Commit Graph

16123 Commits

Author SHA1 Message Date
Fabiano Fidêncio
d3f81ec337
Merge pull request #11240 from Apokleos/copydir
runtime-rs: Propagate k8s configs correctly when sharedfs is disabled
2025-05-27 12:41:21 +02:00
Paul Meyer
8de8b8185e genpolicy: rename svc_name to svc_name_downward_env
Just to be more explicit what this matches.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
2025-05-27 10:13:43 +02:00
Paul Meyer
78eb65bb0b genpolicy: fix svc_name regex
The service name is specified as RFC 1035 lable name [1]. The svc_name
regex in the genpolicy settings is applied to the downward API env
variables created based on the service name. So it tries to match
RFC 1035 labels after they are transformed to downward API variable
names [2]. So the set of lower case alphanumerics and dashes is
transformed to upper case alphanumerics and underscores.
The previous regex wronly permitted use of numbers, but did allow
dot and dash, which shouldn't be allowed (dot not because they aren't
conform with RFC 1035, dash not because it is transformed to underscore).

We have to take care not to also try to use the regex in places where
we actually want to check for RFC 1035 label instead of the downward
API transformed version of it.

Further, we should consider using a format like JSON5/JSONC for the
policy settings, as these are far from trivial and would highly benefit
from proper documentation through comments.

[1]: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service
[2]: b2dfba4151/pkg/kubelet/envvars/envvars.go (L29-L70)

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
2025-05-27 08:43:25 +02:00
RuoqingHe
139dc13bdc
Merge pull request #11301 from lifupan/fix_cgroup
runtime-rs: fix the issue of delete cgroup failed
2025-05-27 05:05:32 +02:00
Wainer Moschetta
d77e33babf
Merge pull request #11266 from ldoktor/ci-pp-retry
ci.ocp: A couple of peer-pods setup improvements
2025-05-26 14:22:11 -03:00
Wainer Moschetta
c249769bb8
Merge pull request #11270 from ldoktor/gk
tools.testing: Add methods to simplify gatekeeper development
2025-05-26 12:04:07 -03:00
Fabiano Fidêncio
20d3bc6f37
Merge pull request #10964 from hsiangkao/drop_outdated_patches
Drop outdated erofs patches for 6.1.y kernels & fix a dragonball vsock issue
2025-05-26 13:00:25 +02:00
Gao Xiang
b441890749 kernel: drop outdated erofs patches for 6.1.y kernels
Patches 0001..0004 have been included upstream as dependencies
since Linux 6.1.113.

Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-05-26 15:48:24 +08:00
Xingru Li
71b6acfd7e dragonball: vsock: support single descriptor
Since kernel v6.3 the vsock packet is not split over two descriptors and
is instead included in a single one.

Therefore, we currently decide the specific method of obtaining
BufWrapper based on the length of descriptor.

Refer:
a2752fe04f
https://git.kernel.org/torvalds/c/71dc9ec9ac7d

Signed-off-by: Xingru Li <lixingru.lxr@linux.alibaba.com>
[ Gao Xiang: port this patch from the internal branch to address Linux 6.1.63+. ]
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-05-26 15:48:19 +08:00
RuoqingHe
b6cafba5f6
Merge pull request #11308 from hsiangkao/enable_tmpfs_xattr
kernel: support `CONFIG_TMPFS_XATTR=y`
2025-05-26 05:00:26 +02:00
Gao Xiang
b681dfb594 kernel: support CONFIG_TMPFS_XATTR=y
Currently, Kata EROFS support needs it, otherwise it will:
[    0.564610] erofs: (device sda): mounted with root inode @ nid 36.
[    0.564858] overlayfs: failed to set xattr on upper
[    0.564859] overlayfs: ...falling back to index=off,metacopy=off.
[    0.564860] overlayfs: ...falling back to xino=off.

Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2025-05-24 20:43:35 +08:00
RuoqingHe
a9ffdfc2ae
Merge pull request #11294 from wainersm/delint_confidential_kbs
tests/k8s: delint confidential_kbs.sh
2025-05-23 17:00:28 +02:00
Fupan Li
e9b45126fc
Merge pull request #11254 from sampleyang/main
runtime-rs: fix vfio pci address domain 0001 problem
2025-05-23 18:13:10 +08:00
yangsong
06c7c5bccb runtime-rs: fix vfio pci address domain 0001 problem
Some nvidia gpu pci address domain with 0001,
current runtime default deal with 0000:bdf,
which cause address errors during device initialization
and address conflicts during device registration.

Fixes #11252

Signed-off-by: yangsong <yunya.ys@antgroup.com>
2025-05-23 14:33:06 +08:00
Wainer dos Santos Moschetta
ddf333feaf tests/k8s: fix shellcheck SC1091 in confidential_kbs.sh
Fixed "note: Not following: ./../../../tools/packaging/guest-image/lib_se.sh:
openBinaryFile: does not exist (No such file or directory) [SC1091]"

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-22 15:38:27 -03:00
Wainer dos Santos Moschetta
c9fb0b9c85 tests/k8s: fix shellcheck SC2154 in confidential_kbs.sh
Fixed "warning: HKD_PATH is referenced but not assigned. [SC2154]"

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-22 15:02:20 -03:00
Wainer dos Santos Moschetta
68d91d759a tests/k8s: add set -e to confidential_ksh.sh
Although the script will inherit that setting from the caller scripts,
expliciting it in the file will vanish shellcheck "warning: Use 'pushd
... || exit' or 'pushd ... || return' in case pushd fails. [SC2164]"

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-22 14:55:24 -03:00
Wainer dos Santos Moschetta
b4adfcb3cb tests/k8s: apply shellcheck tips to confidential_kbs.sh
Addressed the following shellcheck advices:

SC2046 (warning): Quote this to prevent word splitting.
SC2248 (style): Prefer double quoting even when variables don't contain special characters
SC2250 (style): Prefer putting braces around variable references even when not strictly required.
SC2292 (style): Prefer [[ ]] over [ ] for tests in Bash/Ksh

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-22 14:52:38 -03:00
alex.lyn
043bab3d3e runtime-rs: Handle port allocation in PCIe topology for vfio devices
It's import to handle port allocation in a PCIe topology before vfio
deivce hotplug via QMP.
The code ensures that VFIO devices are properly allocated to available
ports (either root ports or switch ports) and updates the device's bus
and port information accordingly.
It'll first retrieves the PCIe port type from the topology using
pcie_topo.get_pcie_port(). And then, searches for an available node in
the PCIe topology with RootPort or SwitchPort type and allocates the
VFIO device to the found available port. Finally, Updates the device's
bus with the allocated port's ID and type.

Fixes # 10361

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2025-05-22 18:58:41 +08:00
alex.lyn
01b822de16 runtime-rs: Get available port node in the PCIe topology
This commit implements the `find_available_node` function,
which searches the PCIe topology for the first available
`TopologyPortDevice` or `SwitchDownPort`.
If no available node is found in either the `pcie_port_devices`
or the connected switches' downstream ports, the function returns
`None`.

Fixes # 10361

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2025-05-22 18:58:41 +08:00
alex.lyn
533d07a2c3 runtime-rs: Introduce qemu-rs vfio device hotplug handler
This commit note that the current implementation restriction where
'multifunction=on' is temporarily unsupported. While the feature
isn't available in the present version, we explicitly acknowledge
this limitation and commit to addressing it in future iterations
to enhance functional completeness.

Tracking issue #11292 has been created to monitor progress towards
full multifunction support.

Fixes #10361

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2025-05-22 18:58:06 +08:00
Steve Horsman
91f2e97aae
Merge pull request #11267 from Rtoax/p001-fix-osbuilder-lib.sh-indent
osbuilder: lib.sh: Fix indent
2025-05-22 09:54:18 +01:00
alex.lyn
f1796fe9ba runtime-rs: Add more fields in VfioDevice to express vfio devices
To support port devices for vfio devices, more fields need to be
introduced to help pass port type, bus and other information.

