Commit Graph

15645 Commits

Author SHA1 Message Date
Yuting Nie
b6924ef5e5 runtime: Add getExpectedHostDetails for riscv64
Add `getExpectedHostDetails` with expected value according to template
defined in `kata-check_data_riscv64_test.go`. This provides necessary
`HostInfo` for tests to cover `kata-check_riscv64.go`.

Signed-off-by: Yuting Nie <nieyuting@iscas.ac.cn>
2025-03-27 10:34:34 +08:00
Yuting Nie
594c5e36a6 runtime: Add mock data for kata-check
Add definition of `testCPUInfoTemplate` which is retrieved from
`/proc/cpuinfo` of a QEMU emulated virtual machine on virt board.

Signed-off-by: Yuting Nie <nieyuting@iscas.ac.cn>
2025-03-27 10:33:42 +08:00
Yuting Nie
0ff5cb1e66 runtime: Enable testSetCPUTypeGeneric for riscv64
`testSetCPUTypeGeneric` will be used for writting `kata-check` in
`kata-runtime` on riscv64 platforms, enable building for later testing.

Signed-off-by: Yuting Nie <nieyuting@iscas.ac.cn>
2025-03-27 10:32:29 +08:00
Ruoqing He
2329aeec38 runtime: Disable race flag for riscv64
`-race` flag used for `go test` is not yet supported on riscv64
platforms, disable it for now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 10:28:53 +08:00
Ruoqing He
1b4dbebb1b runtime: Enable runtime to build on riscv64
Convert Rust arch to Go arch in Makefile, and add `riscv64-options.mk`
to provide definitions required for runtime to build on riscv64.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 10:22:55 +08:00
Ruoqing He
805da14634 runtime: Enable runtime check for riscv64
Enable `kata-runtime check` command to work on riscv64 platforms to make
sure required features/devices presents.

Co-authored-by: Yuting Nie <nieyuting@iscas.ac.cn>
Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 10:07:09 +08:00
Ruoqing He
96b2d25508 runtime: Define default values for QEMU riscv
Provide default values while invoking QEMU as the hypervisor for Go
runtime on riscv64 platform.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 10:05:36 +08:00
Ruoqing He
1662595146 runtime: Introduce riscv64 to govmm pkg
Define `vmm` for riscv64, set `MaxVCPUs` to 512 as QEMU RISC-V virt
Generic Virtual Platform [1] define.

[1] https://www.qemu.org/docs/master/system/riscv/virt.html

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 09:57:49 +08:00
Ruoqing He
1e4963a3b2 runtime: Define availableGuestProtection for riscv64
`GuestProtection` feature is not made available yet, return
`noneProtection` for now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 09:34:53 +08:00
Ruoqing He
4947938ce8 runtime: Introduce riscv64 template for vm factory
Set `templateDeviceStateSize` to 8 as other architectures did.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-27 09:28:32 +08:00
Zvonko Kaiser
b7cf4fd2e6
Merge pull request #11053 from ldoktor/ci
ci: shellcheck fixes
2025-03-26 13:22:56 -04:00
Fabiano Fidêncio
7a0ac55f22
Merge pull request #10984 from fidencio/topic/tests-kata-deploy-ground-work-to-rewrite-the-tests
tests: kata-deploy: The rest of the ground work to rewrite the kata-deploy tests
2025-03-26 17:47:48 +01:00
Fabiano Fidêncio
404e212102 tests: kata-deploy: Use helm_helper()
With this we switch to fully testing with helm, instead of testimg with
the kustomizations (which will soon be removed).

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:30:15 +01:00
Fabiano Fidêncio
f7976a40e4 tests: Create a helm_helper() common function
Let's use what we have in the k8s functional tests to create a common
function to deploy kata containers using our helm charts.  This will
help us immensely in the kata-deploy testing side in the near future.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:30:11 +01:00
Fabiano Fidêncio
eb884d33a8 tests: k8s: Export all the default env vars on gha-run.sh
This is not strictly needed, but it does help a lot when setting up a
cluster manually, while still relying on those scripts.

While here, let's also ensure the assignment is between quotes, to make
shellchecker happier.

