Commit Graph

15773 Commits

Author SHA1 Message Date
Cameron Baird
bceffd5ff6 genpolicy: Introduce UpdateInterfaceRequest rules in genpolicy-settings
Introduce rules for UpdateInterfaceRequest and genpolicy tests for them.

Signed-off-by: Cameron Baird <cameronbaird@microsoft.com>
2025-03-13 17:30:01 +00:00
Saul Paredes
1c406e9c1d
Merge pull request #11004 from microsoft/cameronbaird/updateroutesrequest-hardening-upstream
genpolicy: Introduce UpdateRoutesRequest rules in genpolicy-settings
2025-03-13 10:11:39 -07:00
Saul Paredes
7a5db51c80 policy: validate pod generated name
Validate sandbox name using a regex. If the YAML specifies metadata.name, use a regex that exact matches.
If the YAML specifies metadata.generateName, use a regex that matches the prefix of the generated name.

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
2025-03-13 09:49:57 -07:00
Steve Horsman
e6a78e64e6
Merge pull request #10967 from stevenhorsman/coco-tests-required
ci: Add coco required tests
2025-03-13 15:10:22 +00:00
mchtech
0e61eb215d tools: initialize unbound variables in rootfs.sh
Initialize unbound variables in rootfs.sh for RHEL series OS.

Signed-off-by: mchtech <michu_an@126.com>
2025-03-13 22:57:43 +08:00
Fupan Li
592d58ca52
Merge pull request #11001 from RuoqingHe/enable-riscv-kernel-build
kernel: Support and enable riscv kernel build
2025-03-13 19:28:00 +08:00
Ruoqing He
e0fb8f08d8 ci: Add riscv-builder to actionlint.yaml
We have three SG2042 connected and labeled as `riscv-builder`, add that
entry to `actionlint.yaml` to help linting while setting up workflows.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
a7e953c7a7 ci: Enable static-tarball build for riscv64
Enable `kernel` and `virtiofsd` static-tarball build for riscv64. Since
`virtiofsd` was previously supported and `kernel` is supported now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
3c8a8ca9c2 kernel: Enable riscv kernel build
Modify `build-kernel.sh` to enable building of riscv64 kernel.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
e316f633d8 kernel: Bump kata_config_version
Bump kata_config_version since riscv kernel build is introduced.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
31446b8be8 kernel: Skip ACPI common fragment for riscv
ACPI is not yet ratified and is still frequently evolving, disable
acpi.conf for riscv architecture.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
ebd1214b2e kernel: Introduce riscv mmu fragment conf
Memory hotplug and related features is required, enable them in
`mmu.conf`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
734f5d07a9 kernel: Introduce riscv pci fragment conf
AIA (Advanced Interrupt Architecture) is available and enabled by
default after v6.10 kernel, provide pci.conf to make proper use of IMSIC
of AIA.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
19d78ca844 kernel: Introduce riscv base fragment conf
Create `riscv` folder for riscv64 architecture to be inferred while
constructing kernel configuration, and introduce `base.conf` which
builds 64-bit kernel and with KVM built-in to kernel.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Cameron Baird
cf129f3744 genpolicy: Introduce UpdateRoutesRequest rules in genpolicy-settings
Introduce rule to block routes from source addresses which are the
loopback. Block routes added to the lo device.

Signed-off-by: Cameron Baird <cameronbaird@microsoft.com>
2025-03-12 19:03:57 +00:00
Dan Mihai
71d4ad5fca
Merge pull request #11003 from microsoft/mahuber/grpc-1-58-3
runtime: upgrade grpc vendor dependency
2025-03-12 09:23:07 -07:00
Wainer Moschetta
8c2d1b374c
Merge pull request #10892 from ldoktor/webhook
ci: Change the way we modify runtimeclass in webhook
2025-03-12 12:32:45 -03:00
RuoqingHe
386fed342c
Merge pull request #10990 from kata-containers/shell-check-vendor-skip
workflows: shellcheck: Expand vendor ignore
2025-03-12 21:34:26 +08:00
Alex Lyn
fdc0d81198
Merge pull request #10994 from teawater/swap7
runtime-rs: Add guest swap support
2025-03-12 17:59:00 +08:00
Hui Zhu
796eab3bef runtime-rs: Update swap option of configuration file
Remove swap configuration from qemu config file because runtime-rs
qemu support code doesn't support hotplug block device.
Add swap configuration to dragonball and cloud-hypervisor config file.

