Commit Graph

12805 Commits

Author SHA1 Message Date
Chao Wu
cbd4481bc1
Merge pull request #7489 from Apokleos/pci_path
runtime-rs: add pci topology for pci devices
2023-12-27 18:52:06 +08:00
alex.lyn
ea69c17008 runtime-rs: initialize pcie topology in Device Manager
Add a pcie_topology field to DeviceManager and initialize
pcie_topology when ResourceManager calls DeviceManager's new()
with TopologyConfigInfo.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:57:23 +08:00
alex.lyn
b42548b8e1 runtime-rs: do unregister device in Trait Device/detach
Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:53:18 +08:00
alex.lyn
0f0b6d13c9 runtime-rs: do register/update device in Trait Device/attach
Before calling the device driver to attach a device, register
the device to PCIe topology and allocate a PciPath for it.

However, for some hypervisor such as CLH, the allocation is invalid
when plugging devices to VM, they have the ability to return
DeviceInfo containing PciPath. It'll update the PciPath with the
returned pci path in the PCIe topology for them to prevent the
inferred pcipath from being different from the actual value returned.

But the update will not be executed if the pcipath value doesn't change.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:49:18 +08:00
alex.lyn
ce7d363695 runtime-rs: Introduce helper macros to simplify PCIe device ops
Introduce helper macros to simplify PCIe device register/unregister
and update, which provides a convenient way to handle devices in
topology.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:43:58 +08:00
alex.lyn
0d4992b24d runtime-rs: add one more argument in Device attach/detach
Add one more argument with type &mut Option<&mut PCIeTopology>
in attach and detach to inroduce methods within PCIe Topology.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:40:01 +08:00
alex.lyn
b425de6105 runtime-rs: implement Trait PCIeDevice for pcie/pci device
Implement Trait PCIeDevice register/unregister for pcie/pci
device, such as vfio device which needs set/get device's pci
path for kata agent's device handler.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:33:08 +08:00
alex.lyn
87e39cd1f6 runtime-rs: introduce Trait PCIeDevice to do [un]register device
Introduce Trait PCIeDevice with register/unregister, which are
used to register or unregister pcie device within the PCIe topology.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:29:35 +08:00
alex.lyn
6ebc4884fa runtime-rs: introduce PCIe Topology framework for pcie/pci devices
Due to different ways that different VMMs handle PCI devices,
we expect to provide a general PCIe topology processing framework
that is as compatible as possible with VMMs such as dragonball,
qemu, clh(Though it has its own management method, no conflict).

Currently,it's mainly developed for kinds of PCIe/PCI devices in
dragonball/clh which are attached on the pci/pcie root bus directly.

More will be added when Qemu is ready in runtime-rs.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:29:25 +08:00
alex.lyn
88839026b9 runtime-rs: introduce TopologyConfigInfo to initialize pcie topology
A TopologyConfigInfo added to store device config info for PCIe/PCI
devices in the VM from Hypervisor DeviceInfo.

And TopologyConfigInfo::new will be the entry to initialize PCIe
Topology for each VM.

Fixes: #7218

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-27 15:21:53 +08:00
Fabiano Fidêncio
35f88dfc93
Merge pull request #8733 from fidencio/topic/fix-shim-check-for-snapshotter-configration
kata-deploy: Fix shim check for snapshotter configuration
2023-12-27 03:30:53 -03:00
Chao Wu
8895cb82df
Merge pull request #8724 from openanolis/chao/add_vfio
dragonball: introduce vfio support
2023-12-27 11:40:53 +08:00
Xuewei Niu
43a627c96f
Merge pull request #8632 from adamqqqplay/support-vhost-user-blk
dragonball: introduce vhost-user-blk device
2023-12-27 09:54:21 +08:00
Chao Wu
2f797a6eb7 pci: rename 2 parameters to follow rust naming convention
PciCapabilityID -> PciCapabilityId
PciBarRegionType::IORegion -> PciBarRegionType::IoRegion

Signed-off-by: Chao Wu <chaowu@linux.alibaba.com>
2023-12-26 23:28:47 +08:00
Chao Wu
9c13b2c990 dragonball: introduce vfio support
vfio mod collects lots of information related to the vfio operations, including VfioMsi and VfioMsix capability & state,
vfio interrupt info, pci region infor and vfio pci device info & state.