Fixes #10361

Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
2025-05-22 16:00:40 +08:00
Fupan Li
15cbc545ca runtime-rs: fix the issue of delete cgroup failed
When try to delete a cgroup, it's needed to move all of the
tasks/procs in the cgroup into root cgroup and then delete it.

Since for cgroup v2, it doesn't  support to move thread into
root cgroup, thus move the processes instead of moving tasks
can fix this issue.

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-05-22 12:15:02 +08:00
Steve Horsman
9356ed59d5
Merge pull request #11130 from wainersm/tests-better-report
tests/k8s: better tests reporting for CI
2025-05-21 17:21:35 +01:00
Steve Horsman
b519e9fdff
Merge pull request #11293 from wainersm/tests_increase_kbs_timeout
tests/k8s: increase wait time of KBS service ingress
2025-05-21 17:14:52 +01:00
Steve Horsman
a897bce29f
Merge pull request #11298 from stevenhorsman/release-3.17.0-bump
release: Bump version to 3.17.0
2025-05-21 12:06:24 +01:00
stevenhorsman
7b90ff3c01 release: Bump version to 3.17.0
Bump VERSION and helm-chart versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-05-21 12:04:39 +01:00
Fabiano Fidêncio
5378e581d8
Merge pull request #11144 from Apokleos/hotplug-block-qemu-rs
Support hot-plug block device in qemu-rs with QMP
2025-05-21 11:31:48 +02:00
Lukáš Doktor
67ee9f3425
ci.ocp: Improve logging of extra new resources
this script relies on temporary subscriptions and won't cleanup any
resources. Let's improve the logging to better describe what resources
were created and how to clean them, if the user needs to do so.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-05-21 11:02:36 +02:00
Lukáš Doktor
32dbc5d2a9
ci.ocp: Use SCRIPT_DIR to allow execution from any folder
We used hardcoded "ci/openshift-ci/cluster" location which expects this
script to be only executed from the root. Let's use SCRIPT_DIR instead
to allow execution from elsewhere eg. by user bisecting a failed CI run.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-05-21 10:30:03 +02:00
Lukáš Doktor
0e4fb62bb4
ci.ocp: Retry first az command as login takes time to propagate
In CI we hit problem where just after `az login` the first `az
network vnet list` command fails due to permission. We see
"insufficient permissions" or "pending permissions", suggesting we should
retry later. Manual tests and successful runs indicate we do have the
permissions, but not immediately after login.

Azure docs suggest using extra `az account set` but still the
propagation might take some time. Add a loop retrying
the first command a few times before declaring failure.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-05-21 10:28:01 +02:00
Fabiano Fidêncio
6c9b199ef1
Merge pull request #11289 from BbolroC/fix-vfio-coldplug
runtime: Preserve hotplug devices for vfio-coldplug mode
2025-05-21 09:48:25 +02:00
Wainer dos Santos Moschetta
fdcf11d090 tests/k8s: increase wait time of KBS service ingress
kbs_k8s_svc_host() returns the ingress IP when the KBS service is
exposed via an ingress. In Azure AKS the ingress can time a while to be
fully ready and recently we have noticed on CI that kbs_k8s_svc_host()
has returned empty value. Maybe the problem is on current timeout being
too low, so let's increase it to 50 seconds to see if the situation
improves.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-20 15:20:08 -03:00
Wainer dos Santos Moschetta
80a816db9d workflows/run-k8s-tests-coco-nontee: add step to report tests
Run `gha-run.sh report-tests` to generate the report of the tests.

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-20 14:43:38 -03:00
Wainer dos Santos Moschetta
8c4637d629 tests/k8s: print tests report
Added 'report-tests' command to gha-run.sh to print to stdout a report
of the tests executed.

