diff --git a/SPECS/kata-containers-cc/0001-Enable-using-an-igvm-file-with-cloud-hypervisor.patch b/SPECS/kata-containers-cc/0001-Enable-using-an-igvm-file-with-cloud-hypervisor.patch new file mode 100644 index 00000000000..fa1fff4cd45 --- /dev/null +++ b/SPECS/kata-containers-cc/0001-Enable-using-an-igvm-file-with-cloud-hypervisor.patch @@ -0,0 +1,431 @@ +From 4f3d39c4a536e4ddfcecd79cd465e313b6c9ec79 Mon Sep 17 00:00:00 2001 +From: Dallas Delaney +Date: Thu, 29 Jun 2023 00:19:46 +0000 +Subject: [PATCH] Enable using an igvm file with cloud-hypervisor + +--- + src/runtime/pkg/katautils/config.go | 35 ++++++++++++++++-- + src/runtime/virtcontainers/clh.go | 37 +++++++++++++------ + src/runtime/virtcontainers/hypervisor.go | 13 +++++++ + .../virtcontainers/hypervisor_config_linux.go | 8 ++-- + .../pkg/annotations/annotations.go | 5 +++ + .../cloud-hypervisor/client/api/openapi.yaml | 5 +++ + .../client/model_payload_config.go | 37 +++++++++++++++++++ + .../cloud-hypervisor/cloud-hypervisor.yaml | 2 + + src/runtime/virtcontainers/types/asset.go | 6 +++ + 9 files changed, 129 insertions(+), 19 deletions(-) + +diff --git a/src/runtime/pkg/katautils/config.go b/src/runtime/pkg/katautils/config.go +index 51bf23a29..c70420419 100644 +--- a/src/runtime/pkg/katautils/config.go ++++ b/src/runtime/pkg/katautils/config.go +@@ -78,6 +78,7 @@ type factory struct { + } + + type hypervisor struct { ++ Igvm string `toml:"igvm"` + Path string `toml:"path"` + JailerPath string `toml:"jailer_path"` + Kernel string `toml:"kernel"` +@@ -244,11 +245,25 @@ func (h hypervisor) jailerPath() (string, error) { + return ResolvePath(p) + } + ++func (h hypervisor) igvm() (string, error) { ++ p := h.Igvm ++ ++ if p == "" { ++ return "", nil ++ } ++ ++ return ResolvePath(p) ++} ++ + func (h hypervisor) kernel() (string, error) { + p := h.Kernel + + if p == "" { +- p = defaultKernelPath ++ if h.Igvm == "" { ++ p = defaultKernelPath ++ } else { ++ return "", nil ++ } + } + + return ResolvePath(p) +@@ -987,9 +1002,9 @@ func newClhHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) { + return vc.HypervisorConfig{}, err + } + +- if image == "" && initrd == "" { +- return vc.HypervisorConfig{}, +- errors.New("image or initrd must be defined in the configuration file") ++ igvm, err := h.igvm() ++ if err != nil { ++ return vc.HypervisorConfig{}, err + } + + rootfsType, err := h.rootfsType() +@@ -997,6 +1012,11 @@ func newClhHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) { + return vc.HypervisorConfig{}, err + } + ++ if image == "" && initrd == "" && igvm == "" { ++ return vc.HypervisorConfig{}, ++ errors.New("image, initrd, or igvm must be defined in the configuration file") ++ } ++ + firmware, err := h.firmware() + if err != nil { + return vc.HypervisorConfig{}, err +@@ -1031,6 +1051,7 @@ func newClhHypervisorConfig(h hypervisor) (vc.HypervisorConfig, error) { + KernelPath: kernel, + InitrdPath: initrd, + ImagePath: image, ++ IgvmPath: igvm, + RootfsType: rootfsType, + FirmwarePath: firmware, + MachineAccelerators: machineAccelerators, +@@ -1163,6 +1184,8 @@ func updateRuntimeConfigHypervisor(configPath