Merge pull request #5379 from bergwolf/3.0.0-branch-bump

# Kata Containers 3.0.0

.github/actionlint.yaml

@@ -1,24 +0,0 @@
-# Copyright (c) 2024 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Configuration file with rules for the actionlint tool.
-#
-self-hosted-runner:
-  # Labels of self-hosted runner that linter should ignore
-  labels:
-    - arm64-builder
-    - garm-ubuntu-2004
-    - garm-ubuntu-2004-smaller
-    - garm-ubuntu-2204
-    - garm-ubuntu-2304
-    - garm-ubuntu-2304-smaller
-    - garm-ubuntu-2204-smaller
-    - k8s-ppc64le
-    - metrics
-    - ppc64le
-    - sev
-    - sev-snp
-    - s390x
-    - s390x-large
-    - tdx

.github/workflows/PR-wip-checks.yaml

@@ -9,10 +9,6 @@ on:
       - labeled
       - unlabeled
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   pr_wip_check:
     runs-on: ubuntu-latest

.github/workflows/add-backport-label.yaml

@@ -0,0 +1,100 @@
+name: Add backport label
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+      - labeled
+      - unlabeled
+
+jobs:
+  check-issues:
+    if: ${{ github.event.label.name != 'auto-backport' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code to allow hub to communicate with the project
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v3
+
+      - name: Install hub extension script
+        run: |
+          pushd $(mktemp -d) &>/dev/null
+          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
+          sudo install hub-util.sh /usr/local/bin
+          popd &>/dev/null
+
+      - name: Determine whether to add label 
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CONTAINS_AUTO_BACKPORT: ${{ contains(github.event.pull_request.labels.*.name, 'auto-backport') }}
+        id: add_label
+        run: |
+          pr=${{ github.event.pull_request.number }}
+          linked_issue_urls=$(hub-util.sh \
+            list-issues-for-pr "$pr" |\
+            grep -v "^\#"  |\
+            cut -d';' -f3 || true)
+          [ -z "$linked_issue_urls" ] && {
+            echo "::error::No linked issues for PR $pr"
+            exit 1
+          }
+          has_bug=false
+          for issue_url in $(echo "$linked_issue_urls")
+          do
+            issue=$(echo "$issue_url"| awk -F\/ '{print $NF}' || true)
+            [ -z "$issue" ] && {
+              echo "::error::Cannot determine issue number from $issue_url for PR $pr"
+              exit 1
+            }
+            labels=$(hub-util.sh list-labels-for-issue "$issue")
+            
+            label_names=$(echo $labels | jq -r '.[].name' || true)
+            if [[ "$label_names" =~ "bug" ]]; then
+              has_bug=true
+              break
+            fi
+          done
+
+          has_backport_needed_label=${{ contains(github.event.pull_request.labels.*.name, 'needs-backport') }}
+          has_no_backport_needed_label=${{ contains(github.event.pull_request.labels.*.name, 'no-backport-needed') }}
+
+          echo "::set-output name=add_backport_label::false"
+          if [ $has_backport_needed_label  = true ] || [ $has_bug  = true ]; then
+            if [[ $has_no_backport_needed_label = false ]]; then
+              echo "::set-output name=add_backport_label::true"
+            fi
+          fi
+
+          # Do not spam comment, only if auto-backport label is going to be newly added.
+          echo "::set-output name=auto_backport_added::$CONTAINS_AUTO_BACKPORT"
+
+      - name: Add comment
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'true' && steps.add_label.outputs.auto_backport_added == 'false' }}
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: 'This issue has been marked for auto-backporting. Add label(s) backport-to-BRANCHNAME to backport to them'
+            })
+
+      # Allow label to be removed by adding no-backport-needed label
+      - name: Remove auto-backport label
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'false' }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        with:
+          remove-labels: "auto-backport"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add auto-backport label
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && steps.add_label.outputs.add_backport_label == 'true' }}
+        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
+        with:
+          add-labels: "auto-backport"
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/add-issues-to-project.yaml

@@ -11,10 +11,6 @@ on:
       - opened
       - reopened
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   add-new-issues-to-backlog:
     runs-on: ubuntu-latest
@@ -39,7 +35,7 @@ jobs:
           popd &>/dev/null
 
       - name: Checkout code to allow hub to communicate with the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v2
 
       - name: Add issue to issue backlog
         env:

.github/workflows/add-pr-sizing-label.yaml

@@ -12,25 +12,12 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
   add-pr-size-label:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+        uses: actions/checkout@v1
 
       - name: Install PR sizing label script
         run: |

.github/workflows/auto-backport.yaml

@@ -0,0 +1,29 @@
+on:
+  pull_request_target:
+    types: ["labeled", "closed"]
+
+jobs:
+  backport:
+    name: Backport PR
+    runs-on: ubuntu-latest
+    if: |
+      github.event.pull_request.merged == true
+      && contains(github.event.pull_request.labels.*.name, 'auto-backport')
+      && (
+        (github.event.action == 'labeled' && github.event.label.name == 'auto-backport')
+        || (github.event.action == 'closed')
+      )
+    steps:
+      - name: Backport Action
+        uses: sqren/backport-github-action@v8.9.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          auto_backport_label_prefix: backport-to-
+
+      - name: Info log
+        if: ${{ success() }}
+        run: cat /home/runner/.backport/backport.info.log
+        
+      - name: Debug log
+        if: ${{ failure() }}
+        run: cat /home/runner/.backport/backport.debug.log

.github/workflows/basic-ci-amd64.yaml

@@ -1,343 +0,0 @@
-name: CI | Basic amd64 tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'dragonball', 'qemu', 'stratovirt', 'cloud-hypervisor', 'qemu-runtime-rs']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        timeout-minutes: 10
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-  run-containerd-stability:
-    strategy:
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'cloud-hypervisor', 'dragonball', 'qemu', 'stratovirt']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/stability/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/stability/gha-run.sh install-kata kata-artifacts
-
-      - name: Run containerd-stability tests
-        timeout-minutes: 15
-        run: bash tests/stability/gha-run.sh run
-
-  run-nydus:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        containerd_version: ['lts', 'active']
-        vmm: ['clh', 'qemu', 'dragonball', 'stratovirt']
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/nydus/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nydus/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nydus tests
-        timeout-minutes: 10
-        run: bash tests/integration/nydus/gha-run.sh run
-
-  run-runk:
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        timeout-minutes: 10
-        run: bash tests/integration/runk/gha-run.sh run
-
-  run-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh # cloud-hypervisor
-          - qemu
-    # TODO: enable me when https://github.com/kata-containers/kata-containers/issues/9763 is fixed
-    if: false
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/tracing/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/tracing/gha-run.sh install-kata kata-artifacts
-
-      - name: Run tracing tests
-        timeout-minutes: 15
-        run: bash tests/functional/tracing/gha-run.sh run
-
-  run-vfio:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-        exclude:
-          # TODO: enable with clh when https://github.com/kata-containers/kata-containers/issues/9764 is fixed
-          - vmm: clh
-    runs-on: garm-ubuntu-2304
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/vfio/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Run vfio tests
-        timeout-minutes: 15
-        run: bash tests/functional/vfio/gha-run.sh run
-
-  run-docker-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-    runs-on: garm-ubuntu-2304-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/docker/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
-
-      - name: Run docker smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/docker/gha-run.sh run
-
-  run-nerdctl-tests:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # all the tests are not flaky, otherwise we'll fail them
-      # all due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - cloud-hypervisor
-    runs-on: garm-ubuntu-2304-smaller
-    env:
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/nerdctl/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/nerdctl/gha-run.sh install-kata kata-artifacts
-
-      - name: Run nerdctl smoke test
-        timeout-minutes: 5
-        run: bash tests/integration/nerdctl/gha-run.sh run
-
-      - name: Collect artifacts ${{ matrix.vmm }}
-        run: bash tests/integration/nerdctl/gha-run.sh collect-artifacts
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: nerdctl-tests-garm-${{ matrix.vmm }}
-          path: /tmp/artifacts
-          retention-days: 1

.github/workflows/build-checks.yaml

@@ -1,114 +0,0 @@
-on:
-  workflow_call:
-    inputs:
-      instance:
-        required: true
-        type: string
-
-name: Build checks
-jobs:
-  check:
-    runs-on: ${{ inputs.instance }}
-    strategy:
-      fail-fast: false
-      matrix:
-        component:
-          - agent
-          - dragonball
-          - runtime
-          - runtime-rs
-          - agent-ctl
-          - kata-ctl
-          - runk
-          - trace-forwarder
-          - genpolicy
-        command:
-          - "make vendor"
-          - "make check"
-          - "make test"
-          - "sudo -E PATH=\"$PATH\" make test"
-        include:
-          - component: agent
-            component-path: src/agent
-          - component: dragonball
-            component-path: src/dragonball
-          - component: runtime
-            component-path: src/runtime
-          - component: runtime-rs
-            component-path: src/runtime-rs
-          - component: agent-ctl
-            component-path: src/tools/agent-ctl
-          - component: kata-ctl
-            component-path: src/tools/kata-ctl
-          - component: runk
-            component-path: src/tools/runk
-          - component: trace-forwarder
-            component-path: src/tools/trace-forwarder
-          - install-libseccomp: no
-          - component: agent
-            install-libseccomp: yes
-          - component: runk
-            install-libseccomp: yes
-          - component: genpolicy
-            component-path: src/tools/genpolicy
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE $HOME
-          sudo rm -rf $GITHUB_WORKSPACE/* && echo "GITHUB_WORKSPACE removed" || { sleep 10 && sudo rm -rf $GITHUB_WORKSPACE/*; }
-          sudo rm -f /tmp/kata_hybrid*  # Sometime we got leftover from test_setup_hvsock_failed()
-        if: ${{ inputs.instance != 'ubuntu-20.04' }}
-
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        if: ${{ matrix.component == 'runtime' }}
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-      - name: Install rust
-        if: ${{ matrix.component != 'runtime' }}
-        run: |
-          ./tests/install_rust.sh
-          echo "${HOME}/.cargo/bin" >> $GITHUB_PATH
-      - name: Install musl-tools
-        if: ${{ matrix.component != 'runtime' }}
-        run: sudo apt-get -y install musl-tools
-      - name: Install devicemapper
-        if: ${{ matrix.command == 'make check' && matrix.component == 'agent' }}
-        run: sudo apt-get -y install libdevmapper-dev
-      - name: Install libseccomp
-        if: ${{ matrix.command != 'make vendor'  &&  matrix.command != 'make check' &&  matrix.install-libseccomp == 'yes' }}
-        run: |
-          libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
-          gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
-          ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
-          echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
-          echo "LIBSECCOMP_LINK_TYPE=static" >> $GITHUB_ENV
-          echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> $GITHUB_ENV
-      - name: Install protobuf-compiler
-        if: ${{ matrix.command != 'make vendor' && (matrix.component == 'agent' || matrix.component == 'runk' || matrix.component == 'genpolicy') }}
-        run: sudo apt-get -y install protobuf-compiler
-      - name: Install clang
-        if: ${{ matrix.command == 'make check' && matrix.component == 'agent' }}
-        run: sudo apt-get -y install clang
-      - name: Setup XDG_RUNTIME_DIR for the `runtime` tests
-        if: ${{ matrix.command != 'make vendor' && matrix.command != 'make check' && matrix.component == 'runtime' }}
-        run: |
-          XDG_RUNTIME_DIR=$(mktemp -d /tmp/kata-tests-$USER.XXX | tee >(xargs chmod 0700))
-          echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> $GITHUB_ENV
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
-        run: |
-          cd ${{ matrix.component-path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-          SKIP_GO_VERSION_CHECK: "1"

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -1,138 +0,0 @@
-name: CI | Build kata-static tarball for amd64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - agent-ctl
-          - cloud-hypervisor
-          - cloud-hypervisor-glibc
-          - coco-guest-components
-          - firecracker
-          - genpolicy
-          - kata-ctl
-          - kata-manager
-          - kernel
-          - kernel-confidential
-          - kernel-dragonball-experimental
-          - kernel-nvidia-gpu
-          - kernel-nvidia-gpu-confidential
-          - nydus
-          - ovmf
-          - ovmf-sev
-          - pause-image
-          - qemu
-          - qemu-snp-experimental
-          - stratovirt
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-          - rootfs-initrd-mariner
-          - runk
-          - shim-v2
-          - trace-forwarder
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-        exclude:
-          - asset: cloud-hypervisor-glibc
-            stage: release
-    steps:
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          mkdir -p kata-build && cp "${build_dir}"/kata-static-${KATA_ASSET}*.tar.* kata-build/.
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        if: ${{ matrix.stage != 'release' || (matrix.asset != 'agent' && matrix.asset != 'coco-guest-components' && matrix.asset != 'pause-image') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-amd64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ubuntu-latest
-    needs: build-asset
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-amd64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-arm64.yaml

@@ -1,123 +0,0 @@
-name: CI | Build kata-static tarball for arm64
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: arm64-builder
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - cloud-hypervisor
-          - firecracker
-          - kernel
-          - kernel-dragonball-experimental
-          - nydus
-          - qemu
-          - stratovirt
-          - rootfs-image
-          - rootfs-initrd
-          - shim-v2
-          - virtiofsd
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        if: ${{ inputs.stage != 'release' || matrix.asset != 'agent' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-arm64-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: arm64-builder
-    needs: build-asset
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-arm64-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-ppc64le.yaml

@@ -1,126 +0,0 @@
-name: CI | Build kata-static tarball for ppc64le
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: ppc64le
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - kernel
-          - qemu
-          - rootfs-initrd
-          - shim-v2
-          - virtiofsd
-        stage:
-          - ${{ inputs.stage }}
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - name: Prepare the self-hosted runner
-        run: |
-            ${HOME}/scripts/prepare_runner.sh
-            sudo rm -rf $GITHUB_WORKSPACE/*
-
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        if: ${{ inputs.stage != 'release' || matrix.asset != 'agent' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-ppc64le-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: ppc64le
-    needs: build-asset
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-ppc64le-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -1,167 +0,0 @@
-name: CI | Build kata-static tarball for s390x
-on:
-  workflow_call:
-    inputs:
-      stage:
-        required: false
-        type: string
-        default: test
-      tarball-suffix:
-        required: false
-        type: string
-      push-to-registry:
-        required: false
-        type: string
-        default: no
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-asset:
-    runs-on: s390x
-    strategy:
-      matrix:
-        asset:
-          - agent
-          - coco-guest-components
-          - kernel
-          - kernel-confidential
-          - pause-image
-          - qemu
-          - rootfs-image
-          - rootfs-image-confidential
-          - rootfs-initrd
-          - rootfs-initrd-confidential
-          - shim-v2
-          - virtiofsd
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.push-to-registry == 'yes' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0 # This is needed in order to keep the commit ids history
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Build ${{ matrix.asset }}
-        run: |
-          make "${KATA_ASSET}-tarball"
-          build_dir=$(readlink -f build)
-          # store-artifact does not work with symlink
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          KATA_ASSET: ${{ matrix.asset }}
-          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
-          PUSH_TO_REGISTRY: ${{ inputs.push-to-registry }}
-          ARTEFACT_REGISTRY: ghcr.io
-          ARTEFACT_REGISTRY_USERNAME: ${{ github.actor }}
-          ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-          RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
-
-      - name: store-artifact ${{ matrix.asset }}
-        if: ${{ inputs.stage != 'release' || (matrix.asset != 'agent' && matrix.asset != 'coco-guest-components' && matrix.asset != 'pause-image') }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x-${{ matrix.asset }}${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
-          retention-days: 15
-          if-no-files-found: error
-
-  build-asset-boot-image-se:
-    runs-on: s390x
-    needs: build-asset
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-
-      - name: Place a host key document
-        run: |
-          mkdir -p "host-key-document"
-          cp "${CI_HKD_PATH}" "host-key-document"
-        env:
-          CI_HKD_PATH: ${{ secrets.CI_HKD_PATH }}
-
-      - name: Build boot-image-se
-        run: |
-          base_dir=tools/packaging/kata-deploy/local-build/
-          cp -r kata-artifacts ${base_dir}/build
-          # Skip building dependant artifacts of boot-image-se-tarball
-          # because we already have them from the previous build
-          sed -i 's/\(^boot-image-se-tarball:\).*/\1/g' ${base_dir}/Makefile
-          make boot-image-se-tarball
-          build_dir=$(readlink -f build)
-          sudo cp -r "${build_dir}" "kata-build"
-          sudo chown -R $(id -u):$(id -g) "kata-build"
-        env:
-          HKD_PATH: "host-key-document"
-
-      - name: store-artifact boot-image-se
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-artifacts-s390x${{ inputs.tarball-suffix }}
-          path: kata-build/kata-static-boot-image-se.tar.xz
-          retention-days: 1
-          if-no-files-found: error
-
-  create-kata-tarball:
-    runs-on: s390x
-    needs: [build-asset, build-asset-boot-image-se]
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-      - name: get-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: kata-artifacts-s390x-*${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-          merge-multiple: true
-      - name: merge-artifacts
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts versions.yaml
-      - name: store-artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-static.tar.xz
-          retention-days: 15
-          if-no-files-found: error

.github/workflows/cargo-deny-runner.yaml

@@ -1,16 +1,5 @@
 name: Cargo Crates Check Runner
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+on: [pull_request]
 jobs:
   cargo-deny-runner:
     runs-on: ubuntu-latest
@@ -18,7 +7,7 @@ jobs:
     steps:
       - name: Checkout Code
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       - name: Generate Action
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
         run: bash cargo-deny-generator.sh

.github/workflows/ci-nightly-s390x.yaml

@@ -1,21 +0,0 @@
-on:
-  schedule:
-    - cron: '0 5 * * *'
-
-name: Nightly CI for s390x
-jobs:
-  check-internal-test-result:
-    runs-on: s390x
-    strategy:
-      fail-fast: false
-      matrix:
-        test_title:
-          - kata-vfio-ap-e2e-tests
-          - cc-se-e2e-tests
-    steps:
-    - name: Fetch a test result for {{ matrix.test_title }}
-      run: |
-        file_name="${TEST_TITLE}-$(date +%Y-%m-%d).log"
-        /home/${USER}/script/handle_test_log.sh download $file_name
-      env:
-        TEST_TITLE: ${{ matrix.test_title }}

.github/workflows/ci-nightly.yaml

@@ -1,19 +0,0 @@
-name: Kata Containers Nightly CI
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      pr-number: "nightly"
-      tag: ${{ github.sha }}-nightly
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit

.github/workflows/ci-on-push.yaml

@@ -1,30 +0,0 @@
-name: Kata Containers CI
-on:
-  pull_request_target:
-    branches:
-      - 'main'
-      - 'stable-*'
-    types:
-      # Adding 'labeled' to the list of activity types that trigger this event
-      # (default: opened, synchronize, reopened) so that we can run this
-      # workflow when the 'ok-to-test' label is added.
-      # Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
-      - opened
-      - synchronize
-      - reopened
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-containers-ci-on-push:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    uses: ./.github/workflows/ci.yaml
-    with:
-      commit-hash: ${{ github.event.pull_request.head.sha }}
-      pr-number: ${{ github.event.pull_request.number }}
-      tag: ${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
-      target-branch: ${{ github.event.pull_request.base.ref }}
-    secrets: inherit

.github/workflows/ci.yaml

@@ -1,248 +0,0 @@
-name: Run the Kata Containers CI
-on:
-  workflow_call:
-    inputs:
-      commit-hash:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-  
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-  
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  build-and-publish-tee-confidential-unencrypted-image:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Kata Containers ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker build and push
-        uses: docker/build-push-action@v5
-        with:
-          tags: ghcr.io/kata-containers/test-images:unencrypted-${{ inputs.pr-number }}
-          push: true
-          context: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/
-          platforms: linux/amd64, linux/s390x
-          file: tests/integration/kubernetes/runtimeclass_workloads/confidential/unencrypted/Dockerfile
-
-  run-kata-deploy-tests-on-aks:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-kata-deploy-tests-on-aks.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-deploy-tests-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-kata-deploy-tests-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-monitor-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-kata-monitor-tests.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-k8s-tests-on-aks:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-with-crio-on-garm:
-    needs: publish-kata-deploy-payload-amd64
-    uses: ./.github/workflows/run-k8s-tests-with-crio-on-garm.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-kata-coco-tests:
-    needs: [publish-kata-deploy-payload-amd64, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-kata-coco-tests.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-amd64
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-    secrets: inherit
-
-  run-k8s-tests-on-zvsi:
-    needs: [publish-kata-deploy-payload-s390x, build-and-publish-tee-confidential-unencrypted-image]
-    uses: ./.github/workflows/run-k8s-tests-on-zvsi.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-s390x
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-      
-  run-k8s-tests-on-ppc64le:
-    needs: publish-kata-deploy-payload-ppc64le
-    uses: ./.github/workflows/run-k8s-tests-on-ppc64le.yaml
-    with:
-      registry: ghcr.io
-      repo: ${{ github.repository_owner }}/kata-deploy-ci
-      tag: ${{ inputs.tag }}-ppc64le
-      commit-hash: ${{ inputs.commit-hash }}
-      pr-number: ${{ inputs.pr-number }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-metrics-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/run-metrics.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-basic-amd64-tests:
-    needs: build-kata-static-tarball-amd64
-    uses: ./.github/workflows/basic-ci-amd64.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-cri-containerd-tests-s390x:
-    needs: build-kata-static-tarball-s390x
-    uses: ./.github/workflows/run-cri-containerd-tests-s390x.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}
-
-  run-cri-containerd-tests-ppc64le:
-    needs: build-kata-static-tarball-ppc64le
-    uses: ./.github/workflows/run-cri-containerd-tests-ppc64le.yaml
-    with:
-      tarball-suffix: -${{ inputs.tag }}
-      commit-hash: ${{ inputs.commit-hash }}
-      target-branch: ${{ inputs.target-branch }}

.github/workflows/commit-message-check.yaml

@@ -6,10 +6,6 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 env:
   error_msg: |+
     See the document below for help on formatting commits for the project.
@@ -19,8 +15,6 @@ env:
 jobs:
   commit-message-check:
     runs-on: ubuntu-latest
-    env:
-      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
     name: Commit Message Check
     steps:
     - name: Get PR Commits
@@ -49,7 +43,7 @@ jobs:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
 
     - name: Check Subject Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
@@ -58,7 +52,7 @@ jobs:
         post_error: ${{ env.error_msg }}
 
     - name: Check Body Line Length
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}
@@ -68,9 +62,6 @@ jobs:
         #   to be specified at the start of the regex as the action is passed
         #   the entire commit message.
         #
-        # - This check will pass if the commit message only contains a subject
-        #   line, as other body message properties are enforced elsewhere.
-        #
         # - Body lines *can* be longer than the maximum if they start
         #   with a non-alphabetic character or if there is no whitespace in
         #   the line.
@@ -84,12 +75,23 @@ jobs:
         #
         # - A SoB comment can be any length (as it is unreasonable to penalise
         #   people with long names/email addresses :)
-        pattern: '(^[^\n]+$|^.+(\n([a-zA-Z].{0,150}|[^a-zA-Z\n].*|[^\s\n]*|Signed-off-by:.*|))+$)'
+        pattern: '^.+(\n([a-zA-Z].{0,150}|[^a-zA-Z\n].*|[^\s\n]*|Signed-off-by:.*|))+$'
         error: 'Body line too long (max 150)'
         post_error: ${{ env.error_msg }}
 
+    - name: Check Fixes
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      uses: tim-actions/commit-message-checker-with-regex@v0.3.1
+      with:
+        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        pattern: '\s*Fixes\s*:?\s*(#\d+|github\.com\/kata-containers\/[a-z-.]*#\d+)|^\s*release\s*:'
+        flags: 'i'
+        error: 'No "Fixes" found'
+        post_error: ${{ env.error_msg }}
+        one_pass_all_pass: 'true'
+
     - name: Check Subsystem
-      if: ${{ (env.PR_AUTHOR != 'dependabot[bot]') && !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }}
       uses: tim-actions/commit-message-checker-with-regex@v0.3.1
       with:
         commits: ${{ steps.get-pr-commits.outputs.commits }}

.github/workflows/darwin-tests.yaml

@@ -6,20 +6,20 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 name: Darwin tests
 jobs:
   test:
-    runs-on: macos-latest
+    strategy:
+      matrix:
+        go-version: [1.16.x, 1.17.x]
+        os: [macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
     - name: Install Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.22.2
+        go-version: ${{ matrix.go-version }}
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
     - name: Build utils
       run: ./ci/darwin-test.sh

.github/workflows/docs-url-alive-check.yaml

@@ -5,7 +5,11 @@ on:
 name: Docs URL Alive Check
 jobs:
   test:
-    runs-on: ubuntu-20.04
+    strategy:
+      matrix:
+        go-version: [1.17.x]
+        os: [ubuntu-20.04]
+    runs-on: ${{ matrix.os }}
     # don't run this action on forks
     if: github.repository_owner == 'kata-containers'
     env:
@@ -14,7 +18,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.22.2
+        go-version: ${{ matrix.go-version }}
       env:
         GOPATH: ${{ runner.workspace }}/kata-containers
     - name: Set env
@@ -22,7 +26,7 @@ jobs:
         echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
         echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v2
       with:
         fetch-depth: 0
         path: ./src/github.com/${{ github.repository }}