Signed-off-by: Fabiano Fidêncio <fabiano@fidencio.org>
2025-03-26 13:23:16 +01:00
Saul Paredes
ae5c587efc
Merge pull request #11074 from Sumynwa/sumsharma/genpolicy_test
genpolicy: Refactor tests to allow different request types in a testcases json.
2025-03-25 12:38:19 -07:00
Sumedh Sharma
3406df9133 genpolicy: Refactor tests to add different request types in testcases json
This commit introduces changes to add test data for multiple request
type in a single testcases.json file. This allows for stateful testing,
for ex: enable testing ExecProcessRequest using policy state set after testing
a CreateContainerRequest.

Fixes #11073.

Signed-off-by: Sumedh Sharma <sumsharma@microsoft.com>
2025-03-25 13:52:17 +05:30
RuoqingHe
7a704453b6
Merge pull request #11075 from microsoft/danmihai1/genpolicy-debug-build
genpolicy: add support for BUILD_TYPE=debug
2025-03-25 14:59:15 +08:00
RuoqingHe
5d68600c06
Merge pull request #11010 from stevenhorsman/metrics-containerd-debugging
metrics: Test improvements
2025-03-25 11:38:28 +08:00
Dan Mihai
15c9035254 genpolicy: add support for BUILD_TYPE=debug
Use "cargo build --release" when BUILD_TYPE was not specified, or when
BUILD_TYPE=release. The default "cargo build" behavior is to build in
debug mode.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-24 16:10:20 +00:00
RuoqingHe
f6a1c6d0e0
Merge pull request #11069 from kimullaa/exit-if-action-is-invalid
kata-deploy: return exit code for invalid argument
2025-03-24 09:40:39 +08:00
Shunsuke Kimura
e5d7414c33 kata-deploy: Return exit code for invalid argument
It hangs when invalid arguments are specified.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh xxx
Action:
* xxx
...
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
...
^C <- hang
```

I changed it to behave the same as when there are no arguments.