fixes: #8722

Signed-off-by: Gerry Liu <gerry@linux.alibaba.com>
Signed-off-by: Zizheng Bian <zizheng.bian@linux.alibaba.com>
Signed-off-by: Shifang Feng <fengshifang@linux.alibaba.com>
Signed-off-by: Yang Su <yang.su@linux.alibaba.com>
Signed-off-by: Zha Bin <zhabin@linux.alibaba.com>
Signed-off-by: Xin Lin <jingshan@linux.alibaba.com>
Signed-off-by: Chao Wu <chaowu@linux.alibaba.com>
2023-12-26 23:28:43 +08:00
alex.lyn
8779fe7dd5 runtime-rs: create a reference that directs users to kata csi doc
Fixes: #8602

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-26 20:36:34 +08:00
alex.lyn
ba5437382a runtime-rs: add examples about Kata pod with directvol by CSI.
Fixes: #8602

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-26 20:36:34 +08:00
alex.lyn
c6d2a32146 runtime-rs: add support for directvol csi deploy scripts.
Fixes: #8602

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-26 20:36:34 +08:00
alex.lyn
25d8e83e43 runtime-rs: Add dedicated CSI driver for DirectVolume support in Kata
Bridge the gap between user requirements for direct block device access
and the DirectVolume capabilities provided by Kata runtimes
(kata-runtime/runtime-rs), and facilitate seamless integration with CSI
to improve user experience.

It aims to integrate DirectVolume CSI support into Kata, enabling users
to benefit from its performance and flexibility advantages.

Fixes: #8602

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-26 20:36:22 +08:00
Fabiano Fidêncio
6ee7fb5402
kata-deploy: Double quote the snapshotter name
Otherwise `jq` will complain about:
```sh
jq: error: nydus/0 is not defined at <top-level>, line 1:
.plugins."io.containerd.grpc.v1.cri".containerd.runtimes."kata-clh".snapshotter=nydus
jq: 1 compile error
```

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-12-26 09:14:36 -03:00
Qinqi Qu
81ab174c16 dragonball: support vhost-user-blk in device manager
This patch introduces a feature of supporting vhost-user-blk device.

Fixes: #8631

Signed-off-by: Qinqi Qu <quqinqi@linux.alibaba.com>
2023-12-26 20:02:38 +08:00
Qinqi Qu
ef8dc3b0ce dragonball: support vhost-user-blk
This patch introduces a feature of supporting vhost-user-blk device.

This device needs to be defined before the VM instance is started,
which can be done through the dbs-cli tool with --virblks option:
--virblks '{
	"drive_id": "8623",
	"device_type": "Spdk",
	"path_on_host": "spdk:///var/tmp/vhost.sock",
	"is_root_device": false,
	"is_read_only": false,
	"is_direct": false,
	"no_drop": false,
	"num_queues": 1,
	"queue_size": 256
}'

Fixes: #8631

Signed-off-by: Eric Ren <renzhen@linux.alibaba.com>
Signed-off-by: fupan <fupan.lfp@antgroup.com>
Signed-off-by: Liu Jiang <gerry@linux.alibaba.com>
Signed-off-by: Qinqi Qu <quqinqi@linux.alibaba.com>
2023-12-26 20:02:32 +08:00
Fabiano Fidêncio
8332f3c684
kata-deploy: Fix the snapshotter config placement
In the way the script is without this patch, we're trying to set
```toml
[`$shim`]
snapshotter = $snapshotter
```

However, what we actually want to set is the full runtime table instead
of shim.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-12-26 08:26:38 -03:00
Fabiano Fidêncio
907f1ddb9e
kata-deploy: Fix shim check for snapshotter configuration
We want to check whether the shim is part of the "plain text" shims
passed to the daemonset (meaning, checking against `$SHIMS`).  Before
this fix we were checking against `$shims`, which is an array of shims
instead of a string, resulting on a broken check.

Fixes: #8732

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-12-26 07:42:36 -03:00
Tim Zhang
a4ad12a3d1
Merge pull request #8729 from liubin/fix/package-kata-monitor
kata-monitor: fix Dockerfile to build image
2023-12-26 18:30:15 +08:00
alex.lyn
3b317e69e2 runtime-rs: add README and user guide to deploy directvol CSI Driver
Fixes: #8602

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2023-12-26 18:00:35 +08:00
Bin Liu
23eb3042c7 kata-monitor: fix Dockerfile to build image
move `SKIP_GO_VERSION_CHECK` after `make` command to skip
checking golang version.

And also upgrade golang to 1.19.

