Commit Graph

8842 Commits

Author SHA1 Message Date
Bin Liu
b33ad7e57a
Merge pull request #4574 from jelipo/fix-serde-serializing
oci: fix serde skip serializing condition
2022-07-05 13:51:43 +08:00
Bin Liu
0189738283
Merge pull request #4576 from ManaSugi/fix/oci-poststart-hook
agent: Run OCI poststart hooks after a container is launched
2022-07-05 11:08:49 +08:00
Peng Tao
cd2d8c6fe2
Merge pull request #4580 from ManaSugi/fix/replace-libc-with-nix
agent: Replace some libc functions with nix ones
2022-07-05 10:53:42 +08:00
Peng Tao
a1de394e51
Merge pull request #4550 from liubin/fix/4548-overwrite-mount-type-for-bind-mount
runtime: overwrite mount type to bind for bind mounts
2022-07-04 19:56:26 +08:00
Peng Tao
44ec9684d8
Merge pull request #4573 from amshinde/unsafe-repo-runtime-shimv2
build: Set safe.directory for runtime repo
2022-07-04 19:51:00 +08:00
haining.cao
0ddb34a38d oci: fix serde skip serializing condition
There is an extra space on the serde serialization condition.

Fixes: #4578

Signed-off-by: haining.cao <haining.cao@daocloud.io>
2022-07-04 16:16:04 +08:00
Manabu Sugimoto
fbb2e9bce9 agent: Replace some libc functions with nix ones
Replace `libc::setgroups()`, `libc::fchown()`, and `libc::sethostname()`
functions with nix crate ones for safety and maintainability.

Fixes: #4579

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
2022-07-04 14:49:38 +09:00
Manabu Sugimoto
acd3302bef agent: Run OCI poststart hooks after a container is launched
Run the OCI `poststart` hooks must be called after the
user-specified process is executed but before the `start`
operation returns in accordance with OCI runtime spec.

Fixes: #4575

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
2022-07-03 18:03:51 +09:00
GabyCT
635fa543a3
Merge pull request #4560 from bookinabox/update-commit-message-check
ci/cd: update check-commit-message
2022-07-01 11:30:03 -05:00
liubin
1f363a386c runtime: overwrite mount type to bind for bind mounts
Some clients like nerdctl may pass mount type of none for volumes/bind mounts,
this will lead to container start fails.

Referring to runc, it overwrites the mount type to bind and ignores the input value.

Fixes: #4548

Signed-off-by: liubin <liubin0329@gmail.com>
2022-07-01 12:13:01 +08:00
Archana Shinde
4e48509ed9 build: Set safe.directory for runtime repo
While doing a docker build for shim-v2, we see this:

```
fatal: unsafe repository
('/home/${user}/go/src/github.com/kata-containers/kata-containers' is
owned by someone else)
To add an exception for this directory, call:

        git config --global --add safe.directory
/home/${user}/go/src/github.com/kata-containers/kata-containers
```

This is because the docker container build is run as root while the
runtime repo is checked out as normal user.

Unlike this error causing the rootfs build to error out, the error here
does not really cause `make shim-v2-tarball` to fail.

However its good to get rid of this error message showing during the
make process.

Fixes: #4572

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
2022-06-30 20:52:44 -07:00
Archana Shinde
c29038a2e2
Merge pull request #4562 from ManaSugi/git-safe-repo
Set safe.directory against tests repository
2022-06-30 16:13:15 -07:00
GabyCT
02a51e75a7
Merge pull request #4554 from liubin/fix/delete-not-used-console-from-container-config
runtime: delete Console from Cmd type
2022-06-30 11:40:07 -05:00
Fabiano Fidêncio
aa561b49f5
Merge pull request #4540 from fidencio/topic/default_maxmemory
Add `default_maxmemory` config option
2022-06-30 12:08:15 +02:00
Manabu Sugimoto
48ccd42339 ci: Set safe.directory against tests repository
Set `safe.directory` against `kata-containers/tests` repository
before checkout because the user in the docker container is root,
but the `tests` repository on the host machine is usually owned
by the normal user.
This works when we already have the `tests` repository which is
not owned by root on the host machine and try to create a rootfs
using Docker (`USE_DOCKER=true`).

