Commit Graph

11226 Commits

Author SHA1 Message Date
Jeremi Piotrowski
cdb2efe003 workflows: static-checks: Remove TRAVIS_XXX variables
These variables are unused since we don't use travis CI. This also allows to
remove two steps:

- 'Setup GOPATH' only printed variables
- 'Setup travis reference' modified some shell local variables that don't have
  any influence on the rest of the steps

The TRAVIS var is still used by tools/osbuilder/tests to determine if
virtualization is available.

Fixes: #3544
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-20 12:19:35 +01:00
Fabiano Fidêncio
2fe0733dcb
Merge pull request #4582 from BbolroC/vfio-ap
agent: Bring in VFIO-AP device handling again
2023-03-20 11:43:13 +01:00
Steve Horsman
4bd6103253
Merge pull request #6491 from jepio/jepio/kata-deploy-push-more-space
CC | kata-deploy-push more space
2023-03-20 10:34:51 +00:00
Jianyong Wu
ece5edc641 qemu/arm64: disable image nvdimm if no firmware offered
For now, image nvdimm on qemu/arm64 depends on UEFI/ACPI, so if there
is no firmware offered, it should be disabled.

Fixes: #6468
Signed-off-by: Jianyong Wu <jianyong.wu@arm.com>
2023-03-20 18:03:05 +08:00
Fabiano Fidêncio
20452402b5
Merge pull request #6498 from fidencio/topic/cc-switch-back-the-permission-of-cache-components-to-0755
cache_components: Switch back the permission to 755
2023-03-20 09:09:22 +01:00
Zhongtao Hu
1e8005ff88
Merge pull request #6477 from openanolis/runtime-rs-hostname
bugfix: set hostname in CreateSandboxRequest
2023-03-20 12:43:29 +08:00
Fabiano Fidêncio
77783153b6 cache_components: Switch back the permission to 755
2b41dbe broke all the cached jobs as it changed the permission of the
cache_components.sh file from 755 to 644.

Fixes: #6497

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 23:50:47 +01:00
Fabiano Fidêncio
45759e82b1
Merge pull request #6474 from UnmeshDeodhar/fix-sev-cached-kernel-bug
packaging: fix sev kernel caching
2023-03-17 23:01:40 +01:00
Gabe Venberg
dd23f452ab utils: renamed only_kata to skip_containerd
Renamed for greater clarity as to what that flag does.

Signed-off-by: Gabe Venberg <gabevenberg@gmail.com>
2023-03-17 16:09:45 -05:00
Gabe Venberg
59c81ed2bb utils: informed pre-check about only_kata
passed the only_kata variable through to pre_check, only_kata does not
abort the install when containerd is already installed.

fixes #6385

Signed-off-by: Gabe Venberg <gabevenberg@gmail.com>
2023-03-17 15:58:57 -05:00
Fabiano Fidêncio
96252db787
Merge pull request #6481 from fidencio/topic/cache-artefacts
packaging / kata-deploy builds:  Add the ability to cache and consume cached components
2023-03-17 20:54:42 +01:00
Wainer dos Santos Moschetta
4f0887ce42 kata-deploy: fix install failing to chmod runtime-rs/bin/*
The kata-deploy install method tried to `chmod +x /opt/kata/runtime-rs/bin/*` but it isn't
always true that /opt/kata/runtime-rs/bin/ exists. For example, the
s390x payload does not build the kernel-dragonball-experimental
artifacts. So let's ensure the dir exist before issuing the command.

Fixes #6494
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2023-03-17 16:09:21 -03:00
Wainer dos Santos Moschetta
09c4828ac3 workflows: add missing artifacts on payload-after-push
The kata-deploy-ci payloads for amd64 and arm64 were missing the shim-v2
and kernel-dragonball-experimental artifacts.

Fixes #6493
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
2023-03-17 15:31:21 -03:00
Jeremi Piotrowski
26f80ff468 workflows: kata-deploy-push: Remove unneeded tools from runner
`make kata-tarball` needs a lot of disk space and github action runners don't
have that much of it. Remove unneeded tools from the runner, which frees
another ~10GB of space.

