Commit Graph

8384 Commits

Author SHA1 Message Date
Jakob Naucke
205420d21b
docs: Replicate branch rename on runtime-spec
renamed branch `master` to `main`

Fixes: #3336
Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-12-22 18:15:01 +01:00
Fabiano Fidêncio
562fc73769
Merge pull request #3297 from jodh-intel/cargo-audit-fixes
security: Update rust crate versions
2021-12-22 16:10:10 +01:00
Dov Murik
91abebf92e agent: mount: Remove unneeded mount_point local variable
We already have a `mount_path` local Path variable which holds the mount
point.

Use it instead of creating a new `mount_point` variable with identical
type and content.

Fixes: #3332

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
2021-12-22 14:11:50 +02:00
James O. D. Hunt
b1f4e945b3 security: Update rust crate versions
Update the rust dependencies that have upstream security fixes. Issues
fixed by this change:

- [`RUSTSEC-2020-0002`](https://rustsec.org/advisories/RUSTSEC-2020-0002) (`prost` crate)
- [`RUSTSEC-2020-0036`](https://rustsec.org/advisories/RUSTSEC-2020-0036) (`failure` crate)
- [`RUSTSEC-2021-0073`](https://rustsec.org/advisories/RUSTSEC-2021-0073) (`prost-types` crate)
- [`RUSTSEC-2021-0119`](https://rustsec.org/advisories/RUSTSEC-2021-0119) (`nix` crate)

This change also includes:

- Minor code changes for the new version of `prometheus` for the agent.

- A *downgrade* of the version of the `futures` crate to the (new)
  latest version (`0.3.17`) since version `0.3.18` was removed [1].

Fixes: #3296.

[1] - See https://crates.io/crates/futures/versions

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-22 07:41:16 +00:00
Fabiano Fidêncio
ee66155a72
Merge pull request #3271 from Jakob-Naucke/kata-manager-static
kata-manager: Retrieve static tarball
2021-12-21 16:09:50 +01:00
Fabiano Fidêncio
67f0ab4092
Merge pull request #3294 from Kvasscn/kata_dev_osbuilder_makefile
osbuilder: avoid to copy versions.txt which already deprecated
2021-12-21 16:07:01 +01:00
Wainer dos Santos Moschetta
d79268ac65 tools/packaging: add copyright to kata-monitor's Dockerfile
The kata-monitor's Dockerfile was added by Eric Ernst on commit 2f1cb7995f
but for some reason the static checker did not catch the file misses the copyright statement
at the time it was added. But it is now complaining about it. So this assign the copyright to
him to make the static-checker happy.

Fixes #3329
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 10:01:11 -05:00
Fabiano Fidêncio
79153c3845
Merge pull request #3288 from gkurz/qemu-disable-libudev
qemu: Disable libudev for QEMU 5.2 and newer
2021-12-21 15:56:16 +01:00
Wainer dos Santos Moschetta
428cf0a685 packaging: delint tests dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:44 -05:00
Wainer dos Santos Moschetta
1ea9b70383 packaging: delint kata-deploy dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:44 -05:00
Wainer dos Santos Moschetta
3669e1b6d9 ci/openshift-ci: delint dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:44 -05:00
Wainer dos Santos Moschetta
aeb2b673b3 osbuilder: delint dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:44 -05:00
Wainer dos Santos Moschetta
bc120289ec packaging: delint kata-monitor dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:44 -05:00
Wainer dos Santos Moschetta
bc71dd5812 packaging: delint static-build dockerfiles
Removed all errors/warnings pointed out by hadolint version 2.7.0, except for the following
ignored rules:
  - "DL3008 warning: Pin versions in apt get install"
  - "DL3041 warning: Specify version with `dnf install -y <package>-<version>`"
  - "DL3033 warning: Specify version with `yum install -y <package>-<version>`"
  - "DL3048 style: Invalid label key"
  - "DL3003 warning: Use WORKDIR to switch to a directory"
  - "DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>"
  - "DL3037 warning: Specify version with zypper install -y <package>[=]<version>"

Fixes #3107
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-21 09:54:41 -05:00
Fabiano Fidêncio
aa7ba1741b
Merge pull request #3324 from fidencio/wip/add-protoc-to-alpine-image
osbuilder: Add protoc to the alpine container
2021-12-21 15:52:25 +01:00
Fabiano Fidêncio
99ef52a35d osbuilder: Add protoc to the alpine container
It seems the lack of protoc in the alpine containers is causing issues
with some of our CIs, such as the VFIO one.