Fixes: #4561

Signed-off-by: Manabu Sugimoto <Manabu.Sugimoto@sony.com>
2022-06-30 17:36:29 +09:00
Derek Lee
433816cca2 ci/cd: update check-commit-message
Recently added check-commit-message to the tests repository. Minor
changes were also made to action. For consistency's sake, copied changes
over to here as well.

tests - https://github.com/kata-containers/tests/pull/4878

Minor Changes:
   1. Body length check is now 75 and consistent with guidelines
   2. Lines without spaces are not counted in body length check

Fixes #4559

Signed-off-by: Derek Lee <derlee@redhat.com>
2022-06-29 16:55:43 -07:00
GabyCT
2a94261df5
Merge pull request #4549 from liubin/fix/4419-set-status-if-wait-process-failed
shim: set a non-zero return code if the wait process call failed.
2022-06-29 17:04:53 -05:00
Fabiano Fidêncio
1e12d56512
Merge pull request #4469 from egernst/config-validation-refactor
Refactor how hypervisor config validation is handled
2022-06-29 14:42:11 +02:00
liubin
a5a25ed13d runtime: delete Console from Cmd type
There is much code related to this property, but it is not used anymore.

Fixes: #4553

Signed-off-by: liubin <liubin0329@gmail.com>
2022-06-29 17:36:32 +08:00
liubin
ab5f1c9564 shim: set a non-zero return code if the wait process call failed.
Return code is an int32 type, so if an error occurred, the default value
may be zero, this value will be created as a normal exit code.

Set return code to 255 will let the caller(for example Kubernetes) know
that there are some problems with the pod/container.

Fixes: #4419

Signed-off-by: liubin <liubin0329@gmail.com>
2022-06-29 12:33:32 +08:00
Eric Ernst
e5be5cb086 runtime: device: cleanup outdated comments
Prior device config move didn't update the comments. Let's address this,
and make sure comments match the new path...

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-28 18:22:28 -07:00
Eric Ernst
5f936f268f virtcontainers: config validation is host specific
Ideally this config validation would be in a seperate package
(katautils?), but that would introduce circular dependency since we'd
call it from vc, and it depends on vc types (which, shouldn't be vc, but
probably a hypervisor package instead).

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-28 18:22:28 -07:00
Fabiano Fidêncio
323271403e virtcontainers: Remove unused function
While working on the previous commits, some of the functions become
non-used.  Let's simply remove them.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-28 21:19:24 +02:00
Fabiano Fidêncio
0939f5181b config: Expose default_maxmemory
Expose the newly added `default_maxmemory` to the project's Makefile and
to the configuration files.

Fixes: #4516

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-28 21:19:24 +02:00
Fabiano Fidêncio
58ff2bd5c9 clh,qemu: Adapt to using default_maxmemory
Let's adapt Cloud Hypervisor's and QEMU's code to properly behave to the
newly added `default_maxmemory` config.

While implementing this, a change of behaviour (or a bug fix, depending
on how you see it) has been introduced as if a pod requests more memory
than the amount avaiable in the host, instead of failing to start the
pod, we simply hotplug the maximum amount of memory available, mimicing
better the runc behaviour.

Fixes: #4516

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-28 21:19:24 +02:00
Fabiano Fidêncio
ad055235a5
Merge pull request #4547 from GabyCT/topic/removeunuseddocker
packaging: Remove unused kata docker configure script
2022-06-28 20:09:15 +02:00
GabyCT
b2c0387993
Merge pull request #4130 from surajssd/add-cgroup-driver-info
kata-with-k8s: Add cgroupDriver for containerd
2022-06-28 10:30:18 -05:00
Gabriela Cervantes
1a78c3df2e packaging: Remove unused kata docker configure script
This PR removes an unused kata configure docker script which was used
in packaging for kata 1.x but not longer being used in kata 2.x

Fixes #4546

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2022-06-28 15:10:39 +00:00
Tim Zhang
916ffb75d7
Merge pull request #4432 from liubin/fix/4420-binary-log
shim: support shim v2 logging plugin
2022-06-28 16:29:07 +08:00
Fabiano Fidêncio
afdc960424 hypervisor: Add default_maxmemory configuration
Let's add a `default_maxmemory` configuration, which allows the admins
to set the maximum amount of memory to be used by a VM, considering the
initial amount + whatever ends up being hotplugged via the pod limits.

By default this value is 0 (zero), and it means that the whole physical
RAM is the limit.

Fixes: #4516

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-28 08:32:15 +02:00
Bin Liu
4e30e11b31 shim: support shim v2 logging plugin
Now kata shim only supports stdout/stderr of fifo from
containerd/CRI-O, but shim v2 supports logging plugins,
and nerdctl default will use the binary schema for logs.

