Commit Graph

15886 Commits

Author SHA1 Message Date
Fupan Li
4b93176225 runtime-rs: update the protobuf to 3.7.1
Since some files generated by protobuf were share between
runtime-rs and kata agent, and the kata agent's dependency
image-rs dependened protobuf@3.7.1, thus we'd better to keep
the protobuf version aligned between runtime-rs and agent,
otherwise, we couldn't compile the runtime-rs and agent
at the same time.

Fixes: https://github.com/kata-containers/kata-containers/issues/10650

Signed-off-by: Fupan Li <fupan.lfp@antgroup.com>
2025-03-21 17:46:12 +08:00
Ruoqing He
5e81f67ceb ci: Generalize GITHUB_RUNNER_CI_ARM64
`GITHUB_RUNNER_CI_ARM64` is turned on for self hosted runners without
virtualization to skipped those tests depend on virtualization. This may
happen to other archs/runners as well, let's generalize it to
`GITHUB_RUNNER_CI_NON_VIRT` so we can reuse it on other archs.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-21 09:49:44 +08:00
RuoqingHe
e84f7c2c4b
Merge pull request #11046 from mythi/drop-dcap-libs
build: drop libtdx-attest
2025-03-21 09:23:33 +08:00
Dan Mihai
835c6814d7 tests: k8s/tests_common: avoid using regex
More straightforward implementation of hard_coded_policy_tests_enabled,
that avoids ShellCheck warning:

warning: Remove quotes from right-hand side of =~ to match as a regex rather than literally. [SC2076]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 22:23:19 +00:00
Dan Mihai
d83b8349a2 tests: policy: avoid using caller's variable
Fix unintended use of caller's variable. Use the corresponding function
parameter instead. ShellCheck:

warning: policy_settings_dir is referenced but not assigned. [SC2154]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:29 +00:00
Dan Mihai
59a70a2b28 tests: k8s/tests_common: avoid masking return values
Avoid masking command return values by declaring and only then assigning.

ShellCheck:

warning: Declare and assign separately to avoid masking return values. [SC2155]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:29 +00:00
Dan Mihai
b895e3b3e5 tests: k8s/tests_common.sh: add variable assignments
Pick the the values exported by other scripts. ShellCheck:

warning: AUTO_GENERATE_POLICY is referenced but not assigned. [SC2154]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:29 +00:00
Dan Mihai
0f4de1c94a tests: tests_common: remove useless assignment
ShellCheck:

warning: This assignment is only seen by the forked process. [SC2097]
warning: This expansion will not see the mentioned assignment. [SC2098]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:29 +00:00
Dan Mihai
9c0d069ac7 tests: tests_common: prevent globbing and word splitting
ShellCheck:

note: Double quote to prevent globbing and word splitting. [SC2086]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
15961b03f7 tests: k8s/tests_common.sh: -n instead of ! -z
ShellCheck:

note: Use -n instead of ! -z. [SC2236]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
4589dc96ef tests: k8s/tests_common.sh: add double quoting
ShellCheck:

note: Prefer double quoting even when variables don't contain special characters. [SC2248]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
cc5f8d31d2 tests: k8s/tests_common.sh: add braces
ShellCheck: add braces around variable references:

note: Prefer putting braces around variable references even when not strictly required. [SC2250]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
0d3f9fcee1 tests: tests_common: export variables used externally
ShellCheck: export variables used outside of tests_common.sh - e.g.,

warning: timeout appears unused. Verify use (or export if used externally). [SC2034]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
5df43ffc7c tests: k8s/tests_common.sh: Prefer [[ ]] over [ ]
Replace [ ] with [[ ]] as advised by shellcheck:

note: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-20 19:02:28 +00:00
Dan Mihai
f79fabab24
Merge pull request #11024 from microsoft/danmihai1/empty-exec-output
tests: k8s: retry "kubectl exec" on empty output
2025-03-20 11:03:08 -07:00
stevenhorsman
70d32afbb7 ci: Remove metrics tests from required list
The metrics tests haven't been stable, or required through
github for many week now, so update the required-tests.yaml
list to re-sync

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-20 16:03:03 +00:00
stevenhorsman
607b27fd7f ci: Update static-checks strings
With the refactor in #10948 the names of
the static checks has changed, so update these.

