Commit Graph

239 Commits

Author SHA1 Message Date
ChengyuZhu6
aa31a9d3c4 tools: install luks-encrypt-storage script by guest-components
Install luks-encrypt-storage script by guest-components. So that we can maintain a single source and prevent synchronization issues.

Fixes: #10173 -- part I

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
2024-08-16 16:28:20 +08:00
Beraldo Leal
74662a0721 Merge pull request #10137 from hex2dec/fix-image-warning
tools: Fix container image build warning
2024-08-15 14:45:41 -04:00
Archana Shinde
1012449141 Merge pull request #10129 from hex2dec/qemu-aio-native
tools: Support for building qemu with linux aio
2024-08-07 14:32:52 -07:00
Zhiwei Huang
7270a7ba48 tools: Fix container image build warning
All commands within the Dockerfile should use the same casing
(either upper or lower).[1]

[1]: https://docs.docker.com/reference/build-checks/consistent-instruction-casing/

Signed-off-by: Zhiwei Huang <ai.william@outlook.com>
2024-08-07 15:49:01 +08:00
Zhiwei Huang
d455883b46 tools: Support for building qemu with linux aio
The kata containers hypervisior qemu configuration supports setting
block_device_aio="native", but the kata static build of qemu does
not add the linux aio feature.

The libaio-dev library is a necessary dependency for building qemu
with linux aio.

Fixes: #10130

Signed-off-by: Zhiwei Huang <ai.william@outlook.com>
2024-08-06 14:30:45 +08:00
Markus Rudy
69535e5458 genpolicy: add crate-scoped integration test
Provides a test runner that generates a policy and validates it
with canned requests. The initial set of test cases is mostly for
illustration and will be expanded incrementally.

In order to enable both cross-compilation on Ubuntu test runners as well
as native compilation on the Alpine tools builder, it is easiest to
switch to the vendored openssl-src variant. This builds OpenSSL from
source, which depends on Perl at build time.

Adding the test to the Makefile makes it execute in CI, on a variety of
architectures. Building on ppc64le requires a newer version of the
libz-ng-sys crate.

Fixes: #10061

Signed-off-by: Markus Rudy <mr@edgeless.systems>
2024-08-05 11:52:01 +02:00
Fabiano Fidêncio
b7051890af Merge pull request #9722 from zvonkok/busybox-build
deploy: Add busybox target
2024-07-17 13:47:15 +02:00
Xynnn007
1072658219 agent: Enable kata-cc-rustls-tls in image-rs
- Enable the kata-cc-rustls-tls feature in image-rs, so that it
can get resources from the KBS in order to retrieve the registry
credentials.
- Also bump to the latest image-rs to pick up protobuf fixes
- Add libprotobuf-dev dependency to the agent packaging
as it is needed by the new image-rs feature
- Add extra env in the agent make test as the
new version of the anyhow crate has changed the backtrace capture thus unit
tests of kata-agent that compares a raised error with an expected one
would fail. To fix this, we need only panics to have backtraces, thus
set RUST_BACKTRACE=0 for tests due to document
https://docs.rs/anyhow/latest/anyhow/

Fixes #9538

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-07-15 12:00:50 +01:00
Hyounggyu Choi
856a1f72c6 packaging: Set ATTESTER to se-attester for guest components on s390x
This commit allows the guest-components builder to only build se-attester on s390x.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-07-10 16:18:37 +02:00
Amulyam24
259ec408b5 kata-deploy: fix qemu static build for v8.2.1 on ppc64le
Do not install the packages librados-dev and librbd-dev as they are not needed for building static qemu.

Add machine option cap-ail-mode-3=off while creating the VM to qemu cmdline.
Fixes: #9893

Signed-off-by: Amulyam24 <amulmek1@in.ibm.com>
2024-07-01 14:56:43 +05:30
Zvonko Kaiser
b1909e940e deploy: Add busybox target
For a minimal initrd/image build we may want to leverage busybox.
This is part number two of the NVIDIA initrd/image build

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-06-18 15:31:00 +00:00
Beraldo Leal
c99ba42d62 deps: bumping yq to v4.40.7
Since yq frequently updates, let's upgrade to a version from February to
bypass potential issues with versions 4.41-4.43 for now. We can always
upgrade to the newest version if necessary.