Fixes: #10988

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-12 13:51:35 +08:00
Dan Mihai
4f41989a6a
Merge pull request #11009 from mythi/e2e-skip-flaky-tests
tests: k8s: skip trusted storage tests for qemu-tdx
2025-03-11 12:13:35 -07:00
Dan Mihai
e40251d9f8
Merge pull request #11006 from ryansavino/fix-confidential-ssh-dockerfile
tests: fix confidential ssh Dockerfile
2025-03-11 11:22:23 -07:00
Aurélien Bombo
33f3a8cf5f
Merge pull request #10973 from microsoft/danmihai1/main
ci: temporarily avoid using the Mariner Host image
2025-03-11 10:24:00 -05:00
Steve Horsman
420b282279
Merge pull request #10948 from RuoqingHe/better-matrix
ci: Refactor matrix for `build-checks`
2025-03-11 14:13:10 +00:00
Mikko Ylinen
71531a82f4 tests: k8s: skip trusted storage tests for qemu-tdx
follow other TEEs to skip trusted storage tests due to #10838.

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-11 15:14:03 +02:00
Hui Zhu
93cd30862d libs: Add AddSwapPath to service AgentService
AddSwap send the pci path to guest kernel to let it add swap device.
But some mmio device doesn't have pci path.  To support it add
AddSwapPath send virt_path to guest kernel as swap device.

Fixes: #10988

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 16:02:48 +08:00
Hui Zhu
7787340ab6 runtime-rs: Add guest swap support
This commit add guest swap support.

When configuration enable_guest_swap is enabled, runtime-rs will start a
swap task.
When the VM start or update the guest memory, the swap task will be
waked up to create and insert a swap file.

Before this job, swap task will sleep some seconds (set by configuration
guest_swap_create_threshold_secs) to reduce the impact on guest kernel
boot performance and prevent the insertion of multiple swap files due to
frequent memory elasticity within a short period.

The size of swap file is set by configuration guest_swap_size_percent.
The percentage of the total memory to be used as swap device.

Fixes: #10988

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 16:02:31 +08:00
Hui Zhu
4cd9d70c4d runtime-rs: Add is_direct to struct BlockConfig
Add is_direct to struct BlockConfig.
This option specifies cache-related options for block devices.
Denotes whether use of O_DIRECT (bypass the host page cache) is enabled.
If not set, use configurarion block_device_cache_direct.

Fixes: #10988

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-11 15:44:40 +08:00
Ryan Savino
1dbe3fb8bc tests: fix confidential ssh Dockerfile
Need to set correct permissions for ssh directories and files

Fixes: #11005

Signed-Off-By: Ryan Savino <ryan.savino@amd.com>
2025-03-10 18:31:05 -05:00
Dan Mihai
e8405590c1 ci: temporarily avoid using the Mariner Host image
Disable the Mariner host during CI, while investigating test failures
with new Cloud Hypervisor v43.0.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-10 20:15:09 +00:00
Steve Horsman
730e007abd
Merge pull request #11000 from microsoft/danmihai1/print-exec-output2
tests: k8s: log kubectl exec ouput
2025-03-10 09:31:41 +00:00
Fupan Li
df9c6ae9d7
Merge pull request #10998 from teawater/ma_config
runtime-rs: Add mem-agent config to clh and qemu config file
2025-03-10 16:23:20 +08:00
Dan Mihai
509e6da965 tests: k8s-env.bats: log exec output
Log the "kubectl exec" ouput, just in case it helps investigate sporadic
test errors like:

https://github.com/kata-containers/kata-containers/actions/runs/13724022494/job/38387329321?pr=10973

not ok 1 Environment variables
(in test file k8s-env.bats, line 37)
 `grep "HOST_IP=\([0-9]\+\(\.\|$\)\)\{4\}"' failed

It appears that the first exec from this test case produced the expected
output:

