1
0
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-05-06 07:27:28 +00:00
Commit Graph

902 Commits

Author SHA1 Message Date
David Esparza
029a6de52b
Merge pull request from GabyCT/topic/fixlaunchtime
metrics: Update launch times script
2024-05-16 11:28:44 -06:00
GabyCT
05cc8fae5e
Merge pull request from GabyCT/topic/fixrwfio
metrics: Fix random write value for FIO
2024-05-15 17:44:41 -06:00
Gabriela Cervantes
793a02600a metrics: Fix random write value for clh for FIO
This PR decreases the random write value for clh for FIO.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-05-15 22:13:10 +00:00
GabyCT
d752f0aa4f
Merge pull request from GabyCT/topic/ghacomk8s
gha: Fix indentation in gha run k8s common
2024-05-15 11:55:14 -06:00
GabyCT
64b915b86e
Merge pull request from GabyCT/topic/addnegativetest
tests: Add k8s negative policy test
2024-05-15 08:52:57 -06:00
Gabriela Cervantes
f20a44bba3 gha: Fix indentation in gha run k8s common
This PR fixes the indentation in gha run k8s common script
to have uniformity across the script.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-05-13 20:07:47 +00:00
Fabiano Fidêncio
9713558477
k0s: Use a different port for kube-route's metrics
kube-router decided to use :8080 for its metrics, and this seems to be a
change that affected k0s 1.30.0+, leading to kube-router pod crashing
all the time and anything can actually be started after that.

Due to this issue, let's simply use a different port (:9999) and move on
with our tests.

Fixes: 

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-05-11 23:18:20 +02:00
Gabriela Cervantes
80e551ea74 metrics: Update launch times script
This PR updates the launch times scripts by improving the variable
definition as well as trying to use the same format across all the script.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-05-09 21:29:32 +00:00
Fabiano Fidêncio
aba56a8adb
tests: measured-rootfs: Skip policy addition
Let's skip the policy addition for now, in order to get the TDX CI back
up and running, and then we can re-enable it as soon as we get
https://github.com/kata-containers/kata-containers/issues/9612 fixed.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-05-09 07:59:12 +02:00
Gabriela Cervantes
2fb406ed3a metrics: Fix random write value for FIO
This PR fixes the random write value for FIO for qemu by decreasing it
to avoid the random failures of the GHA CI.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-05-08 18:54:41 +00:00
Fabiano Fidêncio
142342012c
tests: pull-image: Don't run on TEEs
Let's skip those tests on TEEs as we've been facing a reasonable amount
of issues, most likely on the containerd side, related to pulling the
image on the guest.

Once we're able to fix the issues on containerd, we can get back and
re-enable those by reverting this commit.

The decision of disabling the tests for TEEs is because the machines may
end up in a state where human intervention is necessary to get them back
to a functional state, and that's really not optimal for our CI.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-05-08 18:40:22 +02:00
Fabiano Fidêncio
ddf6b367c7
Merge pull request from kata-containers/dependabot/go_modules/src/runtime/go_modules-22ef55fa20
build(deps): bump the go_modules group across 5 directories with 8 updates
2024-05-07 13:14:48 +02:00
Gabriela Cervantes
506e17a60d tests: Add k8s negative policy test
This PR adds a k8s negative policy test to the confidential attestation
bats test.

Fixes 

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-05-06 15:28:54 +00:00
Aurélien Bombo
0cc2b07a8c tests: adapt Mariner CI to unblock CH v39 upgrade
The CH v39 upgrade in  is currently blocked because of a bug in the
Mariner host kernel. To address this, we temporarily tweak the Mariner
CI to use an Ubuntu host and the Kata guest kernel, while retaining the
Mariner initrd. This is tracked in .

Importantly, this allows us to preserve CI for genpolicy. We had to
tweak the default rules.rego however, as the OCI version is now
different in the Ubuntu host. This is tracked in .

This change has been tested together with CH v39 in .