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-20 13:45:57 +00:00
Mikko Ylinen
f52a565834 build: drop libtdx-attest
with the latest CoCo guest-components, tdx-attester no longer
depends on libtdx attest. Stop installing it to the rootfs.

Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
2025-03-20 10:45:30 +02:00
Steve Horsman
c0632f847f
Merge pull request #11043 from stevenhorsman/3.15.0-release
release: Bump version to 3.15.0
2025-03-20 07:38:20 +00:00
Greg Kurz
e19b81225c
Merge pull request #11045 from kata-containers/sprt/fix-gha-tag
security: ci: Pin third-party actions to commit hashes
2025-03-20 08:14:06 +01:00
Aurélien Bombo
a678046d13 gha: Pin third-party actions to commit hashes
A popular third-party action has recently been compromised [1][2] and
the attacker managed to point multiple git version tags to a malicious
commit containing code to exfiltrate secrets.

This PR follows GitHub's recommendation [3] to pin third-party actions
to a full-length commit hash, to mitigate such attacks.

Hopefully actionlint starts warning about this soon [4].

 [1] https://www.cve.org/CVERecord?id=CVE-2025-30066
 [2] https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
 [3] https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
 [4] https://github.com/rhysd/actionlint/pull/436

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-19 13:52:49 -05:00
stevenhorsman
fad248ef09 release: Bump version to 3.15.0
Bump VERSION and helm-chart versions

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 17:28:06 +00:00
Fabiano Fidêncio
a6e5d28a15
Merge pull request #11055 from stevenhorsman/bump-github.com/containerd/containerd/v1.7.27
runtime: Update github.com/containerd/containerd
2025-03-19 18:19:10 +01:00
stevenhorsman
cb7c599180 runtime: Switch from deprecated tracer
`go.opentelemetry.io/otel/trace.NewNoopTracerProvider`
is deprectated now, so switch to
`go.opentelemetry.io/otel/trace/noop.NewTracerProvider`

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 14:22:06 +00:00
stevenhorsman
8f22b07aba runtime: Update github.com/containerd/containerd
Update to 1.7.27 to resolve CVE-2024-40635

Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-03-19 13:48:04 +00:00
Lukáš Doktor
d708866b2a
ci.ocp: shellcheck various fixes
various manual fixes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:28 +01:00
Lukáš Doktor
7e11489daf
ci: shellcheck - collection of fixes
manual fixes of various issues.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:23 +01:00
Lukáš Doktor
f62e08998c
ci: shellcheck - remove unused argument
the "-a" argument was introduced with this tool but never was actually
used.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:19 +01:00
Lukáš Doktor
02deb1d782
ci: shellcheck SC2248
SC2248 (style): Prefer double quoting even when variables don't contain
special characters, might result in arguments difference, shouldn't in
our cases.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:16 +01:00
Lukáš Doktor
d80e7c7644
ci: shellcheck SC2155
SC2155 (warning): Declare and assign separately to avoid masking return
values, should be harmless.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:12 +01:00
Lukáš Doktor
6552ac41e0
ci: shellcheck SC2086
SC2086 Double quote to prevent globbing and word splitting, might break
places where we deliberately use word splitting, but we are not using it
here.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:08 +01:00
Lukáš Doktor
154a4ddc00
ci: shellcheck SC2292
SC2292 (style): Prefer [[ ]] over [ ] for tests in Bash/Ksh. This might
result in different handling of globs and some ops which we don't use.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:26:03 +01:00
Lukáš Doktor
667e26036c
ci: shellcheck SC2250
Treat the SC2250 require-variable-braces in CI. There are no functional
changes.

