Commit Graph

13834 Commits

Author SHA1 Message Date
Bo Chen
a68aeca356
Merge pull request #9575 from likebreath/0430/clh_v39.0
versions: Upgrade to Cloud Hypervisor v39.0
2024-06-14 09:10:19 -07:00
Steve Horsman
ab8a9882c1
Merge pull request #9818 from EmmEff/fix-spelling
runtime: fix minor spelling issues
2024-06-14 13:12:56 +01:00
Steve Horsman
99bf95f773
Merge pull request #9827 from littlejawa/fix_panic_on_metrics_gathering
runtime: avoid panic on metrics gathering
2024-06-14 11:12:43 +01:00
Steve Horsman
3eba4211f3
Merge pull request #9843 from microsoft/danmihai1/install_yq
ci: fix the expected yq version string
2024-06-14 10:26:21 +01:00
Dan Mihai
824287d64a
Merge pull request #9844 from microsoft/danmihai1/k8s-policy-pvc
tests: fix yq command line in k8s-policy-pvc
2024-06-13 15:07:15 -07:00
Mike Frisch
c2f61b0fe3 runtime: spelling fixes
Minor spelling fixes in runtime log messages.

Signed-off-by: Mike Frisch <mikef17@gmail.com>
2024-06-13 12:11:34 -04:00
Dan Mihai
56f9e23710 tests: fix yq command line in k8s-policy-pvc
Fix the collision between:
- https://github.com/kata-containers/kata-containers/pull/9377
- https://github.com/kata-containers/kata-containers/pull/9706

One enabled a newer yq command line format and the other used the
older format. Both passed CI because they were not tested together.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-06-13 16:06:15 +00:00
Dan Mihai
23e99e264c ci: fix the expected yq version string
I get:

~/gopath/bin/yq --version
yq (https://github.com/mikefarah/yq/) version v4.40.7

Also add support for set -o xtrace to install_yq.sh.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-06-13 15:52:26 +00:00
Greg Kurz
b85b1c1058
Merge pull request #9790 from gkurz/kill-some-dead-runtime-code
Kill some dead runtime code
2024-06-13 15:45:51 +02:00
Fabiano Fidêncio
56423cbbfe
Merge pull request #9706 from burgerdev/burgerdev/genpolicy-devices
genpolicy: add support for devices
2024-06-12 23:03:41 +02:00
Wainer Moschetta
d971e5ae68
Merge pull request #9537 from wainersm/kata-deploy-crio
kata-deploy: configuring CRI-O for guest-pull image pulling
2024-06-12 17:27:00 -03:00
GabyCT
461b6e7c93
Merge pull request #9821 from GabyCT/topic/fixts
metrics: Use function definition to have uniformity
2024-06-12 10:04:28 -06:00
Fabiano Fidêncio
3a0247ed43
Merge pull request #9819 from stevenhorsman/config-envvar-precedence
agent: config: Ensure envs take precedence
2024-06-12 11:26:02 +02:00
Julien Ropé
9c86eb1d35 runtime: avoid panic on metrics gathering
While running with a remote hypervisor, whenever kata-monitor tries to access
metrics from the shim, the shim does a "panic" and no metric can be gathered.

The function GetVirtioFsPid() is called on metrics gathering, and had a call
to "panic()". Since there is no virtiofs process for remote hypervisor, the
right implementation is to return nil. The caller expects that, and will skip
metrics gathering for virtiofs.

Fixes: #9826

Signed-off-by: Julien Ropé <jrope@redhat.com>
2024-06-12 10:02:44 +02:00
Xuewei Niu
92cc5e0adb
Merge pull request #9781 from gaohuatao-1/ght/shm 2024-06-12 12:39:28 +08:00
Greg Kurz
1acf8d0c35 govmm: Drop QEMU's NoShutdown knob
Code is not used.

Signed-off-by: Greg Kurz <groug@kaod.org>
2024-06-11 19:55:54 +02:00
Greg Kurz
cb5b548ad7 govmm: Drop QEMU's Daemonize knob
Code isn't used anymore.

Signed-off-by: Greg Kurz <groug@kaod.org>
2024-06-11 19:55:54 +02:00
Greg Kurz
33eaf69d5f virtcontainers: Drop QEMU's Daemonize knob
QEMU isn't started as daemon anymore and this won't change (see #5736
for details). Drop the related code.