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2024-05-03 16:29:12 +00:00
dependabot[bot]
391bc35805 build(deps): bump the go_modules group across 5 directories with 8 updates
Bumps the go_modules group with 2 updates in the /src/runtime directory: [github.com/containerd/containerd](https://github.com/containerd/containerd) and [github.com/containers/podman/v4](https://github.com/containers/podman).
Bumps the go_modules group with 4 updates in the /src/tools/csi-kata-directvolume directory: [golang.org/x/sys](https://github.com/golang/sys), google.golang.org/protobuf, [golang.org/x/net](https://github.com/golang/net) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).
Bumps the go_modules group with 2 updates in the /src/tools/log-parser directory: [golang.org/x/sys](https://github.com/golang/sys) and gopkg.in/yaml.v3.
Bumps the go_modules group with 2 updates in the /tests directory: [golang.org/x/sys](https://github.com/golang/sys) and gopkg.in/yaml.v3.
Bumps the go_modules group with 2 updates in the /tools/testing/kata-webhook directory: [golang.org/x/sys](https://github.com/golang/sys) and [golang.org/x/net](https://github.com/golang/net).


Updates `github.com/containerd/containerd` from 1.7.2 to 1.7.11
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v1.7.2...v1.7.11)

Updates `github.com/containers/podman/v4` from 4.2.0 to 4.9.4
- [Release notes](https://github.com/containers/podman/releases)
- [Changelog](https://github.com/containers/podman/blob/v4.9.4/RELEASE_NOTES.md)
- [Commits](https://github.com/containers/podman/compare/v4.2.0...v4.9.4)

Updates `google.golang.org/protobuf` from 1.29.1 to 1.33.0

Updates `github.com/cyphar/filepath-securejoin` from 0.2.3 to 0.2.4
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.2.3...v0.2.4)

Updates `golang.org/x/sys` from 0.15.0 to 0.19.0
- [Commits](https://github.com/golang/sys/compare/v0.15.0...v0.19.0)

Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0

Updates `golang.org/x/net` from 0.19.0 to 0.23.0
- [Commits](https://github.com/golang/net/compare/v0.19.0...v0.23.0)

Updates `google.golang.org/grpc` from 1.59.0 to 1.63.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.59.0...v1.63.2)

Updates `golang.org/x/sys` from 0.0.0-20191026070338-33540a1f6037 to 0.1.0
- [Commits](https://github.com/golang/sys/compare/v0.15.0...v0.19.0)

Updates `gopkg.in/yaml.v3` from 3.0.0-20200313102051-9f266ea9e77c to 3.0.0

Updates `golang.org/x/sys` from 0.0.0-20220429233432-b5fbb4746d32 to 0.19.0
- [Commits](https://github.com/golang/sys/compare/v0.15.0...v0.19.0)

Updates `gopkg.in/yaml.v3` from 3.0.0-20210107192922-496545a6307b to 3.0.0

Updates `golang.org/x/sys` from 0.15.0 to 0.19.0
- [Commits](https://github.com/golang/sys/compare/v0.15.0...v0.19.0)

Updates `golang.org/x/net` from 0.19.0 to 0.23.0
- [Commits](https://github.com/golang/net/compare/v0.19.0...v0.23.0)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/containers/podman/v4
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/sys
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/sys
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/sys
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: gopkg.in/yaml.v3
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/sys
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
2024-04-30 09:46:13 +01:00
Wainer dos Santos Moschetta
631f6f6ed6 gha: switch CoCo tests on non-TEE to use qemu-coco-dev
With the addition of the 'qemu-coco-dev' runtimeClass we no longer need
to run CoCo tests on non-TEE environments with 'qemu'. As a result the
tests also no longer need to set the "io.katacontainers.config.hypervisor.image"
annotation to pods.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-04-29 05:45:11 -03:00
Hyounggyu Choi
80cb4a6c18 build: Update golang version to 1.22.2
As we have an issue with a golang version for `run-cri-containerd`,
it is required to bump the language.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-04-26 15:50:29 +02:00
James O. D. Hunt
5bd614530f
Merge pull request from jodh-intel/gha-k8s-ch-dm
gha: Enable k8s tests for cloud hypervisor with devicemapper
2024-04-25 09:28:09 +01:00
James O. D. Hunt
ff7349b6f0 gha: Enable k8s tests for cloud hypervisor with devicemapper
Enable the k8s tests for cloud hypervisor with devicemapper.

Fixes: .

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
Co-authored-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-04-24 16:32:51 +01:00
Dan Mihai
e5c3f5fa9b tests: no generated policy for untested platforms
Avoid auto-generating Policy on platforms that haven't been tested
yet with auto-generated Policy.

