to the kata-containers repo under the src/tools/log-parser folder
and vendor the modules
Fixes: #4100
Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
The following issues have been addressed from the latest bug fix release
v23.1 of Cloud Hypervisor: 1) Add some missing seccomp rules; 2) Remove
virtio-fs filesystem entries from config on removal; 3) Do not delete
API socket on API server start; 4) Reject virtio-mem resize if the guest
doesn't activate the device; 5) Fix OpenAPI naming of I/O throttling
knobs;
Fixes: #4222
Signed-off-by: Bo Chen <chen.bo@intel.com>
- agent watchers: ensure uid/gid is preserved on copy/mkdir
- clh: Rely on Cloud Hypervisor for generating the device ID
- agent: add tests for create_logger_task function
- runk: set BinaryName for runk for containerd
- tools: Add a Rust-based standard OCI container runtime based on Kata agent
- rustjail: add tests for parse_mount_table
- Virtcontainers: Enable hot plugging vhost-user-blk device on ARM
- docs: repropose direct-assigned volume
- versions: change qemu tdx url and tag
- doc: Update for NVIDIA GPUs
- agent-ctl: Fix abstract socket connections
- Implement network and disk rate limiter for Cloud Hypervisor
- kata-deploy: Add support to RKE2
- docs: Update containerd link to installation guide
- docs: remove pc machine type supports
- Agent: Unit tests for random.rs
- rustjail: Add tests for mount_grpc_to_oci
- packaging: Fix broken path in `build-static-clh.sh`
- Fix Go unit tests to clean up /tmp after themselves
- rustjail: add tests for mount_from function
- rustjail: Add tests for hooks_grpc_to_oci
- agent: modify the type of swappiness to u64
- libs/safe-path: add crate to safely resolve fs paths
- agent: move assert_result macro to test_utils file
- rustjail: Add tests for root_grpc_to_oci
- agent: add tests for mount_to_rootfs function
- agent: add tests for update_container_namespaces
- agent: add tests for is_signal_handled function
- Upgrade to Cloud Hypervisor v23.0
- agent: best-effort removing mount point
- test: Fix golangci-lint error for s390x
- fsGroup support for direct-assigned volume
- kata-monitor: add the README file
- kata-monitor: update the hrefs in the debug/pprof index page
- runtime: Base64 encode the direct volume mountInfo path
- runtime: no need to write virtiofsd error to log
- kata-monitor: add some links when generating pages for browsers
- agent: Avoid agent panic when reading empty stats
- docs: Update link to contributions guide
- agent: add tests for mount_storage
- agent: add test coverage for parse_mount_flags_and_options function
- agent: add tests for do_write_stream function
- runtime: delete debug option in virtiofsd
- rustjail: add test coverage for process_grpc_to_oci function
- agent: Allow the agent to be rebuilt with the change of Cargo features
- protocols: add src/csi.rs to .gitignore
- kata-runtime enable hugepage support
- docs: Add a firecracker installation guide
- runtime: Allow and require no initrd for SE
- test: use `T.TempDir` to create temporary test directory
- clh: Expose service offload configuration
33a8b705 clh: Rely on Cloud Hypervisor for generating the device ID
70eda2fa agent: watchers: ensure uid/gid is preserved on copy/mkdir
7772f7dd runk: set BinaryName for runk for containerd
7ffe5a16 docs: Direct-assigned volume design
081f6de8 versions: change qemu tdx url and tag
666aee54 docs: Add VSOCK localhost example for agent-ctl
86d348e0 docs: Use VM term in agent-ctl doc
4b9b62bb agent-ctl: Fix abstract socket connections
b6467ddd clh: Expose disk rate limiter config
7580bb5a clh: Expose net rate limiter config
a88adaba clh: Cloud Hypervisor has a built-in Rate Limiter
63c4da03 clh: Implement the Disk RateLimiter logic
511f7f82 config: Add DiskRateLimiter* to Cloud Hypervisor
5b18575d hypervisor: Add disk bandwidth and operations rate limiters
1cf94692 clh: Implement the Network RateLimiter logic
00a5b1bd utils: Define DefaultRateLimiterRefillTimeMilliSecs
be1bb7e3 utils: Move FC's function to revert bytes to utils
c9f6496d config: Add NetRateLimiter* to Cloud Hypervisor
2d35e606 hypervisor: Add network bandwidth and operations rate limiters
