Commit Graph

15637 Commits

Author SHA1 Message Date
Hyounggyu Choi
0432d2fcdf
Merge pull request #11086 from BbolroC/fix-overwrite-containerd-config
tests: Make sure /etc/containerd before writing config
2025-03-27 05:57:31 +01:00
Zvonko Kaiser
b7cf4fd2e6
Merge pull request #11053 from ldoktor/ci
ci: shellcheck fixes
2025-03-26 13:22:56 -04:00
Hyounggyu Choi
1e187482d4 tests: Make sure /etc/containerd before writing config
We get the following error while writing containerd config
if a base dir `/etc/containerd` does not exist like:

```
sudo tee /etc/containerd/config.toml << EOF
...
EOF
tee: /etc/containerd/config.toml: No such file or directory
```

The commit makes sure a base directory for containerd before
writing config and drops the config file deletion because a
default behaviour of `tee` is overwriting.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2025-03-26 18:19:45 +01:00
Fabiano Fidêncio
7a0ac55f22
Merge pull request #10984 from fidencio/topic/tests-kata-deploy-ground-work-to-rewrite-the-tests
tests: kata-deploy: The rest of the ground work to rewrite the kata-deploy tests
2025-03-26 17:47:48 +01:00
Fabiano Fidêncio
404e212102 tests: kata-deploy: Use helm_helper()
With this we switch to fully testing with helm, instead of testimg with
the kustomizations (which will soon be removed).

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:30:15 +01:00
Fabiano Fidêncio
f7976a40e4 tests: Create a helm_helper() common function
Let's use what we have in the k8s functional tests to create a common
function to deploy kata containers using our helm charts.  This will
help us immensely in the kata-deploy testing side in the near future.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:30:11 +01:00
Fabiano Fidêncio
eb884d33a8 tests: k8s: Export all the default env vars on gha-run.sh
This is not strictly needed, but it does help a lot when setting up a
cluster manually, while still relying on those scripts.

While here, let's also ensure the assignment is between quotes, to make
shellchecker happier.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:23:16 +01:00
Saul Paredes
ae5c587efc
Merge pull request #11074 from Sumynwa/sumsharma/genpolicy_test
genpolicy: Refactor tests to allow different request types in a testcases json.
2025-03-25 12:38:19 -07:00
Sumedh Sharma
3406df9133 genpolicy: Refactor tests to add different request types in testcases json
This commit introduces changes to add test data for multiple request
type in a single testcases.json file. This allows for stateful testing,
for ex: enable testing ExecProcessRequest using policy state set after testing
a CreateContainerRequest.

Fixes #11073.

Signed-off-by: Sumedh Sharma <sumsharma@microsoft.com>
2025-03-25 13:52:17 +05:30
RuoqingHe
7a704453b6
Merge pull request #11075 from microsoft/danmihai1/genpolicy-debug-build
genpolicy: add support for BUILD_TYPE=debug
2025-03-25 14:59:15 +08:00
RuoqingHe
5d68600c06
Merge pull request #11010 from stevenhorsman/metrics-containerd-debugging
metrics: Test improvements
2025-03-25 11:38:28 +08:00
Dan Mihai
15c9035254 genpolicy: add support for BUILD_TYPE=debug
Use "cargo build --release" when BUILD_TYPE was not specified, or when
BUILD_TYPE=release. The default "cargo build" behavior is to build in
debug mode.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-24 16:10:20 +00:00
RuoqingHe
f6a1c6d0e0
Merge pull request #11069 from kimullaa/exit-if-action-is-invalid
kata-deploy: return exit code for invalid argument
2025-03-24 09:40:39 +08:00
Shunsuke Kimura
e5d7414c33 kata-deploy: Return exit code for invalid argument
It hangs when invalid arguments are specified.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh xxx
Action:
* xxx
...
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
...
^C <- hang
```

I changed it to behave the same as when there are no arguments.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
kata-deploy-6sr2p:/# echo $?
1
```