.github/workflows/kata-deploy-push.yaml

@@ -0,0 +1,84 @@
+name: kata deploy build
+
+on: 
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+    paths:
+      - tools/**
+      - versions.yaml
+
+jobs:
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - kernel
+          - shim-v2
+          - qemu
+          - cloud-hypervisor
+          - firecracker
+          - rootfs-image
+          - rootfs-initrd
+          - virtiofsd
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install docker
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          curl -fsSL https://test.docker.com -o test-docker.sh
+          sh test-docker.sh
+
+      - name: Build ${{ matrix.asset }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make "${KATA_ASSET}-tarball"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r --preserve=all "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+
+      - name: store-artifact ${{ matrix.asset }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: build
+      - name: merge-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make merge-builds
+      - name: store-artifacts
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  make-kata-tarball:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: make kata-tarball
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          make kata-tarball
+          sudo make install-tarball

.github/workflows/kata-deploy-test.yaml

@@ -0,0 +1,149 @@
+on:
+  workflow_dispatch: # this is used to trigger the workflow on non-main branches
+  issue_comment:
+    types: [created, edited]
+
+name: test-kata-deploy
+
+jobs:
+  check-comment-and-membership:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.issue.pull_request
+      && github.event_name == 'issue_comment'
+      && github.event.action == 'created'
+      && startsWith(github.event.comment.body, '/test_kata_deploy')
+    steps:
+      - name: Check membership
+        uses: kata-containers/is-organization-member@1.0.1
+        id: is_organization_member
+        with:
+          organization: kata-containers
+          username: ${{ github.event.comment.user.login }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Fail if not member
+        run: |
+          result=${{ steps.is_organization_member.outputs.result }}
+          if [ $result == false ]; then
+              user=${{ github.event.comment.user.login }}
+              echo Either ${user} is not part of the kata-containers organization
+              echo or ${user} has its Organization Visibility set to Private at
+              echo https://github.com/orgs/kata-containers/people?query=${user}
+              echo 
+              echo Ensure you change your Organization Visibility to Public and
+              echo trigger the test again.
+              exit 1
+          fi
+
+  build-asset:
+    runs-on: ubuntu-latest
+    needs: check-comment-and-membership
+    strategy:
+      matrix:
+        asset:
+          - cloud-hypervisor
+          - firecracker
+          - kernel
+          - qemu
+          - rootfs-image
+          - rootfs-initrd
+          - shim-v2
+          - virtiofsd
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            echo "reference for PR: " ${ref}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+
+      - name: Install docker
+        run: |
+          curl -fsSL https://test.docker.com -o test-docker.sh
+          sh test-docker.sh
+
+      - name: Build ${{ matrix.asset }}
+        run: |
+          make "${KATA_ASSET}-tarball"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
+
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            echo "reference for PR: " ${ref}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  kata-deploy:
+    needs: create-kata-tarball
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-PR-ref
+        id: get-PR-ref
+        run: |
+            ref=$(cat $GITHUB_EVENT_PATH | jq -r '.issue.pull_request.url' | sed  's#^.*\/pulls#refs\/pull#' | sed 's#$#\/merge#')
+            echo "reference for PR: " ${ref}
+            echo "##[set-output name=pr-ref;]${ref}"
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ steps.get-PR-ref.outputs.pr-ref }}
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-static-tarball
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
+        run: |
+          PR_SHA=$(git log --format=format:%H -n1)
+          mv kata-static.tar.xz $GITHUB_WORKSPACE/tools/packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t quay.io/kata-containers/kata-deploy-ci:$PR_SHA $GITHUB_WORKSPACE/tools/packaging/kata-deploy
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$PR_SHA
+          mkdir -p packaging/kata-deploy
+          ln -s $GITHUB_WORKSPACE/tools/packaging/kata-deploy/action packaging/kata-deploy/action
+          echo "::set-output name=PKG_SHA::${PR_SHA}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+        env:
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}

.github/workflows/kata-runtime-classes-sync.yaml

@@ -1,36 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  kata-deploy-runtime-classes-check:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Ensure the split out runtime classes match the all-in-one file
-      run: |
-        pushd tools/packaging/kata-deploy/runtimeclasses/
-        echo "::group::Combine runtime classes"
-        for runtimeClass in `find . -type f \( -name "*.yaml" -and -not -name "kata-runtimeClasses.yaml" \) | sort`; do
-            echo "Adding ${runtimeClass} to the resultingRuntimeClasses.yaml"
-            cat ${runtimeClass} >> resultingRuntimeClasses.yaml;
-        done
-        echo "::endgroup::"
-        echo "::group::Displaying the content of resultingRuntimeClasses.yaml"
-        cat resultingRuntimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        echo "::group::Displaying the content of kata-runtimeClasses.yaml"
-        cat kata-runtimeClasses.yaml
-        echo "::endgroup::"
-        echo ""
-        diff resultingRuntimeClasses.yaml kata-runtimeClasses.yaml

.github/workflows/move-issues-to-in-progress.yaml

@@ -38,17 +38,7 @@ jobs:
 
       - name: Checkout code to allow hub to communicate with the project
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+        uses: actions/checkout@v2
 
       - name: Move issue to "In progress"
         if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
@@ -62,10 +52,11 @@ jobs:
             grep -v "^\#"  |\
             cut -d';' -f3 || true)
 
-          # PR doesn't have any linked issues, handle it only if it exists
+          # PR doesn't have any linked issues
+          # (it should, but maybe a new user forgot to add a "Fixes: #XXX" commit).
           [ -z "$linked_issue_urls" ] && {
-            echo "::warning::No linked issues for PR $pr"
-            exit 0
+            echo "::error::No linked issues for PR $pr"
+            exit 1
           }
 
           project_name="Issue backlog"

.github/workflows/payload-after-push.yaml

@@ -1,107 +0,0 @@
-name: CI | Publish Kata Containers payload
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-
-jobs:
-  build-assets-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  build-assets-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-  
-  build-assets-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      push-to-registry: yes
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-amd64:
-    needs: build-assets-amd64
-    uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-amd64
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-arm64:
-    needs: build-assets-arm64
-    uses: ./.github/workflows/publish-kata-deploy-payload-arm64.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-arm64
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-s390x:
-    needs: build-assets-s390x
-    uses: ./.github/workflows/publish-kata-deploy-payload-s390x.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-s390x
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-kata-deploy-payload-ppc64le:
-    needs: build-assets-ppc64le
-    uses: ./.github/workflows/publish-kata-deploy-payload-ppc64le.yaml
-    with:
-      commit-hash: ${{ github.sha }}
-      registry: quay.io
-      repo: kata-containers/kata-deploy-ci
-      tag: kata-containers-latest-ppc64le
-      target-branch: ${{ github.ref_name }}
-    secrets: inherit
-
-  publish-manifest:
-    runs-on: ubuntu-latest
-    needs: [publish-kata-deploy-payload-amd64, publish-kata-deploy-payload-arm64, publish-kata-deploy-payload-s390x, publish-kata-deploy-payload-ppc64le]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Push multi-arch manifest
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest"
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci"

.github/workflows/publish-kata-deploy-payload-amd64.yaml

@@ -1,66 +0,0 @@
-name: CI | Publish kata-deploy payload for amd64
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/publish-kata-deploy-payload-arm64.yaml

@@ -1,71 +0,0 @@
-name: CI | Publish kata-deploy payload for arm64
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: arm64-builder
-    steps:
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}
-

.github/workflows/publish-kata-deploy-payload-ppc64le.yaml

@@ -1,75 +0,0 @@
-name: CI | Publish kata-deploy payload for ppc64le
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: ppc64le
-    steps:
-      - name: Prepare the self-hosted runner
-        run: |
-          ${HOME}/scripts/prepare_runner.sh
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - name: Adjust a permission for repo
-        run: |
-          sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/publish-kata-deploy-payload-s390x.yaml

@@ -1,69 +0,0 @@
-name: CI | Publish kata-deploy payload for s390x
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  kata-payload:
-    runs-on: s390x
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-
-      - name: Login to Kata Containers quay.io
-        if: ${{ inputs.registry == 'quay.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Login to Kata Containers ghcr.io
-        if: ${{ inputs.registry == 'ghcr.io' }}
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: build-and-push-kata-payload
-        id: build-and-push-kata-payload
-        run: |
-          ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-          $(pwd)/kata-static.tar.xz \
-          ${{ inputs.registry }}/${{ inputs.repo }} ${{ inputs.tag }}

.github/workflows/release-amd64.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for amd64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-amd64:
-    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-amd64
-    runs-on: ubuntu-latest
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64
-
-      - name: build-and-push-kata-deploy-ci-amd64
-        id: build-and-push-kata-deploy-ci-amd64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-arm64.yaml

@@ -1,59 +0,0 @@
-name: Publish Kata release artifacts for arm64
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-arm64:
-    uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-arm64
-    runs-on: arm64-builder
-    steps:
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64
-
-      - name: build-and-push-kata-deploy-ci-arm64
-        id: build-and-push-kata-deploy-ci-arm64
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-ppc64le.yaml

@@ -1,64 +0,0 @@
-name: Publish Kata release artifacts for ppc64le
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-ppc64le:
-    uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-ppc64le
-    runs-on: ppc64le
-    steps:
-      - name: Prepare the self-hosted runner
-        run: |
-          bash ${HOME}/scripts/prepare_runner.sh
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: build-and-push-kata-deploy-ci-ppc64le
-        id: build-and-push-kata-deploy-ci-ppc64le
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release-s390x.yaml

@@ -1,62 +0,0 @@
-name: Publish Kata release artifacts for s390x
-on:
-  workflow_call:
-    inputs:
-      target-arch:
-        required: true
-        type: string
-
-jobs:
-  build-kata-static-tarball-s390x:
-    uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml
-    with:
-      push-to-registry: yes
-      stage: release
-    secrets: inherit
-
-  kata-deploy:
-    needs: build-kata-static-tarball-s390x
-    runs-on: s390x
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - uses: actions/checkout@v4
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: build-and-push-kata-deploy-ci-s390x
-        id: build-and-push-kata-deploy-ci-s390x
-        run: |
-          # We need to do such trick here as the format of the $GITHUB_REF
-          # is "refs/tags/<tag>"
-          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
-          if [ "${tag}" = "main" ]; then
-              tag=$(./tools/packaging/release/release.sh release-version)
-              tags=(${tag} "latest")
-          else
-              tags=(${tag})
-          fi
-          for tag in ${tags[@]}; do
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "docker.io/katadocker/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-              ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-payload.sh \
-                  $(pwd)/kata-static.tar.xz "quay.io/kata-containers/kata-deploy" \
-                  "${tag}-${{ inputs.target-arch }}"
-          done

.github/workflows/release.yaml

@@ -1,189 +1,178 @@
-name: Release Kata Containers
+name: Publish Kata release artifacts
 on:
-  workflow_dispatch
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*'
 
 jobs:
-  release:
+  build-asset:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        asset:
+          - cloud-hypervisor
+          - firecracker
+          - kernel
+          - qemu
+          - rootfs-image
+          - rootfs-initrd
+          - shim-v2
+          - virtiofsd
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install docker
+        run: |
+          curl -fsSL https://test.docker.com -o test-docker.sh
+          sh test-docker.sh
+
+      - name: Build ${{ matrix.asset }}
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-copy-yq-installer.sh
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh --build="${KATA_ASSET}"
+          build_dir=$(readlink -f build)
+          # store-artifact does not work with symlink
+          sudo cp -r "${build_dir}" "kata-build"
+        env:
+          KATA_ASSET: ${{ matrix.asset }}
+          TAR_OUTPUT: ${{ matrix.asset }}.tar.gz
+
+      - name: store-artifact ${{ matrix.asset }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-build/kata-static-${{ matrix.asset }}.tar.xz
+          if-no-files-found: error
+
+  create-kata-tarball:
+    runs-on: ubuntu-latest
+    needs: build-asset
+    steps:
+      - uses: actions/checkout@v2
+      - name: get-artifacts
+        uses: actions/download-artifact@v2
+        with:
+          name: kata-artifacts
+          path: kata-artifacts
+      - name: merge-artifacts
+        run: |
+          ./tools/packaging/kata-deploy/local-build/kata-deploy-merge-builds.sh kata-artifacts
+      - name: store-artifacts
+        uses: actions/upload-artifact@v2
+        with:
+          name: kata-static-tarball
+          path: kata-static.tar.xz
+
+  kata-deploy:
+    needs: create-kata-tarball
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v2
+      - name: get-kata-tarball
+        uses: actions/download-artifact@v2
         with:
-          fetch-depth: 0
-
-      - name: Create a new release
+          name: kata-static-tarball
+      - name: build-and-push-kata-deploy-ci
+        id: build-and-push-kata-deploy-ci
         run: |
-          ./tools/packaging/release/release.sh create-new-release
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          pushd $GITHUB_WORKSPACE
+          git checkout $tag
+          pkg_sha=$(git rev-parse HEAD)
+          popd
+          mv kata-static.tar.xz $GITHUB_WORKSPACE/tools/packaging/kata-deploy/kata-static.tar.xz
+          docker build --build-arg KATA_ARTIFACTS=kata-static.tar.xz -t katadocker/kata-deploy-ci:$pkg_sha -t quay.io/kata-containers/kata-deploy-ci:$pkg_sha $GITHUB_WORKSPACE/tools/packaging/kata-deploy
+          docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
+          docker push katadocker/kata-deploy-ci:$pkg_sha
+          docker login -u ${{ secrets.QUAY_DEPLOYER_USERNAME }} -p ${{ secrets.QUAY_DEPLOYER_PASSWORD }} quay.io
+          docker push quay.io/kata-containers/kata-deploy-ci:$pkg_sha
+          mkdir -p packaging/kata-deploy
+          ln -s $GITHUB_WORKSPACE/tools/packaging/kata-deploy/action packaging/kata-deploy/action
+          echo "::set-output name=PKG_SHA::${pkg_sha}"
+      - name: test-kata-deploy-ci-in-aks
+        uses: ./packaging/kata-deploy/action
+        with:
+          packaging-sha: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
         env:
-          GH_TOKEN: ${{ github.token }}
-
-  build-and-push-assets-amd64:
-    needs: release
-    uses: ./.github/workflows/release-amd64.yaml
-    with:
-      target-arch: amd64
-    secrets: inherit
-
-  build-and-push-assets-arm64:
-    needs: release
-    uses: ./.github/workflows/release-arm64.yaml
-    with:
-      target-arch: arm64
-    secrets: inherit
-
-  build-and-push-assets-s390x:
-    needs: release
-    uses: ./.github/workflows/release-s390x.yaml
-    with:
-      target-arch: s390x
-    secrets: inherit
-
-  build-and-push-assets-ppc64le:
-    needs: release
-    uses: ./.github/workflows/release-ppc64le.yaml
-    with:
-      target-arch: ppc64le
-    secrets: inherit
-
-  publish-multi-arch-images:
-    runs-on: ubuntu-latest
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Login to Kata Containers docker.io
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to Kata Containers quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_DEPLOYER_USERNAME }}
-          password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
-
-      - name: Get the image tags
+          PKG_SHA: ${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}}
+          AZ_APPID: ${{ secrets.AZ_APPID }}
+          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
+          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
+          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
+      - name: push-tarball
         run: |
-          release_version=$(./tools/packaging/release/release.sh release-version)
-          echo "KATA_DEPLOY_IMAGE_TAGS=$release_version latest" >> "$GITHUB_ENV"
+          # tag the container image we created and push to DockerHub
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tags=($tag)
+          tags+=($([[ "$tag" =~ "alpha"|"rc" ]] && echo "latest" || echo "stable"))
+          for tag in ${tags[@]}; do \
+            docker tag katadocker/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} katadocker/kata-deploy:${tag} && \
+            docker tag quay.io/kata-containers/kata-deploy-ci:${{steps.build-and-push-kata-deploy-ci.outputs.PKG_SHA}} quay.io/kata-containers/kata-deploy:${tag} && \
+            docker push katadocker/kata-deploy:${tag} && \
+            docker push quay.io/kata-containers/kata-deploy:${tag}; \
+          done
 
-      - name: Publish multi-arch manifest on docker.io and quay.io
-        run: |
-          ./tools/packaging/release/release.sh publish-multiarch-manifest
-        env:
-          KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy docker.io/katadocker/kata-deploy"
-
-  upload-multi-arch-static-tarball:
-    needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
+  upload-static-tarball:
+    needs: kata-deploy
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set KATA_STATIC_TARBALL env var
-        run: |
-          tarball=$(pwd)/kata-static.tar.xz
-          echo "KATA_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
-
-      - name: Download amd64 artifacts
-        uses: actions/download-artifact@v4
+      - uses: actions/checkout@v2
+      - name: download-artifacts
+        uses: actions/download-artifact@v2
         with:
-          name: kata-static-tarball-amd64
-
-      - name: Upload amd64 static tarball to GitHub
+          name: kata-static-tarball
+      - name: install hub
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: amd64
-
-      - name: Download arm64 artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-arm64
-
-      - name: Upload arm64 static tarball to GitHub
+          HUB_VER=$(curl -s "https://api.github.com/repos/github/hub/releases/latest" | jq -r .tag_name | sed 's/^v//')
+          wget -q -O- https://github.com/github/hub/releases/download/v$HUB_VER/hub-linux-amd64-$HUB_VER.tgz | \
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && sudo mv hub /usr/local/bin/hub
+      - name: push static tarball to github
         run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: arm64
-
-      - name: Download s390x artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x
-
-      - name: Upload s390x static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: s390x
-
-      - name: Download ppc64le artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le
-
-      - name: Upload ppc64le static tarball to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-kata-static-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ARCHITECTURE: ppc64le
-
-  upload-versions-yaml:
-    needs: release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Upload versions.yaml to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-versions-yaml-file
-        env:
-          GH_TOKEN: ${{ github.token }}
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-static-$tag-x86_64.tar.xz"
+          mv kata-static.tar.xz "$GITHUB_WORKSPACE/${tarball}"
+          pushd $GITHUB_WORKSPACE
+          echo "uploading asset '${tarball}' for tag: ${tag}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}"
+          popd
 
   upload-cargo-vendored-tarball:
-    needs: release
+    needs: upload-static-tarball
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Generate and upload vendored code tarball
+      - uses: actions/checkout@v2
+      - name: generate-and-upload-tarball
         run: |
-          ./tools/packaging/release/release.sh upload-vendored-code-tarball
-        env:
-          GH_TOKEN: ${{ github.token }}
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          tarball="kata-containers-$tag-vendor.tar.gz"
+          pushd $GITHUB_WORKSPACE
+          bash -c "tools/packaging/release/generate_vendor.sh ${tarball}"
+          GITHUB_TOKEN=${{ secrets.GIT_UPLOAD_TOKEN }} hub release edit -m "" -a "${tarball}" "${tag}" 
+          popd
 
   upload-libseccomp-tarball:
-    needs: release
+    needs: upload-cargo-vendored-tarball
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download libseccomp tarball and upload it to GitHub
-        run: |
-          ./tools/packaging/release/release.sh upload-libseccomp-tarball
+      - uses: actions/checkout@v2
+      - name: download-and-upload-tarball
         env:
-          GH_TOKEN: ${{ github.token }}
-
-  publish-release:
-    needs: [ build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le, publish-multi-arch-images, upload-multi-arch-static-tarball, upload-versions-yaml, upload-cargo-vendored-tarball, upload-libseccomp-tarball ]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Publish a release
+          GITHUB_TOKEN: ${{ secrets.GIT_UPLOAD_TOKEN }}
+          GOPATH: ${HOME}/go
         run: |
-          ./tools/packaging/release/release.sh publish-release
-        env:
-          GH_TOKEN: ${{ github.token }}
+          pushd $GITHUB_WORKSPACE
+          ./ci/install_yq.sh
+          tag=$(echo $GITHUB_REF | cut -d/ -f3-)
+          versions_yaml="versions.yaml"
+          version=$(${GOPATH}/bin/yq read ${versions_yaml} "externals.libseccomp.version")
+          repo_url=$(${GOPATH}/bin/yq read ${versions_yaml} "externals.libseccomp.url")
+          download_url="${repo_url}/releases/download/v${version}"
+          tarball="libseccomp-${version}.tar.gz"
+          asc="${tarball}.asc"
+          curl -sSLO "${download_url}/${tarball}"
+          curl -sSLO "${download_url}/${asc}"
+          # "-m" option should be empty to re-use the existing release title
+          # without opening a text editor.
+          # For the details, check https://hub.github.com/hub-release.1.html.
+          hub release edit -m "" -a "${tarball}" "${tag}"
+          hub release edit -m "" -a "${asc}" "${tag}"
+          popd

.github/workflows/require-pr-porting-labels.yaml

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+name: Ensure PR has required porting labels
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - labeled
+      - unlabeled
+    branches:
+      - main
+
+jobs:
+  check-pr-porting-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install hub
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          HUB_ARCH="amd64"
+          HUB_VER=$(curl -sL "https://api.github.com/repos/github/hub/releases/latest" |\
+            jq -r .tag_name | sed 's/^v//')
+          curl -sL \
+            "https://github.com/github/hub/releases/download/v${HUB_VER}/hub-linux-${HUB_ARCH}-${HUB_VER}.tgz" |\
+          tar xz --strip-components=2 --wildcards '*/bin/hub' && \
+          sudo install hub /usr/local/bin
+
+      - name: Checkout code to allow hub to communicate with the project
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v2
+
+      - name: Install porting checker script
+        run: |
+          # Clone into a temporary directory to avoid overwriting
+          # any existing github directory.
+          pushd $(mktemp -d) &>/dev/null
+          git clone --single-branch --depth 1 "https://github.com/kata-containers/.github" && cd .github/scripts
+          sudo install pr-porting-checks.sh /usr/local/bin
+          popd &>/dev/null
+
+      - name: Stop PR being merged unless it has a correct set of porting labels
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.KATA_GITHUB_ACTIONS_TOKEN }}
+        run: |
+          pr=${{ github.event.number }}
+          repo=${{ github.repository }}
+
+          pr-porting-checks.sh "$pr" "$repo"

.github/workflows/run-cri-containerd-tests-ppc64le.yaml

@@ -1,67 +0,0 @@
-name: CI | Run cri-containerd tests on ppc64le
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu']
-    runs-on: ppc64le
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: Adjust a permission for repo
-        run: sudo chown -R $USER:$USER $GITHUB_WORKSPACE
-  
-      - name: Prepare the self-hosted runner
-        run: |
-          bash ${HOME}/scripts/prepare_runner.sh cri-containerd
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-ppc64le${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-      
-      - name: Cleanup actions for the self hosted runner
-        run: ${HOME}/scripts/cleanup_runner.sh

.github/workflows/run-cri-containerd-tests-s390x.yaml

@@ -1,63 +0,0 @@
-name: CI | Run cri-containerd tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-cri-containerd:
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance
-      fail-fast: false
-      matrix:
-        containerd_version: ['active']
-        vmm: ['qemu', 'qemu-runtime-rs']
-    runs-on: s390x-large
-    env:
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
-
-      - name: Run cri-containerd tests
-        run: bash tests/integration/cri-containerd/gha-run.sh run
-
-      - name: Take a post-action for self-hosted runner
-        if: always()
-        run: ${HOME}/script/post_action.sh ubuntu-2204

.github/workflows/run-k8s-tests-on-aks.yaml

@@ -1,124 +0,0 @@
-name: CI | Run kubernetes tests on AKS
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - qemu-runtime-rs
-          - stratovirt
-          - cloud-hypervisor
-        instance-type:
-          - small
-          - normal
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: oci-distribution
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: small
-            genpolicy-pull-method: containerd
-          - host_os: cbl-mariner
-            vmm: clh
-            instance-type: normal
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-      GENPOLICY_PULL_METHOD: ${{ matrix.genpolicy-pull-method }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-k8s-tests-on-garm.yaml

@@ -1,100 +0,0 @@
-name: CI | Run kubernetes tests on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh #cloud-hypervisor
-          - dragonball
-          - fc #firecracker
-          - qemu
-          - cloud-hypervisor
-        snapshotter:
-          - devmapper
-        k8s:
-          - k3s
-        instance:
-          - garm-ubuntu-2004
-          - garm-ubuntu-2004-smaller
-        include:
-          - instance: garm-ubuntu-2004
-            instance-type: normal
-          - instance: garm-ubuntu-2004-smaller
-            instance-type: small
-    runs-on: ${{ matrix.instance }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        run: bash tests/integration/kubernetes/gha-run.sh configure-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-garm
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-  
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-  
-      - name: Collect artifacts ${{ matrix.vmm }}
-        run: bash tests/integration/kubernetes/gha-run.sh collect-artifacts
-
-      - name: Archive artifacts ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: k8s-tests-garm-${{ matrix.vmm }}-${{ matrix.snapshotter }}-${{ matrix.k8s }}-${{ matrix.instance }}-${{ inputs.tag }}
-          path: /tmp/artifacts
-          retention-days: 1
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-garm

.github/workflows/run-k8s-tests-on-ppc64le.yaml

@@ -1,82 +0,0 @@
-name: CI | Run kubernetes tests on Power(ppc64le)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - kubeadm
-    runs-on: k8s-ppc64le
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-      TARGET_ARCH: "ppc64le"
-    steps:
-      - name: Prepare the self-hosted runner
-        run: | 
-          bash ${HOME}/scripts/prepare_runner.sh kubernetes
-          sudo rm -rf $GITHUB_WORKSPACE/*
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install golang
-        run: |
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-
-      - name: Prepare the runner for k8s cluster creation
-        run: bash ${HOME}/scripts/k8s_cluster_cleanup.sh
-
-      - name: Create k8s cluster using kubeadm
-        run: bash ${HOME}/scripts/k8s_cluster_create.sh
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-kubeadm
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete cluster and post cleanup actions
-        run: bash ${HOME}/scripts/k8s_cluster_cleanup.sh

