Commit Graph

11014 Commits

Author SHA1 Message Date
Jeremi Piotrowski
e201544145 tools/osbuilder/tests: Remove TRAVIS variable
The last remaining user of the TRAVIS variable in this repo is
tools/osbuilder/tests and it is only used to skip spinning up VMs. Travis
didn't support virtualization and the same is true for github actions hosted
runners. Replace the variable with KVM_MISSING and determine availability of
/dev/kvm at runtime.

TRAVIS is also used by '.ci/setup.sh' in kata-containers/tests to reduce the
set of dependencies that gets installed, but this is also in the process of
being removed.

Fixes: #3544
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-20 12:19:35 +01:00
Jeremi Piotrowski
cdb2efe003 workflows: static-checks: Remove TRAVIS_XXX variables
These variables are unused since we don't use travis CI. This also allows to
remove two steps:

- 'Setup GOPATH' only printed variables
- 'Setup travis reference' modified some shell local variables that don't have
  any influence on the rest of the steps

The TRAVIS var is still used by tools/osbuilder/tests to determine if
virtualization is available.

Fixes: #3544
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-20 12:19:35 +01:00
Fabiano Fidêncio
2fe0733dcb
Merge pull request #4582 from BbolroC/vfio-ap
agent: Bring in VFIO-AP device handling again
2023-03-20 11:43:13 +01:00
Steve Horsman
4bd6103253
Merge pull request #6491 from jepio/jepio/kata-deploy-push-more-space
CC | kata-deploy-push more space
2023-03-20 10:34:51 +00:00
Fabiano Fidêncio
20452402b5
Merge pull request #6498 from fidencio/topic/cc-switch-back-the-permission-of-cache-components-to-0755
cache_components: Switch back the permission to 755
2023-03-20 09:09:22 +01:00
Zhongtao Hu
1e8005ff88
Merge pull request #6477 from openanolis/runtime-rs-hostname
bugfix: set hostname in CreateSandboxRequest
2023-03-20 12:43:29 +08:00
Fabiano Fidêncio
77783153b6 cache_components: Switch back the permission to 755
2b41dbe broke all the cached jobs as it changed the permission of the
cache_components.sh file from 755 to 644.

Fixes: #6497

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 23:50:47 +01:00
Fabiano Fidêncio
45759e82b1
Merge pull request #6474 from UnmeshDeodhar/fix-sev-cached-kernel-bug
packaging: fix sev kernel caching
2023-03-17 23:01:40 +01:00
Fabiano Fidêncio
96252db787
Merge pull request #6481 from fidencio/topic/cache-artefacts
packaging / kata-deploy builds:  Add the ability to cache and consume cached components
2023-03-17 20:54:42 +01:00
Jeremi Piotrowski
26f80ff468 workflows: kata-deploy-push: Remove unneeded tools from runner
`make kata-tarball` needs a lot of disk space and github action runners don't
have that much of it. Remove unneeded tools from the runner, which frees
another ~10GB of space.

Fixes: #6490
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-17 17:46:38 +01:00
Jeremi Piotrowski
a394798b75 kata-deploy: Remove temporary directory after creating tarball
The various tarballs are unpacked into a temporary directory, and then that
directory is compressed into kata-static.tar.xz. After we have the tarball,
there is no reason to keep the temporary directory. Dispose of it as the last
step.

Fixes: #6490
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-17 17:43:42 +01:00
Fabiano Fidêncio
fbf891fdff packaging: Adapt get_last_modification()
The function is returning "" when called from the script used to cache
the artefacts and one difference noted between this version and the
already working one from the CCv0 is that we make sure to `pushd
${repo_root_dir}` in the CCv0 version.