For example:
```
SUMMARY (2025-02-17-14:43:53):
 Pass:  0
 Fail:  1

STATUSES:
 not_ok foo.bats

OUTPUTS:
::group::foo.bats
1..3
not ok 1 test 1
not ok 2 test 2
ok 3 test 3
1..2
not ok 1 test 1
not ok 2 test 2
::endgroup::
```

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-20 14:43:38 -03:00
Wainer dos Santos Moschetta
5e3b8a019a tests/k8s: split and save bats outputs in files
Currently run_kubernetes_tests.sh sends all the bats outputs to stdout
which can be very difficult to browse to find a problem, mainly on
CI. With this change, each bats execution have its output sent to
'reports/yyy-mm-dd-hh:mm:ss/<status>-<bats file>.log' where <status>
is either 'ok' (tests passed) or 'not_ok' (some tests failed).

Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2025-05-20 14:43:38 -03:00
Steve Horsman
f8c5aa6df6
Merge pull request #11259 from fitzthum/bump-gc-0140
Update Trustee and Guest Components for CoCo v0.14.0
2025-05-20 18:05:17 +01:00
Lukáš Doktor
c203d7eba6
ci.ocp: Set peer-pods-azure license
We forgot to add the license header when introducing this test.

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-05-20 17:03:48 +02:00
Steve Horsman
b4aa1e3fbd
Merge pull request #11279 from skazi0/repo-components
osbuilder: ubuntu: Add REPO_COMPONENTS setting
2025-05-20 16:03:48 +01:00
Lukáš Doktor
b97b20295b
ci.ocp: Make peer-pods setup executable
set permissions of the peer-pods-azure.sh script to executable

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-05-20 17:03:48 +02:00
Sumedh Alok Sharma
9a4432d197
Merge pull request #11233 from Ankita13-code/ankitapareek/execprocess-additional-input-validation
genpolicy: validate input process fields for ExecProcessRequest
2025-05-20 20:11:41 +05:30
Jacek Tomasiak
91fb4353f6
osbuilder: ubuntu: Add REPO_COMPONENTS setting
Added variable REPO_COMPONENTS (default: "main") which sets components
used by mmdebstrap for rootfs building.
This is useful for custom image builders who want to include EXTRA_PKGS
from components other than the default "main" (e.g. "universe").

Fixes: #11278
Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
2025-05-20 14:01:48 +02:00
Fabiano Fidêncio
29099d139b
Merge pull request #11280 from kata-containers/dependabot/cargo/src/tools/kata-ctl/ring-0.17.14
build(deps): bump ring from 0.17.5 to 0.17.14 in /src/tools/kata-ctl
2025-05-20 13:47:22 +02:00
Fabiano Fidêncio
0bc0623037
Merge pull request #11277 from skazi0/repo-url
osbuilder: ubuntu: Expose REPO_URL variables
2025-05-20 13:46:01 +02:00
Ankita Pareek
ad75595dc8 genpolicy: Add tests for various input validations for ExecProcessRequest
These additional tests cover edge cases specific to-
- Terminal validation
- Capabilities validation
- Working directory (Cwd) validation
- NoNewPrivileges validation
- User validation
- Environment variables validation

Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
2025-05-20 11:19:55 +00:00
Saul Paredes
1e466bf39c genpolicy: fix validation of env variables sourced from metadata.namespace
Use $(sandbox-namespace) wildcard in case none is specified in yaml. If wildcard is present, compare
input against annotation value.

Fixes regression introduced in https://github.com/microsoft/kata-containers/pull/273
where samples that use metadata.namespace env var were no longer working.

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
2025-05-20 11:19:46 +00:00
Dan Mihai
a113b9eefd genpolicy: validate probe process fields
Validate more process fields for k8s probe commands - e.g.,
livenessProbe, readinessProbe, etc.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-05-20 11:15:30 +00:00
Dan Mihai
c0b8c6ed5e genpolicy: validate process for commands from settings
Validate more process fields for commands enabled using the
ExecProcessRequest "commands" and/or "regex" fields from the
settings file.
Add function to get the container from state based on container_id
matching instead of matching it against every policy container data

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
2025-05-20 11:15:30 +00:00
Dan Mihai
6f78aaa411 genpolicy: use process inputs for allow_process()
Using process data inputs for allow_process() is easier to
read/understand compared with the older OCI data inputs.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-05-20 11:15:30 +00:00