mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-10-21 20:08:54 +00:00
Use AGENT_POLICY=yes when building the Guest images, and add a permissive test policy to the k8s tests for: - CBL-Mariner - SEV - SNP - TDX Also, add an example of policy rejecting ExecProcessRequest. Fixes: #7667 Signed-off-by: Dan Mihai <dmihai@microsoft.com>
174 lines
3.5 KiB
Bash
Executable File
174 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Copyright (c) 2018 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
[ -z "${DEBUG}" ] || set -x
|
|
|
|
set -o errexit
|
|
set -o nounset
|
|
set -o pipefail
|
|
|
|
readonly script_name="$(basename "${BASH_SOURCE[0]}")"
|
|
readonly script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
readonly packaging_root_dir="$(cd "${script_dir}/../" && pwd)"
|
|
|
|
source "${packaging_root_dir}/scripts/lib.sh"
|
|
|
|
readonly osbuilder_dir="$(cd "${repo_root_dir}/tools/osbuilder" && pwd)"
|
|
|
|
export GOPATH=${GOPATH:-${HOME}/go}
|
|
|
|
ARCH=${ARCH:-$(uname -m)}
|
|
if [ $(uname -m) == "${ARCH}" ]; then
|
|
arch_target="$(uname -m)"
|
|
else
|
|
arch_target="${ARCH}"
|
|
fi
|
|
|
|
final_artifact_name="kata-containers"
|
|
image_initrd_extension=".img"
|
|
|
|
build_initrd() {
|
|
info "Build initrd"
|
|
info "initrd os: $os_name"
|
|
info "initrd os version: $os_version"
|
|
sudo -E PATH="$PATH" make initrd \
|
|
DISTRO="$os_name" \
|
|
DEBUG="${DEBUG:-}" \
|
|
OS_VERSION="${os_version}" \
|
|
ROOTFS_BUILD_DEST="${builddir}/initrd-image" \
|
|
USE_DOCKER=1 \
|
|
AGENT_INIT="yes" \
|
|
AGENT_POLICY="${AGENT_POLICY:-}"
|
|
mv "kata-containers-initrd.img" "${install_dir}/${artifact_name}"
|
|
(
|
|
cd "${install_dir}"
|
|
ln -sf "${artifact_name}" "${final_artifact_name}${image_initrd_extension}"
|
|
)
|
|
}
|
|
|
|
build_image() {
|
|
info "Build image"
|
|
info "image os: $os_name"
|
|
info "image os version: $os_version"
|
|
sudo -E PATH="${PATH}" make image \
|
|
DISTRO="${os_name}" \
|
|
DEBUG="${DEBUG:-}" \
|
|
USE_DOCKER="1" \
|
|
IMG_OS_VERSION="${os_version}" \
|
|
ROOTFS_BUILD_DEST="${builddir}/rootfs-image" \
|
|
AGENT_POLICY="${AGENT_POLICY:-}"
|
|
mv -f "kata-containers.img" "${install_dir}/${artifact_name}"
|
|
if [ -e "root_hash.txt" ]; then
|
|
cp root_hash.txt "${install_dir}/"
|
|
fi
|
|
(
|
|
cd "${install_dir}"
|
|
ln -sf "${artifact_name}" "${final_artifact_name}${image_initrd_extension}"
|
|
)
|
|
}
|
|
|
|
usage() {
|
|
return_code=${1:-0}
|
|
cat <<EOF
|
|
Create image and initrd in a tarball for kata containers.
|
|
Use it to build an image to distribute kata.
|
|
|
|
Usage:
|
|
${script_name} [options]
|
|
|
|
Options:
|
|
--osname=${os_name}
|
|
--osversion=${os_version}
|
|
--imagetype=${image_type}
|
|
--prefix=${prefix}
|
|
--destdir=${destdir}
|
|
--image_initrd_suffix=${image_initrd_suffix}
|
|
EOF
|
|
|
|
exit "${return_code}"
|
|
}
|
|
|
|
main() {
|
|
image_type=image
|
|
destdir="$PWD"
|
|
prefix="/opt/kata"
|
|
image_suffix=""
|
|
image_initrd_suffix=""
|
|
builddir="${PWD}"
|
|
while getopts "h-:" opt; do
|
|
case "$opt" in
|
|
-)
|
|
case "${OPTARG}" in
|
|
osname=*)
|
|
os_name=${OPTARG#*=}
|
|
;;
|
|
osversion=*)
|
|
os_version=${OPTARG#*=}
|
|
;;
|
|
imagetype=image)
|
|
image_type=image
|
|
;;
|
|
imagetype=initrd)
|
|
image_type=initrd
|
|
;;
|
|
image_initrd_suffix=*)
|
|
image_initrd_suffix=${OPTARG#*=}
|
|
;;
|
|
prefix=*)
|
|
prefix=${OPTARG#*=}
|
|
;;
|
|
destdir=*)
|
|
destdir=${OPTARG#*=}
|
|
;;
|
|
builddir=*)
|
|
builddir=${OPTARG#*=}
|
|
;;
|
|
*)
|
|
echo >&2 "ERROR: Invalid option -$opt${OPTARG}"
|
|
usage 1
|
|
;;
|
|
esac
|
|
;;
|
|
h) usage 0 ;;
|
|
*)
|
|
echo "Invalid option $opt"
|
|
usage 1
|
|
;;
|
|
esac
|
|
done
|
|
readonly destdir
|
|
readonly builddir
|
|
|
|
echo "build ${image_type}"
|
|
|
|
if [ "${image_type}" = "initrd" ]; then
|
|
final_artifact_name+="-initrd"
|
|
fi
|
|
|
|
if [ -n "${image_initrd_suffix}" ]; then
|
|
artifact_name="kata-${os_name}-${os_version}-${image_initrd_suffix}.${image_type}"
|
|
final_artifact_name+="-${image_initrd_suffix}"
|
|
else
|
|
artifact_name="kata-${os_name}-${os_version}.${image_type}"
|
|
fi
|
|
|
|
install_dir="${destdir}/${prefix}/share/kata-containers/"
|
|
readonly install_dir
|
|
|
|
mkdir -p "${install_dir}"
|
|
|
|
pushd "${osbuilder_dir}"
|
|
case "${image_type}" in
|
|
initrd) build_initrd ;;
|
|
image) build_image ;;
|
|
esac
|
|
|
|
popd
|
|
}
|
|
|
|
main $*
|