9f01e1d, as the
pacthes for helm are coming as part of this series.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-09-03 23:08:22 +02:00
Fabiano Fidêncio
cfe6e4ae71 Reapply "ci: Use helm to deploy kata-deploy" (partially)
This reverts commit 36f4038a89, as the
pacthes for helm are coming as part of this series.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-09-03 23:08:22 +02:00
Fabiano Fidêncio
424347bf0e Reapply "kata-deploy: Add Helm Chart" (partially)
This reverts commit b18c3dfce3, as the
pacthes for helm are coming as part of this series.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-09-03 23:08:22 +02:00
Gabriela Cervantes
5b0ab7f17c metrics: Remove metrics report for Kata Containers
This PR removes the metrics report which is not longer being used
in Kata Containers.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-09-03 16:11:07 +00:00
Hyounggyu Choi
b0a912b8b4 tests: Enable KBS deployment for qemu-coco-dev on s390x
To deploy KBS on s390x, the environment variable `IBM_SE_CREDS_DIR`
must be exported, and the corresponding directory must be created.

This commit enables KBS deployment for `qemu-coco-dev`, in addition
to the existing `qemu-se` support on the platform.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-09-03 15:51:18 +02:00
Fabiano Fidêncio
e8657c502d Revert "CI: Add tests for stdio"
This reverts commit 704da86e9b, as the
tests never became stable to run.

This was discussed and agreed with the maintainer.

 Conflicts:
	.github/workflows/basic-ci-amd64.yaml
	tests/integration/stdio/gha-run.sh

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-09-03 11:52:30 +02:00
Gabriela Cervantes
825cb2d22e tests: Enable k8s soak stability test for Kata CoCo CI
This PR enables the k8s soak stability test to run on the weekly
Kata CoCo stability CI.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-09-02 16:30:44 +00:00
Gabriela Cervantes
aa8635727d metrics: Remove unused variable in oneDNN benchmark
This PR removes an unused variable in oneDNN metrics benchmark.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-29 15:52:47 +00:00
GabyCT
dd9f41547c Merge pull request #10160 from microsoft/saulparedes/support_priority_class
genpolicy: add priorityClassName as a field in PodSpec interface
2024-08-28 14:36:20 -06:00
Archana Choudhary
ae2cdedba8 genpolicy: add priorityClassName as a field in PodSpec interface
This allows generation of policy for pods specifying priority classes.

Signed-off-by: Archana Choudhary <archana1@microsoft.com>
2024-08-27 19:54:02 -07:00
Gabriela Cervantes
3affde5b28 docs: Add oneDNN benchmark information to metrics README
This PR adds the oneDNN benchmark information to the machine
learning metrics README.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-27 16:32:50 +00:00
Aurélien Bombo
a3dba3e82b ci: reinstate Mariner host
GH-9592 addressed a bug in a previous version of the AKS Mariner host
kernel that blocked the CH v39 upgrade. This bug has now been fixed so
we undo that PR.

Note we also specify a different OCI version for Mariner as it differs
from Ubuntu's.

Fixes: #9594

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2024-08-26 21:07:25 +00:00
GabyCT
6b0272d6bf Merge pull request #10193 from GabyCT/topic/k8ssoak
stability: Add kubernetes parallel test
2024-08-23 15:51:01 -06:00
GabyCT
83177efb9b Merge pull request #10201 from GabyCT/topic/readmeopenvino
metrics: Add OpenVINO general information into README
2024-08-23 14:11:26 -06:00
Hyounggyu Choi
4cd83d2b98 Merge pull request #10202 from BbolroC/fix-k8s-tests-s390x
tests: Fix k8s test issues on s390x
2024-08-23 09:51:11 +02:00
Archana Shinde
b0be03a93f Revert "tests: add image check before running coco tests"
This reverts commit 41b7577f08.

We were seeing a lot of issues in the TDX CI of the nature:

"Error: failed to create containerd container: create instance
470: object with key "470" already exists: unknown"

With the TDX CI, we moved to having the nydus snapsotter pre-installed.
Essentially the `deploy-snapshotter` step was performed once before any
actual CI runs.
We were seeing failures related to the error message above.

On reverting this change, we are no longer seeing errors related to
"key exists" with the TDX CI passing now.

The change reverted here is related to downloading incomplete images, but this
seems to be messing up TDX CI.
It is possible to pass --snapshotter to `ctr image check` but that does
not seem to have any effect on the data set returned.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
2024-08-22 18:05:42 -07:00
Gabriela Cervantes
2fa8e85439 metrics: Add OpenVINO general information into README
This PR adds the OpenVINO benchmark general information into the
machine learning README metrics information.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-22 16:08:06 +00:00
Hyounggyu Choi
274de8c6af tests: Introduce wait_time to k8s_create_pod()
In certain environments (e.g., those with lower performance), `k8s_create_pod()`
may require additional wait time, especially when dealing with large images.
Since `k8s_wait_pod_be_ready()` — which is called by `k8s_create_pod()` — already
accepts `wait_time` as a second argument, it makes sense to introduce `wait_time`
to `k8s_create_pod()` and propagate it to the callee.