This commit will add the others type of log plugins:

- file
- binary

In case of binary, kata shim will receive a stdout/stderr like:

binary:///nerdctl?_NERDCTL_INTERNAL_LOGGING=/var/lib/nerdctl/1935db59

That means the nerdctl process will handle the logs(stdout/stderr)

Fixes: #4420

Signed-off-by: Bin Liu <bin@hyper.sh>
2022-06-28 13:54:22 +08:00
Eric Ernst
bdf5e5229b virtcontainers: validate hypervisor config outside of hypervisor itself
Depending on the user of it, the hypervisor from hypervisor interface
could have differing view on what is valid or not. To help decouple,
let's instead check the hypervisor config validity as part of the
sandbox creation, rather than as part of the CreateVM call within the
hypervisor interface implementation.

Fixes: #4251

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-27 11:53:41 -07:00
Eric Ernst
469e098543 katautils: don't do validation when loading hypervisor config
Policy for whats valid/invalid within the config varies by VMM, host,
and by silicon architecture. Let's keep katautils simple for just
translating a toml to the hypervisor config structure, and leave
validation to virtcontainers.

Without this change, we're doing duplicate validation.

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-27 10:13:26 -07:00
Bin Liu
27b1bb5ed9
Merge pull request #4467 from egernst/device-pkg
device package cleanup/refactor
2022-06-27 14:40:53 +08:00
Eric Ernst
e32bf53318 device: deduplicate state structures
Before, we maintained almost identical structures between our persist
API and what we keep for our devices, with the persist API being a
slight subset of device structures.

Let's deduplicate this, now that persist is importing device package.
Json unmarshal of prior persist structure will work fine, since it was
an exact subset of fields.

Fixes: #4468

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-26 21:31:29 -07:00
Eric Ernst
f97d9b45c8 runtime: device/persist: drop persist dependency from device pkgs
Rather than have device package depend on persist, let's define the
(almost duplicate) structures within device itself, and have the Kata
Container's persist pkg import these.

This'll help avoid unecessary dependencies within our core packages.

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-26 21:31:29 -07:00
Eric Ernst
f9e96c6506 runtime: device: move to top level package
Let's move device package to runtime/pkg instead of being buried under
virtcontainers.

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
2022-06-26 21:31:29 -07:00
Bin Liu
3880e0c077 agent: refactor reading file timing for debugging
In the original code, reads mountstats file and return
the content in the error, but at this time the file maybe
changed, we should return the file content that parsed
line by line to check why there is not a fstype option.

Fixes: #4246

Signed-off-by: Bin Liu <bin@hyper.sh>
2022-06-26 21:27:43 -07:00
Archana Shinde
2488a0f6c0
Merge pull request #4439 from amshinde/update-kernel-to-5.15.46
versions: Update kernel to latest LTS version 5.15.48
2022-06-24 11:03:32 -07:00
Fabiano Fidêncio
083ca5f217
Merge pull request #4505 from yoheiueda/agent-debug-build
agent: Allow BUILD_TYPE=debug
2022-06-24 14:04:23 +02:00
Fabiano Fidêncio
03fca8b459
Merge pull request #4526 from fidencio/topic/fix-clippy-warnings-and-update-agent-vendored-code
Fix clippy warnings and update agent's vendored code
2022-06-24 14:02:28 +02:00
Fabiano Fidêncio
c70d3a2c35 agent: Update the dependencies
Let's run a `cargo update` and ensure the deps are up-to-date before we
cut the "-rc0" release.

Fixes: #4525

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-24 11:37:25 +02:00
Fabiano Fidêncio
612fd79bae random: Fix "nonminimal-bool" clippy warning
The error shown below was caught during a dependency bump in the CCv0
branch, but we better fix it here first.
```
error: this boolean expression can be simplified
  --> src/random.rs:85:21
   |
85 |             assert!(!ret.is_ok());
   |                     ^^^^^^^^^^^^ help: try: `ret.is_err()`
   |
   = note: `-D clippy::nonminimal-bool` implied by `-D warnings`
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#nonminimal_bool

error: this boolean expression can be simplified
  --> src/random.rs:93:17
   |
93 |         assert!(!ret.is_ok());
   |                 ^^^^^^^^^^^^ help: try: `ret.is_err()`
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#nonminimal_bool
```