string, tomlConf tomlConfig, confi + case clhHypervisorTableType: + config.HypervisorType = vc.ClhHypervisor + hConfig, err = newClhHypervisorConfig(hypervisor) ++ ++ + case dragonballHypervisorTableType: + config.HypervisorType = vc.DragonballHypervisor + hConfig, err = newDragonballHypervisorConfig(hypervisor) +@@ -1207,6 +1230,10 @@ func SetKernelParams(runtimeConfig *oci.RuntimeConfig) error { + kataUtilsLogger.WithField("default-kernel-parameters", formatted).Debug() + } + ++ strParams := vc.SerializeParams(defaultKernelParams, "=") ++ formatted := strings.Join(strParams, " ") ++ kataUtilsLogger.WithField("default-kernel-parameters", formatted).Debug() ++ + // retrieve the parameters specified in the config file + userKernelParams := runtimeConfig.HypervisorConfig.KernelParams + +diff --git a/src/runtime/virtcontainers/clh.go b/src/runtime/virtcontainers/clh.go +index 95917f3a8..24cd1e967 100644 +--- a/src/runtime/virtcontainers/clh.go ++++ b/src/runtime/virtcontainers/clh.go +@@ -476,12 +476,21 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net + // Create the VM config via the constructor to ensure default values are properly assigned + clh.vmconfig = *chclient.NewVmConfig(*chclient.NewPayloadConfig()) + +- // Make sure the kernel path is valid +- kernelPath, err := clh.config.KernelAssetPath() ++ // Make sure the igvm path is valid ++ igvmPath, err := clh.config.IgvmAssetPath() + if err != nil { + return err + } +- clh.vmconfig.Payload.SetKernel(kernelPath) ++ clh.vmconfig.Payload.SetIgvm(igvmPath) ++ ++ // Make sure the kernel path is valid if no igvm set ++ if igvmPath == "" { ++ kernelPath, err := clh.config.KernelAssetPath() ++ if err != nil { ++ return err ++ } ++ clh.vmconfig.Payload.SetKernel(kernelPath) ++ } + + if clh.config.ConfidentialGuest { + if err := clh.enableProtection(); err != nil { +@@ -495,7 +504,7 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net + clh.vmconfig.Memory.Shared = func(b bool) *bool { return &b }(true) + // Enable hugepages if needed + clh.vmconfig.Memory.Hugepages = func(b bool) *bool { return &b }(clh.config.HugePages) +- if !clh.config.ConfidentialGuest { ++ if !clh.config.ConfidentialGuest && igvmPath == "" { + hotplugSize := clh.config.DefaultMaxMemorySize + // OpenAPI only supports int64 values + clh.vmconfig.Memory.HotplugSize = func(i int64) *int64 { return &i }(int64((utils.MemUnit(hotplugSize) * utils.MiB).ToBytes())) +@@ -525,7 +534,10 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net + // Followed by extra kernel parameters defined in the configuration file + params = append(params, clh.config.KernelParams...) + +- clh.vmconfig.Payload.SetCmdline(kernelParamsToString(params)) ++ // Set kernel cmdline if no IGVM file set ++ if igvmPath == "" { ++ clh.vmconfig.Payload.SetCmdline(kernelParamsToString(params)) ++ } + + // set random device generator to hypervisor + clh.vmconfig.Rng = chclient.NewRngConfig(clh.config.EntropySource) +@@ -561,12 +573,14 @@ func (clh *cloudHypervisor) CreateVM(ctx context.Context, id string, network Net + clh.vmconfig.Pmem = &[]chclient.PmemConfig{*pmem} + } + } +- } else { +- initrdPath, err := clh.config.InitrdAssetPath() +- if err != nil { +- return err +- } ++ } ++ ++ initrdPath, err := clh.config.InitrdAssetPath() ++ if err != nil { ++ return err ++ } + ++ if initrdPath != "" { + clh.vmconfig.Payload.SetInitramfs(initrdPath) + } + +@@ -1317,6 +1331,7 @@ func (clh *cloudHypervisor) launchClh() (int, error) { + } + + args := []string{cscAPIsocket, clh.state.apiSocket} ++ + if clh.config.Debug { + // Cloud hypervisor log levels + // 'v' occurrences increase the level +@@ -1348,9 +1363,9 @@ func (clh *cloudHypervisor) launchClh() (int, error) { + } + + clh.Logger().WithField("path", clhPath).Info() +- clh.Logger().WithField("args", strings.Join(args, " ")).Info() + + cmdHypervisor := exec.Command(clhPath, args...) ++ + if clh.config.Debug { + cmdHypervisor.Env = os.Environ() + cmdHypervisor.Env = append(cmdHypervisor.Env, "RUST_BACKTRACE=full") +diff --git a/src/runtime/virtcontainers/hypervisor.go b/src/runtime/virtcontainers/hypervisor.go +index d0ecb1259..7c23db734 100644 +--- a/src/runtime/virtcontainers/hypervisor.go ++++ b/src/runtime/virtcontainers/hypervisor.go +@@ -317,6 +317,7 @@ type HypervisorConfig struct { + KernelPath string + ImagePath string + InitrdPath string ++ IgvmPath string + FirmwarePath string + FirmwareVolumePath string + MachineAccelerators string +@@ -493,6 +494,8 @@ func (conf *HypervisorConfig) assetPath(t types.AssetType) (string, error) { + return conf.KernelPath, nil + case types.ImageAsset: + return conf.ImagePath, nil ++ case types.IgvmAsset: ++ return conf.IgvmPath, nil + case types.InitrdAsset: + return conf.InitrdPath, nil + case types.HypervisorAsset: +@@ -535,6 +538,16 @@ func (conf *HypervisorConfig) CustomImageAsset() bool { + return conf.isCustomAsset(types.ImageAsset) + } + ++// IgvmAssetPath returns the guest image path ++func (conf *HypervisorConfig) IgvmAssetPath() (string, error) { ++ return conf.assetPath(types.IgvmAsset) ++} ++ ++// CustomIgvmAsset returns true if the image asset is a custom one, false otherwise. ++func (conf *HypervisorConfig) CustomIgvmAsset() bool { ++ return conf.isCustomAsset(types.IgvmAsset) ++} ++ + // InitrdAssetPath returns the guest initrd path + func (conf *HypervisorConfig) InitrdAssetPath() (string, error) { + return conf.assetPath(types.InitrdAsset) +diff --git a/src/runtime/virtcontainers/hypervisor_config_linux.go b/src/runtime/virtcontainers/hypervisor_config_linux.go +index 4a2d33e20..5aa57ae11 100644 +--- a/src/runtime/virtcontainers/hypervisor_config_linux.go ++++ b/src/runtime/virtcontainers/hypervisor_config_linux.go +@@ -17,8 +17,8 @@ func validateHypervisorConfig(conf *HypervisorConfig) error { + return nil + } + +- if conf.KernelPath == "" { +- return fmt.Errorf("Missing kernel path") ++ if conf.KernelPath == "" && conf.IgvmPath == "" { ++ return fmt.Errorf("Missing kernel and igvm path") + } + + if conf.ConfidentialGuest && conf.HypervisorMachineType == QemuCCWVirtio { +@@ -26,8 +26,8 @@ func validateHypervisorConfig(conf *HypervisorConfig) error { + fmt.Println("yes, failing") + return fmt.Errorf("Neither