Fixes #9354
Depends-on:github.com/kata-containers/tests#5818

Signed-off-by: Beraldo Leal <bleal@redhat.com>
2024-05-31 13:28:34 -04:00
Zvonko Kaiser
063db516f2 ci: Remove all git config safe.directory
Now with the sudo less build we should be good
to remove those hacks.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-30 15:12:28 +00:00
Fabiano Fidêncio
97806dbdaa Merge pull request #9732 from zvonkok/shim-v2-no-sudo
ci: shim-v2 no sudo
2024-05-30 07:01:04 +02:00
GabyCT
0eddfdc74f Merge pull request #9731 from zvonkok/pause-no-sudo
ci: pause-image no sudo
2024-05-29 11:48:41 -06:00
Zvonko Kaiser
7354c427f9 Merge pull request #9734 from zvonkok/virtiofsd-no-sudo
ci: virtiofsd no sudo
2024-05-29 19:31:25 +02:00
GabyCT
3c91aa0475 Merge pull request #9739 from zvonkok/initramfs-no-sudo
ci: initramfs no sudo
2024-05-29 11:28:59 -06:00
Hyounggyu Choi
40d2306f95 Merge pull request #9729 from zvonkok/agent-no-sudo-build
ci: build agent without sudo
2024-05-29 19:27:56 +02:00
GabyCT
03be220482 Merge pull request #9730 from zvonkok/kernel-no-sudo
ci: kernel no sudo
2024-05-29 10:23:31 -06:00
GabyCT
a5808a556d Merge pull request #9733 from zvonkok/tools-no-sudo
ci: tools no sudo
2024-05-29 10:19:17 -06:00
GabyCT
e94b09839d Merge pull request #9736 from zvonkok/qemu-no-sudo
ci: qemu no sudo
2024-05-29 10:18:34 -06:00
Hyounggyu Choi
6ba2461404 Merge pull request #9728 from zvonkok/coco-guest-comp-no-sudo
ci: guest-components without sudo
2024-05-29 17:55:43 +02:00
Zvonko Kaiser
25c784c568 ci: shim-v2 no sudo
Build shim-v2 without sudo docker this is not needed. This is part 6 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-29 09:24:54 +00:00
Zvonko Kaiser
84a9773cec ci: initramfs no sudo
BUild initramfs  without sudo docker this is not needed. This is part 10 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-29 09:20:39 +00:00
Zvonko Kaiser
7dc47c8150 ci: qemu no sudo
Build qemu without sudo docker this is not needed. This is part 9 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 16:12:06 +00:00
Zvonko Kaiser
4a455bf24a ci: virtiofsd no sudo
build virtiofsd without sudo docker this is not needed. This is part 8 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 14:19:58 +00:00
Zvonko Kaiser
dd04d26cb0 ci: tools no sudo
Build tools without sudo docker this is not needed. This is part 7 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 13:57:20 +00:00
Zvonko Kaiser
6c9c0306ac ci: pause-image no sudo
Build pause-image without sudo docker this is not needed. This is part 5 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 11:31:59 +00:00
Zvonko Kaiser
c95ae5a502 ci: kernel no sudo
Build kernel without sudo docker this is not needed. This is part 4 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 11:19:08 +00:00
Zvonko Kaiser
8fab5dd584 ci: build agent without sudo
Build agent without sudo docker this is not needed. This is part 3 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 09:55:32 +00:00
Zvonko Kaiser
1e4cbc4fcd ci: guest-components wihout sudo
Build guest-components without sudo docker this is not needed. This is part 2 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 09:03:14 +00:00
Zvonko Kaiser
b76938b922 ci: ovmf without sudo
Build ovmf without sudo docker this is not needed. This is part 1 of N

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-05-28 08:25:27 +00:00
Hyounggyu Choi
3917930a76 CI: Append arch type to initramfs-cryptsetup image
This commit is to append an arch type to the initramfs-cryptsetup image
to prevent a wrong arch image from being pulled on a different arch host.

Fixes: #9654

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-05-17 11:42:49 +02:00
Fabiano Fidêncio
f2d40da8e4 versions: build: Remove unused td-shim entry
We haven't been using nor testing with td-shim, as Cloud Hypervisor does
not officially support TDX yet, and TDVF is supposed to be used with
QEMU, instead of td-shim.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-05-09 07:59:12 +02:00
Fabiano Fidêncio
4292c4c3b1 versions: build: Remove TDX specific OVMF (TDVF)
Let's remove everything related to the TDVF building / shipping from our
repo, as we'll be relying on the one coming from the distro.

Later on, we may need to re-add TDVF logic, as we're already using
upstream edk2 repo / content, but when that's needed we'll simply revert
this commit.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-05-09 07:59:12 +02:00
stevenhorsman
29a5652e31 packaging: guest-components, set new environment variables
- Set KBC_PROVIDER and ATTESTER rather than TEE_PLATFORM
to avoid tss build issues for vTPM attester(s)
- There are future plans to make a matching TEE_PLATFORM, so this can be simplified once that is available

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-04-08 11:38:53 +01:00
stevenhorsman
101a5bf273 packaging: Update guest-components Dockerfile
- Switch to Ubuntu 20.04 for building guest-components as
The rootfs is based on 20.04, so we need matching GLIBC versions.
See #8955
- Add dependencies needed by TDX verifier as we want to build for all platforms

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-04-08 11:38:53 +01:00
Fabiano Fidêncio
2ee03b5dc3 tdvf: Adapt the build command
This is done in order to match the example from:
https://github.com/intel/tdx-linux/wiki/Instruction-to-set-up-TDX-host-and-guest#build-tdvf-image

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-04-05 19:51:27 +02:00
Fabiano Fidêncio
fe5adae5d9 qemu-tdx: Update to v8.1.0 + TDX patches
Let's update the QEMU to the one that's officially maintained by Intel
till all the TDX patches make their way upstream.

