Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adapt code for vanilla Kata #154

Merged
merged 4 commits into from
Feb 14, 2024
Merged

Adapt code for vanilla Kata #154

merged 4 commits into from
Feb 14, 2024

Conversation

sprt
Copy link
Collaborator

@sprt sprt commented Jan 24, 2024 •
edited
Loading

Merge Checklist
  • Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format
    • Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own.
  • Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar)
  • genPolicy only: Ensured the tool still builds on Windows
  • genPolicy only: Updated sample YAMLs' policy annotations, if applicable
  • The upstream-missing label (or upstream-not-needed) has been set on the PR.
Summary

Turns out we can start vanilla Kata pods pretty much out of the box with msft-main. This PR just tweaks the vanilla config file and patches the runtime to unblock the debug console. I'm surprised we still need the runtime change, but I've verified the debug console doesn't work without that patch.

See microsoft/azurelinux#6942 for specs changes.

Test Methodology

@danmihai1 @sprt
runtime: fix error when using the debug console
5952d30 
This fixes the below error when attempting to access the debug console when
all debug_console_enabled=true and all 3 enable_debug options are true:

level=error msg="error create pseudo tty" error="open /dev/ptmx: operation not
permitted"

Signed-off-by: Aurelien Bombo <abombo@microsoft.com>
@sprt sprt added the upstream/missing PRs that are yet to be upstreamed label Jan 24, 2024
@sprt
config: don't hardcode confidential_guest=true for clh
fb4c887 
Doesn't make sense for non-TEEs and was only a remnant of cc-msft-prototypes.
This will have to be taken into account in microsoft/azurelinux#6942.

[upstream-merged] Already done this way upstream.

Signed-off-by: Aurélien Bombo <abombo@microsoft.com>
@sprt sprt force-pushed the sprt/align-vanilla-sources branch from 4be2127 to fb4c887 Compare January 24, 2024 17:47
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 24, 2024
@sprt
kata-containers: adapt for msft-main sources
3daa9ec 
* Requires the new Rust virtiosfd 1.8.0.

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Cleans up runtime make flags:
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 24, 2024
@sprt
kata-containers: adapt for msft-main sources
1944a18 
* Requires the new Rust virtiosfd 1.8.0.

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do not have a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 24, 2024
@sprt
kata-containers: adapt for msft-main sources
c20754a 
* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Requires the new Rust virtiosfd 1.8.0.

* Adds BuildRequires for devmapper code paths in msft-main.

* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular, so it'd become out of sync
  with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag as
  well for good measure.
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 24, 2024
@sprt
kata-containers: adapt for msft-main sources
f55179c 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular, so it'd become out of sync
  with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag as
  well for good measure.
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 24, 2024
@sprt
kata-containers: adapt for msft-main sources
330f23a 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular file, so it'd become out of
  sync with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag
  as well for good measure.
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 25, 2024
@sprt
kata-containers: adapt for msft-main sources
dd2456d 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular file, so it'd become out of
  sync with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag
  as well for good measure.
@sprt sprt mentioned this pull request Jan 25, 2024
Merged
12 tasks
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 25, 2024
@sprt
kata-containers: adapt for msft-main sources
7436e69 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular file, so it'd become out of
  sync with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag
  as well for good measure.
@sprt
rootfs-builder: only look for AGENT_POLICY_FILE if AGENT_POLICY=yes
b4ab11d 
When the rootfs is built with AGENT_POLICY=no, the build fails at
line 36 for us, since our package build does not have access to the
entire source at once. Rather, we only copy the directories that we
think we'll need (and we missed that one). TBA in a future packaging
change.

[upstream-not-needed] Upstream isn't affected as they build with
the whole code base.

Signed-off-by: Aurelien Bombo <abombo@microsoft.com>
@sprt sprt force-pushed the sprt/align-vanilla-sources branch from 7729400 to b4ab11d Compare January 31, 2024 17:23
sprt added a commit to microsoft/azurelinux that referenced this pull request Jan 31, 2024
@sprt
kata-containers: adapt for msft-main sources
80c733e 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular file, so it'd become out of
  sync with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag
  as well for good measure.
@sprt sprt marked this pull request as ready for review January 31, 2024 17:47
@sprt sprt requested review from a team as code owners January 31, 2024 17:47
@sprt sprt marked this pull request as draft February 5, 2024 20:30
@sprt sprt force-pushed the sprt/align-vanilla-sources branch 2 times, most recently from fcf3b08 to b4ab11d Compare February 12, 2024 20:58
@sprt
runtime: make sev_snp_guest default to false
ca1b9a7 
Fixes a remnant of cc-msft-prototypes. This will
require a change in the kata-containers-cc spec.

[upstream-not-needed]

Signed-off-by: Aurelien Bombo <abombo@microsfot.com>
sprt added a commit to microsoft/azurelinux that referenced this pull request Feb 12, 2024
@sprt
kata-containers: adapt for msft-main sources
9130f64 
* Cleans up runtime make flags:
  * Set DEFVIRTIOFSDAEMON to the Rust binary path.
  * The following were redundant as we were setting the default:
    * DEFSHAREDFS (now DEFSHAREDFS_CLH_VIRTIOFS)
    * DEFVIRTIOFSCACHESIZE
    * DEFSANDBOXCGROUPONLY
    * DEFSTATICRESOURCEMGMT_CLH
  * The following were referring to macros that do NOT expand to a value:
    * QEMUPATH
    * MACHINETYPE
  * FEATURE_SELINUX does not exist in the Kata source code.
  * DEFENABLEANNOTATIONS should not be set to ".*".

* Removes all patches. See
  microsoft/kata-containers#122 (comment)
  for a discussion. Since then, the memory patch was included in msft-main
  and patch 0004 is included in microsoft/kata-containers#154.

* Adds BuildRequires for devmapper code paths in msft-main.

* Requires the new Rust virtiosfd 1.8.0.

* Ensures sed doesn't break symlinks. For configuration.toml, sed would
  convert that file from a symlink to a regular file, so it'd become out of
  sync with configuration-clh.toml. rootfs.sh isn't a symlink but added the flag
  as well for good measure.
@sprt sprt marked this pull request as ready for review February 13, 2024 17:06
@sprt sprt merged commit 401db3a into msft-main Feb 14, 2024
43 of 54 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@danmihai1 danmihai1 danmihai1 approved these changes

@ms-mahuber ms-mahuber ms-mahuber approved these changes

Assignees
No one assigned
Labels
upstream/missing PRs that are yet to be upstreamed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sprt @danmihai1 @ms-mahuber