the image or initrd path may be set for Secure Execution") + } +- } else if conf.ImagePath == "" && conf.InitrdPath == "" { +- return fmt.Errorf("Missing image and initrd path") ++ } else if conf.ImagePath == "" && conf.InitrdPath == "" && conf.IgvmPath == "" { ++ return fmt.Errorf("Missing image, initrd, and igvm path") + } else if conf.ImagePath != "" && conf.InitrdPath != "" { + return fmt.Errorf("Image and initrd path cannot be both set") + } +diff --git a/src/runtime/virtcontainers/pkg/annotations/annotations.go b/src/runtime/virtcontainers/pkg/annotations/annotations.go +index e4c201a00..876f8b7a2 100644 +--- a/src/runtime/virtcontainers/pkg/annotations/annotations.go ++++ b/src/runtime/virtcontainers/pkg/annotations/annotations.go +@@ -37,6 +37,9 @@ const ( + // ImagePath is a sandbox annotation for passing a per container path pointing at the guest image that will run in the container VM. + ImagePath = kataAnnotHypervisorPrefix + "image" + ++ // ImagePath is a sandbox annotation for passing a per container path pointing at the guest image that will run in the container VM. ++ IgvmPath = kataAnnotHypervisorPrefix + "igvm" ++ + // InitrdPath is a sandbox annotation for passing a per container path pointing at the guest initrd image that will run in the container VM. + InitrdPath = kataAnnotHypervisorPrefix + "initrd" + +@@ -65,6 +68,8 @@ const ( + // ImageHash is an sandbox annotation for passing a container guest image SHA-512 hash value. + ImageHash = kataAnnotHypervisorPrefix + "image_hash" + ++ IgvmHash = kataAnnotHypervisorPrefix + "igvm_hash" ++ + // InitrdHash is an sandbox annotation for passing a container guest initrd SHA-512 hash value. + InitrdHash = kataAnnotHypervisorPrefix + "initrd_hash" + +diff --git a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml +index 750c1e725..28150f8ef 100644 +--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml ++++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml +@@ -642,6 +642,7 @@ components: + cmdline: cmdline + kernel: kernel + initramfs: initramfs ++ igvm: igvm + firmware: firmware + serial: + mode: "false" +@@ -776,6 +777,7 @@ components: + cmdline: cmdline + kernel: kernel + initramfs: initramfs ++ igvm: igvm + firmware: firmware + properties: + firmware: +@@ -786,6 +788,8 @@ components: + type: string + initramfs: + type: string ++ igvm: ++ type: string + type: object + VmConfig: + description: Virtual machine configuration +@@ -1004,6 +1008,7 @@ components: + cmdline: cmdline + kernel: kernel + initramfs: initramfs ++ igvm: igvm + firmware: firmware + serial: + mode: "false" +diff --git a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go +index 5029c92d9..84b98d5ce 100644 +--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go ++++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_payload_config.go +@@ -20,6 +20,7 @@ type PayloadConfig struct { + Kernel *string `json:"kernel,omitempty"` + Cmdline *string `json:"cmdline,omitempty"` + Initramfs *string `json:"initramfs,omitempty"` ++ Igvm *string `json:"igvm,omitempty"` + } + + // NewPayloadConfig instantiates a new