Let's give it a try here and see if it solves the issue.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
82a04dbce1 local-build: Use cached VirtioFS when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
3b99004897 local-build: Use cached shim v2 when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
1b8c5474da local-build: Use cached RootFS when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
09ce4ab893 local-build: Use cached QEMU when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
1e1c843b8b local-build: Use cached Nydus when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
64832ab65b local-build: Use cached Kernel when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
04fb52f6c9 local-build: Use cached Firecracker when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
8a40f6f234 local-build: Use cached Cloud Hypervisor when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Unmesh Deodhar
2b41dbe00f packaging: fix sev kernel caching
Check if tarball exists. If yes, skip the tarball create command.

Fixes: #6473

signed-off-by: Unmesh Deodhar <udeodhar@amd.com>
2023-03-17 10:17:54 -05:00
Fabiano Fidêncio
194d5dc8a6 tools: Add support for caching VirtioFS artefacts
Let's add support for caching VirtioFS artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
a34272cf20 tools: Add support for caching shim v2 artefacts
Let's add support for caching shim v2 artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
7898db5f79 tools: Add support for caching RootFS artefacts
Let's add support for caching RootFS artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
e90891059b tools: Add support for caching QEMU artefacts
Let's add support for caching QEMU artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
7aed8f8c80 tools: Add support for caching Nydus artefacts
Let's add support for caching Nydus artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
cb4cbe2958 tools: Add support for caching Kernel artefacts
Let's add support for caching Kernel artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
762f9f4c3e tools: Add support for caching Firecracker artefacts
Let's add support for caching Firecracker artefacts that are generated
using the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
6b1b424fc7 tools: Add support for caching Cloud Hypervisor artefacts
Let's add support for caching Cloud Hypervisor artefacts that are
generated using the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
08fe49f708 versions: Adjust kernel names to match kata-deploy build targets
Let's adjust the kernel names in versions.yaml so those can match the
names used as part of the kata-deploy local build scripts.

Right now this doesn't bring any benefit nor drawback, but it'll make
our life easier later on in this same series.

Depends-on: github.com/kata-containers/tests#5534

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
d281d1b90a
Merge pull request #6483 from GabyCT/topic/updatefcv
versions: Update firecracker version
2023-03-17 10:37:22 +01:00
Fabiano Fidêncio
9c16268b0a
Merge pull request #6486 from fidencio/topic/cache-artefacts-fix-kernel-version
CC | kernel: Ensure `kata_config_version` is taken into account
2023-03-17 10:17:09 +01:00
Gabriela Cervantes
99505c0f4f versions: Update firecracker version
This PR updates the firecracker version being used in kata containers
versions.yaml

The changes in version 1.3.1 are

Added

Introduced T2CL (Intel) and T2A (AMD) CPU templates to provide
instruction set feature parity between Intel and AMD CPUs when using
these templates.
Added Graviton3 support (c7g instance type).
Changed

Improved error message when invalid network backend provided.
Improved TCP throughput by between 5% and 15% (depending on CPU) by using
scatter-gather I/O in the net device's TX path.
Upgraded Rust toolchain from 1.64.0 to 1.66.0.
Made seccompiler output bit-reproducible.
Fixed

Fixed feature flags in T2 CPU template on Intel Ice Lake.

Fixes #6482

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-16 17:34:33 +00:00
Fabiano Fidêncio
b3a2caa527 kernel: Ensure kata_config_version is taken into account
We need to ensure `kata_config_version` is taken into account when:
* consuming a cached kernel, otherwise we may introduce changes to a
  kernel that will never be validated as part of the PR
* caching the kernel, otherwise we won't update the artefacts if just a
  config is changed

Fixes: #6485

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-16 17:44:06 +01:00
Yushuo
f4938c0d90 bugfix: set hostname
Setting hostname according to the spec.

Fixes: #6247

Signed-off-by: Yushuo <y-shuo@linux.alibaba.com>
2023-03-16 17:16:06 +08:00
Hyounggyu Choi
96baa83895 agent: Bring in VFIO-AP device handling again
This PR is a continuing work for (kata-containers#3679).

This generalizes the previous VFIO device handling which only
focuses on PCI to include AP (IBM Z specific).