This commit adds `wait_time` to `k8s_create_pod()` as the 2nd (optional) argument.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-08-22 17:46:53 +02:00
Hyounggyu Choi
5d7397cc69 tests: Load confidential_kbs.sh in k8s-guest-pull-iamge.bats
Some of the tests call set_metadata_annotation() for updating the kernel
parameters. For `kata-qemu-se`, repack_secure_image() is called which is
defined in `lib_se.sh` and sourced by `confidential_kbs.sh`.

This commit ensures that the function call chain for the relevant
`KATA_HYPERVISOR` is properly handled.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-08-22 17:33:38 +02:00
GabyCT
3fd108b09a Merge pull request #10198 from GabyCT/topic/remvaropenvino
metrics: Remove unused variable in openvino script
2024-08-21 15:48:56 -06:00
Dan Mihai
8ccc8a8d0b Merge pull request #9911 from microsoft/saulparedes/mounts
genpolicy: deny UpdateEphemeralMountsRequest
2024-08-21 10:12:28 -07:00
Gabriela Cervantes
59e31baaee metrics: Remove unused variable in openvino script
This PR removes an unused variable in the openvino script for kata
metrics.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-21 16:05:55 +00:00
Gabriela Cervantes
27d5539954 stability: Add pod deployment yaml for soak test
This PR adds the pod deployment yaml for soak test which is part
of the stability k8s tests.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-21 14:23:22 +00:00
Dan Mihai
6654491cc3 genpolicy: deny UpdateEphemeralMountsRequest
* genpolicy: deny UpdateEphemeralMountsRequest

Deny UpdateEphemeralMountsRequest by default, because paths to
critical Guest components can be redirected using such request.

Signed-off-by: Dan Mihai <Daniel.Mihai@microsoft.com>
2024-08-20 18:28:17 -07:00
Gabriela Cervantes
c04a805215 stability: Add kubernetes parallel test
This PR adds a kubernetes parallel test that will launch multiple replicas
from a kubernetes deployment and we will iterate this multiple times to
verify that we are able to do this using CoCo Kata. This test will be
part of the CoCo Kata stability CI.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-08-20 23:24:22 +00:00
Fabiano Fidêncio
b18c3dfce3 Revert "kata-deploy: Add Helm Chart" (partially)
This partially reverts commit 94b3348d3c,
as there's more work needed in order to have this one done in a robust
way, and we are taking the safer path of reverting for now, and adding
it back as soon as the release is cut out.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-08-21 00:09:11 +02:00
Fabiano Fidêncio
36f4038a89 Revert "ci: Use helm to deploy kata-deploy" (partially)
This partially reverts commit 51690bc157,
as there's more work needed in order to have this one done in a robust
way, and we are taking the safer path of reverting for now, and adding
it back as soon as the release is cut out.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-08-21 00:09:11 +02:00
Fabiano Fidêncio
21f9f01e1d Revert "ci: make cleanup_kata_deploy really simple"
This reverts commit 1221ab73f9, as there's
more work needed in order to have this one done in a robust way, and we
are taking the safer path of reverting for now, and adding it back as
soon as the release is cut out.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2024-08-21 00:09:11 +02:00
GabyCT
e0bff7ed14 Merge pull request #10177 from GabyCT/topic/cocoghas
gha: Add k8s stability Kata CoCo GHA workflow
2024-08-20 15:12:29 -06:00
Fabiano Fidêncio
aeb6f54979 Merge pull request #10180 from fidencio/topic/ci-ensure-the-key-was-created-on-kbs
ci: Ensure the KBS resources are created
2024-08-20 09:07:56 +02:00
Fabiano Fidêncio
40d385d401 Merge pull request #10188 from wainersm/kbs_key
tests/k8s: check and save kbs.key
2024-08-19 23:29:10 +02:00
Fabiano Fidêncio
c0d7222194 ci: Ensure the KBS resources are created
Otherwise we may have tests failing due to the resource not being
created yet.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-08-19 23:27:06 +02:00
Wainer dos Santos Moschetta
e014eee4e8 tests/k8s: check and save kbs.key
The deploy-kbs.sh script generates the kbs.key that's used to install
KBS. This same file is used lately by kbs-client to authenticate. This ensures
that the file was created, otherwise fail.

Another problem solved here is that on bare-metal machines the key doesn't survive
a reboot as it is created in a temporary directory (/tmp/trustee). So let's save
the file to a non-temporary location.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-08-19 16:03:03 -03:00
Fabiano Fidêncio
dd2d9e5524 ci: stdio: Fix typo on getting the containerd version
I assume the PR that introduced this was based on an older version of
yq, and as the test couldn't run before it got merged we never noticed
the error.

However, this test has been failing for a reasonable amount of time,
which makes me think that we either need a maintainer for it, or just
remove it completely, but that's a discussion for another day.

For now, let's make it, at least, run.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-08-17 14:06:24 +02:00
Fabiano Fidêncio
0831081399 ci: k8s: Replace nginx alpine images
The previous ones are gone, so let's switch to our own multi-arch image
for the tests.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-08-17 12:19:33 +02:00
Dan Mihai
79c1d0a806 Merge pull request #10136 from microsoft/danmihai1/docker-image-volume2
genpolicy: add bind mounts for image volumes
2024-08-16 13:07:01 -07:00
Fabiano Fidêncio
28aa4314ba Merge pull request #10175 from ChengyuZhu6/error_message
runtime: Add specific error message for gRPC request timeouts
2024-08-16 22:06:49 +02:00