.github/workflows/run-k8s-tests-on-zvsi.yaml

@@ -1,93 +0,0 @@
-name: CI | Run kubernetes tests on IBM Cloud Z virtual server instance (zVSI)
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        snapshotter:
-          - devmapper
-          - nydus
-        k8s:
-          - k3s
-        include:
-          - snapshotter: devmapper
-            pull-type: default
-            using-nfd: true
-            deploy-cmd: configure-snapshotter
-            vmm: qemu
-          - snapshotter: nydus
-            pull-type: guest-pull
-            using-nfd: false
-            deploy-cmd: deploy-snapshotter
-            vmm: qemu-coco-dev
-    runs-on: s390x-large
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: "ubuntu"
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "k3s"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: ${{ matrix.using-nfd }}
-      TARGET_ARCH: "s390x"
-    steps:
-      - name: Take a pre-action for self-hosted runner
-        run: ${HOME}/script/pre_action.sh ubuntu-2204
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Configure the ${{ matrix.snapshotter }} snapshotter
-        run: bash tests/integration/kubernetes/gha-run.sh ${{ matrix.deploy-cmd }}
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-zvsi
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Take a post-action
-        if: always()
-        run: |
-          bash tests/integration/kubernetes/gha-run.sh cleanup-zvsi || true
-          ${HOME}/script/post_action.sh ubuntu-2204

.github/workflows/run-k8s-tests-with-crio-on-garm.yaml

@@ -1,86 +0,0 @@
-name: CI | Run kubernetes tests, using CRI-O, on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        k8s:
-          - k0s
-        instance:
-          - garm-ubuntu-2204
-          - garm-ubuntu-2204-smaller
-        include:
-          - instance: garm-ubuntu-2204
-            instance-type: normal
-          - instance: garm-ubuntu-2204-smaller
-            instance-type: small
-          - k8s: k0s
-            k8s-extra-params: '--cri-socket remote:unix:///var/run/crio/crio.sock --kubelet-extra-args --cgroup-driver="systemd"'
-    runs-on: ${{ matrix.instance }}
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      KUBERNETES_EXTRA_PARAMS: ${{ matrix.k8s-extra-params }}
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: ${{ matrix.instance-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Configure CRI-O
-        run: bash tests/integration/kubernetes/gha-run.sh setup-crio
-
-      - name: Deploy ${{ matrix.k8s }}
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-garm
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-  
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-  
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-garm

.github/workflows/run-kata-coco-tests.yaml

@@ -1,293 +0,0 @@
-name: CI | Run kata coco tests
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-k8s-tests-on-tdx:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-tdx
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: tdx
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "k3s"
-      USING_NFD: "true"
-      KBS: "true"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      KBS_INGRESS: "nodeport"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx
-
-      - name: Uninstall previous `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-tdx
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-      - name: Delete CoCo KBS
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-  run-k8s-tests-on-sev:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-sev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: sev
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBECONFIG: /home/kata/.kube/config
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-sev
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-sev
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-  run-k8s-tests-sev-snp:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-snp
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: sev-snp
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBECONFIG: /home/kata/.kube/config
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-      K8S_TEST_HOST_TYPE: "baremetal"
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      PULL_TYPE: ${{ matrix.pull-type }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-snp
-
-      - name: Run tests
-        timeout-minutes: 30
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snp
-
-      - name: Delete Snapshotter
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
-
-  # Generate jobs for testing CoCo on non-TEE environments
-  run-k8s-tests-coco-nontee:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu-coco-dev
-        snapshotter:
-          - nydus
-        pull-type:
-          - guest-pull
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      # Some tests rely on that variable to run (or not)
-      KBS: "true"
-      # Set the KBS ingress handler (empty string disables handling)
-      KBS_INGRESS: "aks"
-      KUBERNETES: "vanilla"
-      PULL_TYPE: ${{ matrix.pull-type }}
-      SNAPSHOTTER: ${{ matrix.snapshotter }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Download Azure CLI
-        run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/integration/kubernetes/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/integration/kubernetes/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
-
-      - name: Deploy Snapshotter
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
-
-      - name: Deploy Kata
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Run tests
-        timeout-minutes: 60
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests-on-aks.yaml

@@ -1,91 +0,0 @@
-name: CI | Run kata-deploy tests on AKS
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        host_os:
-          - ubuntu
-        vmm:
-          - clh
-          - dragonball
-          - qemu
-          - qemu-runtime-rs
-        include:
-          - host_os: cbl-mariner
-            vmm: clh
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HOST_OS: ${{ matrix.host_os }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: "vanilla"
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Download Azure CLI
-        run: bash tests/functional/kata-deploy/gha-run.sh install-azure-cli
-
-      - name: Log into the Azure account
-        run: bash tests/functional/kata-deploy/gha-run.sh login-azure
-        env:
-          AZ_APPID: ${{ secrets.AZ_APPID }}
-          AZ_PASSWORD: ${{ secrets.AZ_PASSWORD }}
-          AZ_TENANT_ID: ${{ secrets.AZ_TENANT_ID }}
-          AZ_SUBSCRIPTION_ID: ${{ secrets.AZ_SUBSCRIPTION_ID }}
-
-      - name: Create AKS cluster
-        timeout-minutes: 10
-        run: bash tests/functional/kata-deploy/gha-run.sh create-cluster
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Install `kubectl`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-kubectl
-
-      - name: Download credentials for the Kubernetes CLI to use them
-        run: bash tests/functional/kata-deploy/gha-run.sh get-cluster-credentials
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests
-      
-      - name: Delete AKS cluster
-        if: always()
-        run: bash tests/functional/kata-deploy/gha-run.sh delete-cluster

.github/workflows/run-kata-deploy-tests-on-garm.yaml

@@ -1,65 +0,0 @@
-name: CI | Run kata-deploy tests on GARM
-on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
-      pr-number:
-        required: true
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-kata-deploy-tests:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - clh
-          - qemu
-        k8s:
-          - k0s
-          - k3s
-          - rke2
-    runs-on: garm-ubuntu-2004-smaller
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-      KUBERNETES: ${{ matrix.k8s }}
-      USING_NFD: "false"
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Deploy ${{ matrix.k8s }}
-        run:  bash tests/functional/kata-deploy/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/functional/kata-deploy/gha-run.sh install-bats
-
-      - name: Run tests
-        run: bash tests/functional/kata-deploy/gha-run.sh run-tests

.github/workflows/run-kata-monitor-tests.yaml

@@ -1,63 +0,0 @@
-name: CI | Run kata-monitor tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-monitor:
-    strategy:
-      fail-fast: false
-      matrix:
-        vmm:
-          - qemu
-        container_engine:
-          - crio
-          - containerd
-        include:
-          - container_engine: containerd
-            containerd_version: lts
-        exclude:
-          # TODO: enable with containerd when https://github.com/kata-containers/kata-containers/issues/9761 is fixed
-          - container_engine: containerd
-            vmm: qemu
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINER_ENGINE: ${{ matrix.container_engine }}
-      CONTAINERD_VERSION: ${{ matrix.containerd_version }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/functional/kata-monitor/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/functional/kata-monitor/gha-run.sh install-kata kata-artifacts
-
-      - name: Run kata-monitor tests
-        run: bash tests/functional/kata-monitor/gha-run.sh run

.github/workflows/run-metrics.yaml

@@ -1,94 +0,0 @@
-name: CI | Run test metrics
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  setup-kata:
-    name: Kata Setup
-    runs-on: metrics
-    env:
-      GOPATH: ${{ github.workspace }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/metrics/gha-run.sh install-kata kata-artifacts
-
-  run-metrics:
-    needs: setup-kata
-    strategy:
-      # We can set this to true whenever we're 100% sure that
-      # the all the tests are not flaky, otherwise we'll fail
-      # all the tests due to a single flaky instance.
-      fail-fast: false
-      matrix:
-        vmm: ['clh', 'qemu', 'stratovirt']
-      max-parallel: 1
-    runs-on: metrics
-    env:
-      GOPATH: ${{ github.workspace }}
-      KATA_HYPERVISOR: ${{ matrix.vmm }}
-    steps:
-      - name: enabling the hypervisor
-        run: bash tests/metrics/gha-run.sh enabling-hypervisor
-
-      - name: run launch times test
-        run: bash tests/metrics/gha-run.sh run-test-launchtimes
-
-      - name: run memory foot print test
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage
-
-      - name: run memory usage inside container test
-        run:  bash tests/metrics/gha-run.sh run-test-memory-usage-inside-container
-
-      - name: run blogbench test
-        run:  bash tests/metrics/gha-run.sh run-test-blogbench
-
-      - name: run tensorflow test
-        run:  bash tests/metrics/gha-run.sh run-test-tensorflow
-
-      - name: run fio test
-        run:  bash tests/metrics/gha-run.sh run-test-fio
-
-      - name: run iperf test
-        run:  bash tests/metrics/gha-run.sh run-test-iperf
-
-      - name: run latency test
-        run:  bash tests/metrics/gha-run.sh run-test-latency
-
-      - name: make metrics tarball ${{ matrix.vmm }}
-        run: bash tests/metrics/gha-run.sh make-tarball-results
-
-      - name: archive metrics results ${{ matrix.vmm }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: metrics-artifacts-${{ matrix.vmm }}
-          path: results-${{ matrix.vmm }}.tar.gz
-          retention-days: 1
-          if-no-files-found: error

.github/workflows/run-runk-tests.yaml

@@ -1,46 +0,0 @@
-name: CI | Run runk tests
-on:
-  workflow_call:
-    inputs:
-      tarball-suffix:
-        required: false
-        type: string
-      commit-hash:
-        required: false
-        type: string
-      target-branch:
-        required: false
-        type: string
-        default: ""
-
-jobs:
-  run-runk:
-    runs-on: garm-ubuntu-2204-smaller
-    env:
-      CONTAINERD_VERSION: lts
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: Install dependencies
-        run: bash tests/integration/runk/gha-run.sh install-dependencies
-
-      - name: get-kata-tarball
-        uses: actions/download-artifact@v4
-        with:
-          name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-artifacts
-
-      - name: Install kata
-        run: bash tests/integration/runk/gha-run.sh install-kata kata-artifacts
-
-      - name: Run runk tests
-        run: bash tests/integration/runk/gha-run.sh run

.github/workflows/snap-release.yaml

@@ -0,0 +1,42 @@
+name: Release Kata in snapcraft store
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*'
+
+jobs:
+  release-snap:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        uses: samuelmeuli/action-snapcraft@v1
+        with:
+          snapcraft_token: ${{ secrets.snapcraft_token }}
+
+      - name: Build snap
+        run: |
+          # Removing man-db, workflow kept failing, fixes: #4480
+          sudo apt -y remove --purge man-db
+          sudo apt-get install -y git git-extras
+          kata_url="https://github.com/kata-containers/kata-containers"
+          latest_version=$(git ls-remote --tags ${kata_url}  | egrep -o "refs.*" | egrep -v "\-alpha|\-rc|{}" | egrep -o "[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" | sort -V -r | head -1)
+          current_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          # Check semantic versioning format (x.y.z) and if the current tag is the latest tag
+          if echo "${current_version}" | grep -q "^[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$" && echo -e "$latest_version\n$current_version" | sort -C -V; then
+            # Current version is the latest version, build it
+            snapcraft snap --debug --destructive-mode
+          fi
+
+      - name: Upload snap
+        run: |
+          snap_version="$(echo ${GITHUB_REF} | cut -d/ -f3)"
+          snap_file="kata-containers_${snap_version}_amd64.snap"
+          # Upload the snap if it exists
+          if [ -f ${snap_file} ]; then
+            snapcraft upload --release=stable ${snap_file}
+          fi

.github/workflows/snap.yaml

@@ -0,0 +1,27 @@
+name: snap CI
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+
+jobs:
+  test:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Check out
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install Snapcraft
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        uses: samuelmeuli/action-snapcraft@v1
+
+      - name: Build snap
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+        run: |
+          snapcraft snap --debug --destructive-mode

.github/workflows/stale.yaml

@@ -1,17 +0,0 @@
-name: 'Automatically close stale PRs'
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v9
-        with:
-          stale-pr-message: 'This PR has been opened without with no activity for 180 days. Comment on the issue otherwise it will be closed in 7 days'
-          days-before-pr-stale: 180
-          days-before-pr-close: 7
-          days-before-issue-stale: -1
-          days-before-issue-close: -1

.github/workflows/static-checks-self-hosted.yaml

@@ -1,26 +0,0 @@
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - labeled # a workflow runs only when the 'ok-to-test' label is added
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-name: Static checks self-hosted
-jobs:
-  build-checks:
-    if: ${{ contains(github.event.pull_request.labels.*.name, 'ok-to-test') }}
-    strategy:
-      fail-fast: false
-      matrix:
-        instance:
-          - "arm-no-k8s"
-          - "s390x"
-          - "ppc64le"
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ${{ matrix.instance }}

.github/workflows/static-checks.yaml

@@ -6,106 +6,91 @@ on:
       - reopened
       - synchronize
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 name: Static checks
 jobs:
-  check-kernel-config-version:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Ensure the kernel config version has been updated
-        run: |
-          kernel_dir="tools/packaging/kernel/"
-          kernel_version_file="${kernel_dir}kata_config_version"
-          modified_files=$(git diff --name-only origin/$GITHUB_BASE_REF..HEAD)
-          if git diff --name-only origin/$GITHUB_BASE_REF..HEAD "${kernel_dir}" | grep "${kernel_dir}"; then
-            echo "Kernel directory has changed, checking if $kernel_version_file has been updated"
-            if echo "$modified_files" | grep -v "README.md" | grep "${kernel_dir}" >>"/dev/null"; then
-              echo "$modified_files" | grep "$kernel_version_file" >>/dev/null || ( echo "Please bump version in $kernel_version_file" && exit 1)
-            else
-              echo "Readme file changed, no need for kernel config version update."
-            fi
-            echo "Check passed"
-          fi
-
-  build-checks:
-    uses: ./.github/workflows/build-checks.yaml
-    with:
-      instance: ubuntu-20.04
-
-  build-checks-depending-on-kvm:
-    runs-on: garm-ubuntu-2004-smaller
+  test:
     strategy:
-      fail-fast: false
       matrix:
-        component:
-          - runtime-rs
-        include:
-          - component: runtime-rs
-            command: "sudo -E env PATH=$PATH LIBC=gnu SUPPORT_VIRTUALIZATION=true make test"
-          - component: runtime-rs
-            component-path: src/dragonball
-    steps:
-      - name: Checkout the code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Install system deps
-        run: |
-          sudo apt-get install -y build-essential musl-tools
-      - name: Install yq
-        run: |
-          sudo -E ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install rust
-        run: |
-          export PATH="$PATH:/usr/local/bin"
-          ./tests/install_rust.sh
-      - name: Running `${{ matrix.command }}` for ${{ matrix.component }}
-        run: |
-          export PATH="$PATH:${HOME}/.cargo/bin"
-          cd ${{ matrix.component-path }}
-          ${{ matrix.command }}
-        env:
-          RUST_BACKTRACE: "1"
-
-  static-checks:
-    runs-on: ubuntu-20.04
-    strategy:
-      fail-fast: false
-      matrix:
-        cmd:
-          - "make static-checks"
+        go-version: [1.16.x, 1.17.x]
+        os: [ubuntu-20.04]
+    runs-on: ${{ matrix.os }}
     env:
-      GOPATH: ${{ github.workspace }}
+      TRAVIS: "true"
+      TRAVIS_BRANCH: ${{ github.base_ref }}
+      TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
+      TRAVIS_PULL_REQUEST_SHA : ${{ github.event.pull_request.head.sha }}
+      RUST_BACKTRACE: "1"
+      target_branch: ${{ github.base_ref }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          path: ./src/github.com/${{ github.repository }}
-      - name: Install yq
-        run: |
-          cd ${GOPATH}/src/github.com/${{ github.repository }}
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-      - name: Install golang
-        run: |
-          cd ${GOPATH}/src/github.com/${{ github.repository }}
-          ./tests/install_go.sh -f -p
-          echo "/usr/local/go/bin" >> $GITHUB_PATH
-      - name: Install system dependencies
-        run: |
-          sudo apt-get -y install moreutils hunspell hunspell-en-gb hunspell-en-us pandoc
-      - name: Run check
-        run: |
-          export PATH=${PATH}:${GOPATH}/bin
-          cd ${GOPATH}/src/github.com/${{ github.repository }} && ${{ matrix.cmd }}
+    - name: Install Go
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      uses: actions/setup-go@v2
+      with:
+        go-version: ${{ matrix.go-version }}
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Setup GOPATH
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH: ${TRAVIS_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_BRANCH: ${TRAVIS_PULL_REQUEST_BRANCH}"
+        echo "TRAVIS_PULL_REQUEST_SHA: ${TRAVIS_PULL_REQUEST_SHA}"
+        echo "TRAVIS: ${TRAVIS}"
+    - name: Set env
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+        echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+    - name: Checkout code
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
+        path: ./src/github.com/${{ github.repository }}
+    - name: Setup travis references
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        echo "TRAVIS_BRANCH=${TRAVIS_BRANCH:-$(echo $GITHUB_REF | awk 'BEGIN { FS = \"/\" } ; { print $3 }')}"
+        target_branch=${TRAVIS_BRANCH}
+    - name: Setup
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/setup.sh
+      env:
+        GOPATH: ${{ runner.workspace }}/kata-containers
+    - name: Installing rust
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_rust.sh
+        PATH=$PATH:"$HOME/.cargo/bin"
+        rustup target add x86_64-unknown-linux-musl
+        rustup component add rustfmt clippy
+    - name: Setup seccomp
+      run: |
+        libseccomp_install_dir=$(mktemp -d -t libseccomp.XXXXXXXXXX)
+        gperf_install_dir=$(mktemp -d -t gperf.XXXXXXXXXX)
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && ./ci/install_libseccomp.sh "${libseccomp_install_dir}" "${gperf_install_dir}"
+        echo "Set environment variables for the libseccomp crate to link the libseccomp library statically"
+        echo "LIBSECCOMP_LINK_TYPE=static" >> $GITHUB_ENV
+        echo "LIBSECCOMP_LIB_PATH=${libseccomp_install_dir}/lib" >> $GITHUB_ENV
+    # Check whether the vendored code is up-to-date & working as the first thing
+    - name: Check vendored code
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make vendor
+    - name: Static Checks
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make static-checks
+    - name: Run Compiler Checks
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make check
+    - name: Run Unit Tests
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && make test
+    - name: Run Unit Tests As Root User
+      if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') }}
+      run: |
+        cd ${GOPATH}/src/github.com/${{ github.repository }} && sudo -E PATH="$PATH" make test

.gitignore

@@ -4,10 +4,6 @@
 **/*.rej
 **/target
 **/.vscode
-**/.idea
-**/.fleet
-**/*.swp
-**/*.swo
 pkg/logging/Cargo.lock
 src/agent/src/version.rs
 src/agent/kata-agent.service
@@ -15,4 +11,4 @@ src/agent/protocols/src/*.rs
 !src/agent/protocols/src/lib.rs
 build
 src/tools/log-parser/kata-log-parser
-tools/packaging/static-build/agent/install_libseccomp.sh
+

CODEOWNERS

@@ -1,4 +1,4 @@
-# Copyright (c) 2019-2023 Intel Corporation
+# Copyright (c) 2019 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -9,83 +9,4 @@
 # Order in this file is important. Only the last match will be
 # used. See https://help.github.com/articles/about-code-owners/
 
-/CODEOWNERS			@kata-containers/codeowners
-
-VERSION				@kata-containers/release
-
-# The versions database needs careful handling
-versions.yaml			@kata-containers/release @kata-containers/ci @kata-containers/tests
-
-Makefile*			@kata-containers/build
-*.mak				@kata-containers/build
-*.mk				@kata-containers/build
-
-# Documentation related files could also appear anywhere
-# else in the repo.
-*.md				@kata-containers/documentation
-*.drawio			@kata-containers/documentation
-*.jpg				@kata-containers/documentation
-*.png				@kata-containers/documentation
-*.svg				@kata-containers/documentation
-
-*.bash				@kata-containers/shell
-*.sh				@kata-containers/shell
-**/completions/			@kata-containers/shell
-
-Dockerfile*			@kata-containers/docker
-
-/ci/				@kata-containers/ci
-
-*.bats				@kata-containers/tests
-/tests/				@kata-containers/tests
-
-*.rs				@kata-containers/rust
-*.go				@kata-containers/golang
-
-/utils/				@kata-containers/utils
-
-# FIXME: Maybe a new "protocol" team would be better?
-#
-# All protocol changes must be reviewed.
-# Note, we include all subdirs, including the vendor dir, as at present there are no .proto files
-# in the vendor dir. Later we may have to extend this matching rule if that changes.
-/src/libs/protocols/*.proto	@kata-containers/architecture-committee @kata-containers/builder @kata-containers/packaging
-
-# GitHub Actions
-/.github/workflows/		@kata-containers/action-admins @kata-containers/ci
-
-/ci/				@kata-containers/ci @kata-containers/tests
-/docs/				@kata-containers/documentation
-
-/src/agent/			@kata-containers/agent
-
-/src/runtime*/			@kata-containers/runtime
-
-/src/runtime/			@kata-containers/golang
-
-src/runtime-rs/			@kata-containers/rust
-src/libs/			@kata-containers/rust
-
-src/dragonball/			@kata-containers/dragonball
-
-/tools/osbuilder/		@kata-containers/builder
-/tools/packaging/		@kata-containers/packaging
-/tools/packaging/kernel/	@kata-containers/kernel
-/tools/packaging/kata-deploy/	@kata-containers/kata-deploy
-/tools/packaging/qemu/		@kata-containers/qemu
-/tools/packaging/release/	@kata-containers/release
-
-**/vendor/			@kata-containers/vendoring
-
-# Handle arch specific files last so they match more specifically than
-# the kernel packaging files.
-**/*aarch64*			@kata-containers/arch-aarch64
-**/*arm64*			@kata-containers/arch-aarch64
-
-**/*amd64*			@kata-containers/arch-amd64
-**/*x86-64*			@kata-containers/arch-amd64
-**/*x86_64*			@kata-containers/arch-amd64
-
-**/*ppc64*			@kata-containers/arch-ppc64le
-
-**/*s390x*			@kata-containers/arch-s390x
+*.md    @kata-containers/documentation

Makefile

@@ -1,4 +1,4 @@
-# Copyright (c) 2020-2023 Intel Corporation
+# Copyright (c) 2020 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -8,7 +8,6 @@ COMPONENTS =
 
 COMPONENTS += libs
 COMPONENTS += agent
-COMPONENTS += dragonball
 COMPONENTS += runtime
 COMPONENTS += runtime-rs
 
@@ -16,16 +15,11 @@ COMPONENTS += runtime-rs
 TOOLS =
 
 TOOLS += agent-ctl
-TOOLS += kata-ctl
-TOOLS += log-parser
-TOOLS += runk
 TOOLS += trace-forwarder
+TOOLS += runk
+TOOLS += log-parser
 
-STANDARD_TARGETS = build check clean install static-checks-build test vendor
-
-# Variables for the build-and-publish-kata-debug target
-KATA_DEBUG_REGISTRY ?= ""
-KATA_DEBUG_TAG ?= ""
+STANDARD_TARGETS = build check clean install test vendor
 
 default: all
 
@@ -41,19 +35,18 @@ generate-protocols:
 	make -C src/agent generate-protocols
 
 # Some static checks rely on generated source files of components.
-static-checks: static-checks-build
-	bash tests/static-checks.sh github.com/kata-containers/kata-containers
+static-checks: build
+	bash ci/static-checks.sh
 
 docs-url-alive-check:
 	bash ci/docs-url-alive-check.sh
 
-build-and-publish-kata-debug:
-	bash tools/packaging/kata-debug/kata-debug-build-and-upload-payload.sh ${KATA_DEBUG_REGISTRY} ${KATA_DEBUG_TAG} 
-
 .PHONY: \
 	all \
-	kata-tarball \
-	install-tarball \
+	binary-tarball \
 	default \
+	install-binary-tarball \
 	static-checks \
 	docs-url-alive-check
+
+

README.md

@@ -1,6 +1,4 @@
-<img src="https://object-storage-ca-ymq-1.vexxhost.net/swift/v1/6e4619c416ff4bd19e1c087f27a43eea/www-images-prod/openstack-logo/kata/SVG/kata-1.svg" width="900">
-
-[![CI | Publish Kata Containers payload](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/payload-after-push.yaml) [![Kata Containers Nightly CI](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml/badge.svg)](https://github.com/kata-containers/kata-containers/actions/workflows/ci-nightly.yaml)
+<img src="https://www.openstack.org/assets/kata/kata-vertical-on-white.png" width="150">
 
 # Kata Containers
 
@@ -121,9 +119,11 @@ The table below lists the core parts of the project:
 | [runtime](src/runtime) | core | Main component run by a container manager and providing a containerd shimv2 runtime implementation. |
 | [runtime-rs](src/runtime-rs) | core | The Rust version runtime. |
 | [agent](src/agent) | core | Management process running inside the virtual machine / POD that sets up the container environment. |
+| [libraries](src/libs) | core | Library crates shared by multiple Kata Container components or published to [`crates.io`](https://crates.io/index.html) |
 | [`dragonball`](src/dragonball) | core | An optional built-in VMM brings out-of-the-box Kata Containers experience with optimizations on container workloads |
 | [documentation](docs) | documentation | Documentation common to all components (such as design and install documentation). |
-| [tests](tests) | tests | Excludes unit tests which live with the main code. |
+| [libraries](src/libs) | core | Library crates shared by multiple Kata Container components or published to [`crates.io`](https://crates.io/index.html) |
+| [tests](https://github.com/kata-containers/tests) | tests | Excludes unit tests which live with the main code. |
 
 ### Additional components
 
@@ -134,28 +134,18 @@ The table below lists the remaining parts of the project:
 | [packaging](tools/packaging) | infrastructure | Scripts and metadata for producing packaged binaries<br/>(components, hypervisors, kernel and rootfs). |
 | [kernel](https://www.kernel.org) | kernel | Linux kernel used by the hypervisor to boot the guest image. Patches are stored [here](tools/packaging/kernel). |
 | [osbuilder](tools/osbuilder) | infrastructure | Tool to create "mini O/S" rootfs and initrd images and kernel for the hypervisor. |
-| [kata-debug](tools/packaging/kata-debug/README.md) | infrastructure | Utility tool to gather Kata Containers debug information from Kubernetes clusters. |
 | [`agent-ctl`](src/tools/agent-ctl) | utility | Tool that provides low-level access for testing the agent. |
-| [`kata-ctl`](src/tools/kata-ctl) | utility | Tool that provides advanced commands and debug facilities. |
 | [`trace-forwarder`](src/tools/trace-forwarder) | utility | Agent tracing helper. |
 | [`runk`](src/tools/runk) | utility | Standard OCI container runtime based on the agent. |
-| [`ci`](.github/workflows) | CI | Continuous Integration configuration files and scripts. |
-| [`ocp-ci`](ci/openshift-ci/README.md) | CI | Continuous Integration configuration for the OpenShift pipelines. |
+| [`ci`](https://github.com/kata-containers/ci) | CI | Continuous Integration configuration files and scripts. |
 | [`katacontainers.io`](https://github.com/kata-containers/www.katacontainers.io) | Source for the [`katacontainers.io`](https://www.katacontainers.io) site. |
-| [`Webhook`](tools/testing/kata-webhook/README.md) | utility | Example of a simple admission controller webhook to annotate pods with the Kata runtime class |
 
 ### Packaging and releases
 
 Kata Containers is now
 [available natively for most distributions](docs/install/README.md#packaged-installation-methods).
-
-## General tests
-
-See the [tests documentation](tests/README.md).
-
-## Metrics tests
-
-See the [metrics documentation](tests/metrics/README.md).
+However, packaging scripts and metadata are still used to generate [snap](snap/local) and GitHub releases. See
+the [components](#components) section for further details.
 