MY_POD_NAME=test-env

but the second exec produced something else - that will be logged after
this change.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:37:20 +00:00
Dan Mihai
95d47e4d05 tests: k8s-configmap.bats: log exec output
Log the "kubectl exec" ouput, just in case it helps investigate sporadic
test errors like:

https://github.com/kata-containers/kata-containers/actions/runs/13724022494/job/38387329268?pr=10973

not ok 1 ConfigMap for a pod
(in test file k8s-configmap.bats, line 44)
`kubectl exec $pod_name -- "${exec_command[@]}" | grep "KUBE_CONFIG_2=value-2"' failed

It appears that the first exec from this test case produced the expected
output:

KUBE_CONFIG_1=value-1

but the second exec produced something else - that will be logged after
this change.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:35:45 +00:00
Dan Mihai
caee12c796 tests: k8s: add function to log exec output
grep_pod_exec_output invokes "kubectl exec", logs its output, and checks
that a grep pattern is present in the output.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-07 19:34:57 +00:00
Steve Horsman
014ff8476a
Merge pull request #10992 from microsoft/danmihai1/git-helper
gha: always delete workspace on rebase error
2025-03-07 14:26:00 +00:00
Steve Horsman
cb682ef3c8
Merge pull request #10987 from RuoqingHe/enable-docker-on-riscv
kata-deploy: Use docker.io for all architectures
2025-03-07 11:14:19 +00:00
Xuewei Niu
0671252466
Merge pull request #10760 from lifupan/route_flags_suport 2025-03-07 18:18:01 +08:00
Hui Zhu
691430ca95 runtime-rs: Add mem-agent config to clh and qemu config file
Add mem-agent config to clh and qemu config file.

Fixes: #10996

Signed-off-by: Hui Zhu <teawater@antgroup.com>
2025-03-07 15:54:59 +08:00
Fupan Li
9a4c0a5c5c agent: add the route flags support when adding routes
Get the route entry's flags passed from host and
set it in the add route request.

Fixes: #7934

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
d929bc0224 agent: refactor the code of update routes/interfaces
We can use the netlink update method to add a route or an interface
address. There is no need to delete it first and then add it. This can
save two system commissions.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
aad915a7a1 agent: upgrade the netlink related crates
Upgrade rtnetlink and related crates to support
route flags.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
0995c6528e runtime-rs: add the route flags support
Get the route entry's flags from the host and
pass it into kata-agent to add route entries
with flags support.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
cda6d0e36c runtime-rs: upgrade the netlink related crates
Upgrade netlink-packet-route and rtnetlink to support
route flags.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Fupan Li
1ade2a874f runtime: add the flags support to the route setting
We should support the flags when add the route from
host to guest. Otherwise, some route would be set
failed.

Fixes: #7934

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-07 09:56:08 +08:00
Dan Mihai
7b63f256e5 gha: fix git-helper issues reported by shellcheck
./tests/git-helper.sh:20:5: note: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
./tests/git-helper.sh:22:26: note: Double quote to prevent globbing and word splitting. [SC2086]
./tests/git-helper.sh:23:7: note: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-06 20:28:41 +00:00
Dan Mihai
04adcdace6 gha: always delete workspace on rebase error
The workplace was already being deleted on non-x86_64 platforms, but
x86_64 can be affected by the same problem too. That might have been
the case with the SNP and TDX test runs from:

https://github.com/kata-containers/kata-containers/actions/runs/13687511270/job/38313758751?pr=10973
https://github.com/kata-containers/kata-containers/actions/runs/13687511270/job/38313760086?pr=10973

Rebase worked fine for the same patch/PR on other platforms.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-06 20:24:09 +00:00
Ruoqing He
3a8131349e kata-deploy: Use docker.io for all archietcutres
Switch to `docker.io` provided by Ubuntu sources. It is not necessary
for us to install docker through `get-docker.sh`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-07 02:22:31 +08:00
RuoqingHe
8ef8109b2f
Merge pull request #10985 from RuoqingHe/remove-s390x-conditional-compilation
runtime-rs: Remove s390x conditional compilation
2025-03-06 23:13:11 +08:00
Pavel Mores
133528a63c runtime-rs: remove snp_certs_path support
SNP certs were apparently obsoleted by AMD.

Signed-off-by: Pavel Mores <pmores@redhat.com>
2025-03-06 15:53:24 +01:00