PayloadConfig object +@@ -39,6 +40,39 @@ func NewPayloadConfigWithDefaults() *PayloadConfig { + return &this + } + ++// GetIgvm returns the Igvm field value if set, zero value otherwise. ++func (o *PayloadConfig) GetIgvm() string { ++ if o == nil || o.Igvm == nil { ++ var ret string ++ return ret ++ } ++ return *o.Igvm ++} ++ ++// GetIgvmOk returns a tuple with the Igvm field value if set, nil otherwise ++// and a boolean to check if the value has been set. ++func (o *PayloadConfig) GetIgvmOk() (*string, bool) { ++ if o == nil || o.Igvm == nil { ++ return nil, false ++ } ++ return o.Igvm, true ++} ++ ++// HasIgvm returns a boolean if a field has been set. ++func (o *PayloadConfig) HasIgvm() bool { ++ if o != nil && o.Igvm != nil { ++ return true ++ } ++ ++ return false ++} ++ ++// SetIgvm gets a reference to the given string and assigns it to the Igvm field. ++func (o *PayloadConfig) SetIgvm(v string) { ++ o.Igvm = &v ++} ++ ++ + // GetFirmware returns the Firmware field value if set, zero value otherwise. + func (o *PayloadConfig) GetFirmware() string { + if o == nil || o.Firmware == nil { +@@ -169,6 +203,9 @@ func (o *PayloadConfig) SetInitramfs(v string) { + + func (o PayloadConfig) MarshalJSON() ([]byte, error) { + toSerialize := map[string]interface{}{} ++ if o.Igvm != nil { ++ toSerialize["igvm"] = o.Igvm ++ } + if o.Firmware != nil { + toSerialize["firmware"] = o.Firmware + } +diff --git a/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml b/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml +index dee8bdbf0..61b455b25 100644 +--- a/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml ++++ b/src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml +@@ -510,6 +510,8 @@ components: + type: string + initramfs: + type: string ++ igvm: ++ type: string + description: Payloads to boot in guest + + VmConfig: +diff --git a/src/runtime/virtcontainers/types/asset.go b/src/runtime/virtcontainers/types/asset.go +index 3b00b5a20..7e4b0105e 100644 +--- a/src/runtime/virtcontainers/types/asset.go ++++ b/src/runtime/virtcontainers/types/asset.go +@@ -25,6 +25,9 @@ const ( + // ImageAsset is an image asset. + ImageAsset AssetType = "image" + ++ // IgvmAsset is an image asset. ++ IgvmAsset AssetType = "igvm" ++ + // InitrdAsset is an initrd asset. + InitrdAsset AssetType = "initrd" + +@@ -53,6 +56,7 @@ func AssetTypes() []AssetType { + HypervisorAsset, + HypervisorCtlAsset, + ImageAsset, ++ IgvmAsset, + InitrdAsset, + JailerAsset, + KernelAsset, +@@ -82,6 +86,8 @@ func (t AssetType) Annotations() (string, string, error) { + return annotations.KernelPath, annotations.KernelHash, nil + case ImageAsset: + return annotations.ImagePath, annotations.ImageHash, nil ++ case IgvmAsset: ++ return annotations.IgvmPath, annotations.IgvmHash, nil + case InitrdAsset: + return annotations.InitrdPath, annotations.InitrdHash, nil + case HypervisorAsset: +-- +2.33.8 + diff --git a/SPECS/kata-containers-cc/kata-containers-cc.signatures.json b/SPECS/kata-containers-cc/kata-containers-cc.signatures.json index a3b4f25a816..8ef69885cc9 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.signatures.json +++ b/SPECS/kata-containers-cc/kata-containers-cc.signatures.json @@ -1,8 +1,7 @@ { "Signatures": { - "kata-containers-cc-0.4.1.tar.gz": "25ba6117341208d9de2208aa50881f22496ba64ae3a5f16fddbccce36f8a0de8", - "kata-containers-cc-0.4.1-cargo.tar.gz": "cc037d5a3f4a1290386693b9a7780b364ec02552c43611fb31195547d8ad71aa", - "mariner-coco-build-uvm-rootfs.sh" :"3968664bc3655ec77b846bcd233307fdb45b8281341e208d1d88fa5b88e28076", - "mariner-coco-build-uvm-image.sh": "3672dd7f8c90e3d9e754b5b5ecffa9816339a30fd4770a4cd96c66af945cd9ef" + "kata-containers-cc-0.4.2.tar.gz": "a56e971383c5871b4a43dbc0de4e4650fa560765afb89dc6a8f39f13a8377c53", + "kata-containers-cc-0.4.2-cargo.tar.gz": "13e391e5957f29aedbfe6914443c1de5f5d1eeaa57ff689704b21040fb87a500", + "mariner-coco-build-uvm.sh" :"347dd3189332066fc739cd6fc6f4c43bf583e174003ac997705ebca65e8d8ac9" } } diff --git a/SPECS/kata-containers-cc/kata-containers-cc.spec b/SPECS/kata-containers-cc/kata-containers-cc.spec index 76a2a99be34..e8f2ec5564f 100644 --- a/SPECS/kata-containers-cc/kata-containers-cc.spec +++ b/SPECS/kata-containers-cc/kata-containers-cc.spec @@ -1,5 +1,4 @@ -%global runtime_make_vars DEFSERVICEOFFLOAD=true \\\ - DEFSTATICRESOURCEMGMT=true \\\ +%global runtime_make_vars DEFSTATICRESOURCEMGMT=true \\\ SKIP_GO_VERSION_CHECK=1 %global agent_make_vars LIBC=gnu @@ -7,8 +6,8 @@ %global debug_package %{nil} Name: kata-containers-cc -Version: 0.4.1 -Release: 3%{?dist} +Version: 0.4.2 +Release: 1%{?dist} Summary: Kata Confidential Containers License: ASL 2.0 Vendor: Microsoft Corporation @@ -16,8 +15,9 @@ URL: https://github.com/microsoft/kata-containers Source0: https://github.com/microsoft/kata-containers/archive/refs/tags/cc-%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: https://github.com/microsoft/kata-containers/archive/refs/tags/%{name}-%{version}.tar.gz Source2: %{name}-%{version}-cargo.tar.gz -Source3: mariner-coco-build-uvm-image.sh -Source4: mariner-coco-build-uvm-rootfs.sh +Source3: mariner-coco-build-uvm.sh + +Patch0: 0001-Enable-using-an-igvm-file-with-cloud-hypervisor.patch ExclusiveArch: x86_64 @@ -34,6 +34,9 @@ BuildRequires: perl-lib BuildRequires: libseccomp-devel BuildRequires: kernel-uvm-devel BuildRequires: openssl-devel +BuildRequires: clang +BuildRequires: device-mapper-devel +BuildRequires: cmake Requires: kernel-uvm Requires: moby-containerd-cc @@ -62,6 +65,7 @@ popd %build export PATH=$PATH:"$(pwd)/go/bin" export GOPATH="$(pwd)/go" +export OPENSSL_NO_VENDOR=1 # Runtime pushd %{_builddir}/%{name}-%{version}/src/runtime @@ -89,7 +93,6 @@ popd # Agent pushd %{_builddir}/%{name}-%{version}/src/agent -export OPENSSL_NO_VENDOR=1 %make_build %{agent_make_vars} popd @@ -114,11 +117,13 @@ pushd %{_builddir}/%{name}-%{version} rm tools/osbuilder/.gitignore rm tools/osbuilder/rootfs-builder/.gitignore -install -D -m 0755 %{SOURCE3} %{buildroot}%{osbuilder}/mariner-coco-build-uvm-image.sh -install -D -m 0755 %{SOURCE4} %{buildroot}%{osbuilder}/mariner-coco-build-uvm-rootfs.sh +install -D -m 0755 %{SOURCE3} %{buildroot}%{osbuilder}/mariner-coco-build-uvm.sh install -D -m 0644 