 ## Glossary of Terms
 

VERSION

@@ -1 +1 @@
-3.6.0
+3.0.0

ci/README.md

@@ -1,343 +0,0 @@
-# Kata Containers CI
-
-> [!WARNING]
-> While this project's CI has several areas for improvement, it is constantly
-> evolving. This document attempts to describe its current state, but due to
-> ongoing changes, you may notice some outdated information here. Feel free to
-> modify/improve this document as you use the CI and notice anything odd. The
-> community appreciates it!
-
-## Introduction
-
-The Kata Containers CI relies on [GitHub Actions][gh-actions], where the actions
-themselves can be found in the `.github/workflows` directory, and they may call
-helper scripts, which are located under the `tests` directory, to actually
-perform the tasks required for each test case.
-
-## The different workflows
-
-There are a few different sets of workflows that are running as part of our CI,
-and here we're going to cover the ones that are less likely to get rotten.  With
-this said, it's fair to advise that if the reader finds something that got
-rotten, opening an issue to the project pointing to the problem is a nice way to
-help, and providing a fix for the issue is a very encouraging way to help.
-
-### Jobs that run automatically when a PR is raised
-
-These are a bunch of tests that will automatically run as soon as a PR is
-opened, they're mostly running on "cost free" runners, and they do some
-pre-checks to evaluate that your PR may be okay to start getting reviewed.
-
-Mind, though, that the community expects the contributors to, at least, build
-their code before submitting a PR, which the community sees as a very fair
-request.
-
-Without getting into the weeds with details on this, those jobs are the ones
-responsible for ensuring that:
-
-- The commit message is in the expected format
-- There's no missing Developer's Certificate of Origin
-- Static checks are passing
-
-### Jobs that require a maintainer's approval to run
-
-These are the required tests, and our so-called "CI".  These require a
-maintainer's approval to run as parts of those jobs will be running on "paid
-runners", which are currently using Azure infrastructure.
-
-Once a maintainer of the project gives "the green light" (currently by adding an
-`ok-to-test` label to the PR, soon to be changed to commenting "/test" as part
-of a PR review), the following tests will be executed:
-
-- Build all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a tarball with all the components (runs on free cost runners, or bare-metal depending on the architecture)
-- Create a kata-deploy payload with the tarball generated in the previous step (runs on free costs runner, or bare-metal depending on the architecture)
-- Run the following tests:
-  - Tests depending on the generated tarball
-    - Metrics (runs on bare-metal)
-    - `docker` (runs on Azure small instances)
-    - `nerdctl` (runs on Azure small instances)
-    - `kata-monitor` (runs on Azure small instances)
-    - `cri-containerd` (runs on Azure small instances)
-    - `nydus` (runs on Azure small instances)
-    - `vfio` (runs on Azure normal instances)
-  - Tests depending on the generated kata-deploy payload
-    - kata-deploy (runs on Azure small instances)
-      - Tests are performed using different "Kubernetes flavors", such as k0s, k3s, rke2, and Azure Kubernetes Service (AKS).
-    - Kubernetes (runs in Azure small and medium instances depending on what's required by each test, and on TEE bare-metal machines)
-      - Tests are performed with different runtime engines, such as CRI-O and containerd.
-      - Tests are performed with different snapshotters for containerd, namely OverlayFS and devmapper.
-      - Tests are performed with all the supported hypervisors, which are Cloud Hypervisor, Dragonball, Firecracker, and QEMU.
-
-For all the tests relying on Azure instances, real money is being spent, so the
-community asks for the maintainers to be mindful about those, and avoid abusing
-them to merely debug issues.
-
-## The different runners
-
-In the previous section we've mentioned using different runners, now in this section we'll go through each type of runner used.
-
-- Cost free runners:  Those are the runners provided by GIthub itself, and
-  those are fairly small machines with no virtualization capabilities enabled - 
-- Azure small instances: Those are runners which have virtualization
-  capabilities enabled, 2 CPUs, and 8GB of RAM.  These runners have a "-smaller"
-  suffix to their name. 
-- Azure normal instances: Those are runners which have virtualization
-  capabilities enabled, 4 CPUs, and 16GB of RAM.  These runners are usually
-  `garm` ones with no "-smaller" suffix.
-- Bare-metal runners: Those are runners provided by community contributors,
-  and they may vary in architecture, size and virtualization capabilities.
-  Builder runners don't actually require any virtualization capabilities, while
-  runners which will be actually performing the tests must have virtualization
-  capabilities and a reasonable amount for CPU and RAM available (at least
-  matching the Azure normal instances).
-  
-## Adding new tests
-
-Before someone decides to add a new test, we strongly recommend them to go
-through [GitHub Actions Documentation][gh-actions],
-which will provide you a very sensible background on how to read and understand
-current tests we have, and also become familiar with how to write a new test.
-
-On the Kata Containers land, there are basically two sets of tests: "standalone"
-and "part of something bigger".
-
-The "standalone" tests, for example the commit message check, won't be covered
-here as they're better covered by the GitHub Actions documentation pasted above.
-
-The "part of something bigger" is the more complicated one and not so
-straightforward to add, so we'll be focusing our efforts on describing the
-addition of those.
-
-> [!NOTE]
-> TODO: Currently, this document refers to "tests" when it actually means the
-> jobs (or workflows) of GitHub. In an ideal world, except in some specific cases,
-> new tests should be added without the need to add new workflows. In the
-> not-too-distant future (hopefully), we will improve the workflows to support
-> this.
-
-### Adding a new test that's "part of something bigger"
-
-The first important thing here is to align expectations, and we must say that
-the community strongly prefers receiving tests that already come with:
-
-- Instructions how to run them
-- A proven run where it's passing
-
-There are several ways to achieve those two requirements, and an example of that
-can be seen in PR #8115.
-
-With the expectations aligned, adding a test consists in:
-
-- Adding a new yaml file for your test, and ensure it's called from the
-  "bigger" yaml. See the [Kata Monitor test example][monitor-ex01].
-
-- Adding the helper scripts needed for your test to run. Again, use the [Kata Monitor script as example][monitor-ex02].
-
-Following those examples, the community advice during the review, and even
-asking the community directly on Slack are the best ways to get your test
-accepted.
-
-## Running tests
-
-### Running the tests as part of the CI
-
-If you're a maintainer of the project, you'll be able to kick in the tests by
-yourself.  With the current approach, you just need to add the `ok-to-test`
-label and the tests will automatically start.  We're moving, though, to use a
-`/test` command as part of a GitHub review comment, which will simplify this
-process.
-
-If you're not a maintainer, please, send a message on Slack or wait till one of
-the maintainers reviews your PR.  Maintainers will then kick in the tests on
-your behalf.
-
-In case a test fails and there's the suspicion it happens due to flakiness in
-the test itself, please, create an issue for us, and then re-run (or asks
-maintainers to re-run) the tests following these steps:
-
-- Locate which tests is failing
-- Click in "details"
-- In the top right corner, click in "Re-run jobs"
-- And then in "Re-run failed jobs"
-- And finally click in the green "Re-run jobs" button
-
-> [!NOTE]
-> TODO: We need figures here
-
-### Running the tests locally
-
-In this section, aligning expectations is also something very important, as one
-will not be able to run the tests exactly in the same way the tests are running
-in the CI, as one most likely won't have access to an Azure subscription.
-However, we're trying our best here to provide you with instructions on how to
-run the tests in an environment that's "close enough" and will help you to debug
-issues you find with the current tests, or even provide a proof-of-concept to
-the new test you're trying to add.
-
-The basic steps, which we will cover in details down below are:
-
- 1. Create a VM matching the configuration of the target runner
- 2. Generate the artifacts you'll need for the test, or download them from a
-    current failed run
- 3. Follow the steps provided in the action itself to run the tests.
-
-Although the general overview looks easy, we know that some tricks need to be
-shared, and we'll go through the general process of debugging one non-Kubernetes
-and one Kubernetes specific test for educational purposes.
-
-One important thing to note is that "Create a VM" can be done in innumerable
-different ways, using the tools of your choice.  For the sake of simplicity on
-this guide, we'll be using `kcli`, which we strongly recommend in case you're a
-non-experienced user, and happen to be developing on a Linux box.
-
-For both non-Kubernetes and Kubernetes cases, we'll be using PR #8070 as an
-example, which at the time this document is being written serves us very well
-the purpose, as you can see that we have `nerdctl` and Kubernetes tests failing.
-
-## Debugging tests
-
-### Debugging a non Kubernetes test
-
-As shown above, the `nerdctl` test is failing.
-
-As a developer you can go ahead to the details of the job, and expand the job
-that's failing in order to gather more information.
-
-But when that doesn't help, we need to set up our own environment to debug
-what's going on.
-
-Taking a look at the `nerdctl` test, which is located here, you can easily see
-that it runs-on a `garm-ubuntu-2304-smaller` virtual machine.
-
-The important parts to understand are `ubuntu-2304`, which is the OS where the
-test is running on; and "smaller", which means we're running it on a machine
-with 2 CPUs and 8GB of RAM.
-
-With this information, we can go ahead and create a similar VM locally using `kcli`.
-
-```bash
-$ sudo kcli create vm -i ubuntu2304 -P disks=[60] -P numcpus=2 -P memory=8192 -P cpumodel=host-passthrough debug-nerdctl-pr8070
-```
-
-In order to run the tests, you'll need the "kata-tarball" artifacts, which you
-can build your own using "make kata-tarball" (see below), or simply get them
-from the PR where the tests failed.  To download them, click on the "Summary"
-button that's on the top left corner, and then scroll down till you see the
-artifacts, as shown below.
-
-Unfortunately GitHub doesn't give us a link that we can download those from
-inside the VM, but we can download them on our local box, and then `scp` the
-tarball to the newly created VM that will be used for debugging purposes.
-
-> [!NOTE]
-> Those artifacts are only available (for 15 days) when all jobs are finished.
-
-Once you have the `kata-static.tar.xz` in your VM, you can login to the VM with
-`kcli ssh debug-nerdctl-pr8070`, go ahead and then clone your development branch
-
-```bash
-$ git clone --branch feat_add-fc-runtime-rs https://github.com/nubificus/kata-containers
-```
-
-Add the upstream as a remote, set up your git, and rebase your branch atop of the upstream main one
-
-```bash
-$ git remote add upstream https://github.com/kata-containers/kata-containers
-$ git remote update
-$ git config --global user.email "you@example.com"
-$ git config --global user.name "Your Name"
-$ git rebase upstream/main 
-```
-
-Now copy the `kata-static.tar.xz` into your `kata-containers/kata-artifacts` directory
-
-```bash
-$ mkdir kata-artifacts
-$ cp ../kata-static.tar.xz kata-artifacts/
-```
-
-> [!NOTE]
-> If you downloaded the .zip from GitHub you need to uncompress first to see `kata-static.tar.xz`
-
-And finally run the tests following what's in the yaml file for the test you're
-debugging. 
-
-In our case, the `run-nerdctl-tests-on-garm.yaml`.
-
-When looking at the file you'll notice that some environment variables are set,
-such as `KATA_HYPERVISOR`, and should be aware that, for this particular example,
-the important steps to follow are:
-
-Install the dependencies
-Install kata
-Run the tests
-
-Let's now run the steps mentioned above exporting the expected environment variables
-
-```bash
-$ export KATA_HYPERVISOR=dragonball
-$ bash ./tests/integration/nerdctl/gha-run.sh install-dependencies
-$ bash ./tests/integration/nerdctl/gha-run.sh install-kata
-$ bash tests/integration/nerdctl/gha-run.sh run
-```
-
-And with this you should've been able to reproduce exactly the same issue found
-in the CI, and from now on you can build your own code, use your own binaries,
-and have fun debugging and hacking! 
-
-### Debugging a Kubernetes test
-
-Steps for debugging the Kubernetes tests are very similar to the ones for
-debugging non-Kubernetes tests, with the caveat that what you'll need, this
-time, is not the `kata-static.tar.xz` tarball, but rather a payload to be used
-with kata-deploy.
-
-In order to generate your own kata-deploy image you can generate your own
-`kata-static.tar.xz` and then take advantage of the following script.  Be aware
-that the image generated and uploaded must be accessible by the VM where you'll
-be performing your tests.
-
-In case you want to take advantage of the payload that was already generated
-when you faced the CI failure, which is considerably easier, take a look at the
-failed job, then click in "Deploy Kata" and expand the "Final kata-deploy.yaml
-that is used in the test" section.  From there you can see exactly what you'll
-have to use when deploying kata-deploy in your local cluster.
-
-> [!NOTE]
-> TODO: WAINER TO FINISH THIS PART BASED ON HIS PR TO RUN A LOCAL CI
-
-## Adding new runners
-
-Any admin of the project is able to add or remove GitHub runners, and those are
-the folks you should rely on.
-
-If you need a new runner added, please, tag @ac in the Kata Containers slack,
-and someone from that group will be able to help you.
-
-If you're part of that group and you're looking for information on how to help
-someone, this is simple, and must be done in private. Basically what you have to
-do is:
-
-- Go to the kata-containers/kata-containers repo
-- Click on the Settings button, located in the top right corner
-- On the left panel, under "Code and automation", click on "Actions"
-- Click on "Runners"
-
-If you want to add a new self-hosted runner:
-
-- In the top right corner there's a green button called "New self-hosted runner"
-
-If you want to remove a current self-hosted runner:
-
-- For each runner there's a "..." menu, where you can just click and the
-  "Remove runner" option will show up
-  
-## Known limitations
-
-As the GitHub actions are structured right now we cannot: Test the addition of a
-GitHub action that's not triggered by a pull_request event as part of the PR.
-
-[gh-actions]: https://docs.github.com/en/actions
-[monitor-ex01]: https://github.com/kata-containers/kata-containers/commit/a3fb067f1bccde0cbd3fd4d5de12dfb3d8c28b60
-[monitor-ex02]: https://github.com/kata-containers/kata-containers/commit/489caf1ad0fae27cfd00ba3c9ed40e3d512fa492

ci/gh-util.sh

@@ -1,182 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2020 Intel Corporation
-# Copyright (c) 2024 IBM Corporation
-#
-# SPDX-License-Identifier: Apache-2.0
-
-set -o errexit
-set -o errtrace
-set -o nounset
-set -o pipefail
-
-[ -n "${DEBUG:-}" ] && set -o xtrace
-
-script_name=${0##*/}
-
-#---------------------------------------------------------------------
-
-die()
-{
-    echo >&2 "$*"
-    exit 1
-}
-
-usage()
-{
-    cat <<EOF
-Usage: $script_name [OPTIONS] [command] [arguments]
-
-Description: Utility to expand the abilities of the GitHub CLI tool, gh.
-
-Command descriptions:
-
-  list-issues-for-pr     List issues linked to a PR.
-  list-labels-for-issue  List labels, in json format for an issue
-
-Commands and arguments:
-
-  list-issues-for-pr <pr>
-  list-labels-for-issue <issue>
-
-Options:
-
- -h                 Show this help statement.
- -r <owner/repo>    Optional <org/repo> specification. Default: 'kata-containers/kata-containers'
-
-Examples:
-
-- List issues for a Pull Request 123 in kata-containers/kata-containers repo
-
-  $ $script_name list-issues-for-pr 123
-EOF
-}
-
-list_issues_for_pr()
-{
-    local pr="${1:-}"
-    local repo="${2:-kata-containers/kata-containers}"
-
-    [ -z "$pr" ] && die "need PR"
-
-    local commits=$(gh pr view ${pr} --repo ${repo} --json commits --jq .commits[].messageBody)
-
-    [ -z "$commits" ] && die "cannot determine commits for PR $pr"
-
-    # Extract the issue number(s) from the commits.
-    #
-    # This needs to be careful to take account of lines like this:
-    #
-    # fixes 99
-    # fixes: 77
-    # fixes #123.
-    # Fixes: #1, #234, #5678.
-    #
-    # Note the exclusion of lines starting with whitespace which is
-    # specifically to ignore vendored git log comments, which are whitespace
-    # indented and in the format:
-    #
-    #     "<git-commit> <git-commit-msg>"
-    #
-    local issues=$(echo "$commits" |\
-        egrep -v "^( |	)" |\
-        egrep -i "fixes:* *(#*[0-9][0-9]*)" |\
-        tr ' ' '\n' |\
-        grep "[0-9][0-9]*" |\
-        sed 's/[.,\#]//g' |\
-        sort -nu || true)
-
-    [ -z "$issues" ] && die "cannot determine issues for PR $pr"
-
-    echo "# Issues linked to PR"
-    echo "#"
-    echo "# Fields: issue_number"
-
-    local issue
-    echo "$issues"|while read issue
-    do
-        printf "%s\n" "$issue"
-    done
-}
-
-list_labels_for_issue()
-{
-    local issue="${1:-}"
-
-    [ -z "$issue" ] && die "need issue number"
-
-    local labels=$(gh issue view ${issue} --repo kata-containers/kata-containers --json labels)
-
-    [ -z "$labels" ] && die "cannot determine labels for issue $issue"
-
-    printf "$labels"
-}
-
-setup()
-{
-    for cmd in gh jq
-    do
-        command -v "$cmd" &>/dev/null || die "need command: $cmd"
-    done
-}
-
-handle_args()
-{
-    setup
-
-    local show_all="false"
-    local opt
-
-    while getopts "ahr:" opt "$@"
-    do
-        case "$opt" in
-            a) show_all="true" ;;
-            h) usage && exit 0 ;;
-            r) repo="${OPTARG}" ;;
-        esac
-    done
-
-    shift $(($OPTIND - 1))
-
-    local repo="${repo:-kata-containers/kata-containers}"
-    local cmd="${1:-}"
-
-    case "$cmd" in
-        list-issues-for-pr) ;;
-        list-labels-for-issue) ;;
-
-        "") usage && exit 0 ;;
-        *) die "invalid command: '$cmd'" ;;
-    esac
-
-    # Consume the command name
-    shift
-
-    local issue=""
-    local pr=""
-
-    case "$cmd" in
-        list-issues-for-pr)
-            pr="${1:-}"
-
-            list_issues_for_pr "$pr" "${repo}"
-            ;;
-
-        list-labels-for-issue)
-            issue="${1:-}"
-
-            list_labels_for_issue "$issue"
-            ;;
-
-        *) die "impossible situation: cmd: '$cmd'" ;;
-    esac
-
-    exit 0
-}
-
-main()
-{
-    handle_args "$@"
-}
-
-main "$@"

ci/install_libseccomp.sh

@@ -7,10 +7,12 @@
 
 set -o errexit
 
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-script_name="$(basename "${BASH_SOURCE[0]}")"
+cidir=$(dirname "$0")
+source "${cidir}/lib.sh"
 
-source "${script_dir}/../tests/common.bash"
+clone_tests_repo
+
+source "${tests_repo_dir}/.ci/lib.sh"
 
 # The following variables if set on the environment will change the behavior
 # of gperf and libseccomp configure scripts, that may lead this script to
@@ -23,11 +25,11 @@ workdir="$(mktemp -d --tmpdir build-libseccomp.XXXXX)"
 # Variables for libseccomp
 libseccomp_version="${LIBSECCOMP_VERSION:-""}"
 if [ -z "${libseccomp_version}" ]; then
-    libseccomp_version=$(get_from_kata_deps ".externals.libseccomp.version")
+    libseccomp_version=$(get_version "externals.libseccomp.version")
 fi
 libseccomp_url="${LIBSECCOMP_URL:-""}"
 if [ -z "${libseccomp_url}" ]; then
-    libseccomp_url=$(get_from_kata_deps ".externals.libseccomp.url")
+    libseccomp_url=$(get_version "externals.libseccomp.url")
 fi
 libseccomp_tarball="libseccomp-${libseccomp_version}.tar.gz"
 libseccomp_tarball_url="${libseccomp_url}/releases/download/v${libseccomp_version}/${libseccomp_tarball}"
@@ -36,11 +38,11 @@ cflags="-O2"
 # Variables for gperf
 gperf_version="${GPERF_VERSION:-""}"
 if [ -z "${gperf_version}" ]; then
-    gperf_version=$(get_from_kata_deps ".externals.gperf.version")
+    gperf_version=$(get_version "externals.gperf.version")
 fi
 gperf_url="${GPERF_URL:-""}"
 if [ -z "${gperf_url}" ]; then
-    gperf_url=$(get_from_kata_deps ".externals.gperf.url")
+    gperf_url=$(get_version "externals.gperf.url")
 fi
 gperf_tarball="gperf-${gperf_version}.tar.gz"
 gperf_tarball_url="${gperf_url}/${gperf_tarball}"
@@ -85,8 +87,7 @@ build_and_install_libseccomp() {
     curl -sLO "${libseccomp_tarball_url}"
     tar -xf "${libseccomp_tarball}"
     pushd "libseccomp-${libseccomp_version}"
-    [ "${arch}" == $(uname -m) ] && cc_name="" || cc_name="${arch}-linux-gnu-gcc"
-    CC=${cc_name} ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
+    ./configure --prefix="${libseccomp_install_dir}" CFLAGS="${cflags}" --enable-static --host="${arch}"
     make
     make install
     popd

ci/install_yq.sh

@@ -5,8 +5,6 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 
-[ -n "$DEBUG" ] && set -o xtrace
-
 # If we fail for any reason a message will be displayed
 die() {
 	msg="$*"
@@ -18,8 +16,7 @@ die() {
 # Install via binary download, as we may not have golang installed at this point
 function install_yq() {
 	local yq_pkg="github.com/mikefarah/yq"
-	local yq_version=v4.40.7
-	local precmd=""
+	local yq_version=3.4.1
 	INSTALL_IN_GOPATH=${INSTALL_IN_GOPATH:-true}
 
 	if [ "${INSTALL_IN_GOPATH}"  == "true" ];then
@@ -28,17 +25,8 @@ function install_yq() {
 		local yq_path="${GOPATH}/bin/yq"
 	else
 		yq_path="/usr/local/bin/yq"
-		# Check if we need sudo to install yq
-		if [ ! -w "/usr/local/bin" ]; then
-			# Check if we have sudo privileges
-			if ! sudo -n true 2>/dev/null; then
-				die "Please provide sudo privileges to install yq"
-			else
-				precmd="sudo"
-			fi
-		fi
 	fi
-	[ -x  "${yq_path}" ] && [ "`${yq_path} --version`"X == "yq (https://github.com/mikefarah/yq/) version ${yq_version}"X ] && return
+	[ -x  "${yq_path}" ] && [ "`${yq_path} --version`"X == "yq version ${yq_version}"X ] && return
 
 	read -r -a sysInfo <<< "$(uname -sm)"
 
@@ -55,16 +43,6 @@ function install_yq() {
 	"aarch64")
 		goarch=arm64
 		;;
-	"arm64")
-		# If we're on an apple silicon machine, just assign amd64. 
-		# The version of yq we use doesn't have a darwin arm build, 
-		# but Rosetta can come to the rescue here.
-		if [ $goos == "Darwin" ]; then 
-			goarch=amd64
-		else 
-			goarch=arm64
-		fi
-		;;
 	"ppc64le")
 		goarch=ppc64le
 		;;
@@ -86,10 +64,10 @@ function install_yq() {
 	fi
 