Related to: #10951

Signed-off-by: Lukáš Doktor <ldoktor@redhat.com>
2025-03-19 12:25:44 +01:00
Zvonko Kaiser
d37d9feee9
Merge pull request #11035 from kata-containers/sprt/fix-dependabot
security: ci: Remove `replace` directives in go.mod files
2025-03-18 12:43:46 -04:00
Steve Horsman
ba5b0777b5
Merge pull request #11002 from fitzthum/bump-gc-0130
Bump Trustee and Guest Components for coco v0.13.0
2025-03-17 16:31:23 +00:00
RuoqingHe
36d2dee3a4
Merge pull request #11042 from RuoqingHe/runtime-rs-riscv
runtime-rs: Support and enable build on riscv64
2025-03-17 21:42:15 +08:00
Ruoqing He
cb7508ffdc ci: Enable runtime-rs component build-check on riscv64
`runtime-rs` is now buildable and testable on riscv64 platforms, enable
`build-check` on `runtime-rs`.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:38:59 +08:00
Steve Horsman
f308cbba93
Merge pull request #11015 from AdithyaKrishnan/main
CI: Mark SNP as a Required test
2025-03-17 09:27:28 +00:00
Ruoqing He
084fb2d780 runtime-rs: Enable RISC-V build
Define `riscv64gc-options.mk` to enable `runtime-rs` to be built on
RISC-V platforms.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Ruoqing He
fd6c16e209 kata-sys-util: Set NoProtection for riscv64
`available_guets_protection` is required for `runtime-rs` to infer while
building it on riscv64 platforms. Set it to `NoProtection` as riscv64
does not support guest protection for now.

Signed-off-by: Ruoqing He <heruoqing@iscas.ac.cn>
2025-03-17 17:22:48 +08:00
Aurélien Bombo
26bd7989b3 csi-kata-directvolume: Remove replace in go.mod
Running `go mod tidy` and `go mod vendor` after this resulted in no-ops.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
b965fe8239 tests: Run go mod vendor
`go mod tidy` was a no-op.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
e9f88757ba tests: Remove replace directives in go.mod
Same rationale as for runtime. With tests, the blackfriday replacement was
actually meaningful, so I refactored some imports.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
35c92aa6ad runtime: Run go mod vendor
Regenerating go module files.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
fa0f85e8b0 runtime: Run go mod tidy
Tidying up go.mod.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Aurélien Bombo
c3a9c70d45 runtime: Remove replace directives in go.mod
These replace directives aren't understood by dependabot, hence dependabot can
claim to upgrade a dependency, while a replace directive still makes the
dependency point to an old version.

Fixes: #11020

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
2025-03-14 18:00:36 +00:00
Adithya Krishnan Kannan
32dbee8d7e CI: Mark SNP as a Required test
The SNP CI has been consistently passing and we request the @kata-containers/architecture-committee to mark this test as a required test.

Signed-Off-By: Adithya Krishnan Kannan <AdithyaKrishnan.Kannan@amd.com>
2025-03-14 12:48:55 -05:00
Dan Mihai
dab981b0bc tests: k8s: retry "kubectl exec" on empty output
Retry "kubectl exec" a few times if it unexpectedly produced an empty
output string.

This is an attempt to work around test failures similar to:

https://github.com/kata-containers/kata-containers/actions/runs/13840930994/job/38730153687?pr=10983

not ok 1 Environment variables
(from function `grep_pod_exec_output' in file tests_common.sh, line 394,
 in test file k8s-env.bats, line 36)
`grep_pod_exec_output "${pod_name}" "HOST_IP=\([0-9]\+\(\.\|$\)\)\{4\}" "${exec_command[@]}"' failed

That test obtained correct ouput from "sh -c printenv" one time, but the
second execution of the same command returned an empty output string.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
2025-03-14 17:03:03 +00:00
Tobin Feldman-Fitzthum
b7786fbcf0 agent: update image-rs for coco v0.13.0
image-rs has gotten a number of significant updates, eliminating corner
cases with obscure containers, improving support for local certs, and
more.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
2025-03-14 10:44:10 -05:00
Tobin Feldman-Fitzthum
63ec1609bc versions: update guest-components for coco v0.13.0
Update to the latest hash of guest-components. This will pick up some
nice new features including using ec key for the rcar handshake.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@ibm.com>
2025-03-14 10:44:10 -05:00