VERSION %{buildroot}%{osbuilder}/VERSION install -D -m 0644 ci/install_yq.sh %{buildroot}%{osbuilder}/ci/install_yq.sh install -D -m 0644 versions.yaml %{buildroot}%{osbuilder}/versions.yaml +install -D -m 0644 tools/osbuilder/Makefile %{buildroot}%{osbuilder}/tools/osbuilder/Makefile + +sed -i 's#distro_config_dir="${script_dir}/${distro}#distro_config_dir="${script_dir}/cbl-mariner#g' tools/osbuilder/rootfs-builder/rootfs.sh cp -aR tools/osbuilder/rootfs-builder %{buildroot}%{osbuilder}/tools/osbuilder cp -aR tools/osbuilder/initrd-builder %{buildroot}%{osbuilder}/tools/osbuilder cp -aR tools/osbuilder/scripts %{buildroot}%{osbuilder}/tools/osbuilder @@ -141,7 +146,6 @@ pushd %{_builddir}/%{name}-%{version}/src/agent mkdir -p %{buildroot}%{osbuilder}/src/agent/samples/policy cp -aR samples/policy/all-allowed %{buildroot}%{osbuilder}/src/agent/samples/policy -install -D -m 0755 mount_tar.sh %{buildroot}%{osbuilder}/src/agent/mount_tar.sh install -D -m 0755 kata-containers.target %{buildroot}%{osbuilder}/kata-containers.target install -D -m 0755 kata-agent.service.in %{buildroot}%{osbuilder}/kata-agent.service.in install -D -m 0755 coco-opa.service %{buildroot}%{osbuilder}/coco-opa.service @@ -204,10 +208,8 @@ install -D -m 0755 %{_builddir}/%{name}-%{version}/tools/osbuilder/image-builder %dir %{osbuilder}/src/agent/samples/policy/all-allowed %{osbuilder}/src/agent/samples/policy/all-allowed/all-allowed-data.json %{osbuilder}/src/agent/samples/policy/all-allowed/all-allowed.rego -%{osbuilder}/src/agent/mount_tar.sh -%{osbuilder}/mariner-coco-build-uvm-image.sh -%{osbuilder}/mariner-coco-build-uvm-rootfs.sh +%{osbuilder}/mariner-coco-build-uvm.sh %{osbuilder}/kata-containers.target %{osbuilder}/kata-agent.service.in %{osbuilder}/coco-opa.service @@ -232,8 +234,11 @@ install -D -m 0755 %{_builddir}/%{name}-%{version}/tools/osbuilder/image-builder %changelog -* Thu Jun 15 2023 CBL-Mariner Servicing Account - 0.4.1-3 -- Bump release to rebuild with go 1.19.10 +* Thu Jun 29 2023 Dallas Delaney 0.4.2-1 +- Upgrade to version 0.4.2 for new snapshotter and policy features + +* Thu Jun 15 2023 CBL-Mariner Servicing Account - 0.4.1-3 +- Bump release to rebuild with go 1.19.10 * Wed May 24 2023 Dallas Delaney 0.4.1-2 - Enable static resource management and build with host's openssl diff --git a/SPECS/kata-containers-cc/mariner-coco-build-uvm-image.sh b/SPECS/kata-containers-cc/mariner-coco-build-uvm-image.sh deleted file mode 100755 index 64dae99371e..00000000000 --- a/SPECS/kata-containers-cc/mariner-coco-build-uvm-image.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash -# Copyright (c) Microsoft Corporation. -# Licensed under the MIT License. - -set -e -set -o errexit - -[ -n "${DEBUG:-}" ] && set -o xtrace - -readonly SCRIPT_DIR=$(dirname "$(readlink -f "$0")") -readonly IMAGE_BUILD_ROOT=`mktemp --directory -t mariner-coco-build-uvm-image-XXXXXX` - -generate_image() -{ - pushd "${IMAGE_BUILD_ROOT}" - - gcc -O2 ${ROOT_FOLDER}/opt/mariner/share/uvm/tools/osbuilder/image-builder/nsdax.gpl.c \ - -o ${IMAGE_BUILD_ROOT}/nsdax - - # build image - sudo \ - NSDAX_BIN=${IMAGE_BUILD_ROOT}/nsdax \ - ${ROOT_FOLDER}/opt/mariner/share/uvm/tools/osbuilder/image-builder/image_builder.sh \ - ${ROOT_FOLDER}/rootfs-cbl-mariner - - sudo cp kata-containers.img $OUT_DIR - - popd - sudo rm -rf "${IMAGE_BUILD_ROOT}" -} - - -while getopts ":r:o:" OPTIONS; do - case "${OPTIONS}" in - r ) ROOT_FOLDER=$OPTARG ;; - o ) OUT_DIR=$OPTARG ;; - - \? ) - echo "Error - Invalid Option: -$OPTARG" 1>&2 - exit 1 - ;; - : ) - echo "Error - Invalid Option: -$OPTARG requires an argument" 1>&2 - exit 1 - ;; - esac -done - -echo "-- ROOT_FOLDER: $ROOT_FOLDER" -echo "-- OUT_DIR: $OUT_DIR" - -generate_image $* diff --git a/SPECS/kata-containers-cc/mariner-coco-build-uvm-rootfs.sh b/SPECS/kata-containers-cc/mariner-coco-build-uvm.sh similarity index 64% rename from SPECS/kata-containers-cc/mariner-coco-build-uvm-rootfs.sh rename to SPECS/kata-containers-cc/mariner-coco-build-uvm.sh index 39609da6458..2d353653ff3 100755 --- a/SPECS/kata-containers-cc/mariner-coco-build-uvm-rootfs.sh +++ b/SPECS/kata-containers-cc/mariner-coco-build-uvm.sh @@ -8,7 +8,7 @@ set -o errexit readonly SCRIPT_DIR=$(dirname "$(readlink -f "$0")") readonly ROOTFS_DIR=${SCRIPT_DIR}/tools/osbuilder/rootfs-builder/rootfs-cbl-mariner -readonly ROOTFS_TARGET=/opt/mariner/share/uvm +readonly OSBUILDER_DIR=${SCRIPT_DIR}/tools/osbuilder export AGENT_SOURCE_BIN=${SCRIPT_DIR}/kata-agent # get kernel modules version @@ -18,17 +18,22 @@ export KERNEL_MODULES_DIR=${SCRIPT_DIR}/modules/${KERNEL_MODULES_VER} popd # build rootfs -sudo -E PATH=$PATH ./tools/osbuilder/rootfs-builder/rootfs.sh cbl-mariner +pushd ${OSBUILDER_DIR} +sudo make clean +rm -rf ${ROOTFS_DIR} +sudo -E PATH=$PATH make -B DISTRO=cbl-mariner rootfs +popd # run depmod for kernel modules depmod -a -b ${ROOTFS_DIR} ${KERNEL_MODULES_VER} # install other services -cp ${SCRIPT_DIR}/coco-opa.service ${ROOTFS_DIR}/usr/lib/systemd/system/ -cp ${SCRIPT_DIR}/kata-containers.target ${ROOTFS_DIR}/usr/lib/systemd/system/ +cp ${SCRIPT_DIR}/coco-opa.service ${ROOTFS_DIR}/usr/lib/systemd/system/coco-opa.service +cp ${SCRIPT_DIR}/kata-containers.target ${ROOTFS_DIR}/usr/lib/systemd/system/kata-containers.target cp ${SCRIPT_DIR}/kata-agent.service.in ${ROOTFS_DIR}/usr/lib/systemd/system/kata-agent.service -sudo sed -i 's/@BINDIR@\/@AGENT_NAME@/\/usr\/bin\/kata-agent/g' ${ROOTFS_DIR}/usr/lib/systemd/system/kata-agent.service +sed -i 's/@BINDIR@\/@AGENT_NAME@/\/usr\/bin\/kata-agent/g' ${ROOTFS_DIR}/usr/lib/systemd/system/kata-agent.service -pushd ${ROOTFS_TARGET} -sudo mv ${ROOTFS_DIR} . +# build initrd +pushd ${OSBUILDER_DIR} +sudo -E PATH=$PATH make DISTRO=cbl-mariner TARGET_ROOTFS=${ROOTFS_DIR} initrd popd diff --git a/cgmanifest.json b/cgmanifest.json index 685c21c8bec..260526f0ffb 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -8051,8 +8051,8 @@ "type": "other", "other": { "name": "kata-containers-cc", - "version": "0.4.1", - "downloadUrl": "https://github.com/microsoft/kata-containers/archive/refs/tags/cc-0.4.1.tar.gz" + "version": "0.4.2", + "downloadUrl": "https://github.com/microsoft/kata-containers/archive/refs/tags/cc-0.4.2.tar.gz" } } },