 	## NOTE: ${var,,} => gives lowercase value of var
-	local yq_url="https://${yq_pkg}/releases/download/${yq_version}/yq_${goos}_${goarch}"
-	${precmd} curl -o "${yq_path}" -LSsf "${yq_url}"
+	local yq_url="https://${yq_pkg}/releases/download/${yq_version}/yq_${goos,,}_${goarch}"
+	curl -o "${yq_path}" -LSsf "${yq_url}"
 	[ $? -ne 0 ] && die "Download ${yq_url} failed"
-	${precmd} chmod +x "${yq_path}"
+	chmod +x "${yq_path}"
 
 	if ! command -v "${yq_path}" >/dev/null; then
 		die "Cannot not get ${yq_path} executable"

ci/lib.sh

@@ -5,9 +5,6 @@
 
 set -o nounset
 
-GOPATH=${GOPATH:-${HOME}/go}
-export kata_repo="github.com/kata-containers/kata-containers"
-export kata_repo_dir="$GOPATH/src/$kata_repo"
 export tests_repo="${tests_repo:-github.com/kata-containers/tests}"
 export tests_repo_dir="$GOPATH/src/$tests_repo"
 export branch="${target_branch:-main}"
@@ -21,7 +18,13 @@ clone_tests_repo()
 {
 	if [ -d "$tests_repo_dir" ]; then
 		[ -n "${CI:-}" ] && return
-
+		# git config --global --add safe.directory will always append
+		# the target to .gitconfig without checking the existence of
+		# the target, so it's better to check it before adding the target repo.
+		local sd="$(git config --global --get safe.directory ${tests_repo_dir} || true)"
+		if [ -z "${sd}" ]; then
+			git config --global --add safe.directory ${tests_repo_dir}
+		fi
 		pushd "${tests_repo_dir}"
 		git checkout "${branch}"
 		git pull
@@ -36,46 +39,28 @@ clone_tests_repo()
 
 run_static_checks()
 {
+	clone_tests_repo
 	# Make sure we have the targeting branch
 	git remote set-branches --add origin "${branch}"
 	git fetch -a
-	bash "$kata_repo_dir/tests/static-checks.sh" "$@"
+	bash "$tests_repo_dir/.ci/static-checks.sh" "$@"
 }
 
 run_docs_url_alive_check()
 {
+	clone_tests_repo
 	# Make sure we have the targeting branch
 	git remote set-branches --add origin "${branch}"
 	git fetch -a
-	bash "$kata_repo_dir/tests/static-checks.sh" --docs --all "$kata_repo"
+	bash "$tests_repo_dir/.ci/static-checks.sh" --docs --all "github.com/kata-containers/kata-containers"
 }
 
 run_get_pr_changed_file_details()
 {
+	clone_tests_repo
 	# Make sure we have the targeting branch
 	git remote set-branches --add origin "${branch}"
 	git fetch -a
-	source "$kata_repo_dir/tests/common.bash"
+	source "$tests_repo_dir/.ci/lib.sh"
 	get_pr_changed_file_details
 }
-
-# Check if the 1st argument version is greater than and equal to 2nd one
-# Version format: [0-9]+ separated by period (e.g. 2.4.6, 1.11.3 and etc.)
-#
-# Parameters:
-#	$1	- a version to be tested
-#	$2	- a target version
-#
-# Return:
-# 	0 if $1 is greater than and equal to $2
-#	1 otherwise
-version_greater_than_equal() {
-	local current_version=$1
-	local target_version=$2
-	smaller_version=$(echo -e "$current_version\n$target_version" | sort -V | head -1)
-	if [ "${smaller_version}" = "${target_version}" ]; then
-		return 0
-	else
-		return 1
-	fi
-}

ci/openshift-ci/README.md

@@ -1,149 +0,0 @@
-OpenShift CI
-============
-
-This directory contains scripts used by
-[the OpenShift CI](https://github.com/openshift/release/tree/master/ci-operator/config/kata-containers/kata-containers)
-pipelines to monitor selected functional tests on OpenShift.
-There are 2 pipelines, history and logs can be accessed here:
-
-* [main - currently supported OCP](https://prow.ci.openshift.org/job-history/gs/origin-ci-test/logs/periodic-ci-kata-containers-kata-containers-main-e2e-tests)
-* [next - currently under development OCP](https://prow.ci.openshift.org/job-history/gs/origin-ci-test/logs/periodic-ci-kata-containers-kata-containers-main-next-e2e-tests)
-
-
-Running openshift-tests on OCP with kata-containers manually
-============================================================
-
-To run openshift-tests (or other suites) with kata-containers one can use
-the kata-webhook. To deploy everything you can mimic the CI pipeline by:
-
-```bash
-#!/bin/bash -e
-# Setup your kubectl and check it's accessible by
-kubectl nodes
-# Deploy kata (set KATA_DEPLOY_IMAGE to override the default kata-deploy-ci:latest image)
-./test.sh
-# Deploy the webhook
-KATA_RUNTIME=kata-qemu cluster/deploy_webhook.sh
-```
-
-This should ensure kata-containers as well as kata-webhook are installed and
-working. Before running the openshift-tests it's (currently) recommended to
-ignore some security features by:
-
-```bash
-#!/bin/bash -e
-oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts
-oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts
-oc label --overwrite ns default pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-```
-
-Now you should be ready to run the openshift-tests. Our CI only uses a subset
-of tests, to get the current ``TEST_SKIPS`` see
-[the pipeline config](https://github.com/openshift/release/tree/master/ci-operator/config/kata-containers/kata-containers).
-Following steps require the [openshift tests](https://github.com/openshift/origin)
-being cloned and built in the current directory:
-
-```bash
-#!/bin/bash -e
-# Define tests to be skipped (see the pipeline config for the current version)
-TEST_SKIPS="\[sig-node\] Security Context should support seccomp runtime/default\|\[sig-node\] Variable Expansion should allow substituting values in a volume subpath\|\[k8s.io\] Probing container should be restarted with a docker exec liveness probe with timeout\|\[sig-node\] Pods Extended Pod Container lifecycle evicted pods should be terminal\|\[sig-node\] PodOSRejection \[NodeConformance\] Kubelet should reject pod when the node OS doesn't match pod's OS\|\[sig-network\].*for evicted pods\|\[sig-network\].*HAProxy router should override the route\|\[sig-network\].*HAProxy router should serve a route\|\[sig-network\].*HAProxy router should serve the correct\|\[sig-network\].*HAProxy router should run\|\[sig-network\].*when FIPS.*the HAProxy router\|\[sig-network\].*bond\|\[sig-network\].*all sysctl on whitelist\|\[sig-network\].*sysctls should not affect\|\[sig-network\] pods should successfully create sandboxes by adding pod to network"
-# Get the list of tests to be executed
-TESTS="$(./openshift-tests run --dry-run --provider "${TEST_PROVIDER}" "${TEST_SUITE}")"
-# Store the list of tests in /tmp/tsts file
-echo "${TESTS}" | grep -v "$TEST_SKIPS" > /tmp/tsts
-# Remove previously-existing temporarily files as well as previous results
-OUT=RESULTS/tmp
-rm -Rf /tmp/*test* /tmp/e2e-*
-rm -R $OUT
-mkdir -p $OUT
-# Run the tests ignoring the monitor health checks
-./openshift-tests run --provider azure -o "$OUT/job.log" --junit-dir "$OUT" --file /tmp/tsts --max-parallel-tests 5 --cluster-stability Disruptive --run '^\[sig-node\].*|^\[sig-network\]'
-```
-
-[!NOTE]
-Note we are ignoring the cluster stability checks because our public cloud is
-not that stable and running with VMs instead of containers results in minor
-stability issues. Some of the old monitor stability tests do not reflect
-the ``--cluster-stability`` setting, one should simply ignore these. If you
-get a message like ``invariant was violated`` or ``error: failed due to a
-MonitorTest failure``, it's usually an indication that only those kind of
-tests failed but the real tests passed. See
-[wrapped-openshift-tests.sh](https://github.com/openshift/release/blob/master/ci-operator/config/kata-containers/kata-containers/wrapped-openshift-tests.sh)
-for details how our pipeline deals with that.
-
-[!TIP]
-To compare multiple results locally one can use
-[junit2html](https://github.com/inorton/junit2html) tool.
-
-
-Best-effort kata-containers cleanup
-===================================
-
-If you need to cleanup the cluster after testing, you can use the
-``cleanup.sh`` script from the current directory. It tries to delete all
-resources created by ``test.sh`` as well as ``cluster/deploy_webhook.sh``
-ignoring all failures. The primary purpose of this script is to allow
-soft-cleanup after deployment to test different versions without
-re-provisioning everything.
-
-[!WARNING]
-Do not rely on this script in production, return codes are not checked!**
-
-
-Bisecting e2e tests failures
-============================
-
-Let's say the OCP pipeline passed running with
-``quay.io/kata-containers/kata-deploy-ci:kata-containers-d7afd31fd40e37a675b25c53618904ab57e74ccd-amd64``
-but failed running with
-``quay.io/kata-containers/kata-deploy-ci:kata-containers-9f512c016e75599a4a921bd84ea47559fe610057-amd64``
-and you'd like to know which PR caused the regression. You can either run with
-all the 60 tags between or you can utilize the [bisecter](https://github.com/ldoktor/bisecter)
-to optimize the number of steps in between.
-
-Before running the bisection you need a reproducer script. Sample one called
-``sample-test-reproducer.sh`` is provided in this directory but you might
-want to copy and modify it, especially:
-
-* ``OCP_DIR`` - directory where your openshift/release is located (can be exported)
-* ``E2E_TEST`` - openshift-test(s) to be executed (can be exported)
-* behaviour of SETUP (returning 125 skips the current image tag, returning
-  >=128 interrupts the execution, everything else reports the tag as failure
-* what should be executed (perhaps running the setup is enough for you or
-  you might want to be looking for specific failures...)
-* use ``timeout`` to interrupt execution in case you know things should be faster
-
-Executing that script with the GOOD commit should pass
-``./sample-test-reproducer.sh quay.io/kata-containers/kata-deploy-ci:kata-containers-d7afd31fd40e37a675b25c53618904ab57e74ccd-amd64``
-and fail when executed with the BAD commit
-``./sample-test-reproducer.sh quay.io/kata-containers/kata-deploy-ci:kata-containers-9f512c016e75599a4a921bd84ea47559fe610057-amd64``.
-
-To get the list of all tags in between those two PRs you can use the
-``bisect-range.sh`` script
-
-```bash
-./bisect-range.sh d7afd31fd40e37a675b25c53618904ab57e74ccd 9f512c016e75599a4a921bd84ea47559fe610057
-```
-
-[!NOTE]
-The tagged images are only built per PR, not for individual commits. See
-[kata-deploy-ci](https://quay.io/kata-containers/kata-deploy-ci) to see the
-available images.
-
-To find out which PR caused this regression, you can either manually try the
-individual commits or you can simply execute:
-
-```bash
-bisecter start "$(./bisect-range.sh d7afd31fd40 9f512c016)"
-OCP_DIR=/path/to/openshift/release bisecter run ./sample-test-reproducer.sh
-```
-
-[!NOTE]
-If you use ``KATA_WITH_SYSTEM_QEMU=yes`` you might want to deploy once with
-it and skip it for the cleanup. That way you might (in most cases) test
-all images with a single MCP update instead of per-image MCP update.
-
-[!TIP]
-You can check the bisection progress during/after execution by running
-``bisecter log`` from the current directory. Before starting a new
-bisection you need to execute ``bisecter reset``.

ci/openshift-ci/bisect-range.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-if [ "$#" -gt 2 ] || [ "$#" -lt 1 ] ; then
-	echo "Usage: $0 GOOD [BAD]"
-	echo "Prints list of available kata-deploy-ci tags between GOOD and BAD commits (by default BAD is the latest available tag)"
-	exit 255
-fi
-GOOD="$1"
-[ -n "$2" ] && BAD="$2"
-ARCH=amd64
-REPO="quay.io/kata-containers/kata-deploy-ci"
-
-TAGS=$(skopeo list-tags "docker://$REPO")
-# Only amd64
-TAGS=$(echo "$TAGS" | jq '.Tags' | jq "map(select(endswith(\"$ARCH\")))" | jq -r '.[]')
-# Tags since $GOOD
-TAGS=$(echo "$TAGS" | sed -n -e "/$GOOD/,$$p")
-# Tags up to $BAD
-[ -n "$BAD" ] && TAGS=$(echo "$TAGS" | sed "/$BAD/q")
-# Comma separated tags with repo
-echo "$TAGS" | sed -e "s@^@$REPO:@" | paste -s -d, -

ci/openshift-ci/cleanup.sh

@@ -1,59 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script tries to removes most of the resources added by `test.sh` script
-# from the cluster.
-
-scripts_dir=$(dirname $0)
-deployments_dir=${scripts_dir}/cluster/deployments
-configs_dir=${scripts_dir}/configs
-
-source ${scripts_dir}/lib.sh
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Ignore errors as we want best-effort-approach here
-trap - ERR
-
-# Delete webhook resources
-oc delete -f "${scripts_dir}/../../tools/testing/kata-webhook/deploy"
-oc delete -f "${scripts_dir}/cluster/deployments/configmap_kata-webhook.yaml.in"
-
-# Delete potential smoke-test resources
-oc delete -f "${scripts_dir}/smoke/service.yaml"
-oc delete -f "${scripts_dir}/smoke/service_kubernetes.yaml"
-oc delete -f "${scripts_dir}/smoke/http-server.yaml"
-
-# Delete test.sh resources
-oc delete -f "${deployments_dir}/relabel_selinux.yaml"
-if [[ "$WORKAROUND_9206_CRIO" == "yes" ]]; then
-	oc delete -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	oc delete -f "${deployments_dir}/workaround-9206-crio.yaml"
-fi
-[ ${SELINUX_PERMISSIVE} == "yes" ] && oc delete -f "${deployments_dir}/machineconfig_selinux.yaml.in"
-
-# Delete kata-containers
-pushd "$katacontainers_repo_dir/tools/packaging/kata-deploy"
-oc delete -f kata-deploy/base/kata-deploy.yaml
-oc -n kube-system wait --timeout=10m --for=delete -l name=kata-deploy pod
-oc apply -f kata-cleanup/base/kata-cleanup.yaml
-echo "Wait for all related pods to be gone"
-( repeats=1; for i in $(seq 1 600); do
-  oc get pods -l name="kubelet-kata-cleanup" --no-headers=true -n kube-system 2>&1 | grep "No resources found" -q && ((repeats++)) || repeats=1
-  [ "$repeats" -gt 5 ] && echo kata-cleanup finished && break
-  sleep 1
-done) || { echo "There are still some kata-cleanup related pods after 600 iterations"; oc get all -n kube-system; exit -1; }
-oc delete -f kata-cleanup/base/kata-cleanup.yaml
-oc delete -f kata-rbac/base/kata-rbac.yaml
-oc delete -f runtimeclasses/kata-runtimeClasses.yaml
-

ci/openshift-ci/cluster/configs/selinux.conf

@@ -1,6 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-SELINUX=permissive
-SELINUXTYPE=targeted

ci/openshift-ci/cluster/deploy_webhook.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script builds the kata-webhook and deploys it in the test cluster.
-#
-# You should export the KATA_RUNTIME variable with the runtimeclass name
-# configured in your cluster in case it is not the default "kata-ci".
-#
-set -e
-set -o nounset
-set -o pipefail
-
-script_dir="$(dirname $0)"
-webhook_dir="${script_dir}/../../../tools/testing/kata-webhook"
-source "${script_dir}/../lib.sh"
-KATA_RUNTIME=${KATA_RUNTIME:-kata-ci}
-
-info "Creates the kata-webhook ConfigMap"
-RUNTIME_CLASS="${KATA_RUNTIME}" \
-	envsubst < "${script_dir}/deployments/configmap_kata-webhook.yaml.in" \
-	| oc apply -f -
-
-pushd "${webhook_dir}" >/dev/null
-# Build and deploy the webhook
-#
-info "Builds the kata-webhook"
-./create-certs.sh
-info "Deploys the kata-webhook"
-oc apply -f deploy/
-# Check the webhook was deployed and is working.
-RUNTIME_CLASS="${KATA_RUNTIME}" ./webhook-check.sh
-popd >/dev/null

ci/openshift-ci/cluster/deployments/configmap_installer_kernel.yaml

@@ -1,13 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# host kernel.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.kernel
-data:
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/configmap_installer_qemu.yaml

@@ -1,14 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Instruct the daemonset installer to configure Kata Containers to use the
-# system QEMU.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ci.kata.installer.qemu
-data:
-  qemu_path: /usr/libexec/qemu-kvm
-  host_kernel: "yes"

ci/openshift-ci/cluster/deployments/configmap_kata-webhook.yaml.in

@@ -1,12 +0,0 @@
-# Copyright (c) 2021 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Apply customizations to the kata-webhook.
-#
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kata-webhook
-data:
-  runtime_class: ${RUNTIME_CLASS}

ci/openshift-ci/cluster/deployments/machineconfig_sandboxedcontainers_extension.yaml

@@ -1,9 +0,0 @@
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 50-enable-sandboxed-containers-extension
-spec:
-  extensions:
-  - sandboxed-containers

ci/openshift-ci/cluster/deployments/machineconfig_selinux.yaml.in

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Configure SELinux on worker nodes.
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 51-kata-selinux
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,${SELINUX_CONF_BASE64}
-        filesystem: root
-        mode: 0644
-        path: /etc/selinux/config

ci/openshift-ci/cluster/deployments/relabel_selinux.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: relabel-selinux-daemonset
-  namespace: kube-system
-spec:
-  selector:
-    matchLabels:
-      app: restorecon
-  template:
-    metadata:
-      labels:
-        app: restorecon
-    spec:
-      serviceAccountName: kata-deploy-sa
-      hostPID: true
-      containers:
-        - name: relabel-selinux-container
-          image: alpine
-          securityContext:
-            privileged: true
-          command: ["/bin/sh", "-c", "
-            set -e;
-            echo Starting the relabel;
-            nsenter --target 1 --mount bash -xc '
-                command -v semanage &>/dev/null || { echo Does not look like a SELINUX cluster, skipping; exit 0; };
-                for ENTRY in \
-                    \"/(.*/)?opt/kata/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/runtime-rs/bin(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/kata-.*(/.*)?(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/ovmf(/.*)?\" \
-                    \"/(.*/)?opt/kata/share/tdvf(/.*)?\" \
-                    \"/(.*/)?opt/kata/libexec(/.*)?\";
-                do
-                    semanage fcontext -a -t qemu_exec_t \"$ENTRY\" || semanage fcontext -m -t qemu_exec_t \"$ENTRY\" || { echo \"Error in semanage command\"; exit 1; }
-                done;
-                restorecon -v -R /opt/kata || { echo \"Error in restorecon command\"; exit 1; }
-            ';
-            echo NSENTER_FINISHED_WITH: $?;
-            sleep infinity"]

ci/openshift-ci/cluster/deployments/workaround-9206-crio-ds.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: workaround-9206-crio-ds
-spec:
-  selector:
-    matchLabels:
-      app: workaround-9206-crio-ds
-  template:
-    metadata:
-      labels:
-        app: workaround-9206-crio-ds
-    spec:
-      containers:
-      - name: workaround-9206-crio-ds
-        image: alpine
-        volumeMounts:
-        - name: host-dir
-          mountPath: /tmp/config
-        securityContext:
-          runAsUser: 0
-          privileged: true
-        command: ["/bin/sh", "-c", "while [ ! -f '/tmp/config/10-workaround-9206-crio' ]; do sleep 1; done; echo 'Config file present'; sleep infinity"]
-      volumes:
-      - name: host-dir
-        hostPath:
-          path: /etc/crio/crio.conf.d/

ci/openshift-ci/cluster/deployments/workaround-9206-crio.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-metadata:
-  labels:
-    machineconfiguration.openshift.io/role: worker
-  name: 10-workaround-9206-crio
-spec:
-  config:
-    ignition:
-      version: 2.2.0
-    storage:
-      files:
-      - contents:
-              source: data:text/plain;charset=utf-8;base64,W2NyaW9dCnN0b3JhZ2Vfb3B0aW9uID0gWwoJIm92ZXJsYXkuc2tpcF9tb3VudF9ob21lPXRydWUiLApdCg==
-        filesystem: root
-        mode: 0644
-        path: /etc/crio/crio.conf.d/10-workaround-9206-crio

ci/openshift-ci/cluster/install_kata.sh

@@ -1,245 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# This script installs the built kata-containers in the test cluster,
-# and configure a runtime.
-
-scripts_dir=$(dirname $0)
-deployments_dir=${scripts_dir}/deployments
-configs_dir=${scripts_dir}/configs
-
-source ${scripts_dir}/../lib.sh
-
-# Set to 'yes' if you want to configure SELinux to permissive on the cluster
-# workers.
-#
-SELINUX_PERMISSIVE=${SELINUX_PERMISSIVE:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the system's
-# QEMU (from the RHCOS extension).
-#
-KATA_WITH_SYSTEM_QEMU=${KATA_WITH_SYSTEM_QEMU:-no}
-
-# Set to 'yes' if you want to configure Kata Containers to use the host kernel.
-#
-KATA_WITH_HOST_KERNEL=${KATA_WITH_HOST_KERNEL:-no}
-
-# kata-deploy image to be used to deploy the kata (by default use CI image
-# that is built for each pull request)
-#
-KATA_DEPLOY_IMAGE=${KATA_DEPLOY_IMAGE:-quay.io/kata-containers/kata-deploy-ci:kata-containers-latest}
-
-# Enable workaround for OCP 4.13 https://github.com/kata-containers/kata-containers/pull/9206
-#
-WORKAROUND_9206_CRIO=${WORKAROUND_9206_CRIO:-no}
-
-# Leverage kata-deploy to install Kata Containers in the cluster.
-#
-apply_kata_deploy() {
-	local deploy_file="tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml"
-	pushd "$katacontainers_repo_dir"
-	sed -ri "s#(\s+image:) .*#\1 ${KATA_DEPLOY_IMAGE}#" "$deploy_file"
-
-	info "Applying kata-deploy"
-	oc apply -f tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
-	oc label --overwrite ns kube-system pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-	oc apply -f "$deploy_file"
-	oc -n kube-system wait --timeout=10m --for=condition=Ready -l name=kata-deploy pod
-
-	info "Adding the kata runtime classes"
-	oc apply -f tools/packaging/kata-deploy/runtimeclasses/kata-runtimeClasses.yaml
-	popd
-}
-
-
-# Wait all worker nodes reboot.
-#
-# Params:
-#   $1 - timeout in seconds (default to 900).
-#
-wait_for_reboot() {
-	local delta="${1:-900}"
-	local sleep_time=60
-	declare -A BOOTIDS
-	local workers=($(oc get nodes | \
-		awk '{if ($3 == "worker") { print $1 } }'))
-	# Get the boot ID to compared it changed over time.
-	for node in ${workers[@]}; do
-		BOOTIDS[$node]=$(oc get -o jsonpath='{.status.nodeInfo.bootID}'\
-			node/$node)
-		echo "Wait $node reboot"
-	done
-
-	echo "Set timeout to $delta seconds"
-	timer_start=$(date +%s)
-	while [ ${#workers[@]} -gt 0 ]; do
-		sleep $sleep_time
-		now=$(date +%s)
-		if [ $(($timer_start + $delta)) -lt $now ]; then
-			echo "Timeout: not all workers rebooted"
-			return 1
-		fi
-		echo "Checking after $(($now - $timer_start)) seconds"
-		for i in ${!workers[@]}; do
-			current_id=$(oc get \
-				-o jsonpath='{.status.nodeInfo.bootID}' \
-				node/${workers[i]})
-			if [ "$current_id" != ${BOOTIDS[${workers[i]}]} ]; then
-				echo "${workers[i]} rebooted"
-				unset workers[i]
-			fi
-		done
-	done
-}
-
-wait_mcp_update() {
-	local delta="${1:-3600}"
-	local sleep_time=30
-	# The machineconfigpool is fine when all the workers updated and are ready,
-	# and none are degraded.
-	local ready_count=0
-	local degraded_count=0
-	local machine_count=$(oc get mcp worker -o jsonpath='{.status.machineCount}')
-
-	if [[ -z "$machine_count" && "$machine_count" -lt 1 ]]; then
-		warn "Unabled to obtain the machine count"
-		return 1
-	fi
-
-	echo "Set timeout to $delta seconds"
-	local deadline=$(($(date +%s) + $delta))
-	# The ready count might not have changed yet, so wait a little.
-	while [[ "$ready_count" != "$machine_count" && \
-		"$degraded_count" == 0 ]]; do
-		# Let's check it hit the timeout (or not).
-		local now=$(date +%s)
-		if [ $deadline -lt $now ]; then
-			echo "Timeout: not all workers updated" >&2
-			return 1
-		fi
-		sleep $sleep_time
-		ready_count=$(oc get mcp worker \
-			-o jsonpath='{.status.readyMachineCount}')
-		degraded_count=$(oc get mcp worker \
-			-o jsonpath='{.status.degradedMachineCount}')
-		echo "check machineconfigpool - ready_count: $ready_count degraded_count: $degraded_count"
-	done
-	[ $degraded_count -eq 0 ]
-}
-
-# Enable the RHCOS extension for the Sandboxed Containers.
-#
-enable_sandboxedcontainers_extension() {
-	info "Enabling the RHCOS extension for Sandboxed Containers"
-	local deployment_file="${deployments_dir}/machineconfig_sandboxedcontainers_extension.yaml"
-	oc apply -f ${deployment_file}
-	oc get -f ${deployment_file} || \
-		die "Sandboxed Containers extension machineconfig not found"
-	wait_mcp_update || die "Failed to update the machineconfigpool"
-}
-
-# Print useful information for debugging.
-#
-# Params:
-#   $1 - the pod name
-debug_pod() {
-	local pod="$1"
-	info "Debug pod: ${pod}"
-	oc describe pods "$pod"
-        oc logs "$pod"
-}
-
-# Wait for all pods of the app label to contain expected message
-#
-# Params:
-#   $1 - app labela
-#   $2 - expected pods count (>=1)
-#   $3 - message to be present in the logs
-#   $4 - timeout (60)
-#   $5 - namespace (the current one)
-wait_for_app_pods_message() {
-	local app="$1"
-	local pod_count="$2"
-	local message="$3"
-	local timeout="$4"
-	local namespace="$5"
-	[ -z "$pod_count" ] && pod_count=1
-	[ -z "$timeout" ] && timeout=60
-	[ -n "$namespace" ] && namespace=" -n $namespace "
-	local pod
-	local pods
-	local i
-	SECONDS=0
-	while :; do
-		pods=($(oc get pods -l app="$app" --no-headers=true $namespace | awk '{print $1}'))
-		[ "${#pods}" -ge "$pod_count" ] && break
-		if [ "$SECONDS" -gt "$timeout" ]; then
-			echo "Unable to find ${pod_count} pods for '-l app=\"$app\"' in ${SECONDS}s (${pods[@]})"
-			return -1
-		fi
-	done
-	for pod in "${pods[@]}"; do
-		while :; do
-			local log=$(oc logs $namespace "$pod")
-			echo "$log" | grep "$message" -q && echo "Found $(echo "$log" | grep "$message") in $pod's log ($SECONDS)" && break;
-			if [ "$SECONDS" -gt "$timeout" ]; then
-				echo -n "Message '$message' not present in '${pod}' pod of the '-l app=\"$app\"' "
-				echo "pods after ${SECONDS}s (${pods[@]})"
-				echo "Pod $pod's output so far:"
-				echo "$log"
-				return -1
-			fi
-			sleep 1;
-		done
-	done
-}
-
-oc config set-context --current --namespace=default
-
-worker_nodes=$(oc get nodes |  awk '{if ($3 == "worker") { print $1 } }')
-num_nodes=$(echo $worker_nodes | wc -w)
-[ $num_nodes -ne 0 ] || \
-	die "No worker nodes detected. Something is wrong with the cluster"
-
-if [ "${KATA_WITH_SYSTEM_QEMU}" == "yes" ]; then
-	# QEMU is deployed on the workers via RCHOS extension.
-	enable_sandboxedcontainers_extension
-	oc apply -f ${deployments_dir}/configmap_installer_qemu.yaml
-fi
-
-if [ "${KATA_WITH_HOST_KERNEL}" == "yes" ]; then
-	oc apply -f ${deployments_dir}/configmap_installer_kernel.yaml
-fi
-
-apply_kata_deploy
-
-# Set SELinux to permissive mode
-if [ ${SELINUX_PERMISSIVE} == "yes" ]; then
-	info "Configuring SELinux"
-	if [ -z "$SELINUX_CONF_BASE64" ]; then
-		export SELINUX_CONF_BASE64=$(echo \
-			$(cat $configs_dir/selinux.conf|base64) | \
-			sed -e 's/\s//g')
-	fi
-	envsubst < ${deployments_dir}/machineconfig_selinux.yaml.in | \
-		oc apply -f -
-	oc get machineconfig/51-kata-selinux || \
-		die "SELinux machineconfig not found"
-	# The new SELinux configuration will trigger another reboot.
-	wait_for_reboot
-fi
-
-if [[ "$WORKAROUND_9206_CRIO" == "yes" ]]; then
-	info "Applying workaround to enable skip_mount_home in crio on OCP 4.13"
-	oc apply -f "${deployments_dir}/workaround-9206-crio.yaml"
-	oc apply -f "${deployments_dir}/workaround-9206-crio-ds.yaml"
-	wait_for_app_pods_message workaround-9206-crio-ds "$num_nodes" "Config file present" 1200 || echo "Failed to apply the workaround, proceeding anyway..."
-fi
-
-# FIXME: Remove when https://github.com/kata-containers/kata-containers/pull/8417 is resolved
-# Selinux context is currently not handled by kata-deploy
-oc apply -f ${deployments_dir}/relabel_selinux.yaml
-wait_for_app_pods_message restorecon "$num_nodes" "NSENTER_FINISHED_WITH:" 120 "kube-system" || echo "Failed to treat selinux, proceeding anyway..."