Fixes: #11068

Signed-off-by: Shunsuke Kimura <pbrehpuum@gmail.com>
2025-03-22 21:32:38 +09:00
Aurélien Bombo
17baa6199b
Merge pull request #11061 from RuoqingHe/2025-03-21-generalize-non-kvm
ci: Generalize `GITHUB_RUNNER_CI_ARM64`
2025-03-21 15:23:51 -05:00
Ruoqing He
5e81f67ceb ci: Generalize GITHUB_RUNNER_CI_ARM64
`GITHUB_RUNNER_CI_ARM64` is turned on for self hosted runners without
virtualization to skipped those tests depend on virtualization. This may
happen to other archs/runners as well, let's generalize it to
`GITHUB_RUNNER_CI_NON_VIRT` so we can reuse it on other archs.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-21 09:49:44 +08:00
RuoqingHe
e84f7c2c4b
Merge pull request #11046 from mythi/drop-dcap-libs
build: drop libtdx-attest
2025-03-21 09:23:33 +08:00
Dan Mihai
f79fabab24
Merge pull request #11024 from microsoft/danmihai1/empty-exec-output
tests: k8s: retry "kubectl exec" on empty output
2025-03-20 11:03:08 -07:00
Mikko Ylinen
f52a565834 build: drop libtdx-attest
with the latest CoCo guest-components, tdx-attester no longer
depends on libtdx attest. Stop installing it to the rootfs.

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-20 10:45:30 +02:00
Steve Horsman
c0632f847f
Merge pull request #11043 from stevenhorsman/3.15.0-release
release: Bump version to 3.15.0
2025-03-20 07:38:20 +00:00
Greg Kurz
e19b81225c
Merge pull request #11045 from kata-containers/sprt/fix-gha-tag
security: ci: Pin third-party actions to commit hashes
2025-03-20 08:14:06 +01:00
Aurélien Bombo
a678046d13 gha: Pin third-party actions to commit hashes
A popular third-party action has recently been compromised [1][2] and
the attacker managed to point multiple git version tags to a malicious
commit containing code to exfiltrate secrets.

This PR follows GitHub's recommendation [3] to pin third-party actions
to a full-length commit hash, to mitigate such attacks.

Hopefully actionlint starts warning about this soon [4].

 [1] https://www.cve.org/CVERecord?id=CVE-2025-30066
 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
 [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
 [4] https://github.com/rhysd/actionlint/pull/436

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-19 13:52:49 -05:00
stevenhorsman
fad248ef09 release: Bump version to 3.15.0
Bump VERSION and helm-chart versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 17:28:06 +00:00
Fabiano Fidêncio
a6e5d28a15
Merge pull request #11055 from stevenhorsman/bump-github.com/containerd/containerd/v1.7.27
runtime: Update github.com/containerd/containerd
2025-03-19 18:19:10 +01:00
stevenhorsman
cb7c599180 runtime: Switch from deprecated tracer
`go.opentelemetry.io/otel/trace.NewNoopTracerProvider`
is deprectated now, so switch to
`go.opentelemetry.io/otel/trace/noop.NewTracerProvider`

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 14:22:06 +00:00
stevenhorsman
8f22b07aba runtime: Update github.com/containerd/containerd
Update to 1.7.27 to resolve CVE-2024-40635