Fixes: kata-containers#3678
Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2023-03-16 18:14:12 +09:00
Greg Kurz
e6e719699f
Merge pull request #6471 from etrunko/main
dependency: update cgroups-rs
2023-03-16 08:01:07 +01:00
QuanweiZhou
56c63a9b1c
Merge pull request #6186 from wllenyj/dragonball-ut-6
Built-in Sandbox: add more unit tests for dragonball. Part 6
2023-03-16 11:02:05 +08:00
Jakob Naucke
f666f8e2df agent: Add VFIO-AP device handling
Initial VFIO-AP support (#578) was simple, but somewhat hacky; a
different code path would be chosen for performing the hotplug, and
agent-side device handling was bound to knowing the assigned queue
numbers (APQNs) through some other means; plus the code for awaiting
them was written for the Go agent and never released. This code also
artificially increased the hotplug timeout to wait for the (relatively
expensive, thus limited to 5 seconds at the quickest) AP rescan, which
is impractical for e.g. common k8s timeouts.

Since then, the general handling logic was improved (#1190), but it
assumed PCI in several places.

In the runtime, introduce and parse AP devices. Annotate them as such
when passing to the agent, and include information about the associated
APQNs.

The agent awaits the passed APQNs through uevents and triggers a
rescan directly.

Fixes: #3678
Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 10:07:48 +09:00
Jakob Naucke
b546eca26f runtime: Generalize VFIO devices
Generalize VFIO devices to allow for adding AP in the next patch.
The logic for VFIOPciDeviceMediatedType() has been changed and IsAPVFIOMediatedDevice() has been removed.

The rationale for the revomal is:

- VFIODeviceMediatedType is divided into 2 subtypes for AP and PCI
- Logic of checking a subtype of mediated device is included in GetVFIODeviceType()
- VFIOPciDeviceMediatedType() can simply fulfill the device addition based
on a type categorized by GetVFIODeviceType()

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 10:06:37 +09:00
Jakob Naucke
4c527d00c7 agent: Rename VFIO handling to VFIO PCI handling
e.g., split_vfio_option is PCI-specific and should instead be named
split_vfio_pci_option. This mutually affects the runtime, most notably
how the labels are named for the agent.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Jakob Naucke
db89c88f4f agent: Use cfg-if for s390x CCW
Uses fewer lines in upcoming VFIO-AP support.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Jakob Naucke
68a586e52c agent: Use a constant for CCW root bus path
used a function like PCI does, but this is not necessary

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Fabiano Fidêncio
814d07af58
Merge pull request #6463 from sprt/sprt/mshv-compat
runtime: add support for Hyper-V
2023-03-15 18:03:25 +01:00
Eduardo Lima (Etrunko)
a8b55bf874 dependency: update cgroups-rs
Huge pages failure with cgroups v2.
https://github.com/kata-containers/cgroups-rs/issues/112

Fixes: #6470

Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
2023-03-15 12:21:12 -03:00
Steve Horsman
c3059d0bd9
Merge pull request #6207 from BbolroC/s390x-prepare-se-image
CC: Prepare secure execution image tarball for s390x
2023-03-15 14:33:59 +00:00
Chao Wu
530b2a7685
Merge pull request #6458 from openanolis/chao/update_comments
runtime-rs: update load_config comment
2023-03-15 19:32:07 +08:00
Steve Horsman
5da86f3e25
Merge pull request #6440 from GeorginaKin/CCv0
CCv0: Merge main into CCv0 branch
2023-03-15 10:40:55 +00:00
Chao Wu
97cdba97ea runtime-rs: update load_config comment
Since shimv2 create task option is already implemented, we need to update the
corresponding comments.

Also, the ordering is also updated to fit with the code.

fixes: #3961

Signed-off-by: Chao Wu <chaowu@linux.alibaba.com>
2023-03-15 14:44:47 +08:00
Fabiano Fidêncio
0bcbbfe44f
Merge pull request #5665 from jimcadden/online_sev_kbc
CC | runtime: Add online-kbs to kernel params
2023-03-14 21:19:37 +01:00