Commit Graph

1646 Commits

Author SHA1 Message Date
Steve Horsman
44bab5afc4
Merge pull request #11091 from fidencio/topic/ci-add-kata-deploy-tests-as-required
gatekeeper: Add kata-deploy tests as required
2025-03-28 11:05:03 +00:00
Fabiano Fidêncio
5a08d748b9
Merge pull request #11088 from kimullaa/fix-cleanup-failure
kata-deploy: Fix kata-cleanup's CrashLoopBackOff
2025-03-27 20:33:52 +01:00
Fabiano Fidêncio
700944c420 gatekeeper: Add kata-deploy tests as required
kata-deploy tests have been quite stable, working for more than 10 days
without any nightly failure (or any failure reported at all), and I'll
be the one maintaining those.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-27 19:47:38 +01:00
Steve Horsman
97bd311a66
Merge pull request #11058 from stevenhorsman/required-static-checks-rename
ci: Update static-checks strings
2025-03-27 12:56:28 +00:00
Shunsuke Kimura
9ab6ab9897 kata-deploy: Fix kata-cleanup's CrashLoopBackOff
Since kata-deploy.sh references an undefined variable,
kata-cleanup.yaml enters a CrashLoopBackOff state.

```
$ kubectl apply -f https://raw.githubusercontent.com/kata-containers/kata-containers/main/tools/packaging/kata-deploy/kata-cleanup/base/kata-cleanup.yaml
daemonset.apps/kubelet-kata-cleanup created

$ kubectl get pods -n kube-system
kubelet-kata-cleanup-zzbd2        0/1     CrashLoopBackOff   3 (33s ago)     80s

$ kubectl logs -n kube-system daemonsets/kubelet-kata-cleanup
/opt/kata-artifacts/scripts/kata-deploy.sh: line 19: SHIMS: unbound variable
```

Therefore, set an initial value for the environment variables.

Fixes: #11083

Signed-off-by: Shunsuke Kimura <pbrehpuum@gmail.com>
2025-03-27 15:00:19 +09:00
RuoqingHe
f6a1c6d0e0
Merge pull request #11069 from kimullaa/exit-if-action-is-invalid
kata-deploy: return exit code for invalid argument
2025-03-24 09:40:39 +08:00
Shunsuke Kimura
e5d7414c33 kata-deploy: Return exit code for invalid argument
It hangs when invalid arguments are specified.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh xxx
Action:
* xxx
...
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
...
^C <- hang
```

I changed it to behave the same as when there are no arguments.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
kata-deploy-6sr2p:/# echo $?
1
```

Fixes: #11068

Signed-off-by: Shunsuke Kimura <pbrehpuum@gmail.com>
2025-03-22 21:32:38 +09:00
stevenhorsman
70d32afbb7 ci: Remove metrics tests from required list
The metrics tests haven't been stable, or required through
github for many week now, so update the required-tests.yaml
list to re-sync

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-20 16:03:03 +00:00
stevenhorsman
607b27fd7f ci: Update static-checks strings
With the refactor in #10948 the names of
the static checks has changed, so update these.

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-20 13:45:57 +00:00
Mikko Ylinen
f52a565834 build: drop libtdx-attest
with the latest CoCo guest-components, tdx-attester no longer
depends on libtdx attest. Stop installing it to the rootfs.

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-20 10:45:30 +02:00
stevenhorsman
fad248ef09 release: Bump version to 3.15.0
Bump VERSION and helm-chart versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 17:28:06 +00:00
Adithya Krishnan Kannan
32dbee8d7e CI: Mark SNP as a Required test
The SNP CI has been consistently passing and we request the @kata-containers/architecture-committee to mark this test as a required test.