ci/openshift-ci/images/Dockerfile.buildroot

@@ -4,7 +4,7 @@
 #
 # This is the build root image for Kata Containers on OpenShift CI.
 #
-FROM quay.io/centos/centos:stream9
+FROM quay.io/centos/centos:stream8
 
 RUN yum -y update && \
     yum -y install \

ci/openshift-ci/lib.sh

@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright (c) 2023 Red Hat
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-# Ensure GOPATH set
-if command -v go > /dev/null; then
-    export GOPATH=${GOPATH:-$(go env GOPATH)}
-else
-    # if go isn't installed, set default location for GOPATH
-    export GOPATH="${GOPATH:-$HOME/go}"
-fi
-
-lib_dir=$(dirname "${BASH_SOURCE[0]}")
-source "$lib_dir/../../tests/common.bash"
-
-export katacontainers_repo=${katacontainers_repo:="github.com/kata-containers/kata-containers"}
-export katacontainers_repo_dir="${GOPATH}/src/${katacontainers_repo}"

ci/openshift-ci/run_smoke_test.sh

@@ -1,92 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Run a smoke test.
-#
-
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
-
-pod='http-server'
-
-# Create a pod.
-#
-info "Creating the ${pod} pod"
-oc apply -f ${script_dir}/smoke/${pod}.yaml || \
-	die "failed to create ${pod} pod"
-
-# Check it eventually goes to 'running'
-#
-wait_time=600
-sleep_time=5
-cmd="oc get pod/${pod} -o jsonpath='{.status.containerStatuses[0].state}' | \
-	grep running > /dev/null"
-info "Wait until the pod gets running"
-waitForProcess $wait_time $sleep_time "$cmd" || timed_out=$?
-if [ -n "$timed_out" ]; then
-	oc describe pod/${pod}
-	oc delete pod/${pod}
-	die "${pod} not running"
-fi
-info "${pod} is running"
-
-# Add a file with the hello message
-#
-hello_file=/tmp/hello
-hello_msg='Hello World'
-oc exec ${pod} -- sh -c "echo $hello_msg > $hello_file"
-
-info "Creating the service and route"
-if oc apply -f ${script_dir}/smoke/service.yaml; then
-    # Likely on OCP, use service
-    is_ocp=1
-    host=$(oc get route/http-server-route -o jsonpath={.spec.host})
-    port=80
-else
-    # Likely on plain kubernetes, test using another container
-    is_ocp=0
-    info "Failed to create service, likely not on OCP, trying via NodePort"
-    oc apply -f "${script_dir}/smoke/service_kubernetes.yaml"
-    # For some reason kcli's cluster lists external IP as internal IP, try both
-    host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="ExternalIP")].address}')
-    [ -z "$host"] && host=$(oc get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
-    port=$(oc get service/http-server-service -o jsonpath='{.spec.ports[0].nodePort}')
-fi
-
-info "Wait for the HTTP server to respond"
-tempfile=$(mktemp)
-check_cmd="curl -vvv '${host}:${port}${hello_file}' 2>&1 | tee -a '$tempfile' | grep -q '$hello_msg'"
-if waitForProcess 60 1 "${check_cmd}"; then
-    test_status=0
-    info "HTTP server is working"
-else
-    test_status=1
-    echo "::error:: HTTP server not working"
-    echo "::group::Output of the \"curl -vvv '${host}:${port}${hello_file}'\""
-    cat "${tempfile}"
-    echo "::endgroup::"
-    echo "::group::Describe kube-system namespace"
-    oc describe -n kube-system all
-    echo "::endgroup::"
-    echo "::group::Descibe current namespace"
-    oc describe all
-    echo "::endgroup::"
-    info "HTTP server is unreachable"
-fi
-rm -f "$tempfile"
-
-# Delete the resources.
-#
-info "Deleting the service/route"
-if [ "$is_ocp" -eq 0 ]; then
-    oc delete -f ${script_dir}/smoke/service_kubernetes.yaml
-else
-    oc delete -f ${script_dir}/smoke/service.yaml
-fi
-info "Deleting the ${pod} pod"
-oc delete pod/${pod} || test_status=$?
-
-exit $test_status

ci/openshift-ci/sample-test-reproducer.sh

@@ -1,50 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2024 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# A sample script to deploy, configure, run E2E_TEST and soft-cleanup
-# afterwards OCP cluster using kata-containers primarily created for use
-# with https://github.com/ldoktor/bisecter
-
-[ "$#" -ne 1 ] && echo "Provide image as the first and only argument" && exit 255
-export KATA_DEPLOY_IMAGE="$1"
-OCP_DIR="${OCP_DIR:-/path/to/your/openshift/release/}"
-E2E_TEST="${E2E_TEST:-'"[sig-node] Container Runtime blackbox test on terminated container should report termination message as empty when pod succeeds and TerminationMessagePolicy FallbackToLogsOnError is set [NodeConformance] [Conformance] [Suite:openshift/conformance/parallel/minimal] [Suite:k8s]"'}"
-KATA_CI_DIR="${KATA_CI_DIR:-$(pwd)}"
-export KATA_RUNTIME="${KATA_RUNTIME:-kata-qemu}"
-
-## SETUP
-# Deploy kata
-SETUP=0
-pushd "$KATA_CI_DIR" || { echo "Failed to cd to '$KATA_CI_DIR'"; exit 255; }
-./test.sh || SETUP=125
-cluster/deploy_webhook.sh || SETUP=125
-if [ $SETUP != 0 ]; then
-    ./cleanup.sh
-    exit "$SETUP"
-fi
-popd || true
-# Disable security
-oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts
-oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts
-oc label --overwrite ns default pod-security.kubernetes.io/enforce=privileged pod-security.kubernetes.io/warn=baseline pod-security.kubernetes.io/audit=baseline
-
-## TEST EXECUTION
-# Run the testing
-pushd "$OCP_DIR" || { echo "Failed to cd to '$OCP_DIR'"; exit 255; }
-echo "$E2E_TEST" > /tmp/tsts
-# Remove previously-existing temporarily files as well as previous results
-OUT=RESULTS/tmp
-rm -Rf /tmp/*test* /tmp/e2e-*
-rm -R $OUT
-mkdir -p $OUT
-# Run the tests ignoring the monitor health checks
-./openshift-tests run --provider azure -o "$OUT/job.log" --junit-dir "$OUT" --file /tmp/tsts --max-parallel-tests 5 --cluster-stability Disruptive
-RET=$?
-popd || true
-
-## CLEANUP
-./cleanup.sh
-exit "$RET"
-

ci/openshift-ci/smoke/http-server.yaml

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Define the pod for a http server app.
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: http-server
-  labels:
-    app: http-server-app
-spec:
-  containers:
-    - name: http-server
-      image: registry.fedoraproject.org/fedora
-      ports:
-        - containerPort: 8080
-      command: ["python3"]
-      args: [ "-m", "http.server", "8080"]
-      securityContext:
-        allowPrivilegeEscalation: false
-        capabilities:
-          drop:
-            - ALL
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-  runtimeClassName: kata-qemu

ci/openshift-ci/smoke/service.yaml

@@ -1,28 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Create the service on port 80 for the http-server app.
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: http-server-service
-spec:
-  selector:
-    app: http-server-app
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-# Create the route to the app's service '/'.
----
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: http-server-route
-spec:
-  path: "/"
-  to:
-    kind: Service
-    name: http-server-service

ci/openshift-ci/smoke/service_kubernetes.yaml

@@ -1,18 +0,0 @@
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-# Create the service on port 80 for the http-server app.
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: http-server-service
-spec:
-  selector:
-    app: http-server-app
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-  type: NodePort

ci/openshift-ci/test.sh

@@ -1,29 +0,0 @@
-#!/bin/bash
-#
-# Copyright (c) 2020 Red Hat, Inc.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
-
-script_dir=$(dirname $0)
-source ${script_dir}/lib.sh
-
-suite=$1
-if [ -z "$1" ]; then
-	suite='smoke'
-fi
-
-# Make oc and kubectl visible
-export PATH=/tmp/shared:$PATH
-
-oc version || die "Test cluster is unreachable"
-
-info "Install and configure kata into the test cluster"
-export SELINUX_PERMISSIVE="no"
-${script_dir}/cluster/install_kata.sh || die "Failed to install kata-containers"
-
-info "Run test suite: $suite"
-test_status='PASS'
-${script_dir}/run_${suite}_test.sh || test_status='FAIL'
-info "Test suite: $suite: $test_status"
-[ "$test_status" == "PASS" ]

docs/Blog-Post-Submission-Guide.md

@@ -1,86 +0,0 @@
-# Blog Post Contributor Guide
-
-This section describes the guidelines for contributing new blog posts to the
-Kata Containers website.
-
-## Share your stories on the Kata Containers website
-
-Are you experimenting with Kata Containers or have it deployed in production and
-would like to share your story as a case study? Do you have a use case that
-Kata Containers can make more secure, but the world doesn't know it yet? Do you
-have features in the runtime that you like and would like to highlight? Do you
-have a Kata Containers demo that you would like to draw attention to?
-
-Share your Kata Containers story on the [Kata Containers blog](https://www.katacontainers.io/blog/)!
-You are only a few steps away...
-
-### Kata Containers website source
-
-Like the rest of the Kata Containers artifacts, the project’s website code and
-content are stored in a [GitHub repository](https://github.com/kata-containers/www.katacontainers.io).
-
-The blog posts are written using markdown language that is mainly plain text
-with a few easy formatting conventions to create lists, add images or code blocks,
-or format the text.
-
-You can find many [cheat sheets](https://www.markdownguide.org/cheat-sheet/)
-floating on the web to get in terms of the basic syntax. You can also check the
-[source files of the already existing blog posts](https://github.com/kata-containers/www.katacontainers.io/tree/main/src/pages/blog),
-where you will find examples of all the basic items that you will need for your
-new entry.
-
-### Create a new blog post
-
-When you create a new blog post, you need to create a new file in the
-[`src/pages/blog/` folder](https://github.com/kata-containers/www.katacontainers.io/tree/main/src/pages/blog)
-with a `.md` extension.
-
-The markdown file has a few formatting conventions in its header to capture the
-title, author, publishing date and category of your blog post.
-
-The header looks like the following:
-
-```
-  ---
-  templateKey: blog-post
-  title: The Title of Your Amazing Blog Post
-  author: Your Name
-  date: 2021-01-28T16:23:52.741Z
-  category:
-    - value: category-6-wjkXzEM2
-      label: Features & Updates
-  ---
-```
-
-The categories give the possibility to filter on the web page and see only the
-blog posts that fall under one of the options. You can choose from the
-following options:
-
-* News & Announcements
-* Features & Updates
-
-The `Annual Report` category is reserved for the Kata Containers chapter in the
-Open Infrastructure Annual report that we are also re-posting on the Kata
-Containers website.
-
-Once you filled out the above fields in the header and got your one-liner all
-set, you can go ahead and type up the contents of your blog post using the
-conventional markdown formatting.
-
-If you have an image file to add, you need to place the file in the
-`static/img` folder.
-
-You can then insert the image into your blog post by using the following line:
-
-```
-  ![alt text](/img/the-file-name-of-your-image.jpg)
-```
-
-Once you are done with formatting your blog post and happy with the content, you
-need to upload it to GitHub and create a pull request. You can do that by using
-git commands on your laptop or you can also use the GitHub web interface to add
-files to the repository and create a pull request when you are ready.
-
-If you have an idea for a blog post and would like to get feedback from the
-community about it or have any questions about the process, please reach out
-on one of the community's [communication channels](https://katacontainers.io/community/).

docs/Debug-shim-guide.md

@@ -1,185 +0,0 @@
-# Using a debugger with the runtime
-
-Setting up a debugger for the runtime is pretty complex: the shim is a server
-process that is run by the runtime manager (containerd/CRI-O), and controlled by
-sending gRPC requests to it.
-Starting the shim with a debugger then just gives you a process that waits for
-commands on its socket, and if the runtime manager doesn't start it, it won't
-send request to it.
-
-A first method is to attach a debugger to the process that was started by the
-runtime manager.
-If the issue you're trying to debug is not located at container creation, this
-is probably the easiest method.
-
-The other method involves a script that is placed in between the runtime manager
-and the actual shim binary. This allows to start the shim with a debugger, and
-wait for a client debugger connection before execution, allowing debugging of the
-kata runtime from the very beginning.
-
-## Prerequisite
-
-At the time of writing, a debugger was used only with the go shim, but a similar
-process should be doable with runtime-rs. This documentation will be enhanced
-with rust-specific instructions later on.
-
-In order to debug the go runtime, you need to use the [Delve debugger](https://github.com/go-delve/delve).
-
-You will also need to build the shim binary with debug flags to make sure symbols
-are available to the debugger.
-Typically, the flags should be: `-gcflags=all=-N -l`
-
-## Attach to the running process
-
-To attach the debugger to the running process, all you need is to let the container
-start as usual, then use the following command with `dlv`:
-
-`$ dlv attach [pid of your kata shim]`
-
-If you need to use your debugger remotely, you can use the following on your target
-machine:
-
-`$ dlv attach [pid of your kata shim] --headless --listen=[IP:port]`
-
-then from your client computer:
-
-`$ dlv connect [IP:port]`
-
-## Make CRI-O/containerd start the shim with the debugger
-
-You can use the [this script](../tools/containerd-shim-katadbg-v2) to make the
-shim binary executed through a debugger, and make the debugger wait for a client
-connection before running the shim.
-This allows starting your container, connecting your debugger, and controlling the
-shim execution from the beginning.
-
-### Adapt the script to your setup
-
-You need to edit the script itself to give it the actual binary
-to execute.
-Locate the following line in the script, and set the path accordingly.
-
-```bash
-SHIM_BINARY=
-```
-
-You may also need to edit the `PATH` variable set within the script,
-to make sure that the `dlv` binary is accessible.
-
-### Configure your runtime manager to use the script
-
-Using either containerd or CRI-O, you will need to have a runtime class that
-uses the script in place of the actual runtime binary.
-To do that, we will create a separate runtime class dedicated to debugging.
-
-- **For containerd**:
-Make sure that the `containerd-shim-katadbg-v2` script is available to containerd
-(putting it in the same folder as your regular kata shim typically).
-Then edit the containerd configuration, and add the following runtime configuration,.
-
-```toml
-[plugins]
-  [plugins."io.containerd.grpc.v1.cri"]
-    [plugins."io.containerd.grpc.v1.cri".containerd]
-      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
-        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.katadbg]
-          runtime_type = "io.containerd.katadbg.v2"
-```
-
-- **For CRI-O**:
-Copy your existing kata runtime configuration from `/etc/crio/crio.conf.d/`, and
-make a new one with the name `katadbg`, and the runtime_path set to the location
-of the script.
-
-E.g:
-
-```toml
-[crio.runtime.runtimes.katadbg]
-  runtime_path = "/usr/local/bin/containerd-shim-katadbg-v2"
-  runtime_root = "/run/vc"
-  runtime_type = "vm"
-  privileged_without_host_devices = true
-  runtime_config_path = "/usr/share/defaults/kata-containers/configuration.toml"
- ```
-
-NOTE: for CRI-O, the name of the runtime class doesn't need to match the name of the
-script. But for consistency, we're using `katadbg` here too.
-
-### Start your container and connect to the debugger
-
-Once the above configuration is in place, you can start your container, using
-your `katadbg` runtime class.
-
-E.g: `$ crictl runp --runtime=katadbg sandbox.json`
-
-The command will hang, and you can see that a `dlv` process is started
-
-```
-$ ps aux | grep dlv
-root        9137  1.4  6.8 6231104 273980 pts/10 Sl   15:04   0:02 dlv exec /go/src/github.com/kata-containers/kata-containers/src/runtime/__debug_bin --headless --listen=:12345 --accept-multiclient -r stdout:/tmp/shim_output_oMC6Jo -r stderr:/tmp/shim_output_oMC6Jo -- -namespace default -address  -publish-binary /usr/local/bin/crio -id 0bc23d2208d4ff8c407a80cd5635610e772cae36c73d512824490ef671be9293 -debug start
-```
-
-Then you can use the `dlv` debugger to connect to it:
-
-```
-$ dlv connect localhost:12345
-Type 'help' for list of commands.
-(dlv)
-```
-
-Before doing anything else, you need to to enable `follow-exec` mode in delve.
-This is because the first thing that the shim will do is to daemonize itself,
-i.e: start itself as a subprocess, and exit. So you really want the debugger
-to attach to the child process.
-
-```
-(dlv) target follow-exec -on .*/__debug_bin
-```
-
-Note that we are providing a regular expression to filter the name of the binary.
-This is to make sure that the debugger attaches to the runtime shim, and not
-to other subprocesses (hypervisor typically).
-
-To ease this process, we recommand the use of an init file containing the above
-command.
-
-```
-$ cat dlv.ini
-target follow-exec -on .*/__debug_bin
-$ dlv connect localhost:12345 --init=dlv.ini
-Type 'help' for list of commands.
-(dlv)
-```
-
-Once this is done, you can set breakpoints, and use the `continue` keyword to
-start the execution of the shim.
-
-You can also use a different client, like VSCode, to connect to it.
-A typical `launch.json` configuration for VSCode would look like:
-
-```yaml
-[...]
-{
-    "name": "Connect to the debugger",
-    "type": "go",
-    "request": "attach",
-    "mode": "remote",
-    "port": 12345,
-    "host": "127.0.0.1",
-}
-[...]
-```
-
-NOTE: VSCode's go extension doesn't seem to support the `follow-exec` mode from
-Delve. So if you want to use VScode, you'll still need to use a commandline
-`dlv` client to set the `follow-exec` flag.
-
-## Caveats
-
-Debugging takes time, and there are a lot of timeouts going on in a Kubernetes
-environments. It is very possible that while you're debugging, some processes
-will timeout and cancel the container execution, possibly breaking your debugging
-session.
-
-You can mitigate that by increasing the timeouts in the different components
-involved in your environment.

docs/Developer-Guide.md

@@ -2,8 +2,6 @@
 
 This document is written **specifically for developers**: it is not intended for end users.
 
-If you want to contribute changes that you have made, please read the [community guidelines](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md) for information about our processes.
-
 # Assumptions
 
 - You are working on a non-critical test or development system.
@@ -15,22 +13,11 @@ The recommended way to create a development environment is to first
 to create a working system.
 
 The installation guide instructions will install all required Kata Containers
-components, plus a container manager, the hypervisor, and the Kata
-Containers image and guest kernel.
-
-Alternatively, you can perform a
-[manual installation](install/container-manager/containerd/containerd-install.md),
-or continue with [the instructions below](#requirements-to-build-individual-components)
-to build the Kata Containers components from source.
+components, plus *Docker*, the hypervisor, and the Kata Containers image and
+guest kernel.
 
 # Requirements to build individual components
 
-> **Note:**
->
-> If you decide to build from sources, you should be aware of the
-> implications of using an unpackaged system which will not be automatically
-> updated as new [releases](https://github.com/kata-containers/kata-containers/releases) are made available.
-
 You need to install the following to build Kata Containers components:
 
 - [golang](https://golang.org/dl)
@@ -46,41 +33,51 @@ You need to install the following to build Kata Containers components:
 - `make`.
 - `gcc` (required for building the shim and runtime).
 
-# Build and install Kata Containers
-## Build and install the Kata Containers runtime
+# Build and install the Kata Containers runtime
 
-```bash
-$ git clone https://github.com/kata-containers/kata-containers.git
-$ pushd kata-containers/src/runtime
-$ make && sudo -E "PATH=$PATH" make install
-$ sudo mkdir -p /etc/kata-containers/
-$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
-$ popd
+```
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/src/runtime
+$ make && sudo -E PATH=$PATH make install
 ```
 
 The build will create the following:
 
 - runtime binary: `/usr/local/bin/kata-runtime` and `/usr/local/bin/containerd-shim-kata-v2`
-- configuration file: `/usr/share/defaults/kata-containers/configuration.toml` and `/etc/kata-containers/configuration.toml`
+- configuration file: `/usr/share/defaults/kata-containers/configuration.toml`
+
+# Check hardware requirements
+
+You can check if your system is capable of creating a Kata Container by running the following:
+
+```
+$ sudo kata-runtime check
+```
+
+If your system is *not* able to run Kata Containers, the previous command will error out and explain why.
 
 ## Configure to use initrd or rootfs image
 
 Kata containers can run with either an initrd image or a rootfs image.
 
-If you want to test with `initrd`, make sure you have uncommented `initrd = /usr/share/kata-containers/kata-containers-initrd.img`
-in your configuration file, commenting out the `image` line in
-`/etc/kata-containers/configuration.toml`. For example:
+If you want to test with `initrd`, make sure you have `initrd = /usr/share/kata-containers/kata-containers-initrd.img`
+in your configuration file, commenting out the `image` line:
 
-```bash
+`/usr/share/defaults/kata-containers/configuration.toml` and comment out the `image` line with the following. For example:
+
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i 's/^\(image =.*\)/# \1/g' /etc/kata-containers/configuration.toml
-$ sudo sed -i 's/^# \(initrd =.*\)/\1/g' /etc/kata-containers/configuration.toml
 ```
 You can create the initrd image as shown in the [create an initrd image](#create-an-initrd-image---optional) section.
 
-If you want to test with a rootfs `image`, make sure you have uncommented `image = /usr/share/kata-containers/kata-containers.img`
+If you want to test with a rootfs `image`, make sure you have `image = /usr/share/kata-containers/kata-containers.img`
 in your configuration file, commenting out the `initrd` line. For example:
 
-```bash
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i 's/^\(initrd =.*\)/# \1/g' /etc/kata-containers/configuration.toml
 ```
 The rootfs image is created as shown in the [create a rootfs image](#create-a-rootfs-image) section.
@@ -93,38 +90,19 @@ rootfs `image`(100MB+).
 
