Commit Graph

5900 Commits

Author SHA1 Message Date
Jakob-Naucke
11fe6a3552
osbuilder: Fix USE_DOCKER on s390x
- Install the required protobuf-compiler on Ubuntu
- Install correct libc Rust target (glibc on s390x)
- Do not skip Rust installation on s390x

Fixes: #1266

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-02-09 12:37:24 +01:00
bin
10f1c30f3d kata-runtime: use filepath.Join() to compose file path
Use filepath.Join() will be safer than format string directly.

Signed-off-by: bin <bin@hyper.sh>
2021-02-09 19:37:20 +08:00
Bin Liu
f4ae9c8476 docs: Update Developer-Guide.md
Add description for difference of namespace in containerd and Kuberenetes.

Co-authored-by: Eric Ernst <eric.g.ernst@gmail.com>
Signed-off-by: bin <bin@hyper.sh>
2021-02-09 19:37:14 +08:00
bin
9963428a4d docs: update document for using debug console
Delete using `kata-monitor` to use `kata-runtime exec`

Fixes: #1329

Signed-off-by: bin <bin@hyper.sh>
2021-02-09 19:37:06 +08:00
bin
44cde6e464 runtime: connect guest debug console bypass kata-monitor
Parse agent socket address by conversation to improve usability of
using guest debug console.

Fixes: #1329

Signed-off-by: bin <bin@hyper.sh>
2021-02-09 19:36:48 +08:00
Fabiano Fidêncio
d4c506f270
Merge pull request #1184 from zanetworker/add-e2e-arch-image
Add katacontainers end-to-end arch image
2021-02-09 12:26:23 +01:00
Fabiano Fidêncio
6dbc648c54
Merge pull request #1263 from Jakob-Naucke/s390x-glibc-agent
Build for glibc on s390x
2021-02-09 12:26:02 +01:00
Fabiano Fidêncio
9e2ac11086
Merge pull request #1265 from Jakob-Naucke/s390x-fix-vmlinux
packaging: Fix vmlinux kernel install on s390x
2021-02-09 11:24:04 +01:00
Fabiano Fidêncio
d6682e3168
Merge pull request #1261 from Jakob-Naucke/update-yq
ci: Upgrade to yq 3.4.1
2021-02-09 10:21:14 +01:00
Fabiano Fidêncio
548c459066
Merge pull request #1375 from fidencio/wip/fix-build-kernel
kernel: Don't fail if "experimental" dir doesn't exist
2021-02-09 10:05:54 +01:00
Bin Liu
4e6a39cd25
Merge pull request #1366 from fidencio/wip/kata-deploy-remove-mention-to-docker
kata-deploy: Remove kata-deploy-docker.sh
2021-02-09 16:11:44 +08:00
Fupan Li
5d1432210c
Merge pull request #1352 from liubin/fix/migrate-opentracing-to-opentelemetry
runtime: migrate from opentracing to opentelemetry
2021-02-09 10:18:10 +08:00
bin
3406502706 runtime: add jaeger configuration items
add configuration items in Kata Containers
configuration file to let users specify jaeger
collector address, and user/password.

Signed-off-by: bin <bin@hyper.sh>
2021-02-09 08:02:05 +08:00
Fabiano Fidêncio
fbab262f2d kernel: Don't fail if "experimental" dir doesn't exist
This directory has been automatically removed as there's no files inside
it, as part of d3c9862059

Let's improve the logic in the scripts to avoid failing in case the
"experimental" dir is not present.

Fixes: #1328

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
2021-02-08 21:52:53 +01:00
Fupan Li
f3e9d4e7e3
Merge pull request #1373 from ManaSugi/use-rlimit-crate
rustjail: use rlimit crate
2021-02-08 23:15:37 +08:00
Manabu Sugimoto
e1dce3a369 rustjail: use rlimit crate
The current implementation of rustjail uses the specific setrlimit.
This patch uses rlimit crate for maintainability.

Fixes: #1372

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
2021-02-08 18:43:56 +09:00
Jakob Naucke
8045104eaf ci: Upgrade to yq 3.4.1
Since the resolution of https://github.com/mikefarah/yq/issues/502,
the `yq` binary is no longer broken on s390x. This is an upgrade to
the latest v3 version of yq (v4 has new syntax).