Fixes: #4523

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-24 11:37:05 +02:00
Fabiano Fidêncio
d4417f210e netlink: Fix "or-fun-call" clippy warnings
The error shown below was caught during a dependency bump in the CCv0
branch, but we better fix it here first.
```
error: use of `ok_or` followed by a function call
   --> src/netlink.rs:526:14
    |
526 |             .ok_or(anyhow!(nix::Error::EINVAL))?;
    |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: try this: `ok_or_else(|| anyhow!(nix::Error::EINVAL))`
    |
    = note: `-D clippy::or-fun-call` implied by `-D warnings`
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#or_fun_call
error: use of `ok_or` followed by a function call
   --> src/netlink.rs:615:49
    |
615 |         let v = u8::from_str_radix(split.next().ok_or(anyhow!(nix::Error::EINVAL))?, 16)?;
    |                                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ help: try this: `ok_or_else(|| anyhow!(nix::Error::EINVAL))`
    |
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#or_fun_call
```

Fixes: #4523

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-24 11:37:01 +02:00
Archana Shinde
93874cb3bb packaging: Restrict kernel patches applied to top-level dir
The apply_patches.sh script applies all patches in the patches
directory,  as well as subdirectories. This means if there is a sub-dir
called "experimental" under a major kernel version directory,
experimental patches would be applied to the default kernel supported by
Kata.
We did not come accross this issue earlier as typically the experimental
kernel version was different from the default kernel.
With both the default kernel and the arm-experimental kernel having the
same major kernel version (5.15.x) at this time, trying to update the
kernel patch version revealed that arm-experimental patches were being
applied to the default kernel.

Restricting the patches to be applied to the top level directory will
solve the issue. The apply_patches script should ignore any
sub-directories meant for experimental patches.

Fixes #4520

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
2022-06-23 10:43:52 -07:00
Archana Shinde
07b1367c2b versions: Update kernel to latest LTS version 5.15.48
This brings in a few security fixes.
Removing arm patches related to virtio-mem that are no longer required
as they have been merged.

Fixes #4438

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
2022-06-23 10:43:52 -07:00
Fabiano Fidêncio
133528dd14
Merge pull request #4503 from amshinde/multi-queue-block
block: Leverage multiqueue for virtio-block
2022-06-23 12:17:11 +02:00
Fabiano Fidêncio
f186a52b16
Merge pull request #4511 from fidencio/topic/add-config-efi-to-the-tdx-kernel
kernel: Add CONFIG_EFI=y as part of the TDX fragments
2022-06-23 12:15:30 +02:00
Yohei Ueda
1b7d36fdb0
agent: Allow BUILD_TYPE=debug
The cargo command creates debug build binaries, when the --release
option is not specified. Specifying --debug option causes an error.
This patch specifies --release option when BUILD_TYPE=release,
and does not specify any build type option when BUILD_TYPE=debug.

Fixes #4504

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
2022-06-23 13:54:32 +09:00
Fabiano Fidêncio
9ff10c0830 kernel: Add CONFIG_EFI=y as part of the TDX fragments
Otherwise `./build-kernel.sh -x tdx setup` will fail with the following
error:
```
$ ./build-kernel.sh -x tdx setup
INFO: Config version: 92
INFO: Kernel version: tdx-guest-v5.15-4
INFO: kernel path does not exist, will download kernel
INFO: Apply patches from
/home/ffidenci/go/src/github.com/kata-containers/kata-containers/tools/packaging/kernel/patches/tdx-guest-v5.15-4.x
INFO: Found 0 patches
INFO: Enabling config for 'tdx' confidential guest protection
INFO: Constructing config from fragments:
/home/ffidenci/go/src/github.com/kata-containers/kata-containers/tools/packaging/kernel/configs/fragments/x86_64/.config

WARNING: unmet direct dependencies detected for UNACCEPTED_MEMORY
  Depends on [n]: EFI [=n] && EFI_STUB [=n]
  Selected by [y]:
  - INTEL_TDX_GUEST [=y] && HYPERVISOR_GUEST [=y] && X86_64 [=y] &&
    CPU_SUP_INTEL [=y] && PARAVIRT [=y] && SECURITY [=y] &&
     X86_X2APIC[=y]
INFO: Some CONFIG elements failed to make the final .config:
INFO: Value requested for CONFIG_EFI_STUB not in final .config
INFO: Generated config file can be found in
/home/ffidenci/go/src/github.com/kata-containers/kata-containers/tools/packaging/kernel/configs/fragments/x86_64/.config
ERROR: Failed to construct requested .config file
ERROR: failed to find default config
```

Fixes: #4510

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2022-06-22 15:21:30 +02:00