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 13:48:04 +00:00
Lukáš Doktor
d708866b2a
ci.ocp: shellcheck various fixes
various manual fixes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:28 +01:00
Lukáš Doktor
7e11489daf
ci: shellcheck - collection of fixes
manual fixes of various issues.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:23 +01:00
Lukáš Doktor
f62e08998c
ci: shellcheck - remove unused argument
the "-a" argument was introduced with this tool but never was actually
used.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:19 +01:00
Lukáš Doktor
02deb1d782
ci: shellcheck SC2248
SC2248 (style): Prefer double quoting even when variables don't contain
special characters, might result in arguments difference, shouldn't in
our cases.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:16 +01:00
Lukáš Doktor
d80e7c7644
ci: shellcheck SC2155
SC2155 (warning): Declare and assign separately to avoid masking return
values, should be harmless.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:12 +01:00
Lukáš Doktor
6552ac41e0
ci: shellcheck SC2086
SC2086 Double quote to prevent globbing and word splitting, might break
places where we deliberately use word splitting, but we are not using it
here.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:08 +01:00
Lukáš Doktor
154a4ddc00
ci: shellcheck SC2292
SC2292 (style): Prefer [[ ]] over [ ] for tests in Bash/Ksh. This might
result in different handling of globs and some ops which we don't use.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:03 +01:00
Lukáš Doktor
667e26036c
ci: shellcheck SC2250
Treat the SC2250 require-variable-braces in CI. There are no functional
changes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:25:44 +01:00
Zvonko Kaiser
d37d9feee9
Merge pull request #11035 from kata-containers/sprt/fix-dependabot
security: ci: Remove `replace` directives in go.mod files
2025-03-18 12:43:46 -04:00
Steve Horsman
ba5b0777b5
Merge pull request #11002 from fitzthum/bump-gc-0130
Bump Trustee and Guest Components for coco v0.13.0
2025-03-17 16:31:23 +00:00
RuoqingHe
36d2dee3a4
Merge pull request #11042 from RuoqingHe/runtime-rs-riscv
runtime-rs: Support and enable build on riscv64
2025-03-17 21:42:15 +08:00
Ruoqing He
cb7508ffdc ci: Enable runtime-rs component build-check on riscv64
`runtime-rs` is now buildable and testable on riscv64 platforms, enable
`build-check` on `runtime-rs`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:38:59 +08:00
Steve Horsman
f308cbba93
Merge pull request #11015 from AdithyaKrishnan/main
CI: Mark SNP as a Required test
2025-03-17 09:27:28 +00:00
Ruoqing He
084fb2d780 runtime-rs: Enable RISC-V build
Define `riscv64gc-options.mk` to enable `runtime-rs` to be built on
RISC-V platforms.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Ruoqing He
fd6c16e209 kata-sys-util: Set NoProtection for riscv64
`available_guets_protection` is required for `runtime-rs` to infer while
building it on riscv64 platforms. Set it to `NoProtection` as riscv64
does not support guest protection for now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Aurélien Bombo
26bd7989b3 csi-kata-directvolume: Remove replace in go.mod
Running `go mod tidy` and `go mod vendor` after this resulted in no-ops.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
b965fe8239 tests: Run go mod vendor
`go mod tidy` was a no-op.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
e9f88757ba tests: Remove replace directives in go.mod
Same rationale as for runtime. With tests, the blackfriday replacement was
actually meaningful, so I refactored some imports.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
35c92aa6ad runtime: Run go mod vendor
Regenerating go module files.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
fa0f85e8b0 runtime: Run go mod tidy
Tidying up go.mod.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
c3a9c70d45 runtime: Remove replace directives in go.mod
These replace directives aren't understood by dependabot, hence dependabot can
claim to upgrade a dependency, while a replace directive still makes the
dependency point to an old version.

Fixes: #11020

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Adithya Krishnan Kannan
32dbee8d7e CI: Mark SNP as a Required test
The SNP CI has been consistently passing and we request the @kata-containers/architecture-committee to mark this test as a required test.

Signed-Off-By: Adithya Krishnan Kannan <AdithyaKrishnan.Kannan@amd.com>
2025-03-14 12:48:55 -05:00
Dan Mihai
dab981b0bc tests: k8s: retry "kubectl exec" on empty output
Retry "kubectl exec" a few times if it unexpectedly produced an empty
output string.

This is an attempt to work around test failures similar to:

https://github.com/kata-containers/kata-containers/actions/runs/13840930994/job/38730153687?pr=10983

not ok 1 Environment variables
(from function `grep_pod_exec_output' in file tests_common.sh, line 394,
 in test file k8s-env.bats, line 36)
`grep_pod_exec_output "${pod_name}" "HOST_IP=\([0-9]\+\(\.\|$\)\)\{4\}" "${exec_command[@]}"' failed

That test obtained correct ouput from "sh -c printenv" one time, but the
second execution of the same command returned an empty output string.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-14 17:03:03 +00:00
Tobin Feldman-Fitzthum
b7786fbcf0 agent: update image-rs for coco v0.13.0
image-rs has gotten a number of significant updates, eliminating corner
cases with obscure containers, improving support for local certs, and
more.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
2025-03-14 10:44:10 -05:00