Signed-Off-By: Adithya Krishnan Kannan <AdithyaKrishnan.Kannan@amd.com>
2025-03-14 12:48:55 -05:00
RuoqingHe
810a6dafad
Merge pull request #10939 from mchtech/fix-unbound-var
tools: initialize unbound variables in rootfs.sh
2025-03-14 08:22:05 +08:00
Steve Horsman
e6a78e64e6
Merge pull request #10967 from stevenhorsman/coco-tests-required
ci: Add coco required tests
2025-03-13 15:10:22 +00:00
mchtech
0e61eb215d tools: initialize unbound variables in rootfs.sh
Initialize unbound variables in rootfs.sh for RHEL series OS.

Signed-off-by: mchtech <michu_an@126.com>
2025-03-13 22:57:43 +08:00
Ruoqing He
3c8a8ca9c2 kernel: Enable riscv kernel build
Modify `build-kernel.sh` to enable building of riscv64 kernel.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
e316f633d8 kernel: Bump kata_config_version
Bump kata_config_version since riscv kernel build is introduced.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
31446b8be8 kernel: Skip ACPI common fragment for riscv
ACPI is not yet ratified and is still frequently evolving, disable
acpi.conf for riscv architecture.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
ebd1214b2e kernel: Introduce riscv mmu fragment conf
Memory hotplug and related features is required, enable them in
`mmu.conf`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
734f5d07a9 kernel: Introduce riscv pci fragment conf
AIA (Advanced Interrupt Architecture) is available and enabled by
default after v6.10 kernel, provide pci.conf to make proper use of IMSIC
of AIA.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Ruoqing He
19d78ca844 kernel: Introduce riscv base fragment conf
Create `riscv` folder for riscv64 architecture to be inferred while
constructing kernel configuration, and introduce `base.conf` which
builds 64-bit kernel and with KVM built-in to kernel.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-13 13:43:29 +08:00
Steve Horsman
cb682ef3c8
Merge pull request #10987 from RuoqingHe/enable-docker-on-riscv
kata-deploy: Use docker.io for all architectures
2025-03-07 11:14:19 +00:00
Ruoqing He
3a8131349e kata-deploy: Use docker.io for all archietcutres
Switch to `docker.io` provided by Ubuntu sources. It is not necessary
for us to install docker through `get-docker.sh`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-07 02:22:31 +08:00
stevenhorsman
a40d5d3daa ci: Add arm64 K8s tests as required
This is based on the request from @fidencio, who
is one of the maintainers
2025-03-06 14:39:04 +00:00
stevenhorsman
f45b398170 ci: Add coco required tests
Add the zvsi and nontee coco tests to the required jobs list

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-06 14:38:52 +00:00
Hyounggyu Choi
bf41618a84
Merge pull request #10862 from BbolroC/enable-ibm-se-for-qemu-runtime-rs
runtime-rs: Enable IBM SE for QEMU
2025-03-06 05:38:13 +01:00
Hyounggyu Choi
4ea7d274c4 runtime-rs: Add new runtimeClass qemu-se-runtime-rs
When `KATA_HYPERVISOR` is set to `qemu-se-runtime-rs`,
a configuration file is properly referenced and a runtime class
should be created via kata-deploy.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2025-03-05 13:50:38 +01:00
stevenhorsman
e33ad56cf4 kernel: bump kata_config_version
Bump kernel version as the build-kernel script
was updated (even if there was no functional change).

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:39:10 +00:00
stevenhorsman
67bfd4793e shellcheck: Fix shellcheck SC2242
> Can only exit with status 0-255. Other data should be written to stdout/stderr.

Switch exit -1 to exit 1

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:39:01 +00:00
stevenhorsman
ed8347c868 shellcheck: Fix shellcheck SC2070
> -n doesn't work with unquoted arguments. Quote or use [[ ]]

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:35:46 +00:00
stevenhorsman
dbba6b056b shellcheck: Fix shellcheck SC2148
> Tips depend on target shell and yours is unknown. Add a shebang.

Add
```
#!/usr/bin/env bash
```

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:35:46 +00:00
stevenhorsman
c5ff513e0b shellcheck: Fix shellcheck SC2068
> Double quote array expansions to avoid re-splitting elements

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:35:46 +00:00
stevenhorsman
58672068ff shellcheck: Fix shellcheck SC2145
> Argument mixes string and array. Use * or separate argument.

