mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-12 10:16:48 +00:00
bd93a93990
During the transition to composable (base + extension) CoCo images, run the
two runtimes on different image layouts so CI exercises both paths via
the existing qemu-{snp,tdx,coco-dev} (Go) and -runtime-rs (Rust) shims:
- runtime-rs (Rust) CoCo templates use the standard base image plus a
CoCo extension extra_image:
image = "@IMAGEPATH@" (was @IMAGECONFIDENTIALPATH@)
[[hypervisor.qemu.guest_extension_images]]
name = "coco"
path = "@COCOIMAGEPATH@"
verity_params = "@COCOVERITYPARAMS@"
COCOIMAGENAME/COCOIMAGEPATH/COCOVERITYPARAMS are added to the
runtime-rs Makefile only.
- runtime (Go) CoCo templates keep the monolithic confidential image
(@IMAGECONFIDENTIALPATH@) and pull rootfs-image-confidential.
shim-components.json reflects this: Go CoCo shims depend on
rootfs-image-confidential while the runtime-rs CoCo shims depend on
rootfs-image + rootfs-image-coco-extension.
shim-v2/build.sh feeds each runtime its own dm-verity params: Rust gets
the measured base image hash (@KERNELVERITYPARAMS@) plus the extension hash
(@COCOVERITYPARAMS@); Go gets the monolithic confidential image hash
(@KERNELVERITYPARAMS@). This is wired per make invocation so the same
@KERNELVERITYPARAMS@ placeholder resolves correctly for each.
Once the split path is validated we can flip the Go templates too and
drop the monolithic confidential image.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>
92 lines
4.9 KiB
JSON
92 lines
4.9 KiB
JSON
{
|
|
"_comment": [
|
|
"Maps each runtime class to the component tarballs it requires per architecture.",
|
|
"All names correspond directly to kata-static-<name>.tar.zst build artifacts."
|
|
],
|
|
"shims": {
|
|
"qemu": {
|
|
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-go", "qemu", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd", "ovmf"],
|
|
"s390x": ["shim-v2-go", "qemu", "virtiofsd", "kernel", "rootfs-image", "rootfs-initrd"],
|
|
"ppc64le": ["shim-v2-go", "qemu", "virtiofsd", "kernel", "rootfs-initrd"]
|
|
},
|
|
"qemu-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-rust", "qemu", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd", "ovmf"],
|
|
"s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-image", "rootfs-initrd"]
|
|
},
|
|
"qemu-snp": {
|
|
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel", "rootfs-image-confidential", "ovmf-sev"]
|
|
},
|
|
"qemu-snp-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-sev"]
|
|
},
|
|
"qemu-tdx": {
|
|
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel", "rootfs-image-confidential", "ovmf-tdx"]
|
|
},
|
|
"qemu-tdx-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "virtiofsd", "kernel", "rootfs-image", "rootfs-image-coco-extension", "ovmf-tdx"]
|
|
},
|
|
"qemu-se": {
|
|
"s390x": ["shim-v2-go", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
|
|
},
|
|
"qemu-se-runtime-rs": {
|
|
"s390x": ["shim-v2-rust", "qemu", "virtiofsd", "kernel", "rootfs-initrd-confidential", "boot-image-se"]
|
|
},
|
|
"qemu-nvidia-gpu": {
|
|
"x86_64": ["shim-v2-go", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
|
|
},
|
|
"qemu-nvidia-gpu-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu", "virtiofsd", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu", "ovmf"]
|
|
},
|
|
"qemu-nvidia-gpu-snp": {
|
|
"x86_64": ["shim-v2-go", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
|
|
},
|
|
"qemu-nvidia-gpu-snp-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu-snp-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-sev"]
|
|
},
|
|
"qemu-nvidia-gpu-tdx": {
|
|
"x86_64": ["shim-v2-go", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
|
|
},
|
|
"qemu-nvidia-gpu-tdx-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu-tdx-experimental", "kernel-nvidia-gpu", "rootfs-image-nvidia-gpu-confidential", "ovmf-tdx"]
|
|
},
|
|
"qemu-coco-dev": {
|
|
"x86_64": ["shim-v2-go", "qemu", "kernel", "kernel-debug", "rootfs-image-confidential"],
|
|
"s390x": ["shim-v2-go", "qemu", "kernel", "rootfs-image-confidential"]
|
|
},
|
|
"qemu-coco-dev-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension"],
|
|
"aarch64": ["shim-v2-rust", "qemu", "kernel", "kernel-debug", "rootfs-image", "rootfs-image-coco-extension", "ovmf"],
|
|
"s390x": ["shim-v2-rust", "qemu", "kernel", "rootfs-image", "rootfs-image-coco-extension"]
|
|
},
|
|
"clh": {
|
|
"x86_64": ["shim-v2-go", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-go", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"]
|
|
},
|
|
"clh-azure": {
|
|
"x86_64": ["shim-v2-go", "cloud-hypervisor", "virtiofsd", "kernel", "kernel-debug", "rootfs-image-mariner"]
|
|
},
|
|
"clh-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-rust", "cloud-hypervisor", "virtiofsd", "nydus", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"]
|
|
},
|
|
"clh-azure-runtime-rs": {
|
|
"x86_64": ["shim-v2-rust", "cloud-hypervisor", "virtiofsd", "kernel", "kernel-debug", "rootfs-image-mariner"]
|
|
},
|
|
"dragonball": {
|
|
"x86_64": ["shim-v2-rust", "virtiofsd", "nydus", "kernel-dragonball-experimental", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-rust", "virtiofsd", "nydus", "kernel-dragonball-experimental", "rootfs-image", "rootfs-initrd"]
|
|
},
|
|
"fc": {
|
|
"x86_64": ["shim-v2-go", "firecracker", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"],
|
|
"aarch64": ["shim-v2-go", "firecracker", "kernel", "kernel-debug", "rootfs-image", "rootfs-initrd"]
|
|
},
|
|
"remote": {
|
|
"x86_64": ["shim-v2-go"],
|
|
"ppc64le": ["shim-v2-go"],
|
|
"s390x": ["shim-v2-go"]
|
|
}
|
|
}
|
|
}
|