We've had to also update python to explicitly use python3 and add
python3-venv as part of the dependencies.

Fixes: #8810

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-04-05 10:23:51 +02:00
Tobin Feldman-Fitzthum
04d021bd12 packaging: remove SERVICEOFFLOAD option
Since we're removing the unused service_offload parameter,
don't set it in any of the packaging scripts.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
2024-03-27 12:21:13 -05:00
ChengyuZhu6
8724d7deeb packaging: Enable to build agent with PULL_TYPE feature
Enable to build kata-agent with PULL_TYPE feature.

We build kata-agent with guest-pull feature by default, with PULL_TYPE set to default.
This doesn't affect how kata shares images by virtio-fs. The snapshotter controls the image pulling in the guest.
Only the nydus snapshotter with proxy mode can activate this feature.

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
2024-03-19 18:06:00 +01:00
Niteesh Dubey
0538bbfc49 packaging: qemu-snp-experimental: support host kernel with gmem
This is required to allow creation of SNP coco on host kernel
(e.g. https://github.com/AMDESE/linux ,branch:snp-host-latest)
supporting guest private memory for SNP using gmem.

Note: This qemu does not work if the host kernel does not support
gmem/UPM.

Fixes: #9092

Signed-off-by: Niteesh Dubey <niteesh@us.ibm.com>
2024-02-15 16:33:46 +00:00
ChengyuZhu6
70a84eca9e packaging: allow to pull and unpack pause image
For Confidential containers stack, the pause image is managed by host side,
then it may configure a malicious pause image, we need package
a pause image inside the rootfs and don't the pause image from host.

But the installation of skopeo is not included in 20.04 release, so we
can not directly install skopeo in rootfs and pull pause image.

So I plan to let the task as a static build stuff, which would not be influenced
by the system version in rootfs. And the pause image will be part of the Kata Containers rootfs
that's used by the Confidential Containers usecase. This commit enables the component to be built
both locally and in our CI environment with the command: make pause-image-tarball.

Fixes: #9032

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
Co-authored-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
2024-02-08 11:23:23 +08:00
Fabiano Fidêncio
64d09874c3 packaging: coco-guest-components: Pass DESTDIR to the build script
As DESTDIR was not being passed, we've been installing the final
binaries in a container path that was not exposed to the host, leading
to creating an empty tarball with the guest components.

Now, theoretically, guest-components should respect a PREFIX passed, but
that's not the case and we're manually adding "/usr/local/bin" to the
passed DESTDIR.

Here's the result of the tarball:
```bash
⋊> kata-containers ≡ tar tf build/kata-static-coco-guest-components.tar.xz
./
./usr/
./usr/local/
./usr/local/bin/
./usr/local/bin/confidential-data-hub
./usr/local/bin/attestation-agent
./usr/local/bin/api-server-rest
```

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-02-05 14:07:10 +01:00
Hyounggyu Choi
f3bc6e4155 packaging: Use Ubuntu 20.04 for building an agent
This involves using Ubuntu 20.04 as a build environment for an agent to match with a runtime environment.

Fixes: #8955

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-01-30 10:22:14 +01:00
Fabiano Fidêncio
644abde35c packaging: coco-guest-components: Allow building the project
The Confidential Containers guest-components will, in the very short
future, be part of the Kata Containers rootfs that's used by the
Confidential Containers usecase.

This commit introduces the ability to, standalone, build the component
locally and as part of our CI, and this can be done by calling:
`make coco-guest-components-tarball`

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Linda Yu <linda.yu@intel.com>
Co-authored-by: stevenhorsman <steven@uk.ibm.com>
Co-authored-by: Jakob Naucke <jakob.naucke@ibm.com>
Co-authored-by: Wang, Arron <arron.wang@intel.com>
Co-authored-by: zhouliang121 <liang.a.zhou@linux.alibaba.com>
Co-authored-by: Alex Carter <alex.carter@ibm.com>
Co-authored-by: Suraj Deshmukh <suraj.deshmukh@microsoft.com>
Co-authored-by: Xynnn007 <xynnn@linux.alibaba.com>
2024-01-26 19:36:01 +01:00
Fabiano Fidêncio
a7c68225aa Merge pull request #8916 from fidencio/topic/packaging-reuse-already-built-agent
packaging:  Don't always build the kata-agent
2024-01-26 12:00:55 +01:00
Fabiano Fidêncio
5b0d0687e5 packaging: agent: Allow building in all arches
We're moving away from alpine and using ubuntu in order to be able to
build the agent for all the architectures we need.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-01-25 19:41:32 +01:00
Gabriela Cervantes
98b5a19b3a tools: Use defined variable in build base qemu script
This PR uses a variable that is already defined in the build base
qemu script to have uniformity across the script as this variable
is already used in the script.

Fixes #8903

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-01-24 17:05:17 +00:00
Zvonko Kaiser
4fc34323ae gpu: Add NVIDIA GPU Confidential kernel target
This is a follow up to the work of minimizing targets, unifying TDX,SNP builds for NVIDIA GPUs

Fixes: #8828

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
2024-01-22 14:58:57 +00:00