Signed-off-by: Greg Kurz <groug@kaod.org>
2024-06-11 19:55:54 +02:00
Wainer Moschetta
f66a5b6287
Merge pull request #9807 from wainersm/qemu-rs_kata-deploy
kata-deploy: add qemu-runtime-rs runtimeClass
2024-06-11 14:50:01 -03:00
Dan Mihai
d47f40210a
Merge pull request #9808 from microsoft/saulparedes/oci_from_settings
genpolicy: load OCI version from settings
2024-06-11 10:42:04 -07:00
Gabriela Cervantes
a96ff49060 metrics: Use function definition to have uniformity
This PR uses the function definition to have uniformity across
all the launch times script.

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2024-06-11 17:36:08 +00:00
Bo Chen
2398442c58 runtime: clh: Re-generate the client code
This patch re-generates the client code for Cloud Hypervisor v39.0.
Note: The client code of cloud-hypervisor's OpenAPI is automatically
generated by openapi-generator.

Fixes: #8694, #9574

Signed-off-by: Bo Chen <chen.bo@intel.com>
2024-06-11 09:42:17 -07:00
Bo Chen
7a82894502 versions: Upgrade to Cloud Hypervisor v39.0
This patch upgrades Cloud Hypervisor to v39.0 from v36.0, which contains
fixes of several security advisories from dependencies. Details can be
found from #9574.

Fixes: #8694, #9574

Signed-off-by: Bo Chen <chen.bo@intel.com>
2024-06-11 09:42:16 -07:00
Wainer dos Santos Moschetta
be9990144a workflow: run kata-deploy tests to qemu-runtime-rs on AKS
Start testing the ability of kata-deploy to install and configure
the qemu-runtime-rs runtimeClass.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-06-11 12:58:47 -03:00
Wainer dos Santos Moschetta
4f398cc969 kata-deploy: add qemu-runtime-rs runtimeClass
Allow kata-deploy to install and configure the qemu-runtime-rs runtimeClass
which ties to qemu hypervisor implementation in rust for the runtime-rs.

Fixes: #9804
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2024-06-11 12:58:47 -03:00
stevenhorsman
40e02b34cb agent: config: Ensure envs take precedence
- Update the config parsing logic so that when reading from the
agent-config.toml file any envs are still processed
- Add units tests to formalise that the envs take precedence over values
from the command line and the config file

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2024-06-11 16:31:10 +01:00
Steve Horsman
59ff40f054
Merge pull request #9811 from mkulke/mkulke/use-kebabcase-for-enum-values-in-config-file-parsing
agent: convert enum vals to kebab-case in cfg file
2024-06-11 14:49:30 +01:00
gaohuatao
638e9acf89 runtime: fix the bug of func countFiles
When the total number of files observed is greater than limit, return (-1, err).
When the returned err is not nil, the func countFiles should return -1.

Fixes:#9780

Signed-off-by: gaohuatao <gaohuatao@bytedance.com>
2024-06-11 18:17:18 +08:00
Alex Lyn
1c8db85d54
Merge pull request #9784 from Apokleos/bufix-testcases
kata-types: fix bug in kata-types several test cases
2024-06-11 10:01:45 +08:00
Saul Paredes
6a84562c16 genpolicy: load OCI version from settings
Load OCI version from genpolicy-settings.json and validate it in
rules.rego

Fixes: #9593

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
2024-06-10 15:30:39 -07:00
GabyCT
0c5849b68b
Merge pull request #9809 from microsoft/danmihai1/yq-breaking-change
tests: k8s: use newer yq command line format
2024-06-10 16:29:59 -06:00
Wainer Moschetta
ade69e44f9
Merge pull request #9785 from BbolroC/kubectl-retry
CI: Introduce retry mechanism for kubectl in gha-run.sh
2024-06-10 18:33:34 -03:00
Magnus Kulke
abc704a720 agent: convert enum vals to kebab-case in cfg file
fixes #9810

Add an annotation to the enum values in the agent config that will
deserialize them using a kebab-case conversion, aligning the behaviour
to parsing of params specified via kernel cmdline.

drive-by fix: add config override for guest_component_procs variable

Signed-off-by: Magnus Kulke <magnuskulke@microsoft.com>
2024-06-10 21:55:05 +02:00
Dan Mihai
32198620a9 tests: k8s: use newer yq command line format
Fix the recent collision between:
- https://github.com/kata-containers/kata-containers/pull/9377
- https://github.com/kata-containers/kata-containers/pull/9725

One enabled a newer yq command line format and the other used the older
format. Both passed CI because they were not tested together.