Fixes: #6490
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-17 17:46:38 +01:00
Jeremi Piotrowski
a394798b75 kata-deploy: Remove temporary directory after creating tarball
The various tarballs are unpacked into a temporary directory, and then that
directory is compressed into kata-static.tar.xz. After we have the tarball,
there is no reason to keep the temporary directory. Dispose of it as the last
step.

Fixes: #6490
Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
2023-03-17 17:43:42 +01:00
Fabiano Fidêncio
fbf891fdff packaging: Adapt get_last_modification()
The function is returning "" when called from the script used to cache
the artefacts and one difference noted between this version and the
already working one from the CCv0 is that we make sure to `pushd
${repo_root_dir}` in the CCv0 version.

Let's give it a try here and see if it solves the issue.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
82a04dbce1 local-build: Use cached VirtioFS when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
3b99004897 local-build: Use cached shim v2 when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
1b8c5474da local-build: Use cached RootFS when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
09ce4ab893 local-build: Use cached QEMU when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
1e1c843b8b local-build: Use cached Nydus when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
64832ab65b local-build: Use cached Kernel when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
04fb52f6c9 local-build: Use cached Firecracker when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Fabiano Fidêncio
8a40f6f234 local-build: Use cached Cloud Hypervisor when possible
As we've added the support for caching components, let's use them
whenever those are available.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 16:27:34 +01:00
Unmesh Deodhar
2b41dbe00f packaging: fix sev kernel caching
Check if tarball exists. If yes, skip the tarball create command.

Fixes: #6473

signed-off-by: Unmesh Deodhar <udeodhar@amd.com>
2023-03-17 10:17:54 -05:00
Fabiano Fidêncio
194d5dc8a6 tools: Add support for caching VirtioFS artefacts
Let's add support for caching VirtioFS artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
a34272cf20 tools: Add support for caching shim v2 artefacts
Let's add support for caching shim v2 artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
7898db5f79 tools: Add support for caching RootFS artefacts
Let's add support for caching RootFS artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
e90891059b tools: Add support for caching QEMU artefacts
Let's add support for caching QEMU artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
7aed8f8c80 tools: Add support for caching Nydus artefacts
Let's add support for caching Nydus artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
cb4cbe2958 tools: Add support for caching Kernel artefacts
Let's add support for caching Kernel artefacts that are generated using
the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:43:01 +01:00
Fabiano Fidêncio
762f9f4c3e tools: Add support for caching Firecracker artefacts
Let's add support for caching Firecracker artefacts that are generated
using the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
6b1b424fc7 tools: Add support for caching Cloud Hypervisor artefacts
Let's add support for caching Cloud Hypervisor artefacts that are
generated using the kata-deploy local-build scripts.

Right now those are not used, but we'll switch to using them very soon
as part of upcoming changes of how we build the components we test in
our CI.

Fixes: #6480

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
08fe49f708 versions: Adjust kernel names to match kata-deploy build targets
Let's adjust the kernel names in versions.yaml so those can match the
names used as part of the kata-deploy local build scripts.

Right now this doesn't bring any benefit nor drawback, but it'll make
our life easier later on in this same series.

Depends-on: github.com/kata-containers/tests#5534

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-17 11:28:56 +01:00
Fabiano Fidêncio
d281d1b90a
Merge pull request #6483 from GabyCT/topic/updatefcv
versions: Update firecracker version
2023-03-17 10:37:22 +01:00
Fabiano Fidêncio
9c16268b0a
Merge pull request #6486 from fidencio/topic/cache-artefacts-fix-kernel-version
CC | kernel: Ensure `kata_config_version` is taken into account
2023-03-17 10:17:09 +01:00
Gabriela Cervantes
99505c0f4f versions: Update firecracker version
This PR updates the firecracker version being used in kata containers
versions.yaml

The changes in version 1.3.1 are

Added

Introduced T2CL (Intel) and T2A (AMD) CPU templates to provide
instruction set feature parity between Intel and AMD CPUs when using
these templates.
Added Graviton3 support (c7g instance type).
Changed

Improved error message when invalid network backend provided.
Improved TCP throughput by between 5% and 15% (depending on CPU) by using
scatter-gather I/O in the net device's TX path.
Upgraded Rust toolchain from 1.64.0 to 1.66.0.
Made seccompiler output bit-reproducible.
Fixed

Fixed feature flags in T2 CPU template on Intel Ice Lake.