Support for auto-generated Policy on these additional platforms is
coming up in future PRs, so the tests being fixed here were
prematurely enabled.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-23 16:07:03 +00:00
Dan Mihai
ed6412b63c tests: k8s: reduce the policy tests output noise
Hide some of the kubectl output, to reduce the size and redundancy of
this output.

Fixes: 

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-22 19:59:33 +00:00
Dan Mihai
58e608d61a tests: remove k8s-policy-set-keys.bats
Remove k8s-policy-set-keys.bats in preparation for using the regorus
crate instead of the OPA daemon for evaluating the Agent Policy. This
test depended on sending HTTP requests to OPA.

Fixes: 

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-22 19:49:38 +00:00
Dan Mihai
5ceed689eb
Merge pull request from microsoft/danmihai1/pod-tests
tests: k8s: inject agent policy failures (part 3)
2024-04-17 14:01:11 -07:00
Wainer Moschetta
2d8e7933c5
Merge pull request from GabyCT/topic/uninstallkbs
tests/k8s: Add uninstall kbs client command function
2024-04-17 09:36:37 -03:00
Archana Shinde
af3b19ed18
Merge pull request from amshinde/document-intel-gpu-vfio
docs: Document Intel Discrete GPUs usage with Kata
2024-04-16 16:17:03 -07:00
Archana Shinde
973a15332a spell-check: Add missing words to spell-check
Add missing words to spell-check dictionaries

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
2024-04-16 11:50:02 -07:00
Dan Mihai
2c4d1ef76b tests: k8s: inject agent policy failures (part 3)
Auto-generate the policy and then simulate attacks from the K8s
control plane by modifying the test yaml files. The policy then
detects and blocks those changes.

These test cases are using K8s Pods. Additional policy failures
are injected during CI using other types of K8s resources - e.g.,
using Jobs and Replication Controllers - from separate PRs.

Fixes: 

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-16 18:15:12 +00:00
GabyCT
9238daf729
Merge pull request from microsoft/danmihai1/rc-tests
tests: k8s: inject agent policy failures (part2)
2024-04-16 10:01:39 -06:00
Hyounggyu Choi
32f58abfde
Merge pull request from BbolroC/runtime-rs-ci-qemu
CI: Enable GHA cri-containerd workflow for runtime-rs with QEMU
2024-04-15 09:31:25 +02:00
Wainer Moschetta
0a04f54a8e
Merge pull request from GabyCT/topic/pulltype
gha: Define unbound PULL TYPE variable
2024-04-12 14:48:56 -03:00
Hyounggyu Choi
3c217c6c15 ci|cri-containerd: Introduce qemu-runtime-rs for KATA_HYPERVISOR
`qemu-runtime-rs` will be utilized to handle a test scenario where
the VMM is QEMU and runtime-rs is employed.

Note: Some of the tests are skipped. They are going to be reintegrated in
the follow-up PR (Check out ).

Fixes: 

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-04-12 12:25:53 +02:00
Dan Mihai
e51cbdcff9 tests: k8s: inject agent policy failures (part2)
Auto-generate the policy and then simulate attacks from the K8s
control plane by modifying the test yaml files. The policy then
detects and blocks those changes.

These test cases are using K8s Replication Controllers. Additional
policy failures will be injected using other types of K8s resources
- e.g., using Pods and/or Jobs - in separate PRs.

Fixes: 

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-11 21:08:53 +00:00
Wainer dos Santos Moschetta
4f74617897 tests: pass --overwrite-existing to aks get-credentials
By passing --overwrite-existing to `aks get-credentials` it will stop
asking if I want to overwrite the existing credentials. This is handy
for running the scripts locally.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-04-11 15:31:40 -03:00
Wainer dos Santos Moschetta
3508f3a43a tests/k8s: use CoCo image on guest-pull when non-TEE
When running on non-TEE environments (e.g. KATA_HYPERVISOR=qemu) the tests should
be stressing the CoCo image (/opt/kata/share/kata-containers/kata-containers-confidential.img)
although currently the default image/initrd is built to be able to do guest-pull as well.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-04-11 15:31:40 -03:00
Wainer dos Santos Moschetta
c24f13431d tests/k8s: enable guest-pull tests on non-TEE
Enabled guest-pull tests on non-TEE environment. It know requires the SNAPSHOTTER environment
variable to avoid it running on jobs where nydus-snapshotter is not installed

Fixes: 
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-04-11 15:31:40 -03:00
Gabriela Cervantes
5420595d03 tests/k8s: Add uninstall kbs client command function
This PR adds the function to uninstall kbs client command function
specially when we are running with baremetal devices.