Fixes: #3323

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2021-12-21 13:57:18 +01:00
Jakob Naucke
bb7a722ce0
Merge pull request #3199 from Jakob-Naucke/deploy-demo
github: Add workflow for deploying a CCv0 demo
2021-12-21 11:30:25 +01:00
Archana Shinde
ae271a7e7b
Merge pull request #3318 from jodh-intel/docs-agent-protoc
docs: Clarify where to run agent API generation commands
2021-12-21 00:28:01 -08:00
Peng Tao
b990868b11
Merge pull request #3302 from wainersm/static_qemu-partial_clone
packaging/qemu: partial git clone
2021-12-21 10:52:49 +08:00
Jakob Naucke
f5e6961dcb
kata-deploy: Configure Kata & containerd for CCv0
Introduce kata-cc runtime class, shim & config
- Specify cri_handler in containerd config
- Specify to use initrd
- Specify kernel_params according to guest config
- Specify service_offload

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-12-20 18:05:46 +01:00
Jakob Naucke
a570b6a0a6
github: Add workflow for deploying a CCv0 demo
using the offline FS KBC [1] and keys from the SSH demo [2]. The
workflow is adapted from `main:kata-deploy-test.yaml`. The image
deployed here is _not_ for a trusted execution environment.

[1] - https://github.com/confidential-containers/attestation-agent/tree/main/src/kbc_modules/offline_fs_kbc
[2] - https://github.com/confidential-containers/documentation/tree/main/demos/ssh-demo

Fixes: #3198
Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-12-20 18:05:46 +01:00
Jakob Naucke
3c79630b87
docs: Create sample config for confidential agent
Basic config, no debug endpoints, no exec/reseed. Uses the
`$AA_KBC_PARAMS` variable to be used with `envsubst`.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-12-20 18:05:46 +01:00
Jakob Naucke
a2926324f5
kata-deploy: realpath INCLUDE_ROOTFS for Docker
Run `realpath` on `INCLUDE_ROOTFS` so it is not required to provide a
full path. This simplifies the required GitHub Actions workflow, as
GitHub's `env` cannot use shell expansions, as well as the usability
overall.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2021-12-20 18:05:46 +01:00
James O. D. Hunt
c2578cd9a1 docs: Clarify where to run agent API generation commands
Make it clear when reading the table in the agent's "Change the agent
API" documentation that the commands in the "Generation method" column
should be run in the agent repo.

Fixes: #3317.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-20 15:45:36 +00:00
James O. D. Hunt
464d1a653e
Merge pull request #3312 from jodh-intel/docs-arch-fix-formatting
docs: Fix arch doc formatting
2021-12-20 14:04:36 +00:00
James O. D. Hunt
cd20bf95e9
Merge pull request #3315 from jodh-intel/ci-use-mirror-for-gnu.org
CI: Switch to a mirror as gnu.org is down
2021-12-20 11:53:14 +00:00
James O. D. Hunt
321995b7df CI: Switch to a mirror as gnu.org is down
All CI jobs are failing as www.gnu.org is down, so switch to a mirror
for the time being.

Fixes: #3314.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-20 11:22:56 +00:00
James O. D. Hunt
fb1989b27a docs: Fix arch doc formatting
PR #3298 failed to move the named link for the debug console to the
`guest-assets.md` meaning the debug console cells in the "User
accessible" column in the table in the "Root filesystem image" section
do not work as a link.

Fixes: #3311.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-20 10:33:48 +00:00
James O. D. Hunt
2ebae2d279
Merge pull request #3287 from jodh-intel/docs-split-arch-doc
Split architecture doc into separate files
2021-12-20 10:11:30 +00:00
Bin Liu
637b519c5a
Merge pull request #3301 from stevenhorsman/CCv0
CCv0: Merge main into CCv0 branch
2021-12-20 17:34:32 +08:00
Julio Montes
e329dcf2ff
Merge pull request #3299 from fidencio/wip/update-stable-branch-strategy
docs: Update the stable branch strategy
2021-12-17 13:29:10 -06:00
Chelsea Mafrica
e4c0b71e40
Merge pull request #3290 from cmaf/tracing-span-logging-error
tracing: Add span name to logging error
2021-12-17 11:13:41 -08:00
Jakob Naucke
7fdb425918
Merge pull request #3286 from zmlcc/pr-advice-expect-211216
docs: Update code PR advice document
2021-12-17 15:35:05 +01:00
stevenhorsman
822efa344d CCv0: Merge
- Re-vendor after merge due to static check error

