kata-containers: add support for virtio-blk based kata pod sandboxing #12713
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "Signatures": { | ||
| "kata-containers-3.2.0.azl4.tar.gz": "e9bb1124541152178bb642f613ab586dc7d021021b769d0548c5013ea701361d", | ||
| "kata-containers-3.2.0.azl4-cargo.tar.gz": "18749c417a5d0458549832237329cef2f8042fbd28fffde7d7084a2b75cc7188" | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ | |
|
|
||
| Name: kata-containers-cc | ||
| Version: 3.2.0.azl4 | ||
| Release: 2%{?dist} | ||
| Summary: Kata Confidential Containers package developed for Confidential Containers on AKS | ||
| License: ASL 2.0 | ||
| URL: https://github.com/microsoft/kata-containers | ||
|
|
@@ -43,6 +43,12 @@ Summary: Kata Confidential Containers tools package for building the UVM | |
| %description tools | ||
| This package contains the scripts and files required to build the UVM | ||
|
|
||
| %package tardev | ||
| Summary: tardev-snapshotter for Kata Containers | ||
|
Contributor
There was a problem hiding this comment. tardev-snapshotter is not necessarily tied to kata containers. we should rephrase to express its more generic purpose |
||
|
|
||
| %description tardev | ||
| This package contains the tardev-snapshotter service for Kata Containers. | ||
|
|
||
| %prep | ||
| %autosetup -p1 -n %{sourceName}-%{version} | ||
| pushd %{_builddir}/%{sourceName}-%{version} | ||
|
|
@@ -52,6 +58,7 @@ popd | |
| %build | ||
| pushd %{_builddir}/%{sourceName}-%{version}/tools/osbuilder/node-builder/azure-linux | ||
| %make_build package-confpods | ||
| %make_build tardev | ||
| popd | ||
|
|
||
| %define kata_path /opt/confidential-containers | ||
|
|
@@ -64,15 +71,16 @@ popd | |
| pushd %{_builddir}/%{sourceName}-%{version}/tools/osbuilder/node-builder/azure-linux | ||
| START_SERVICES=no PREFIX=%{buildroot} %make_build deploy-confpods-package | ||
| PREFIX=%{buildroot} %make_build deploy-confpods-package-tools | ||
| PREFIX=%{buildroot} %make_build deploy-tardev | ||
| popd | ||
|
|
||
| %preun tardev | ||
| %systemd_preun tardev-snapshotter.service | ||
|
|
||
| %postun tardev | ||
| %systemd_postun tardev-snapshotter.service | ||
|
|
||
| %post tardev | ||
| %systemd_post tardev-snapshotter.service | ||
| if [ $1 -eq 1 ]; then # Package install | ||
| systemctl enable tardev-snapshotter.service > /dev/null 2>&1 || : | ||
|
|
@@ -82,9 +90,6 @@ fi | |
| %files | ||
| %{_sbindir}/mount.tar | ||
| %{_bindir}/kata-overlay | ||
| %{kata_bin}/kata-collect-data.sh | ||
| %{kata_bin}/kata-monitor | ||
| %{kata_bin}/kata-runtime | ||
|
|
@@ -98,6 +103,12 @@ fi | |
| %doc CONTRIBUTING.md | ||
| %doc README.md | ||
|
|
||
| %files tardev | ||
| %{_bindir}/tardev-snapshotter | ||
| %{_unitdir}/tardev-snapshotter.service | ||
| %{_sbindir}/mount.tar | ||
|
Contributor
There was a problem hiding this comment. We will also need to remove mount.tar and kata-overlay from above files!? |
||
| %{_bindir}/kata-overlay | ||
|
|
||
| %files tools | ||
| %dir %{kata_path} | ||
| %dir %{tools_pkg} | ||
|
|
@@ -150,6 +161,9 @@ fi | |
| %{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service | ||
|
|
||
| %changelog | ||
| * Tue Mar 18 2025 Mitch Zhu <[email protected]> - 3.2.0.azl4-2 | ||
| - Add tardev subpackage | ||
|
|
||
| * Wed Jan 22 2025 Saul Paredes <[email protected]> - 3.2.0.azl4-1 | ||
| - Upgrade to 3.2.0.azl4 release | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "Signatures": { | ||
| "kata-containers-3.2.0.azl4.tar.gz": "e9bb1124541152178bb642f613ab586dc7d021021b769d0548c5013ea701361d", | ||
| "kata-containers-3.2.0.azl4-cargo.tar.gz": "18749c417a5d0458549832237329cef2f8042fbd28fffde7d7084a2b75cc7188" | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,7 +2,7 @@ | |
|
|
||
| Name: kata-containers | ||
| Version: 3.2.0.azl4 | ||
| Release: 2%{?dist} | ||
| Summary: Kata Containers package developed for Pod Sandboxing on AKS | ||
| License: ASL 2.0 | ||
| URL: https://github.com/microsoft/kata-containers | ||
|
|
@@ -22,8 +22,10 @@ BuildRequires: openssl-devel | |
| BuildRequires: clang | ||
| BuildRequires: device-mapper-devel | ||
| BuildRequires: cmake | ||
| BuildRequires: fuse-devel | ||
|
|
||
| Requires: kernel-uvm | ||
| Requires: kata-containers-cc-tardev | ||
| # Must match the version specified by the `assets.virtiofsd.version` field in the source's versions.yaml. | ||
| Requires: virtiofsd = 1.8.0 | ||
|
|
||
|
|
@@ -67,6 +69,8 @@ popd | |
| %{kata_bin}/kata-runtime | ||
|
|
||
| %{defaults_kata}/configuration.toml | ||
| %{defaults_kata}/configuration-clh-debug.toml | ||
|
Contributor
There was a problem hiding this comment. Why is this line relevant for this PR? |
||
| %{defaults_kata}/configuration-blk.toml | ||
|
|
||
| %{kata_shim_bin}/containerd-shim-kata-v2 | ||