 Enable seccomp as follows:
 
-```bash
+```
 $ sudo sed -i '/^disable_guest_seccomp/ s/true/false/' /etc/kata-containers/configuration.toml
 ```
 
 This will pass container seccomp profiles to the kata agent.
 
-## Enable SELinux on the guest
-
-> **Note:**
->
-> - To enable SELinux on the guest, SELinux MUST be also enabled on the host.
-> - You MUST create and build a rootfs image for SELinux in advance.
->   See [Create a rootfs image](#create-a-rootfs-image) and [Build a rootfs image](#build-a-rootfs-image).
-> - SELinux on the guest is supported in only a rootfs image currently, so
->   you cannot enable SELinux with the agent init (`AGENT_INIT=yes`) yet.
-
-Enable guest SELinux in Enforcing mode as follows:
-
-```
-$ sudo sed -i '/^disable_guest_selinux/ s/true/false/g' /etc/kata-containers/configuration.toml
-```
-
-The runtime automatically will set `selinux=1` to the kernel parameters and `xattr` option to
-`virtiofsd` when `disable_guest_selinux` is set to `false`.
-
-If you want to enable SELinux in Permissive mode, add `enforcing=0` to the kernel parameters.
-
 ## Enable full debug
 
 Enable full debug as follows:
 
-```bash
+```
+$ sudo mkdir -p /etc/kata-containers/
+$ sudo install -o root -g root -m 0640 /usr/share/defaults/kata-containers/configuration.toml /etc/kata-containers
 $ sudo sed -i -e 's/^# *\(enable_debug\).*=.*$/\1 = true/g' /etc/kata-containers/configuration.toml
 $ sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.log=debug initcall_debug"/g' /etc/kata-containers/configuration.toml
 ```
@@ -197,7 +175,7 @@ and offers possible workarounds and fixes.
 it stores. When messages are suppressed, it is noted in the logs. This can be checked
 for by looking for those notifications, such as:
 
-```bash
+```sh
 $ sudo journalctl --since today | fgrep Suppressed
 Jun 29 14:51:17 mymachine systemd-journald[346]: Suppressed 4150 messages from /system.slice/docker.service
 ```
@@ -222,7 +200,7 @@ RateLimitBurst=0
 
 Restart `systemd-journald` for the changes to take effect:
 
-```bash
+```sh
 $ sudo systemctl restart systemd-journald
 ```
 
@@ -236,54 +214,39 @@ $ sudo systemctl restart systemd-journald
 
 The agent is built with a statically linked `musl.` The default `libc` used is `musl`, but on `ppc64le` and `s390x`, `gnu` should be used. To configure this:
 
-```bash
-$ export ARCH="$(uname -m)"
+```
+$ export ARCH=$(uname -m)
 $ if [ "$ARCH" = "ppc64le" -o "$ARCH" = "s390x" ]; then export LIBC=gnu; else export LIBC=musl; fi
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-$ rustup target add "${ARCH}-unknown-linux-${LIBC}"
+$ [ ${ARCH} == "ppc64le" ] && export ARCH=powerpc64le
+$ rustup target add ${ARCH}-unknown-linux-${LIBC}
 ```
 
 To build the agent:
 
+```
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/src/agent && make
+```
+
 The agent is built with seccomp capability by default.
 If you want to build the agent without the seccomp capability, you need to run `make` with `SECCOMP=no` as follows.
 
-```bash
-$ make -C kata-containers/src/agent SECCOMP=no
 ```
-
-For building the agent with seccomp support using `musl`, set the environment
-variables for the [`libseccomp` crate](https://github.com/libseccomp-rs/libseccomp-rs).
-
-```bash
-$ export LIBSECCOMP_LINK_TYPE=static
-$ export LIBSECCOMP_LIB_PATH="the path of the directory containing libseccomp.a"
-$ make -C kata-containers/src/agent
+$ make -C $GOPATH/src/github.com/kata-containers/kata-containers/src/agent SECCOMP=no
 ```
 
-If the compilation fails when the agent tries to link the `libseccomp` library statically
-against `musl`, you will need to build `libseccomp` manually with `-U_FORTIFY_SOURCE`.
-You can use [our script](https://github.com/kata-containers/kata-containers/blob/main/ci/install_libseccomp.sh)
-to install `libseccomp` for the agent.
-
-```bash
-$ mkdir -p ${seccomp_install_path} ${gperf_install_path}
-$ pushd kata-containers/ci 
-$ script -fec 'sudo -E ./install_libseccomp.sh ${seccomp_install_path} ${gperf_install_path}"'
-$ export LIBSECCOMP_LIB_PATH="${seccomp_install_path}/lib"
-$ popd
-```
-
-On `ppc64le` and `s390x`, `glibc` is used. You will need to install the `libseccomp` library
-provided by your distribution.
-
-> e.g. `libseccomp-dev` for Ubuntu, or `libseccomp-devel` for CentOS
-
 > **Note:**
 >
 > - If you enable seccomp in the main configuration file but build the agent without seccomp capability,
 >   the runtime exits conservatively with an error message.
 
+## Get the osbuilder
+
+```
+$ go get -d -u github.com/kata-containers/kata-containers
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder
+```
+
 ## Create a rootfs image
 ### Create a local rootfs
 
@@ -291,32 +254,24 @@ As a prerequisite, you need to install Docker. Otherwise, you will not be
 able to run the `rootfs.sh` script with `USE_DOCKER=true` as expected in
 the following example.
 
-```bash
-$ export distro="ubuntu" # example
-$ export ROOTFS_DIR="$(realpath kata-containers/tools/osbuilder/rootfs-builder/rootfs)"
-$ sudo rm -rf "${ROOTFS_DIR}"
-$ pushd kata-containers/tools/osbuilder/rootfs-builder
-$ script -fec 'sudo -E USE_DOCKER=true ./rootfs.sh "${distro}"'
-$ popd
+```
+$ export ROOTFS_DIR=${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs
+$ sudo rm -rf ${ROOTFS_DIR}
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true ./rootfs.sh ${distro}'
 ```
 
 You MUST choose a distribution (e.g., `ubuntu`) for `${distro}`.
 You can get a supported distributions list in the Kata Containers by running the following.
 
-```bash
-$ ./kata-containers/tools/osbuilder/rootfs-builder/rootfs.sh -l
+```
+$ ./rootfs.sh -l
 ```
 
 If you want to build the agent without seccomp capability, you need to run the `rootfs.sh` script with `SECCOMP=no` as follows.
 
-```bash
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${distro}"'
 ```
-
-If you want to enable SELinux on the guest, you MUST choose `centos` and run the `rootfs.sh` script with `SELINUX=yes` as follows.
-
-```
-$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true SELINUX=yes ./rootfs.sh centos'
+$ script -fec 'sudo -E GOPATH=$GOPATH AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh ${distro}'
 ```
 
 > **Note:**
@@ -332,32 +287,18 @@ $ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true SELINUX=yes ./rootfs.sh ce
 >
 > - You should only do this step if you are testing with the latest version of the agent.
 
-```bash
-$ sudo install -o root -g root -m 0550 -t "${ROOTFS_DIR}/usr/bin" "${ROOTFS_DIR}/../../../../src/agent/target/x86_64-unknown-linux-musl/release/kata-agent"
-$ sudo install -o root -g root -m 0440 "${ROOTFS_DIR}/../../../../src/agent/kata-agent.service" "${ROOTFS_DIR}/usr/lib/systemd/system/"
-$ sudo install -o root -g root -m 0440 "${ROOTFS_DIR}/../../../../src/agent/kata-containers.target" "${ROOTFS_DIR}/usr/lib/systemd/system/"
+```
+$ sudo install -o root -g root -m 0550 -t ${ROOTFS_DIR}/usr/bin ../../../src/agent/target/x86_64-unknown-linux-musl/release/kata-agent
+$ sudo install -o root -g root -m 0440 ../../../src/agent/kata-agent.service ${ROOTFS_DIR}/usr/lib/systemd/system/
+$ sudo install -o root -g root -m 0440 ../../../src/agent/kata-containers.target ${ROOTFS_DIR}/usr/lib/systemd/system/
 ```
 
 ### Build a rootfs image
 
-```bash
-$ pushd  kata-containers/tools/osbuilder/image-builder
-$ script -fec 'sudo -E USE_DOCKER=true ./image_builder.sh "${ROOTFS_DIR}"'
-$ popd
 ```
-
-If you want to enable SELinux on the guest, you MUST run the `image_builder.sh` script with `SELINUX=yes`
-to label the guest image as follows.
-To label the image on the host, you need to make sure that SELinux is enabled (`selinuxfs` is mounted) on the host
-and the rootfs MUST be created by running the `rootfs.sh` with `SELINUX=yes`.
-
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/image-builder
+$ script -fec 'sudo -E USE_DOCKER=true ./image_builder.sh ${ROOTFS_DIR}'
 ```
-$ script -fec 'sudo -E USE_DOCKER=true SELINUX=yes ./image_builder.sh ${ROOTFS_DIR}'
-```
-
-Currently, the `image_builder.sh` uses `chcon` as an interim solution in order to apply `container_runtime_exec_t`
-to the `kata-agent`. Hence, if you run `restorecon` to the guest image after running the `image_builder.sh`,
-the `kata-agent` needs to be labeled `container_runtime_exec_t` again by yourself.
 
 > **Notes:**
 >
@@ -368,31 +309,25 @@ the `kata-agent` needs to be labeled `container_runtime_exec_t` again by yoursel
 >   variable in the previous command and ensure the `qemu-img` command is
 >   available on your system.
 >   - If `qemu-img` is not installed, you will likely see errors such as `ERROR: File /dev/loop19p1 is not a block device` and `losetup: /tmp/tmp.bHz11oY851: Warning: file is smaller than 512 bytes; the loop device may be useless or invisible for system tools`. These can be mitigated by installing the `qemu-img` command (available in the `qemu-img` package on Fedora or the `qemu-utils` package on Debian).
-> - If `loop` module is not probed, you will likely see errors such as `losetup: cannot find an unused loop device`. Execute `modprobe loop` could resolve it.
 
 
 ### Install the rootfs image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/image-builder
-$ commit="$(git log --format=%h -1 HEAD)"
-$ date="$(date +%Y-%m-%d-%T.%N%z)"
+```
+$ commit=$(git log --format=%h -1 HEAD)
+$ date=$(date +%Y-%m-%d-%T.%N%z)
 $ image="kata-containers-${date}-${commit}"
 $ sudo install -o root -g root -m 0640 -D kata-containers.img "/usr/share/kata-containers/${image}"
 $ (cd /usr/share/kata-containers && sudo ln -sf "$image" kata-containers.img)
-$ popd
 ```
 
 ## Create an initrd image - OPTIONAL
 ### Create a local rootfs for initrd image
-
-```bash
-$ export distro="ubuntu" # example
-$ export ROOTFS_DIR="$(realpath kata-containers/tools/osbuilder/rootfs-builder/rootfs)"
-$ sudo rm -rf "${ROOTFS_DIR}"
-$ pushd kata-containers/tools/osbuilder/rootfs-builder/
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./rootfs.sh "${distro}"'
-$ popd
+```
+$ export ROOTFS_DIR="${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs"
+$ sudo rm -rf ${ROOTFS_DIR}
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ script -fec 'sudo -E GOPATH=$GOPATH AGENT_INIT=yes USE_DOCKER=true ./rootfs.sh ${distro}'
 ```
 `AGENT_INIT` controls if the guest image uses the Kata agent as the guest `init` process. When you create an initrd image,
 always set `AGENT_INIT` to `yes`.
@@ -400,14 +335,14 @@ always set `AGENT_INIT` to `yes`.
 You MUST choose a distribution (e.g., `ubuntu`) for `${distro}`.
 You can get a supported distributions list in the Kata Containers by running the following.
 
-```bash
-$ ./kata-containers/tools/osbuilder/rootfs-builder/rootfs.sh -l
+```
+$ ./rootfs.sh -l
 ```
 
 If you want to build the agent without seccomp capability, you need to run the `rootfs.sh` script with `SECCOMP=no` as follows.
 
-```bash
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${distro}"'
+```
+$ script -fec 'sudo -E GOPATH=$GOPATH AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh ${distro}'
 ```
 
 > **Note:**
@@ -416,31 +351,28 @@ $ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true SECCOMP=no ./rootfs.sh "${
 
 Optionally, add your custom agent binary to the rootfs with the following commands. The default `$LIBC` used
 is `musl`, but on ppc64le and s390x, `gnu` should be used. Also, Rust refers to ppc64le as `powerpc64le`:
-```bash
-$ export ARCH="$(uname -m)"
-$ [ "${ARCH}" == "ppc64le" ] || [ "${ARCH}" == "s390x" ] && export LIBC=gnu || export LIBC=musl
-$ [ "${ARCH}" == "ppc64le" ] && export ARCH=powerpc64le
-$ sudo install -o root -g root -m 0550 -T "${ROOTFS_DIR}/../../../../src/agent/target/${ARCH}-unknown-linux-${LIBC}/release/kata-agent" "${ROOTFS_DIR}/sbin/init"
+```
+$ export ARCH=$(uname -m)
+$ [ ${ARCH} == "ppc64le" ] || [ ${ARCH} == "s390x" ] && export LIBC=gnu || export LIBC=musl
+$ [ ${ARCH} == "ppc64le" ] && export ARCH=powerpc64le
+$ sudo install -o root -g root -m 0550 -T ../../../src/agent/target/${ARCH}-unknown-linux-${LIBC}/release/kata-agent ${ROOTFS_DIR}/sbin/init
 ```
 
 ### Build an initrd image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/initrd-builder
-$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./initrd_builder.sh "${ROOTFS_DIR}"'
-$ popd
+```
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/initrd-builder
+$ script -fec 'sudo -E AGENT_INIT=yes USE_DOCKER=true ./initrd_builder.sh ${ROOTFS_DIR}'
 ```
 
 ### Install the initrd image
 
-```bash
-$ pushd kata-containers/tools/osbuilder/initrd-builder
-$ commit="$(git log --format=%h -1 HEAD)"
-$ date="$(date +%Y-%m-%d-%T.%N%z)"
+```
+$ commit=$(git log --format=%h -1 HEAD)
+$ date=$(date +%Y-%m-%d-%T.%N%z)
 $ image="kata-containers-initrd-${date}-${commit}"
 $ sudo install -o root -g root -m 0640 -D kata-containers-initrd.img "/usr/share/kata-containers/${image}"
 $ (cd /usr/share/kata-containers && sudo ln -sf "$image" kata-containers-initrd.img)
-$ popd
 ```
 
 # Install guest kernel images
@@ -450,7 +382,7 @@ You can build and install the guest kernel image as shown [here](../tools/packag
 # Install a hypervisor
 
 When setting up Kata using a [packaged installation method](install/README.md#installing-on-a-linux-system), the
-`QEMU` VMM is installed automatically. Cloud-Hypervisor, Firecracker and StratoVirt VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/README.md).
+`QEMU` VMM is installed automatically. Cloud-Hypervisor and Firecracker VMMs are available from the [release tarballs](https://github.com/kata-containers/kata-containers/releases), as well as through [`kata-deploy`](../tools/packaging/kata-deploy/README.md).
 You may choose to manually build your VMM/hypervisor.
 
 ## Build a custom QEMU
@@ -459,44 +391,44 @@ Kata Containers makes use of upstream QEMU branch. The exact version
 and repository utilized can be found by looking at the [versions file](../versions.yaml).
 
 Find the correct version of QEMU from the versions file:
-```bash
-$ source kata-containers/tools/packaging/scripts/lib.sh
-$ qemu_version="$(get_from_kata_deps ".assets.hypervisor.qemu.version")"
-$ echo "${qemu_version}"
+```
+$ source ${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging/scripts/lib.sh
+$ qemu_version=$(get_from_kata_deps "assets.hypervisor.qemu.version")
+$ echo ${qemu_version}
 ```
 Get source from the matching branch of QEMU:
-```bash
-$ git clone -b "${qemu_version}" https://github.com/qemu/qemu.git
-$ your_qemu_directory="$(realpath qemu)"
+```
+$ go get -d github.com/qemu/qemu
+$ cd ${GOPATH}/src/github.com/qemu/qemu
+$ git checkout ${qemu_version}
+$ your_qemu_directory=${GOPATH}/src/github.com/qemu/qemu
 ```
 
 There are scripts to manage the build and packaging of QEMU. For the examples below, set your
 environment as:
-```bash
-$ packaging_dir="$(realpath kata-containers/tools/packaging)"
+```
+$ go get -d github.com/kata-containers/kata-containers
+$ packaging_dir="${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging"
 ```
 
 Kata often utilizes patches for not-yet-upstream and/or backported fixes for components,
 including QEMU. These can be found in the [packaging/QEMU directory](../tools/packaging/qemu/patches),
 and it's *recommended* that you apply them. For example, suppose that you are going to build QEMU
 version 5.2.0, do:
-```bash
-$ "$packaging_dir/scripts/apply_patches.sh" "$packaging_dir/qemu/patches/5.2.x/"
+```
+$ cd $your_qemu_directory
+$ $packaging_dir/scripts/apply_patches.sh $packaging_dir/qemu/patches/5.2.x/
 ```
 
 To build utilizing the same options as Kata, you should make use of the `configure-hypervisor.sh` script. For example:
-```bash
-$ pushd "$your_qemu_directory"
-$ "$packaging_dir/scripts/configure-hypervisor.sh" kata-qemu > kata.cfg
+```
+$ cd $your_qemu_directory
+$ $packaging_dir/scripts/configure-hypervisor.sh kata-qemu > kata.cfg
 $ eval ./configure "$(cat kata.cfg)"
 $ make -j $(nproc --ignore=1)
-# Optional
 $ sudo -E make install
-$ popd
 ```
 
-If you do not want to install the respective QEMU version, the configuration file can be modified to point to the correct binary. In `/etc/kata-containers/configuration.toml`, change `path = "/path/to/qemu/build/qemu-system-x86_64"` to point to the correct QEMU binary.
-
 See the [static-build script for QEMU](../tools/packaging/static-build/qemu/build-static-qemu.sh) for a reference on how to get, setup, configure and build QEMU for Kata.
 
 ### Build a custom QEMU for aarch64/arm64 - REQUIRED
@@ -507,33 +439,11 @@ See the [static-build script for QEMU](../tools/packaging/static-build/qemu/buil
 >   under upstream review for supporting NVDIMM on aarch64.
 >
 You could build the custom `qemu-system-aarch64` as required with the following command:
-```bash
-$ git clone https://github.com/kata-containers/tests.git
-$ script -fec 'sudo -E tests/.ci/install_qemu.sh'
 ```
-
-## Build `virtiofsd`
-
-When using the file system type virtio-fs (default), `virtiofsd` is required
-
-```bash
-$ pushd kata-containers/tools/packaging/static-build/virtiofsd
-$ ./build.sh
-$ popd
+$ go get -d github.com/kata-containers/tests
+$ script -fec 'sudo -E ${GOPATH}/src/github.com/kata-containers/tests/.ci/install_qemu.sh'
 ```
 
-Modify `/etc/kata-containers/configuration.toml` and update value `virtio_fs_daemon = "/path/to/kata-containers/tools/packaging/static-build/virtiofsd/virtiofsd/virtiofsd"` to point to the binary.
-
-# Check hardware requirements
-
-You can check if your system is capable of creating a Kata Container by running the following:
-
-```bash
-$ sudo kata-runtime check
-```
-
-If your system is *not* able to run Kata Containers, the previous command will error out and explain why.
-
 # Run Kata Containers with Containerd
 Refer to the [How to use Kata Containers and Containerd](how-to/containerd-kata.md) how-to guide.
 
@@ -564,7 +474,7 @@ See [Set up a debug console](#set-up-a-debug-console).
 
 ## Checking Docker default runtime
 
-```bash
+```
 $ sudo docker info 2>/dev/null | grep -i "default runtime" | cut -d: -f2- | grep -q runc  && echo "SUCCESS" || echo "ERROR: Incorrect default Docker runtime"
 ```
 ## Set up a debug console
@@ -581,7 +491,7 @@ contain either `/bin/sh` or `/bin/bash`.
 
 Enable debug_console_enabled in the `configuration.toml` configuration file:
 
-```toml
+```
 [agent.kata]
 debug_console_enabled = true
 ```
@@ -592,7 +502,7 @@ This will pass `agent.debug_console agent.debug_console_vport=1026` to agent as
 
 For Kata Containers `2.0.x` releases, the `kata-runtime exec` command depends on the`kata-monitor` running, in order to get the sandbox's `vsock` address to connect to. Thus, first start the `kata-monitor` process.
 
-```bash
+```
 $ sudo kata-monitor
 ```
 
@@ -600,15 +510,10 @@ $ sudo kata-monitor
 
 #### Connect to debug console
 
-You need to start a container for example:
-```bash
-$ sudo ctr run  --runtime io.containerd.kata.v2 -d docker.io/library/ubuntu:latest testdebug
-```
-
-Then, you can use the command `kata-runtime exec <sandbox id>` to connect to the debug console.
+Command `kata-runtime exec` is used to connect to the debug console.
 
 ```
-$ kata-runtime exec testdebug
+$ kata-runtime exec 1a9ab65be63b8b03dfd0c75036d27f0ed09eab38abb45337fea83acd3cd7bacd
 bash-4.2# id
 uid=0(root) gid=0(root) groups=0(root)
 bash-4.2# pwd
@@ -659,10 +564,10 @@ an additional `coreutils` package.
 
 For example using CentOS:
 
-```bash
-$ pushd kata-containers/tools/osbuilder/rootfs-builder
-$ export ROOTFS_DIR="$(realpath ./rootfs)"
-$ script -fec 'sudo -E USE_DOCKER=true EXTRA_PKGS="bash coreutils" ./rootfs.sh centos'
+```
+$ cd $GOPATH/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder
+$ export ROOTFS_DIR=${GOPATH}/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs
+$ script -fec 'sudo -E GOPATH=$GOPATH USE_DOCKER=true EXTRA_PKGS="bash coreutils" ./rootfs.sh centos'
 ```
 
 #### Build the debug image
@@ -674,13 +579,12 @@ section when using rootfs, or when using initrd, complete the steps in the [Buil
 
 Install the image:
 
->**Note**: When using an initrd image, replace the below rootfs image name `kata-containers.img`
+>**Note**: When using an initrd image, replace the below rootfs image name `kata-containers.img` 
 >with the initrd image name `kata-containers-initrd.img`.
 
-```bash
+```
 $ name="kata-containers-centos-with-debug-console.img"
 $ sudo install -o root -g root -m 0640 kata-containers.img "/usr/share/kata-containers/${name}"
-$ popd
 ```
 
 Next, modify the `image=` values in the `[hypervisor.qemu]` section of the
@@ -689,7 +593,7 @@ to specify the full path to the image name specified in the previous code
 section. Alternatively, recreate the symbolic link so it points to
 the new debug image:
 
-```bash
+```
 $ (cd /usr/share/kata-containers && sudo ln -sf "$name" kata-containers.img)
 ```
 
@@ -700,7 +604,7 @@ to avoid all subsequently created containers from using the debug image.
 
 Create a container as normal. For example using `crictl`:
 
-```bash
+```
 $ sudo crictl run -r kata container.yaml pod.yaml
 ```
 
@@ -708,25 +612,25 @@ $ sudo crictl run -r kata container.yaml pod.yaml
 
 The steps required to enable debug console for QEMU slightly differ with
 those for firecracker / cloud-hypervisor.
-
+ 
 ##### Enabling debug console for QEMU
 
-Add `agent.debug_console` to the guest kernel command line to allow the agent process to start a debug console.
+Add `agent.debug_console` to the guest kernel command line to allow the agent process to start a debug console. 
 
-```bash
+```
 $ sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.debug_console"/g' "${kata_configuration_file}"
 ```
 
-Here `kata_configuration_file` could point to `/etc/kata-containers/configuration.toml`
+Here `kata_configuration_file` could point to `/etc/kata-containers/configuration.toml` 
 or `/usr/share/defaults/kata-containers/configuration.toml`
 or `/opt/kata/share/defaults/kata-containers/configuration-{hypervisor}.toml`, if
 you installed Kata Containers using `kata-deploy`.
 
 ##### Enabling debug console for cloud-hypervisor / firecracker
 
-Slightly different configuration is required in case of firecracker and cloud hypervisor.
-Firecracker and cloud-hypervisor don't have a UNIX socket connected to `/dev/console`.
-Hence, the kernel command line option `agent.debug_console` will not work for them.
+Slightly different configuration is required in case of firecracker and cloud hypervisor. 
+Firecracker and cloud-hypervisor don't have a UNIX socket connected to `/dev/console`. 
+Hence, the kernel command line option `agent.debug_console` will not work for them. 
 These hypervisors support `hybrid vsocks`,  which can be used for communication
 between the host and the guest. The kernel command line option `agent.debug_console_vport`
  was added to allow developers specify on which `vsock` port the debugging console should be connected.
@@ -734,12 +638,12 @@ between the host and the guest. The kernel command line option `agent.debug_cons
 
 Add the parameter `agent.debug_console_vport=1026` to the kernel command line
 as shown below:
-```bash
+```
 sudo sed -i -e 's/^kernel_params = "\(.*\)"/kernel_params = "\1 agent.debug_console_vport=1026"/g' "${kata_configuration_file}"
 ```
 
 > **Note** Ports 1024 and 1025 are reserved for communication with the agent
-> and gathering of agent logs respectively.
+> and gathering of agent logs respectively. 
 