```bash
kata-deploy-6sr2p:/# /opt/kata-artifacts/scripts/kata-deploy.sh
Usage: /opt/kata-artifacts/scripts/kata-deploy.sh [install/cleanup/reset]
ERROR: invalid arguments
kata-deploy-6sr2p:/# echo $?
1
```

Fixes: #11068

Signed-off-by: Shunsuke Kimura <pbrehpuum@gmail.com>
2025-03-22 21:32:38 +09:00
Aurélien Bombo
17baa6199b
Merge pull request #11061 from RuoqingHe/2025-03-21-generalize-non-kvm
ci: Generalize `GITHUB_RUNNER_CI_ARM64`
2025-03-21 15:23:51 -05:00
Ruoqing He
5e81f67ceb ci: Generalize GITHUB_RUNNER_CI_ARM64
`GITHUB_RUNNER_CI_ARM64` is turned on for self hosted runners without
virtualization to skipped those tests depend on virtualization. This may
happen to other archs/runners as well, let's generalize it to
`GITHUB_RUNNER_CI_NON_VIRT` so we can reuse it on other archs.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-21 09:49:44 +08:00
RuoqingHe
e84f7c2c4b
Merge pull request #11046 from mythi/drop-dcap-libs
build: drop libtdx-attest
2025-03-21 09:23:33 +08:00
Dan Mihai
f79fabab24
Merge pull request #11024 from microsoft/danmihai1/empty-exec-output
tests: k8s: retry "kubectl exec" on empty output
2025-03-20 11:03:08 -07:00
Mikko Ylinen
f52a565834 build: drop libtdx-attest
with the latest CoCo guest-components, tdx-attester no longer
depends on libtdx attest. Stop installing it to the rootfs.

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-20 10:45:30 +02:00
Steve Horsman
c0632f847f
Merge pull request #11043 from stevenhorsman/3.15.0-release
release: Bump version to 3.15.0
2025-03-20 07:38:20 +00:00
Greg Kurz
e19b81225c
Merge pull request #11045 from kata-containers/sprt/fix-gha-tag
security: ci: Pin third-party actions to commit hashes
2025-03-20 08:14:06 +01:00
Aurélien Bombo
a678046d13 gha: Pin third-party actions to commit hashes
A popular third-party action has recently been compromised [1][2] and
the attacker managed to point multiple git version tags to a malicious
commit containing code to exfiltrate secrets.

This PR follows GitHub's recommendation [3] to pin third-party actions
to a full-length commit hash, to mitigate such attacks.

Hopefully actionlint starts warning about this soon [4].

 [1] https://www.cve.org/CVERecord?id=CVE-2025-30066
 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
 [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
 [4] https://github.com/rhysd/actionlint/pull/436

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-19 13:52:49 -05:00
stevenhorsman
fad248ef09 release: Bump version to 3.15.0
Bump VERSION and helm-chart versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 17:28:06 +00:00
Fabiano Fidêncio
a6e5d28a15
Merge pull request #11055 from stevenhorsman/bump-github.com/containerd/containerd/v1.7.27
runtime: Update github.com/containerd/containerd
2025-03-19 18:19:10 +01:00
stevenhorsman
cb7c599180 runtime: Switch from deprecated tracer
`go.opentelemetry.io/otel/trace.NewNoopTracerProvider`
is deprectated now, so switch to
`go.opentelemetry.io/otel/trace/noop.NewTracerProvider`

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 14:22:06 +00:00
stevenhorsman
8f22b07aba runtime: Update github.com/containerd/containerd
Update to 1.7.27 to resolve CVE-2024-40635

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 13:48:04 +00:00
Lukáš Doktor
d708866b2a
ci.ocp: shellcheck various fixes
various manual fixes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:28 +01:00
Lukáš Doktor
7e11489daf
ci: shellcheck - collection of fixes
manual fixes of various issues.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:23 +01:00
Lukáš Doktor
f62e08998c
ci: shellcheck - remove unused argument
the "-a" argument was introduced with this tool but never was actually
used.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:19 +01:00
Lukáš Doktor
02deb1d782
ci: shellcheck SC2248
SC2248 (style): Prefer double quoting even when variables don't contain
special characters, might result in arguments difference, shouldn't in
our cases.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:16 +01:00
Lukáš Doktor
d80e7c7644
ci: shellcheck SC2155
SC2155 (warning): Declare and assign separately to avoid masking return
values, should be harmless.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:12 +01:00
Lukáš Doktor
6552ac41e0
ci: shellcheck SC2086
SC2086 Double quote to prevent globbing and word splitting, might break
places where we deliberately use word splitting, but we are not using it
here.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:08 +01:00
Lukáš Doktor
154a4ddc00
ci: shellcheck SC2292
SC2292 (style): Prefer [[ ]] over [ ] for tests in Bash/Ksh. This might
result in different handling of globs and some ops which we don't use.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:03 +01:00
Lukáš Doktor
667e26036c
ci: shellcheck SC2250
Treat the SC2250 require-variable-braces in CI. There are no functional
changes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:25:44 +01:00
Zvonko Kaiser
d37d9feee9
Merge pull request #11035 from kata-containers/sprt/fix-dependabot
security: ci: Remove `replace` directives in go.mod files
2025-03-18 12:43:46 -04:00
Steve Horsman
ba5b0777b5
Merge pull request #11002 from fitzthum/bump-gc-0130
Bump Trustee and Guest Components for coco v0.13.0
2025-03-17 16:31:23 +00:00
RuoqingHe
36d2dee3a4
Merge pull request #11042 from RuoqingHe/runtime-rs-riscv
runtime-rs: Support and enable build on riscv64
2025-03-17 21:42:15 +08:00
Ruoqing He
cb7508ffdc ci: Enable runtime-rs component build-check on riscv64
`runtime-rs` is now buildable and testable on riscv64 platforms, enable
`build-check` on `runtime-rs`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:38:59 +08:00
Steve Horsman
f308cbba93
Merge pull request #11015 from AdithyaKrishnan/main
CI: Mark SNP as a Required test
2025-03-17 09:27:28 +00:00
Ruoqing He
084fb2d780 runtime-rs: Enable RISC-V build
Define `riscv64gc-options.mk` to enable `runtime-rs` to be built on
RISC-V platforms.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Ruoqing He
fd6c16e209 kata-sys-util: Set NoProtection for riscv64
`available_guets_protection` is required for `runtime-rs` to infer while
building it on riscv64 platforms. Set it to `NoProtection` as riscv64
does not support guest protection for now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Aurélien Bombo
26bd7989b3 csi-kata-directvolume: Remove replace in go.mod
Running `go mod tidy` and `go mod vendor` after this resulted in no-ops.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00