Fixes: #1260

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-02-08 09:29:57 +01:00
Jakob-Naucke
3d3e4dc147
packaging: Fix vmlinux kernel install on s390x
Installing the built uncompressed vmlinux kernel will not work on s390x,
QEMU will complain:
Linux kernel boot failure: An attempt to boot a vmlinux ELF image
failed.
This image does not contain all parts necessary for starting up. Use
bzImage or arch/s390/boot/compressed/vmlinux instead.
Hence, use that kernel image on s390x.

Fixes: #1264

Signed-off-by: Jakob-Naucke <jakob.naucke@ibm.com>
2021-02-08 09:25:26 +01:00
Fupan Li
d54c702539
Merge pull request #1368 from ManaSugi/get_caps_dyn
rustjail: get all capabilities dynamically
2021-02-08 16:00:51 +08:00
Manabu Sugimoto
a252d861e3 rustjail: get all capabilities dynamically
The runtime determines the kernel capability set at runtime.

Fixes: #1370

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
2021-02-07 16:39:14 +09:00
Fabiano Fidêncio
d4391d784d
Merge pull request #1334 from clnperez/ppc64le-protoc
agent: README update to install protoc for ppc64le
2021-02-06 01:08:42 +01:00
Fabiano Fidêncio
7b5e56b274
Merge pull request #1360 from fidencio/wip/qemu-virtiofs-security-fixes
qemu: Add security fixes for CVE-2020-35517
2021-02-05 21:37:46 +01:00
Chelsea Mafrica
a12772c601
Merge pull request #1358 from Tim-Zhang/remove-allow
Fix lints and remove allow attributes which silence these warnings
2021-02-05 12:17:29 -08:00
Fabiano Fidêncio
62cbaf4de4 kata-deploy: Remove kata-deploy-docker.sh
Kata Containers 2.x is not supported outside of the kubernetes world.
With this in mind, let's remove leftovers from the 1.x deployments &
documentation.

Fixes: #1356

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
2021-02-05 15:18:43 +01:00
Fabiano Fidêncio
50fea9fa6f github: Only run kata-deploy-test on pull-requests
We're currently running kata-deploy-test for every issue opened, for
every comment in the issue.  Issues, themselves, shouldn't be triggering
those as they can't cause any code change.

With this in mind, let's restrict ourselves to run those on
pull-requests only.

Fixes: #1341

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
2021-02-05 11:00:32 +01:00
Fabiano Fidêncio
b548114f59 qemu: Add security fixes for CVE-2020-35517
This series is based on
https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg01787.html, and
was kindly brought up by David Gilbert.

Fixes: #1361

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
2021-02-04 22:26:20 +01:00
Christy Norman
11680efe4e agent: README update to install protoc for ppc64le
Add a bit to the agent README about installing protoc manually for Power (ppc64le)

Fixes: #1068

Signed-off-by: Christy Norman <christy@linux.vnet.ibm.com>
2021-02-04 17:03:31 +00:00
Tim Zhang
f16ab49b5b agent: fix non_camel_case_types lint and stop hiding the warning
Fixes: #1359

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-04 21:36:21 +08:00
Tim Zhang
8ffe4d6748 agent: fix unused_parens lint and stop hiding the warning
Fixes: #1359

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-04 21:24:04 +08:00
Tim Zhang
f70ca69d0d agent: remove #![allow(unused_unsafe)]
Fixes: #1359

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-04 21:21:48 +08:00
Tim Zhang
e28bf7a59d agent: fix dead_code lint
Fixes: #1359

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-04 21:18:45 +08:00
Tim Zhang
05da23acb7 agent: fix non_snake_case lint and remove ![allow(non_snake_case)]
Fixes: #1359

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-04 21:18:37 +08:00
Jakob Naucke
afb4197813 osbuilder: Build for glibc on s390x
Since there is no Rust target for musl on s390x, builds on s390x should use
glibc. This commit removes the "Cannot build Rust agent on s390x" restriction
in rootfs.sh and only installs musl in the build environment when it is
required.