b0e439cb rustjail: add tests for parse_mount_table
ccb01839 kata-deploy: Add support to RKE2
9d39362e kata-deploy: Reestructure the installing section
18d27f79 kata-deploy: Add a missing `$` prefix in the README
6948b4b3 docs: Update containerd link to installation guide
b221a259 tools: Add runk
2c218a07 agent: Modify Kata agent for runk
dd4bd7f4 doc: Added initial doc update for NV GPUs
832c33d5 docs: remove pc machine type supports
b658dccc tools: fix typo in clh directory name
afbd60da packaging: Fix clh build from source fall-back
4b9e78b8 rustjail: Add tests for mount_grpc_to_oci
81f6b486 agent: add tests for create_logger_task function
96bc3ec2 rustjail: Add tests for hooks_grpc_to_oci
02395027 agent: modify the type of swappiness to u64
1b931f42 runtime: Allock mockfs storage to be placed in any directory
ef6d54a7 runtime: Let MockFSInit create a mock fs driver at any path
5d8438e9 runtime: Move mockfs control global into mockfs.go
963d03ea runtime: Export StoragePathSuffix
1719a8b4 runtime: Don't abuse MockStorageRootPath() for factory tests
bec59f9e runtime: Make bind mount tests better clean up after themselves
f7ba21c8 runtime: Clean up mock hook logs in tests
90b2f5b7 runtime: Make SetupOCIConfigFile clean up after itself
2eeb5dc2 runtime: Don't use fixed /tmp/mountPoint path
0ad89ebd safe-path: add more unit test cases
b63774ec libs/safe-path: add crate to safely resolve fs paths
f385b21b rustjail: add tests for mount_from function
0e7f1a5e agent: move assert_result macro to test_utils file
2256bcb6 rustjail: Add tests for root_grpc_to_oci
7b2ff026 kata-monitor: add a README file
29e569aa virtcontainers: clh: Re-generate the client code
6012c197 versions: Upgrade to Cloud Hypervisor v23.0
aabcebbf agent: best-effort removing mount point
d136c9c2 test: Fix golangci-lint error for s390x
86977ff7 kata-monitor: update the hrefs in the debug/pprof index page
78f30c33 agent: Avoid agent panic when reading empty stats
6e79042a runtime: no need to write virtiofsd error to log
9b6f24b2 agent: add tests for mount_to_rootfs function
c3776b17 agent: add tests for is_signal_handled function
9c22d955 agent: add tests for update_container_namespaces
92c00c7e agent: fsGroup support for direct-assigned volume
6e9e4e8c docs: Update link to contributions guide
532d5397 runtime: fsGroup support for direct-assigned volume
6a47b82c proto: fsGroup support for direct-assigned volume
9d5e7ee0 agent: add tests for mount_storage
f8cc5d1a kata-monitor: add some links when generating pages for browsers
c31cd0e8 rustjail: add test coverage for process_grpc_to_oci function
1118a3d2 agent: add test coverage for parse_mount_flags_and_options function
9d5b03a1 runtime: delete debug option in virtiofsd
eff7c7e0 agent: Allow the agent to be rebuilt with the change of Cargo features
b975f2e8 Virtcontainers: Enable hot plugging vhost-user-blk device on ARM
962d05ec protocols: add src/csi.rs to .gitignore
354cd3b9 runtime: Base64 encode the direct volume mountInfo path
485aeabb agent: add tests for do_write_stream function
4405b188 docs: Add a firecracker installation guide
98750d79 clh: Expose service offload configuration
59c7165e test: use `T.TempDir` to create temporary test directory
ff17c756 runtime: Allow and require no initrd for SE
1cad3a46 agent/random: Ensure data.len > 0
33c953ac agent: Add test_ressed_rng_not_root
39a35b69 agent: Add test to random::reseed_rng()
d8f39fb2 agent/random: Rename RNDRESEEDRNG to RNDRESEEDCRNG
a2f5c176 runtime/virtcontainers: Pass the hugepages resources to agent
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
We're currently hitting a race condition on the Cloud Hypervisor's
driver code when quickly removing and adding a block device.
This happens because the device removal is an asynchronous operation,
and we currently do *not* monitor events coming from Cloud Hypervisor to
know when the device was actually removed. Together with this, the
sandbox code doesn't know about that and when a new device is attached
it'll quickly assign what may be the very same ID to the new device,
leading to the Cloud Hypervisor's driver trying to hotplug a device with
the very same ID of the device that was not yet removed.