Fixes: #9789

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2024-06-10 18:48:25 +00:00
Dan Mihai
079a0a017c
Merge pull request #9557 from portersrc/ci-debug-output-nydus-pod
CI: describe pod on k8s-create-pod wait failure
2024-06-10 08:17:54 -07:00
Ryan Savino
84280115f6
Merge pull request #9151 from niteeshkd/nd_snp_kernel_hashes
runtime: enable kernel-hashes for SNP confidential container
2024-06-07 18:19:51 -05:00
GabyCT
03bcc167a4
Merge pull request #9779 from GabyCT/topic/fixcoscript
tests: Fix indentation in common script
2024-06-07 15:37:10 -06:00
Wainer Moschetta
7a28535277
Merge pull request #9800 from fidencio/topic/ci-tdx-re-enable-some-of-the-tests
ci: tdx: Re-enable a bunch of volume related tests
2024-06-07 16:17:19 -03:00
Hyounggyu Choi
8ff128dda8 CI: Introduce retry mechanism for kubectl in gha-run.sh
Frequent errors have been observed during k8s e2e tests:

- The connection to the server 127.0.0.1:6443 was refused - did you specify the right host or port?
- Error from server (ServiceUnavailable): the server is currently unable to handle the request
- Error from server (NotFound): the server could not find the requested resource

These errors can be resolved by retrying the kubectl command.

This commit introduces a wrapper function in common.sh that runs kubectl up to 3 times
with a 5-second interval. Initially, this change only covers gha-run.sh for Kubernetes.

Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2024-06-07 18:24:19 +02:00
Fabiano Fidêncio
81c221c1b4
ci: k8s: tdx: Re-enable volume tests
It seems I was very lose on disabling some of the tests, and the issues
I faced could be related to other instabilities in the CI.

Let's re-enable this one, following what was done for the SEV, SNP, and
coco-qemu-dev.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 18:13:36 +02:00
Fabiano Fidêncio
9db9d35198
ci: k8s: tdx: Re-enable projected-volume tests
It seems I was very lose on disabling some of the tests, and the issues
I faced could be related to other instabilities in the CI.

Let's re-enable this one, following what was done for the SEV, SNP, and
coco-qemu-dev.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 18:12:36 +02:00
Fabiano Fidêncio
f6a6cba8ca
ci: k8s: tdx: Re-enable nested-configmap-secret tests
It seems I was very lose on disabling some of the tests, and the issues
I faced could be related to other instabilities in the CI.

Let's re-enable this one, following what was done for the SEV, SNP, and
coco-qemu-dev.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 18:12:06 +02:00
Fabiano Fidêncio
957d0cccf6
ci: k8s: tdx: Re-enable inotify tests
It seems I was very lose on disabling some of the tests, and the issues
I faced could be related to other instabilities in the CI.

Let's re-enable this one, following what was done for the SEV, SNP, and
coco-qemu-dev.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 18:10:39 +02:00
Fabiano Fidêncio
fc6f662ae0
ci: k8s: tdx: Re-enable credentials-secrets tests
It seems I was very lose on disabling some of the tests, and the issues
I faced could be related to other instabilities in the CI.

Let's re-enable this one, following what was done for the SEV, SNP, and
coco-qemu-dev.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 18:08:29 +02:00
Fabiano Fidêncio
5741c6d3e6
Merge pull request #9768 from fidencio/topic/ci-tdx-enable-cdh-test
ci: kbs: Enable CDH tests for TDX
2024-06-07 17:59:12 +02:00
Greg Kurz
afeb98d73f
Merge pull request #9782 from ldoktor/ci-centos-9
ci.ocp: Switch base to centos-9
2024-06-07 13:15:02 +02:00
Fabiano Fidêncio
fde457589e ci: kbs: tdx: Enable basic attestation tests
Let's stop skipping the CDH tests for TDX, as know we should have an
environmemnt where it can run and should pass. :-)

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 12:18:50 +02:00
Fabiano Fidêncio
cac525059e ci: kbs: tdx: Use the hostname ip instead of localhost for the PCCS
We must ensure we use the host ip to connect to the PCCS running on the
host side, instead of using localhost (which has a different meaning
from inside the KBS pod).

The reason we're using `hostname -i` isntead of the helper functions, is
because the helper functions need the coco-kbs deployed for them to
work, and what we do is before the deployment.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2024-06-07 12:18:07 +02:00
Alex Lyn
27685c91e5 kata-types: fix bug in kata-types several test cases
(1) As mis-use of cap.set causing previous Caps lost which
causing assert! failed, just replacing cap.set with cap.add.

(2) It will return error if there's no such name setting when
do update_config_by_annotation {
    ...
if config.runtime.name.is_empty() {
            return Err(io::Error::new(
                io::ErrorKind::InvalidData,
                "Runtime name is missing in the configuration",
            ));
        }
...
}

Fixes #9783

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
2024-06-07 09:16:23 +08:00
David Esparza
822c641b58
Merge pull request #9760 from amshinde/kata-manager-link-runc
kata-manager: Add symlinks for runc and slirp4netns
2024-06-06 12:55:57 -06:00