github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-25 22:49:59 +00:00
Code Issues Projects Releases Wiki Activity
Files
qemu-refactor-phase4
kata-containers/tests/integration/kubernetes/runtimeclass_workloads
History
Manuel Huber 9b5897bc55 kata-deploy: shift erofs dm-verity mode to on 
dmverity_mode=auto can preserve existing EROFS layers without
dm-verity metadata, which lets mixed-mode nodes keep running with
partially unprotected image layers.

Use dmverity_mode=on when kata-deploy enables EROFS dm-verity so
missing metadata is reported instead of silently accepted.

Also tighten the Kubernetes probe. Instead of checking for at least one
dm-verity line and one EROFS dm mount in dmesg, derive the expected
workload layer count from the root overlay lowerdirs and require matching
kata-verity devices and dm-backed EROFS mounts.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>
2026-07-14 18:07:32 +00:00
..
confidential
tests: parametrize storage parameters
2026-04-01 10:22:26 +02:00
cryptsetup
tests: Add test for trusted ephemeral data storage
2026-03-09 14:52:17 -05:00
numa
tests: Add NUMA topology / GPU placement tests to the NV CIs
2026-05-24 22:00:46 +02:00
openvpn
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
stress
…
busybox-pod.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
busybox-template.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
configmap.yaml
…
cron-job.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
custom-node-debugger.yaml
…
default-initdata.toml
…
footloose-configmap.yaml
…
initContainer-shared-volume.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
initcontainer-shareprocesspid.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
inject_secret.yaml
…
inotify-configmap-pod.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
inotify-configmap.yaml
…
inotify-updated-configmap.yaml
…
job-template.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
job.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
k8s-layered-sc-deployment.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
k8s-pod-sc-deployment.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
k8s-pod-sc-nobodyupdate-deployment.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
k8s-pod-sc-supplementalgroups-deployment.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
k8s-policy-configmap.yaml
…
k8s-policy-deployment.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
k8s-policy-hard-coded.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
k8s-policy-job.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
k8s-policy-pod-pvc.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
k8s-policy-pod.yaml
genpolicy: support pod-level resources
2026-06-16 15:30:22 +02:00
k8s-policy-pvc.yaml
…
k8s-policy-rc.yaml
genpolicy: ignore preemptionPolicy
2026-05-06 00:35:27 +00:00
k8s-policy-set-keys.rego
…
k8s-policy-set-keys.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
k8s-priority-class.yaml
tests: Make editorconfig-checker happy
2026-02-10 21:58:28 +01:00
kata-runtimeclass.yaml
…
lifecycle-events.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
limit-range.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
nginx-deployment.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
no-layer-image.yaml
runtime: DEFDISABLEBLOCK := true
2026-01-28 19:47:49 +01:00
numa-topology-gpu-test.yaml.in
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
numa-topology-test.yaml.in
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
nvidia-cuda-vectoradd.yaml.in
tests: nvidia: Always rely on the "kata" default runtime class
2025-12-12 16:31:42 +01:00
nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
nvidia-nim-llama-3-1-8b-instruct.yaml.in
tests: nvidia: Do not use elevated privileges
2026-04-01 10:23:26 -07:00
nvidia-nim-llama-3-2-1b-instruct-service-tee.yaml.in
tests: nvidia: onboard NIM service test
2026-04-02 16:58:54 +02:00
nvidia-nim-llama-3-2-1b-instruct-service.yaml.in
tests: nvidia: onboard NIM service test
2026-04-02 16:58:54 +02:00
nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
nvidia-nim-llama-3-2-nv-embedqa-1b-v2.yaml.in
tests: nvidia: Do not use elevated privileges
2026-04-01 10:23:26 -07:00
pod-attestable-gpu.yaml.in
tests: Clean up superfluous GPU annotation
2026-02-09 11:28:24 -08:00
pod-attestable.yaml.in
tests: nvidia: cc: Add attestation test
2025-12-05 11:48:55 +01:00
pod-besteffort.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-block-pv.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-burstable.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-caps.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-confidential-unencrypted.yaml
…
pod-config.yaml.in
…
pod-configmap-volume.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-configmap.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-cpu-defaults.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-cpu.yaml
tests: harden sandbox sizing manifests for k8s cpu workloads
2026-06-25 13:56:11 +02:00
pod-custom-dns.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-empty-dir-fsgroup.yaml.in
tests: generate policy for pod-empty-dir-fsgroup
2026-04-01 10:23:26 -07:00
pod-empty-dir.yaml
tests: test emptyDir sizeLimit eviction with virtio-fs
2026-06-30 09:10:00 -05:00
pod-env.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-erofs-dmverity-probe.yaml
kata-deploy: shift erofs dm-verity mode to on
2026-07-14 18:07:32 +00:00
pod-file-volume.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-footloose.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-graceful-termination.yaml
agent: send SIGTERM only to root container process on container deletion
2026-07-13 22:39:42 +02:00
pod-guaranteed.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-guest-pull-in-trusted-storage.yaml.in
runtime-rs: size static sandboxes with overhead values
2026-06-25 13:56:11 +02:00
pod-hostname.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-hostpath-kmsg.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-http-liveness.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-hugepage.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
pod-istio.yaml
…
pod-liveness.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-memory-limit.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
pod-nested-configmap-secret.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-number-cpu.yaml
tests: add supplementalGroups to pod-number-cpu for guest-pull
2026-06-30 15:50:15 +02:00
pod-oom.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
pod-optional-empty-configmap.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-optional-empty-secret.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-plain-ephemeral-data-storage.yaml.in
tests: cover block-plain emptyDir storage
2026-06-26 21:05:51 +00:00
pod-privileged.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-projected-volume.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-quota-deployment.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-readonly-volume.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-sandbox-cgroup.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-sandbox-vcpus-allocation.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-sealed-secret-as-file.yaml
…
pod-sealed-secret.yaml
tests: Make editorconfig-checker happy
2026-02-10 21:58:28 +01:00
pod-seccomp.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-secret-env.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-secret.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-security-context.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
pod-shared-volume.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-smb-volume.yaml
ci: Introduce smb server test
2026-04-23 21:04:46 -05:00
pod-sysctl.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-tcp-liveness.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-termination-log-fail.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-termination-log-success.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pod-trusted-ephemeral-data-storage.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pv-pod.yaml
tests: pin identity in policy workloads
2026-06-25 23:40:36 +00:00
pv-volume.yaml
…
redis-master-deployment.yaml
tests: use limits for Kata workload manifests
2026-06-19 09:38:15 -07:00
redis-master-service.yaml
…
replication-controller.yaml
tests: Remove terminationGracePeriod in manifests
2026-01-23 16:18:44 -08:00
resource-quota.yaml
…
smb-server.yaml
ci: Introduce smb server test
2026-04-23 21:04:46 -05:00
tests-namespace.yaml
…
volume-claim.yaml
…