Fixes: #3295

Signed-off-by: stevenhorsman steven@uk.ibm.com
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2021-12-17 13:55:51 +00:00
Wainer dos Santos Moschetta
2938bb7f89 packaging/qemu: Use QEMU script to update submodules
Currently QEMU's submodules are git cloned but there is the scripts/git-submodule.sh
which is meant for that. Let's use that script.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-17 10:20:59 -03:00
Wainer dos Santos Moschetta
5d49ccd613 packaging/qemu: Use partial git clone
The static build of QEMU takes a good amount of time on cloning the
source tree because we do a full git clone. In order to speed up that
operation this changed the Dockerfile so that it is carried out a
partial clone by using --depth=1 argument.

Fixes #3291
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2021-12-17 10:20:29 -03:00
Fabiano Fidêncio
87a219a1c9 docs: Update the stable branch strategy
On the last architecture committee meeting, the one held on December
14th 2021, we reached the agreement that minor releases will be cut once
every 16 weeks (instead of 12), and that patch releases will be cut
every 4 weeks (instead of 3)

Fixes: #3298

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2021-12-17 13:48:26 +01:00
stevenhorsman
bf6b1102db doc: Update ccv0
- Update script to reflect merge of directory changes

- Fixes: #3295

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2021-12-17 11:00:33 +00:00
stevenhorsman
85bb1e5e45 CCv0: Merge main into CCv0 branch
Merge remote-tracking branch 'upstream/main' into CCv0

Fixes: #3295

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2021-12-17 10:33:30 +00:00
zhanghj
d1bc409d57 osbuilder: avoid to copy versions.txt which already deprecated
Currently the versions.txt in rootfs-builder dir is already removed,
so avoid to copy it in list of helper files.

Fixes: #3267

Signed-off-by: zhanghj <zhanghj.lc@inspur.com>
2021-12-17 17:23:05 +08:00
Chelsea Mafrica
1653dd4a30 tracing: Add span name to logging error
Add span name to logging error to help with debugging when the context
is not set before the span is created.

Fixes #3289

Signed-off-by: Chelsea Mafrica <chelsea.e.mafrica@intel.com>
2021-12-16 12:44:42 -08:00
Greg Kurz
12c8e41c75 qemu: Disable libudev for QEMU 5.2 and newer
Commit 112ea25859 disabled libudev for static builds because it was
breaking snap. It turns out that the only users of libudev in QEMU are
qemu-pr-helper and USB. Kata already disables USB and doesn't use
qemu-pr-helper. Disable libudev for all builds if QEMU supports it, i.e.
version 5.2 or newer.

Fixes #3078

Signed-off-by: Greg Kurz <groug@kaod.org>
2021-12-16 16:12:02 +01:00
James O. D. Hunt
233015a6d9 docs: Split guest assets details out of arch doc
Move the guest assets details out of the architecture doc and into a
separate file.

Fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:18:49 +00:00
James O. D. Hunt
db411c23e8 docs: Split k8s info out of arch doc
Move the Kubernetes information out of the architecture doc and into a
separate file.

Partially fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:18:47 +00:00
James O. D. Hunt
7ac619b24e docs: Split networking out of arch doc
Move the networking details out of the architecture doc and into a
separate file.

Partially fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:18:45 +00:00
James O. D. Hunt
5df0cb6420 docs: Split storage out of arch doc
Move the storage details in the architecture doc to a separate file.

Partially fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:18:41 +00:00
James O. D. Hunt
7229b7a69d docs: Split background and example out of arch doc
Move the background and example command details out of the architecture
doc and into separate files.

Partially fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:18:38 +00:00
James O. D. Hunt
283d7d52c8 docs: Split history out of arch doc
Move the historical details out of the architecture doc
and into a separate file.

Partially fixes: #3246.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 14:17:59 +00:00
James O. D. Hunt
6f9efb4043 docs: Move arch doc to separate directory
Move the architecture document into a new `docs/design/architecture/` directory
in preparation for splitting it into more manageable pieces.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
2021-12-16 12:26:17 +00:00
Zack
02608e13ab docs: Update code PR advice document
Allow using `expect()` for `Mutex.lock()` because it is almost
unrecoverable if failed in the lock acquisition

Fixes: #3285

Signed-off-by: Zack <zmlcc@linux.alibaba.com>
2021-12-16 19:23:17 +08:00