 ##### Connecting to the debug console
 
@@ -747,7 +651,7 @@ Next, connect to the debug console. The VSOCKS paths vary slightly between each
 VMM solution.
 
 In case of cloud-hypervisor, connect to the `vsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/vm/${sandbox_id}/root/ && socat stdin unix-connect:clh.sock'
 CONNECT 1026
 ```
@@ -755,7 +659,7 @@ CONNECT 1026
 **Note**: You need to type `CONNECT 1026` and press `RETURN` key after entering the `socat` command.
 
 For firecracker, connect to the `hvsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/firecracker/${sandbox_id}/root/ && socat stdin unix-connect:kata.hvsock'
 CONNECT 1026
 ```
@@ -764,25 +668,20 @@ CONNECT 1026
 
 
 For QEMU, connect to the `vsock` as shown:
-```bash
+```
 $ sudo su -c 'cd /var/run/vc/vm/${sandbox_id} && socat "stdin,raw,echo=0,escape=0x11" "unix-connect:console.sock"'
 ```
 
 To disconnect from the virtual machine, type `CONTROL+q` (hold down the
 `CONTROL` key and press `q`).
 
-## Use a debugger with the runtime
-
-For developers interested in using a debugger with the runtime, please
-look at [this document](Debug-shim-guide.md).
-
 ## Obtain details of the image
 
 If the image is created using
 [osbuilder](../tools/osbuilder), the following YAML
 file exists and contains details of the image and how it was created:
 
-```bash
+```
 $ cat /var/lib/osbuilder/osbuilder.yaml
 ```
 

docs/Documentation-Requirements.md

@@ -105,7 +105,7 @@ This section lists requirements for displaying commands and command output.
 The requirements must be adhered to since documentation containing code blocks
 is validated by the CI system, which executes the command blocks with the help
 of the
-[doc-to-script](https://github.com/kata-containers/kata-containers/blob/main/tests/kata-doc-to-script.sh)
+[doc-to-script](https://github.com/kata-containers/tests/tree/main/.ci/kata-doc-to-script.sh)
 utility.
 
 - If a document includes commands the user should run, they **MUST** be shown
@@ -189,7 +189,7 @@ and compare them with standard tools (e.g. `diff(1)`).
 
 Since this project uses a number of terms not found in conventional
 dictionaries, we have a
-[spell checking tool](https://github.com/kata-containers/kata-containers/tree/main/tests/cmd/check-spelling)
+[spell checking tool](https://github.com/kata-containers/tests/tree/main/cmd/check-spelling)
 that checks both dictionary words and the additional terms we use.
 
 Run the spell checking tool on your document before raising a PR to ensure it

docs/Licensing-strategy.md

@@ -18,4 +18,4 @@ licensing and allows automated tooling to check the license of individual
 files.
 
 This SPDX licence identifier requirement is enforced by the
-[CI (Continuous Integration) system](https://github.com/kata-containers/kata-containers/blob/main/tests/static-checks.sh).
+[CI (Continuous Integration) system](https://github.com/kata-containers/tests/blob/main/.ci/static-checks.sh).

docs/Limitations.md

@@ -147,8 +147,7 @@ these commands is potentially challenging.
 See issue https://github.com/clearcontainers/runtime/issues/341 and [the constraints challenge](#the-constraints-challenge) for more information.
 
 For CPUs resource management see
-[CPU constraints(in runtime-go)](design/vcpu-handling-runtime-go.md).
-[CPU constraints(in runtime-rs)](design/vcpu-handling-runtime-rs.md).
+[CPU constraints](design/vcpu-handling.md).
 
 # Architectural limitations
 

docs/README.md

@@ -40,7 +40,6 @@ Documents that help to understand and contribute to Kata Containers.
 ### Design and Implementations
 
 * [Kata Containers Architecture](design/architecture): Architectural overview of Kata Containers
-* [Kata Containers CI](../ci/README.md): Kata Containers CI document
 * [Kata Containers E2E Flow](design/end-to-end-flow.md): The entire end-to-end flow of Kata Containers
 * [Kata Containers design](./design/README.md): More Kata Containers design documents
 * [Kata Containers threat model](./threat-model/threat-model.md): Kata Containers threat model
@@ -50,7 +49,6 @@ Documents that help to understand and contribute to Kata Containers.
 * [Developer Guide](Developer-Guide.md): Setup the Kata Containers developing environments
 * [How to contribute to Kata Containers](https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md)
 * [Code of Conduct](../CODE_OF_CONDUCT.md)
-* [How to submit a blog post](Blog-Post-Submission-Guide.md)
 
 ## Help Writing a Code PR
 
@@ -71,6 +69,7 @@ Documents that help to understand and contribute to Kata Containers.
 
 ### The Release Process
 
+* [Release strategy](Stable-Branch-Strategy.md)
 * [Release Process](Release-Process.md)
 
 ## Presentations

docs/Release-Process.md

@@ -1,76 +1,89 @@
 # How to do a Kata Containers Release
-This document lists the tasks required to create a Kata Release.
+  This document lists the tasks required to create a Kata Release.
 
 ## Requirements
 
-- GitHub permissions to run workflows.
+- [hub](https://github.com/github/hub)
+  * Using an [application token](https://github.com/settings/tokens) is required for hub (set to a GITHUB_TOKEN environment variable).
 
-## Versioning
+- GitHub permissions to push tags and create releases in Kata repositories.
 
-The Kata Containers project uses [semantic versioning](http://semver.org/) for all releases.
-Semantic versions are comprised of three fields in the form:
+- GPG configured to sign git tags. https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
 
-```
-MAJOR.MINOR.PATCH
-```
-
-When `MINOR` increases, the new release adds **new features** but *without changing the existing behavior*.
-
-When `MAJOR` increases, the new release adds **new features, bug fixes, or
-both** and which **changes the behavior from the previous release** (incompatible with previous releases).
-
-A major release will also likely require a change of the container manager version used,
--for example Containerd or CRI-O. Please refer to the release notes for further details.
-
-**Important** : the Kata Containers project doesn't have stable branches (see
-[this issue](https://github.com/kata-containers/kata-containers/issues/9064) for details).
-Bug fixes are released as part of `MINOR` or `MAJOR` releases only. `PATCH` is always `0`.
+- You should configure your GitHub to use your ssh keys (to push to branches). See https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/.
+    * As an alternative, configure hub to push and fork with HTTPS, `git config --global hub.protocol https` (Not tested yet) *
 
 ## Release Process
 
-### Bump the `VERSION` file
 
-When the `kata-containers/kata-containers` repository is ready for a new release,
-first create a PR to set the release in the `VERSION` file and have it merged.
+### Bump all Kata repositories
 
-### Check GitHub Actions
+  Bump the repositories using a script in the Kata packaging repo, where:
+  - `BRANCH=<the-branch-you-want-to-bump>`
+  - `NEW_VERSION=<the-new-kata-version>`
+  ```
+  $ cd ${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging/release
+  $ export NEW_VERSION=<the-new-kata-version>
+  $ export BRANCH=<the-branch-you-want-to-bump>
+  $ ./update-repository-version.sh -p "$NEW_VERSION" "$BRANCH"
+  ```
 
-We make use of [GitHub actions](https://github.com/features/actions) in the
-[release](https://github.com/kata-containers/kata-containers/actions/workflows/release.yaml)
-file from the `kata-containers/kata-containers` repository to build and upload
-release artifacts.
+### Point tests repository to stable branch
 
-The action is manually triggered and is responsible for generating a new
-release (including a new tag), pushing those to the
-`kata-containers/kata-containers` repository. The new release is initially
-created as a draft. It is promoted to an official release when the whole
-workflow has completed successfully.
+  If you create a new stable branch, i.e. if your release changes a major or minor version number (not a patch release), then
+  you should modify the `tests` repository to point to that newly created stable branch and not the `main` branch.
+  The objective is that changes in the CI on the main branch will not impact the stable branch.
 
-Check the [actions status
-page](https://github.com/kata-containers/kata-containers/actions) to verify all
-steps in the actions workflow have completed successfully. On success, a static
-tarball containing Kata release artifacts will be uploaded to the [Release
-page](https://github.com/kata-containers/kata-containers/releases).
+  In the test directory, change references the main branch in:
+  * `README.md`
+  * `versions.yaml`
+  * `cmd/github-labels/labels.yaml.in`
+  * `cmd/pmemctl/pmemctl.sh`
+  * `.ci/lib.sh`
+  * `.ci/static-checks.sh`
 
-If the workflow fails because of some external environmental causes, e.g. network
-timeout, simply re-run the failed jobs until they eventually succeed.
+  See the commits in [the corresponding PR for stable-2.1](https://github.com/kata-containers/tests/pull/3504) for an example of the changes.
 
-If for some reason you need to cancel the workflow or re-run it entirely, go first
-to the [Release page](https://github.com/kata-containers/kata-containers/releases) and
-delete the draft release from the previous run.
 
-### Improve the release notes
+### Merge all bump version Pull requests
 
-Release notes are auto-generated by the GitHub CLI tool used as part of our
-release workflow.  However, some manual tweaking may still be necessary in
-order to highlight the most important features and bug fixes in a specific
-release.
+  - The above step will create a GitHub pull request in the Kata projects. Trigger the CI using `/test` command on each bump Pull request.
+  - Trigger the `test-kata-deploy` workflow which is under the `Actions` tab on the repository GitHub page (make sure to select the correct branch and validate it passes).
+  - Check any failures and fix if needed.
+  - Work with the Kata approvers to verify that the CI works and the pull requests are merged.
 
-With this in mind, please, poke @channel on #kata-dev and people who worked on
-the release will be able to contribute to that.
+### Tag all Kata repositories
+
+  Once all the pull requests to bump versions in all Kata repositories are merged,
+  tag all the repositories as shown below.
+  ```
+  $ cd ${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging/release
+  $ git checkout  <kata-branch-to-release>
+  $ git pull
+  $ ./tag_repos.sh -p -b "$BRANCH" tag
+  ```
+
+### Check Git-hub Actions
+
+  We make use of [GitHub actions](https://github.com/features/actions) in this [file](../.github/workflows/release.yaml) in the `kata-containers/kata-containers` repository to build and upload release artifacts. This action is auto triggered with the above step when a new tag is pushed to the `kata-containers/kata-containers` repository.
+
+  Check the [actions status page](https://github.com/kata-containers/kata-containers/actions) to verify all steps in the actions workflow have completed successfully. On success, a static tarball containing Kata release artifacts will be uploaded to the [Release page](https://github.com/kata-containers/kata-containers/releases).
+
+### Create release notes
+
+  We have a script in place in the packaging repository to create release notes that include a short-log of the commits across Kata components.
+
+  Run the script as shown below:
+
+  ```
+  $ cd ${GOPATH}/src/github.com/kata-containers/kata-containers/tools/packaging/release
+  # Note: OLD_VERSION is where the script should start to get changes.
+  $ ./release-notes.sh ${OLD_VERSION} ${NEW_VERSION} > notes.md
+  # Edit the `notes.md` file to review and make any changes to the release notes.
+  # Add the release notes in the project's GitHub.
+  $ hub release edit -F notes.md "${NEW_VERSION}"
+  ```
 
 ### Announce the release
 
-Publish in [Slack and Kata mailing
-list](https://github.com/kata-containers/community#join-us) that new release is
-ready.
+  Publish in [Slack and Kata mailing list](https://github.com/kata-containers/community#join-us) that new release is ready.

docs/Stable-Branch-Strategy.md

@@ -0,0 +1,151 @@
+Branch and release maintenance for the Kata Containers project.
+
+## Introduction 
+
+This document provides details about Kata Containers releases.
+
+## Versioning
+
+The Kata Containers project uses [semantic versioning](http://semver.org/) for all releases. 
+Semantic versions are comprised of three fields in the form:
+
+```
+MAJOR.MINOR.PATCH
+```
+
+For examples: `1.0.0`, `1.0.0-rc.5`, and `99.123.77+foo.bar.baz.5`.
+
+Semantic versioning is used since the version number is able to convey clear 
+information about how a new version relates to the previous version. 
+For example, semantic versioning can also provide assurances to allow users to know 
+when they must upgrade compared with when they might want to upgrade:
+
+- When `PATCH` increases, the new release contains important **security fixes**
+  and an upgrade is recommended.
+
+  The patch field can contain extra details after the number. 
+Dashes denote pre-release versions. `1.0.0-rc.5` in the example denotes the fifth release
+ candidate for release `1.0.0`. Plus signs denote other details. In our example, `+foo.bar.baz.5` 
+provides additional information regarding release `99.123.77` in the previous example.
+
+- When `MINOR` increases, the new release adds **new features** but *without
+  changing the existing behavior*.
+
+- When `MAJOR` increases, the new release adds **new features, bug fixes, or
+  both** and which **changes the behavior from the previous release** (incompatible with previous releases).
+
+  A major release will also likely require a change of the container manager version used, 
+for example Containerd or CRI-O. Please refer to the release notes for further details.
+
+## Release Strategy
+
+Any new features added since the last release will be available in the next minor
+release. These will include bug fixes as well. To facilitate a stable user environment, 
+Kata provides stable branch-based releases and a main branch release.
+
+## Stable branch patch criteria
+
+No new features should be introduced to stable branches.  This is intended to limit risk to users,
+providing only bug and security fixes.
+
+## Branch Management
+Kata Containers will maintain **one** stable release branch, in addition to the main branch, for
+each active major release.
+Once a new MAJOR or MINOR release is created from main, a new stable branch is created for
+the prior MAJOR or MINOR release and the previous stable branch is no longer maintained. End of
+maintenance for a branch is announced on the Kata Containers mailing list.  Users can determine
+the version currently installed by running `kata-runtime kata-env`. It is recommended to use the
+latest stable branch available.
+
+A couple of examples follow to help clarify this process.
+
+### New bug fix introduced
+
+A bug fix is submitted against the runtime which does not introduce new inter-component dependencies.
+This fix is applied to both the main and stable branches, and there is no need to create a new
+stable branch.
+
+| Branch | Original version | New version |
+|--|--|--|
+| `main` | `2.3.0-rc0` | `2.3.0-rc1` |
+| `stable-2.2` | `2.2.0` | `2.2.1` |
+| `stable-2.1` | (unmaintained) | (unmaintained) |
+
+
+### New release made feature or change adding new inter-component dependency
+
+A new feature is introduced, which adds a new inter-component dependency. In this case a new stable
+branch is created (stable-2.3) starting from main and the previous stable branch (stable-2.2)
+is dropped from maintenance.
+
+
+| Branch | Original version | New version |
+|--|--|--|
+| `main` | `2.3.0-rc1` | `2.3.0` |
+| `stable-2.3` | N/A| `2.3.0` |
+| `stable-2.2` | `2.2.1` | (unmaintained) |
+| `stable-2.1` | (unmaintained) | (unmaintained) |
+
+Note, the stable-2.2 branch will still exist with tag 2.2.1, but under current plans it is
+not maintained further. The next tag applied to main will be 2.4.0-alpha0. We would then
+create a couple of alpha releases gathering features targeted for that particular release (in
+this case 2.4.0), followed by a release candidate. The release candidate marks a feature freeze.
+A new stable branch is created for the release candidate. Only bug fixes and any security issues
+are added to the branch going forward until release 2.4.0 is made.
+   
+## Backporting Process 
+
+Development that occurs against the main branch and applicable code commits should also be submitted
+against the stable branches. Some guidelines for this process follow::
+  1. Only bug and security fixes which do not introduce inter-component dependencies are
+ candidates for stable branches. These PRs should be marked with "bug" in GitHub.
+  2. Once a PR is created against main which meets requirement of (1), a comparable one
+ should also be submitted against the stable branches. It is the responsibility of the submitter
+ to apply their pull request against stable, and it is the responsibility of the
+ reviewers to help identify stable-candidate pull requests.
+ 
+## Continuous Integration Testing
+
+The test repository is forked to create stable branches from main. Full CI
+runs on each stable and main PR using its respective tests repository branch.
+
+### An alternative method for CI testing:
+
+Ideally, the continuous integration infrastructure will run the same test suite on both main
+and the stable branches.  When tests are modified or new feature tests are introduced, explicit
+logic should exist within the testing CI to make sure only applicable tests are executed against
+stable and main. While this is not in place currently, it should be considered in the long term.
+
+## Release Management
+
+### Patch releases
+
+Releases are made every four weeks, which include a GitHub release as
+well as binary packages. These patch releases are made for both stable branches, and a "release candidate"
+for the next `MAJOR` or `MINOR` is created from main. If there are no changes across all the repositories, no
+release is created and an announcement is made on the developer mailing list to highlight this.
+If a release is being made, each repository is tagged for this release, regardless
+of whether changes are introduced. The release schedule can be seen on the
+[release rotation wiki page](https://github.com/kata-containers/community/wiki/Release-Team-Rota).
+
+If there is urgent need for a fix, a patch release will be made outside of the planned schedule.
+
+The process followed for making a release can be found at [Release Process](Release-Process.md).
+
+## Minor releases
+
+###  Frequency
+Minor releases are less frequent in order to provide a more stable baseline for users. They are currently
+running on a sixteen weeks cadence. The release schedule can be seen on the
+[release rotation wiki page](https://github.com/kata-containers/community/wiki/Release-Team-Rota).
+
+### Compatibility
+Kata guarantees compatibility between components that are within one minor release of each other. 
+ 
+This is critical for dependencies which cross between host (shimv2 runtime) and
+the guest (hypervisor, rootfs and agent).  For example, consider a cluster with a long-running
+deployment, workload-never-dies, all on Kata version 2.1.3 components. If the operator updates
+the Kata components to the next new minor release (i.e. 2.2.0), we need to guarantee that the 2.2.0
+shimv2 runtime still communicates with 2.1.3 agent within workload-never-dies.
+
+Handling live-update is out of the scope of this document. See this [`kata-runtime` issue](https://github.com/kata-containers/runtime/issues/492) for details.

docs/Upgrading.md

@@ -14,6 +14,9 @@ period of time, once a stable release for Kata Containers 2.x is published,
 Kata Containers 1.x stable users should consider switching to the Kata 2.x
 release.
 
+See the [stable branch strategy documentation](Stable-Branch-Strategy.md) for
+further details.
+
 # Determine current version
 
 To display the current Kata Containers version, run one of the following:

docs/code-pr-advice.md

@@ -171,9 +171,10 @@ allows you to think about what types of value to test.
 
 ### Other categories of test
 
-Raised a GitHub issue in the Kata Containers repository that
+Raised a GitHub issue in the
+[`tests`](https://github.com/kata-containers/tests) repository that
 explains what sort of test is required along with as much detail as
-possible. Ensure the original issue is referenced in the issue.
+possible. Ensure the original issue is referenced on the `tests` issue.
 
 ### Unsafe code
 
@@ -228,13 +229,13 @@ maintenance issue.
 ### Markdown syntax
 
 Run the
-[markdown checker](https://github.com/kata-containers/kata-containers/tree/main/tests/cmd/check-markdown)
+[markdown checker](https://github.com/kata-containers/tests/tree/main/cmd/check-markdown)
 on your documentation changes.
 
 ### Spell check
 
 Run the
-[spell checker](https://github.com/kata-containers/kata-containers/tree/main/tests/cmd/check-spelling)
+[spell checker](https://github.com/kata-containers/tests/tree/main/cmd/check-spelling)
 on your documentation changes.
 
 ## Finally

docs/design/README.md

@@ -6,19 +6,13 @@ Kata Containers design documents:
 - [API Design of Kata Containers](kata-api-design.md)
 - [Design requirements for Kata Containers](kata-design-requirements.md)
 - [VSocks](VSocks.md)
-- [VCPU handling(in runtime-go)](vcpu-handling-runtime-go.md)
-- [VCPU handling(in runtime-rs)](vcpu-handling-runtime-rs.md)
-- [VCPU threads pinning](vcpu-threads-pinning.md)
+- [VCPU handling](vcpu-handling.md)
 - [Host cgroups](host-cgroups.md)
-- [Agent systemd cgroup](agent-systemd-cgroup.md)
 - [`Inotify` support](inotify.md)
-- [`Hooks` support](hooks-handling.md)
 - [Metrics(Kata 2.0)](kata-2-0-metrics.md)
-- [Metrics in Rust Runtime(runtime-rs)](kata-metrics-in-runtime-rs.md)
 - [Design for Kata Containers `Lazyload` ability with `nydus`](kata-nydus-design.md)
 - [Design for direct-assigned volume](direct-blk-device-assignment.md)
 - [Design for core-scheduling](core-scheduling.md)
-- [Virtualization Reference Architecture](kata-vra.md)
 ---
 
 - [Design proposals](proposals)

docs/design/VSocks.md

@@ -78,4 +78,4 @@ with the containers is if the VM itself or the `containerd-shim-kata-v2` dies, i
 the containers are removed automatically.
 
 [1]: https://wiki.qemu.org/Features/VirtioVsock
-[2]: ./vcpu-handling-runtime-go.md#virtual-cpus-and-kubernetes-pods
+[2]: ./vcpu-handling.md#virtual-cpus-and-kubernetes-pods

docs/design/agent-systemd-cgroup.md

@@ -1,84 +0,0 @@
-# Systemd Cgroup for Agent
-
-As we know, we can interact with cgroups in two ways, **`cgroupfs`** and **`systemd`**. The former is achieved by reading and writing cgroup `tmpfs` files under `/sys/fs/cgroup` while the latter is done by configuring a transient unit by requesting systemd. Kata agent uses **`cgroupfs`** by default, unless you pass the parameter `--systemd-cgroup`.
-
-## usage
-
-For systemd, kata agent configures cgroups according to the following `linux.cgroupsPath` format standard provided by `runc` (`[slice]:[prefix]:[name]`). If you don't provide a valid `linux.cgroupsPath`, kata agent will treat it as `"system.slice:kata_agent:<container-id>"`. 
-
-> Here slice is a systemd slice under which the container is placed. If empty, it defaults to system.slice, except when cgroup v2 is used and rootless container is created, in which case it defaults to user.slice.
->
-> Note that slice can contain dashes to denote a sub-slice (e.g. user-1000.slice is a correct notation, meaning a `subslice` of user.slice), but it must not contain slashes (e.g. user.slice/user-1000.slice is invalid).
->
-> A slice of `-` represents a root slice.
->
-> Next, prefix and name are used to compose the unit name, which is `<prefix>-<name>.scope`, unless name has `.slice` suffix, in which case prefix is ignored and the name is used as is.
-
-## supported properties
-
-The kata agent will translate the parameters in the `linux.resources` of `config.json` into systemd unit properties, and send it to systemd for configuration. Since systemd supports limited properties, only the following parameters in `linux.resources` will be applied. We will simply treat hybrid mode as legacy mode by the way.
-
-- CPU
-
-  - v1
-
-  | runtime spec resource | systemd property name |
-  | --------------------- | --------------------- |
-  | `cpu.shares`          | `CPUShares`           |
-
-  - v2
-
-  | runtime spec resource      | systemd property name      |
-  | -------------------------- | -------------------------- |
-  | `cpu.shares`               | `CPUShares`                |
-  | `cpu.period`               | `CPUQuotaPeriodUSec`(v242) |
-  | `cpu.period` & `cpu.quota` | `CPUQuotaPerSecUSec`       |
-
-- MEMORY
-
-  - v1
-
-  | runtime spec resource | systemd property name |
-  | --------------------- | --------------------- |
-  | `memory.limit`        | `MemoryLimit`         |
-
-  - v2
-
-  | runtime spec resource          | systemd property name |
-  | ------------------------------ | --------------------- |
-  | `memory.low`                   | `MemoryLow`           |
-  | `memory.max`                   | `MemoryMax`           |
-  | `memory.swap` & `memory.limit` | `MemorySwapMax`       |
-
-- PIDS
-
-  | runtime spec resource | systemd property name |
-  | --------------------- | --------------------- |
-  | `pids.limit `         | `TasksMax`            |
-
-- CPUSET
-
-  | runtime spec resource | systemd property name      |
-  | --------------------- | -------------------------- |
-  | `cpuset.cpus`         | `AllowedCPUs`(v244)        |
-  | `cpuset.mems`         | `AllowedMemoryNodes`(v244) |
-
-## Systemd Interface
-
-`session.rs` and `system.rs` in `src/agent/rustjail/src/cgroups/systemd/interface` are automatically generated by `zbus-xmlgen`, which is is an accompanying tool provided by `zbus` to generate Rust code from `D-Bus XML interface descriptions`. The specific commands to generate these two files are as follows: 
-
-```shell
-// system.rs
-zbus-xmlgen --system org.freedesktop.systemd1 /org/freedesktop/systemd1
-// session.rs
-zbus-xmlgen --session org.freedesktop.systemd1 /org/freedesktop/systemd1
-```
-
-The current implementation of `cgroups/systemd` uses `system.rs` while `session.rs` could be used to build rootless containers in the future.
-
-## references
-
-- [runc - systemd cgroup driver](https://github.com/opencontainers/runc/blob/main/docs/systemd.md)
-
-- [systemd.resource-control  — Resource control unit settings](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html)
-