Fixes: #1262

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-02-04 09:52:28 +01:00
Jakob Naucke
a1cedc567a agent: Build for glibc on s390x
Since there is no Rust target for musl on s390x, builds on s390x should
use glibc. This commit makes glibc the default on s390x as per the agent
Makefile.

Fixes: #1262

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-02-04 09:51:23 +01:00
Adel Zaalouk
9f237aab54 docs: add katacontainers end-to-end arch image
Added a Katacontainers e2e flow figure, the figure can be used in many places or simply just as a reference.
It contains pieces from Kata 1.x and Kata 2.0 (e.g., kata-monitor).

The figures are produced via excalidraw.com, also in the commit is the
source .excalidraw which can be used to modify the figure if needed.

Fixes #1185

Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
2021-02-04 08:51:36 +01:00
Chelsea Mafrica
38b5a43267
Merge pull request #1318 from jongwu/acpi
arm64: enable acpi for qemu/virt.
2021-02-03 16:37:49 -08:00
Chelsea Mafrica
d4bc5952b1
Merge pull request #1340 from jing-wang4/rootfs-ppc64le
osbuilder: Enforcing LIBC=gnu to rootfs build for ppc64le
2021-02-03 16:06:05 -08:00
Eric Ernst
a1361608a9
Merge pull request #1353 from Tim-Zhang/fix-async
Fix async problems
2021-02-03 14:49:52 -08:00
Chelsea Mafrica
dbfcd4a679
Merge pull request #1345 from liubin/fix/1343-kata-monitor-build-failed
kata-monitor: set buildmode to exe to avoid build failing
2021-02-03 14:40:12 -08:00
Tim Zhang
254b98dd2f rustjail: fix unit test test_process
test_process has a assertion that waitpid(-1) will fail
because there is no child process in most cases.

But if there is any child process forked by other unit test,
the test test_process will fail.

Because waitpid(-1) will wait for any child process including the
process created by other unit tests.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 22:27:50 +08:00
Tim Zhang
b25575b430 agent: remove crate signal-hook which are no longer used
Had replaced by tokio::signal.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 18:30:18 +08:00
Tim Zhang
b1880b3e80 rustjail: remove unnecessary #[async_trait]
Remove unnecessary #[async_trait]

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 18:30:15 +08:00
Tim Zhang
83e9414f4f rustjail: add unittest test_execute_hook
use xargs to test execute_hook.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 18:30:15 +08:00
Tim Zhang
d2041001ed rustjail: close stdin in execute_hook after it was sent
So that hook program could receive EOF.

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 18:30:15 +08:00
Tim Zhang
bb08131151 rustjail: fix fork/child in execute_hook
Tokio in fork child does not work well as it easily deadlocks.
https://github.com/tokio-rs/tokio/issues/1541

Fixes: #1348

Signed-off-by: Tim Zhang <tim@hyper.sh>
2021-02-03 18:30:11 +08:00
bin
17df9b119d runtime: migrate from opentracing to opentelemetry
This commit includes two changes:
- migrate from opentracing to opentelemetry
- add jaeger configuration items

Fixes: #1351

Signed-off-by: bin <bin@hyper.sh>
2021-02-03 17:30:49 +08:00
Jing Wang
71aeb920aa osbuilder: updates for feedback
Updates for review feedback.

Signed-off-by: Jing Wang <jing.wang4@ibm.com>
2021-02-02 14:41:23 +00:00
Tim Zhang
9a02c81eb9
Merge pull request #1313 from liubin/doc/add-distro-desc
osbuilder: add description for how to use DISTRO variable
2021-02-02 15:19:57 +08:00
bin
8e2b19ac77 osbuilder: add description for how to use DISTRO variable
Fixes: #1312

Signed-off-by: bin <bin@hyper.sh>
2021-02-02 14:52:09 +08:00
bin
b6c2a60509 kata-monitor: set buildmode to exe to avoid build failing
CGO_ENABLED=0 and -buildmode=pie are not compatible and may lead build failing in some OS.
Specify buildmode=exe to overwrite the value set in BUILDFLAGS

Fixes: #1343

Signed-off-by: bin <bin@hyper.sh>
2021-02-02 14:47:21 +08:00