Fixes #6482

Signed-off-by: Gabriela Cervantes <gabriela.cervantes.tellez@intel.com>
2023-03-16 17:34:33 +00:00
Fabiano Fidêncio
b3a2caa527 kernel: Ensure kata_config_version is taken into account
We need to ensure `kata_config_version` is taken into account when:
* consuming a cached kernel, otherwise we may introduce changes to a
  kernel that will never be validated as part of the PR
* caching the kernel, otherwise we won't update the artefacts if just a
  config is changed

Fixes: #6485

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
2023-03-16 17:44:06 +01:00
Yushuo
f4938c0d90 bugfix: set hostname
Setting hostname according to the spec.

Fixes: #6247

Signed-off-by: Yushuo <y-shuo@linux.alibaba.com>
2023-03-16 17:16:06 +08:00
Hyounggyu Choi
96baa83895 agent: Bring in VFIO-AP device handling again
This PR is a continuing work for (kata-containers#3679).

This generalizes the previous VFIO device handling which only
focuses on PCI to include AP (IBM Z specific).

Fixes: kata-containers#3678
Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>
2023-03-16 18:14:12 +09:00
Greg Kurz
e6e719699f
Merge pull request #6471 from etrunko/main
dependency: update cgroups-rs
2023-03-16 08:01:07 +01:00
QuanweiZhou
56c63a9b1c
Merge pull request #6186 from wllenyj/dragonball-ut-6
Built-in Sandbox: add more unit tests for dragonball. Part 6
2023-03-16 11:02:05 +08:00
Jakob Naucke
f666f8e2df agent: Add VFIO-AP device handling
Initial VFIO-AP support (#578) was simple, but somewhat hacky; a
different code path would be chosen for performing the hotplug, and
agent-side device handling was bound to knowing the assigned queue
numbers (APQNs) through some other means; plus the code for awaiting
them was written for the Go agent and never released. This code also
artificially increased the hotplug timeout to wait for the (relatively
expensive, thus limited to 5 seconds at the quickest) AP rescan, which
is impractical for e.g. common k8s timeouts.

Since then, the general handling logic was improved (#1190), but it
assumed PCI in several places.

In the runtime, introduce and parse AP devices. Annotate them as such
when passing to the agent, and include information about the associated
APQNs.

The agent awaits the passed APQNs through uevents and triggers a
rescan directly.

Fixes: #3678
Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 10:07:48 +09:00
Jakob Naucke
b546eca26f runtime: Generalize VFIO devices
Generalize VFIO devices to allow for adding AP in the next patch.
The logic for VFIOPciDeviceMediatedType() has been changed and IsAPVFIOMediatedDevice() has been removed.

The rationale for the revomal is:

- VFIODeviceMediatedType is divided into 2 subtypes for AP and PCI
- Logic of checking a subtype of mediated device is included in GetVFIODeviceType()
- VFIOPciDeviceMediatedType() can simply fulfill the device addition based
on a type categorized by GetVFIODeviceType()

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 10:06:37 +09:00
Jakob Naucke
4c527d00c7 agent: Rename VFIO handling to VFIO PCI handling
e.g., split_vfio_option is PCI-specific and should instead be named
split_vfio_pci_option. This mutually affects the runtime, most notably
how the labels are named for the agent.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Jakob Naucke
db89c88f4f agent: Use cfg-if for s390x CCW
Uses fewer lines in upcoming VFIO-AP support.

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Jakob Naucke
68a586e52c agent: Use a constant for CCW root bus path
used a function like PCI does, but this is not necessary

Signed-off-by: Jakob Naucke <jakob.naucke@ibm.com>
2023-03-16 07:43:39 +09:00
Fabiano Fidêncio
814d07af58
Merge pull request #6463 from sprt/sprt/mshv-compat
runtime: add support for Hyper-V
2023-03-15 18:03:25 +01:00
Eduardo Lima (Etrunko)
a8b55bf874 dependency: update cgroups-rs
Huge pages failure with cgroups v2.
https://github.com/kata-containers/cgroups-rs/issues/112

Fixes: #6470

Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
2023-03-15 12:21:12 -03:00
Steve Horsman
c3059d0bd9
Merge pull request #6207 from BbolroC/s390x-prepare-se-image
CC: Prepare secure execution image tarball for s390x
2023-03-15 14:33:59 +00:00