Fixes 

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-04-11 17:06:11 +00:00
Fabiano Fidêncio
5611233ed8
Merge pull request from microsoft/danmihai1/job-tests
tests: k8s: inject agent policy failures
2024-04-11 17:21:54 +02:00
GabyCT
08dcdc62de
Merge pull request from GabyCT/topic/improvecleanup
tests: Improve the kbs_k8s_delete function
2024-04-10 14:28:21 -06:00
Gabriela Cervantes
4a2ee3670f gha: Define unbound PULL TYPE variable
This PR defines the PULL_TYPE variable to avoid failures of unbound
variable when this is being test it locally.

Fixes 

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-04-10 17:16:19 +00:00
GabyCT
dab837d71d
Merge pull request from GabyCT/topic/fixinnydus
gha: Fix indentation in gha run script
2024-04-10 11:07:56 -06:00
David Esparza
9e1368dbc5
Merge pull request from dborquez/add-onednn-openvino-ml-benchs
add onednn and openvino ml-benchmarks
2024-04-09 19:03:00 -06:00
Dan Mihai
ea31df8bff
Merge pull request from microsoft/saulparedes/genpolicy_add_containerd_pull
genpolicy: Add optional toggle to pull images using containerd
2024-04-09 12:29:19 -07:00
Gabriela Cervantes
6ebdcf8974 gha: Fix indentation in gha run script
This PR fixes an identation in gha run script.

Fixes 

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-04-09 16:37:17 +00:00
Greg Kurz
89353249fc
Merge pull request from beraldoleal/ci-docs
docs: adding an initial CI documentation
2024-04-09 18:26:15 +02:00
Dan Mihai
2252490a96 tests: k8s: inject agent policy failures
Auto-generate the policy and then simulate attacks from the K8s
control plane by modifying the test yaml files. The policy then
detects and blocks those changes.

These test cases are using K8s Jobs. Additional policy failures
will be injected using other types of K8s resources - e.g., using
Pods and/or Replication Controllers - in future PRs.

Fixes: 

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-04-09 15:36:57 +00:00
David Esparza
facf3c9364
metrics: Add onednn benchmark.
This PR adds onednn test to exercise additional ML benchmarks.

Onednn is an Intel-optimized library for Deep Neural Networks.

Fixes: 

Signed-off-by: David Esparza <david.esparza.borquez@intel.com>
2024-04-09 09:05:51 -06:00
David Esparza
3bde511d0d
metrics: Add openvino benchmark.
This PR adds openvino test in order to exercise additional ML
benchmarks.

OpenVino bench used to optimize and deploy deep learning models.

Fixes: 

Signed-off-by: David Esparza <david.esparza.borquez@intel.com>
2024-04-09 09:05:51 -06:00
David Esparza
b37c5f8ba1
metrics:libs: Add HTTPS and HTTP vars to docker build.
Include HTTP and HTTPS env variables in the building docker
images because they are required to download packages
such as Phoronix.

Added a restriction that verifies that docker building images
is performed as root.

Signed-off-by: David Esparza <david.esparza.borquez@intel.com>
2024-04-09 09:05:51 -06:00
David Esparza
3355dd9e2b
metrics:libs: Adds a function to set new kata configuration.
Adds a function that receives as a single parameter the name of
a valid Kata configuration file which  will be established as
the default kata configuration to start kata containers.

Adds a second function that returns the path to the current
kata configuration file.

Signed-off-by: David Esparza <david.esparza.borquez@intel.com>
2024-04-09 09:05:51 -06:00
David Esparza
cb4380d1c9
metrics: common: Add function to clean the cache.
The function clear the Page Cache only.

Signed-off-by: David Esparza <david.esparza.borquez@intel.com>
2024-04-09 09:05:51 -06:00