This is, in a nutshell, why the tests with Cloud Hypervisor and
devmapper have been failing every now and then.
The workaround taken to solve the issue is basically *not* passing down
the device ID to Cloud Hypervisor and simply letting Cloud Hypervisor
itself generate those, as Cloud Hypervisor does it in a manner that
avoids such conflicts. With this addition we have then to keep a map of
the device ID and the Cloud Hypervisor's generated ID, so we can
properly remove the device.
This workaround will probably stay for a while, at least till someone
has enough cycles to implement a way to watch the device removal event
and then properly act on that. Spoiler alert, this will be a complex
change that may not even be worth it considering the race can be avoided
with this commit.
Fixes: #4176
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Add test coverage for the functions find_process and online_resources in src/sandbox.rs.
Fixes#4085Fixes#4136
Signed-off-by: Jack Hance <jack.hance@ndsu.edu>
Today in agent watchers, when we copy files/symlinks
or create directories, the ownership of the source path
is not preserved which can lead to permission issues.
In copy, ensure that we do a chown of the source path
uid/gid to the destination file/symlink after copy to
ensure that ownership matches the source ownership.
fs::copy() takes care of setting the permissions.
For directory creation, ensure that we set the
permissions of the created directory to the source
directory permissions and also perform a chown of the
source path uid/gid to ensure directory ownership
and permissions matches to the source.
Fixes: #4188
Signed-off-by: Yibo Zhuang <yibzhuang@gmail.com>
runk uses liboci-cli crate to parse command line options,
but liboci-cli does not support --all option for kill command,
though this is the runtime spec behavior.
But crictl will issue kill --all command when stopping containers,
as a workaround, we use a custom kill command instead of the one
provided by liboci-cli.
Fixes: #4182
Signed-off-by: Bin Liu <bin@hyper.sh>
The default runtime for io.containerd.runc.v2 is runc,
to use runk, the containerd configuration should set the
default runtime to runk or add BinaryName options for the
runtime.
Fixes: #4177
Signed-off-by: Bin Liu <bin@hyper.sh>
Update the `agent-ctl` docs to show how to use a VSOCK local address
when running the agent and the tool in the same environment. This is an
alternative to using a Unix socket.
Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
Unbreak the `agent-ctl` tool connecting to the agent with a Unix domain
socket.
It appears that [1] changed the behaviour of connecting to the agent
using a local Unix socket (which is not used by Kata under normal
operation).
The change can be seen by reverting to commit
72b8144b56 (the one before [1]) and
running the agent manually as:
```bash
$ sudo KATA_AGENT_SERVER_ADDR=unix:///tmp/foo.socket target/x86_64-unknown-linux-musl/release/kata-agent
```
Before [1], in another terminal we see this:
```bash
$ sudo lsof -U 2>/dev/null |grep foo|awk '{print $9}'
@/tmp/foo.socket@
```
But now, we see the following:
```bash
$ sudo lsof -U 2>/dev/null |grep foo|awk '{print $9}'
@/tmp/foo.socket
```
Note the last byte which represents a nul (`\0`) value.
The `agent-ctl` tool used to add that trailing nul but now it seems to not
be needed, so this change removes it, restoring functionality. No
external changes are necessary so the `agent-ctl` tool can connect to
the agent as below like this:
```bash
$ cargo run -- -l debug connect --server-address "unix://@/tmp/foo.socket" --bundle-dir "$bundle_dir" -c Check -c GetGuestDetails
```
[1] - https://github.com/kata-containers/kata-containers/issues/3124Fixes: #4164.
Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
With everything implemented, let's now expose the disk rate limiter
configuration options in the Cloud Hypervisor configuration file.
Fixes: #4139
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
With everything implemented, let's now expose the net rate limiter
configuration options in the Cloud Hypervisor configuration file.
Fixes: #4017
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
The notion of "built-in rate limiter" was added as part of
bd8658e362, and that commit considered
that only Firecracker had a built-in rate limiter, which I think was the
case when that was introduced (mid 2020).
Nowadays, however, Cloud Hypervisor takes advantage of the very same crate
used by Firecraker to do I/O throttling.
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Let's take advantage of the newly added DiskRateLimiter* options and
apply those to the network device configuration.
The logic here is identical to the one already present in the Network
part of Cloud Hypervisor's driver.
Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