- Swap echos for printfs and improve formatting
- Replace $@ with $*
- Split arrays into separate arguments

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:35:46 +00:00
stevenhorsman
bc2d7d9e1e osbuilder: Skip shellcheck on test_images.sh
I'm not sure if we use test_images anywhere, so before
we invest the time to fix the 120 shellcheck errors and warnings
we should decide if we want to keep it. See #10957

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-04 09:35:46 +00:00
Zvonko Kaiser
eb2f75ee61 gpu: fix init symlinks
With the recent changes we need to make sure NVRC is symlinked
for init and sbin/init

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-03-03 17:21:59 +00:00
Zvonko Kaiser
3f13023f5f
Merge pull request #10870 from zvonkok/module-signing
gpu: add module signing
2025-03-01 09:51:24 -05:00
Zvonko Kaiser
d971e13446 gpu: Update rootfs.sh
Only source NV scripts if variant starts with "nvidia-gpu"

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-03-01 02:08:29 +00:00
Zvonko Kaiser
94579517d4 shellcheck: Update nvidia_rootfs.sh
With the new rules we need more updates.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 16:36:05 +00:00
Zvonko Kaiser
af1d6c2407 shecllcheck: Update nvidia_chroot.sh
Make shellcheck happy with the new rules new updates
needed

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 16:27:51 +00:00
Fabiano Fidêncio
c95f9885ea kata-deploy: k0s: Fix drop-in path
The drop-in path should be /etc/containerd (from the containers'
perspective), which mounts to the host path /etc/k0s/containerd.d.

With what we had we ended up dropping the file under the
/etc/k0s/containerd.d/containerd.d/, which is wrong.

This is a regression introduce by: 94b3348d3c

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-02-28 16:32:00 +01:00
Zvonko Kaiser
c4e4e14b32 kernel: bump kata_config_version
Mandatory update to have a unique kernel version name

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 15:18:15 +00:00
Stéphane Talbot
f2ba224e6c kata-deploy: Update kata-deploy to support microk8s
Change kata-deploy script and Helm chart in order to be able to use kata-deploy on a microk8s cluster deployed with snap.

Fixes: #10830

Signed-off-by: Stephane Talbot <Stephane.Talbot@univ-savoie.fr>
2025-02-28 10:10:29 +01:00
Zvonko Kaiser
4dadd07699 gpu: Update rootfs.sh
Pass-through KBUILD_SIGN_PIN to the rootfs build

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
5ab3192c51 gpu: Update nvidia_rootfs.sh
We need to handle KBUILD_SIGN_PIN so that the kbuild
can decrypte the signing key

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
493ba63c77 gpu: Provide KBUILD_SIGN_PIN to the build.sh
At the proper step pass-through the var KBUILD_SIGN_PIN
so that the kernel_headers step has the PIN for encrypting
the signing key.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
0309b70522 gpu: Pass-through KBUILD_SIGN_PIN
In kata-deploy-binaries.sh we need to pass-through the var
KBUILD_SIGN_PIN to the other static builder scripts.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
9602ba6ccc gpu: Add proper KBUILD_SIGN_PIN to entry script
Update kata-deploy-binaries-in-docker.sh to read the
env variable KBUILD_SIGN_PIN that either can be set via
GHA or other means.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
39d3b7fb90 gpu: Update NVIDIA chroot script
We need to place the signing key and cert at the right place
and hide the KBUILD_SIGN_PIN from echo'ing or xtrace

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
d815fb6f46 gpu: Update kernel-headers
Use the kernel-headers as the extra_tarball to move the encrypted key
and cert from stage to stage

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00
Zvonko Kaiser
c2cb89532b gpu: Add the proper handling in build-kernel.sh
If KBUILD_SIGN_PIN is provided we can encrypt the signing key
for out-of-tree builds and second round jobs in GHA

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2025-02-28 01:31:35 +00:00