Fixes: #8728

Signed-off-by: Bin Liu <bin@hyper.sh>
2023-12-26 15:11:13 +08:00
Xuewei Niu
1065ca6fa7
Merge pull request #8626 from justxuewei/vhost-user-endpoint 2023-12-26 12:52:21 +08:00
Xuewei Niu
36a4cbccf6 runtime-rs: Expand all DeviceType in match arms
The compiler will give a warning if a developer forget to add an arm for
a new variants defined.

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-26 10:18:59 +08:00
Xuewei Niu
f2d08bc00f runtime-rs: Remove unused index from Endpoints
The affected `Endpoint`s are `VhostUserEndpoint` and `TapEndpoint`.

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-26 10:18:59 +08:00
Xuewei Niu
60a42351e2 runtime-rs: DAN supports vhost-user-net device
DAN reads vhost-user-net device from JSON config. It only supports VMM
running as server right now.

Fixes: #8625

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-26 10:18:59 +08:00
Xuewei Niu
693a0cfbfd dragonball: Make vhost-user-net ready for VhostUserEndpoint
The changes involve:

- Expose VhostUserConfig struct to runtime-rs.
- Set a default value while num_queues or queue_size are 0.

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-26 10:18:59 +08:00
Xuewei Niu
54df832407 runtime-rs: Support VhostUserEndpoint
This commit introduces VhostUserEndpoint and supports relative to
vhost-user-net devices for device manager. For now, Dragonball is able to
attach vhost-user-net devices.

Fixes: #8625

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-26 10:18:50 +08:00
Xuewei Niu
374c2f01aa runtime-rs: Simplify VhostUserType enum
Remove unused string parameter from each item.

Fixes: #8625

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-25 16:15:57 +08:00
Xuewei Niu
38eb4077a6
Merge pull request #8503 from justxuewei/vhost-user-net
dragonball: Support vhost-user-net device
2023-12-25 13:47:51 +08:00
Xuewei Niu
4c5de72863 dragonball: Wrap config space into set_config_space
Config space of network device is shared and accord with virtio 1.1 spec.
It is a good way to abstract the common part into one function.
`set_config_space()` implements this.

Plus, this patch removes `vq_pairs` from vhost-net devices, since there is
a possibility of data inconsistency. For example, some places read that
from `self.vq_pairs`, others read from `queue_sizes.len() / 2`.

Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
2023-12-25 10:47:34 +08:00
Alex.Lyn
3a3f39aa2d
Merge pull request #8668 from Apokleos/pci-path-refactor
runtime-rs: Refactor the code related to PCI paths and VFIO device driver initialize in DM.
2023-12-23 21:44:07 +08:00
Steve Horsman
1afce09858
Merge pull request #8721 from stevenhorsman/kata-deploy-typos
kata-deploy: snapshotter typo fixes
2023-12-22 21:26:03 +00:00
stevenhorsman
4a95c0d07f kata-deploy: snapshotter typo fixes
- Add spaces so that the if statements are valid

Fixes: #8720
Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2023-12-22 16:32:02 +00:00
Dan Mihai
080541a0f2 genpolicy: add SPDX license header
Add SPDX license header to rules.rego.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Saul Paredes
7f126be67e genpolicy: Update oci_distribution to 0.10.0
Also support alternative media type and update samples

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
9eb6fd4c24 docs: add agent policy and genpolicy docs
Add docs for the Agent Policy and for the genpolicy tool.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
57f93195ef genpolicy: add support for StatefulSet YAML input
Generate policy for K8s StatefulSet YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
35958ec9cc genpolicy: add support for ReplicationController
Generate policy for K8s ReplicationController YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
7da17099f2 genpolicy: add support for ReplicaSet YAML input
Generate policy for K8s ReplicaSet YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
d84300f1ee genpolicy: add support for List YAML input
Generate policy for K8s List YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
a03452637b genpolicy: add support for Job YAML input
Generate policy for K8s Job YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
2dbd01c80b genpolicy: add support for Deployment YAML input
Generate policy for K8s Deployment YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
a40a6003d0 genpolicy: add support for DaemonSet YAML input
Generate policy for K8s DaemonSet YAML.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00
Dan Mihai
48829120b6 policy: initial genpolicy commit
Add application that infers K8s user's intentions based on user's
K8s YAML file, and generates a Rego/OPA based policy for that YAML.

Just Pod YAML files are supported as input using this initial source
code. Support for other types of YAML files will come with upcoming
commits.

Fixes: #7673

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2023-12-22 15:35:05 +00:00