|
|
||
|
|
@@ -81,6 +85,13 @@ popd | |
| %dir %{tools_pkg}/tools/osbuilder | ||
| %{tools_pkg}/tools/osbuilder/Makefile | ||
|
|
||
| %dir %{tools_pkg}/src | ||
| %dir %{tools_pkg}/src/kata-opa | ||
| %{tools_pkg}/src/kata-opa/allow-all.rego | ||
| %dir %{tools_pkg}/src/tarfs | ||
| %{tools_pkg}/src/tarfs/Makefile | ||
| %{tools_pkg}/src/tarfs/tarfs.c | ||
|
|
||
| %dir %{tools_pkg}/tools/osbuilder/scripts | ||
| %{tools_pkg}/tools/osbuilder/scripts/lib.sh | ||
|
|
||
|
|
@@ -112,6 +123,11 @@ popd | |
| %{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service | ||
|
|
||
| %changelog | ||
| * Tue Mar 18 2025 Mitch Zhu <[email protected]> - 3.2.0.azl4-2 | ||
| - Add systemd-udev, tarfs, and tardev-snapshotter to enable virtio-blk with pod sandboxing | ||
| - Add new config for virtio-blk based pod sandboxing | ||
| - Set AGENT_POLICY=yes for UVM and kata-agent | ||
|
|
||
| * Wed Jan 22 2025 Saul Paredes <[email protected]> - 3.2.0.azl4-1 | ||
| - Upgrade to 3.2.0.azl4 release | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| Summary: Metapackage for Kata UVM components | ||
| Name: kata-packages-uvm | ||
| Version: 1.0.0 | ||
| Release: 9%{?dist} | ||
| License: MIT | ||
| Vendor: Microsoft Corporation | ||
| Distribution: Azure Linux | ||
|
|
@@ -14,34 +14,50 @@ Requires: bash | |
| Requires: ca-certificates | ||
| Requires: chrony | ||
| Requires: cpio | ||
| # Required for confidential storage functionality | ||
| Requires: cryptsetup | ||
| Requires: curl | ||
| Requires: dbus | ||
| # Required for confidential storage functionality | ||
| Requires: e2fsprogs | ||
| Requires: elfutils-libelf | ||
| Requires: filesystem | ||
| Requires: iptables | ||
| Requires: irqbalance | ||
| # Note: We currently only support using systemd for our init process, not the kata-agent. | ||
| # When we go to add support for AGENT_INIT=yes, can drop this. | ||
| # https://github.com/microsoft/kata-containers/blob/msft-main/tools/osbuilder/rootfs-builder/cbl-mariner/config.sh#L10 | ||
| Requires: systemd | ||
| Requires: tzdata | ||
| Requires: zlib | ||
| Requires: cifs-utils | ||
| Requires: device-mapper | ||
| # Note: This assumes we are using systemd which may not always be the case when we support AGENT_INIT=yes | ||
| Requires: systemd-udev | ||
|
|
||
| %description | ||
| Metapackage to install the set of packages inside a Kata containers UVM | ||
|
|
||
| %package debug | ||
| Summary: Metapackage to install the set of packages inside a Kata confidential containers debug UVM. | ||
| Requires: %{name} = %{version}-%{release} | ||
| Requires: curl | ||
| Requires: cpio | ||
| # Provides find | ||
| Requires: findutils | ||
| Requires: gzip | ||
| Requires: iproute | ||
| # Provides ping, tracepath, etc for debugging net | ||
| Requires: iputils | ||
| Requires: lz4 | ||
| Requires: sed | ||
| Requires: tar | ||
| # Provides free, kill, pgrep, ps, etc | ||
| Requires: procps-ng | ||
|
|
||
| %description debug | ||
| Metapackage to install the set of packages inside a Kata containers UVM, includes extra debug utilities. | ||
|
|
||
| %package coco | ||
| Summary: Metapackage to install the set of packages inside a Kata confidential containers UVM. | ||
| Requires: %{name} = %{version}-%{release} | ||
|
|
@@ -95,13 +111,24 @@ Requires: golang | |
|
|
||
| %files | ||
|
|
||
| %files debug | ||
|
|
||
| %files coco | ||
|
|
||
| %files build | ||
|
|
||
| %files coco-sign | ||
|
|
||
| %changelog | ||
| * Mon Feb 24 2025 Mitch Zhu <[email protected]> - 1.0.0-9 | ||
| - Add cifs-utils, device-mapper, and systemd-udev to kata pod sandboxing. | ||
|
|
||
| * Tue Feb 11 2025 Cameron Baird <[email protected]> - 1.0.0-8 | ||
| - Introduce debug metapackage | ||
|
Member
Author
There was a problem hiding this comment. FYI cherry-picked from #12298.
Contributor
There was a problem hiding this comment. Best to remove things from your commit/branch that you do not add. Let's get to a baseline diff of the changes you want to introduce invidually. |
||
| - Move curl, cpio, gzip, iputils, lvm2, tar, procps-ng to debug metapackage | ||
| - Remove bash, grep, readline, util-linux from all metapackages (implicit deps of existing requirements) | ||
| - Add findutils to debug metapackage | ||
|
|
||
| * Mon Nov 25 2024 Manuel Huber <[email protected]> - 1.0.0-7 | ||
| - Add explicit make dependency for UVM build | ||
| - Remove commented package dependencies | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please remove these changes for a pull request. please prepare or contribute to a branch that can be used as the base branch for the Kata CI pipeline which ingests the new release sources. The PR title should then be 'update kata-containers package to azl3.2.0.5 or similar'