Skip to content

Commit 851c863

Browse files
miz060miz060
committed
node-builder: add virtio-blk kata pod sandboxing and separate out tardev-snapshotter build
This PR is to support new virtio-blk kata pod sandboxing runtime. It adds new runtime config, adjusts dependencies for kata pod sandboxing in general, and extract tardev-snapshotter build and install steps into separate scripts. Signed-off by: Mitch Zhu <mitchzhu@microsoft.com>
1 parent 9db7002 commit 851c863

File tree

8 files changed

+114
-55
lines changed

8 files changed

+114
-55
lines changed

‎tools/osbuilder/node-builder/azure-linux/Makefile

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,11 @@ deploy-confpods-package-tools:
8989
.PHONY: deploy-confpods-uvm
9090
deploy-confpods-uvm:
9191
CONF_PODS=yes ./uvm_install.sh
92+
93+
.PHONY: tardev
94+
tardev:
95+
./package_tardev_build.sh
96+
97+
.PHONY: deploy-tardev
98+
deploy-tardev:
99+
./package_tardev_install.sh

‎tools/osbuilder/node-builder/azure-linux/common.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ else
4343
SHIM_CONFIG_INST_FILE_NAME="configuration.toml"
4444
SHIM_DBG_CONFIG_FILE_NAME="configuration-clh-debug.toml"
4545
SHIM_DBG_CONFIG_INST_FILE_NAME="${SHIM_DBG_CONFIG_FILE_NAME}"
46+
SHIM_BLK_CONFIG_FILE_NAME="configuration-blk.toml"
47+
SHIM_BLK_CONFIG_INST_FILE_NAME="${SHIM_BLK_CONFIG_FILE_NAME}"
4648
DEBUGGING_BINARIES_PATH="${INSTALL_PATH_PREFIX}/local/bin"
4749
SHIM_BINARIES_PATH="${INSTALL_PATH_PREFIX}/local/bin"
4850
SHIM_BINARY_NAME="containerd-shim-kata-v2"

‎tools/osbuilder/node-builder/azure-linux/package_build.sh

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -40,31 +40,10 @@ if [ "${OS_VERSION}" == "3.0" ]; then
4040
fi
4141

4242
agent_make_flags="LIBC=gnu OPENSSL_NO_VENDOR=Y DESTDIR=${AGENT_INSTALL_DIR} BUILD_TYPE=${AGENT_BUILD_TYPE}"
43-
44-
if [ "${CONF_PODS}" == "yes" ]; then
45-
agent_make_flags+=" AGENT_POLICY=yes"
46-
fi
43+
agent_make_flags+=" AGENT_POLICY=yes"
4744

4845
pushd "${repo_dir}"
4946

50-
if [ "${CONF_PODS}" == "yes" ]; then
51-
52-
echo "Building utarfs binary"
53-
pushd src/utarfs/
54-
make all
55-
popd
56-
57-
echo "Building kata-overlay binary"
58-
pushd src/overlay/
59-
make all
60-
popd
61-
62-
echo "Building tardev-snapshotter service binary"
63-
pushd src/tardev-snapshotter/
64-
make all
65-
popd
66-
fi
67-
6847
echo "Building shim binary and configuration"
6948
pushd src/runtime/
7049
if [ "${CONF_PODS}" == "yes" ] || [ "${OS_VERSION}" == "3.0" ]; then

‎tools/osbuilder/node-builder/azure-linux/package_install.sh

Lines changed: 5 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ CONF_PODS=${CONF_PODS:-no}
1414
PREFIX=${PREFIX:-}
1515
SHIM_REDEPLOY_CONFIG=${SHIM_REDEPLOY_CONFIG:-yes}
1616
SHIM_USE_DEBUG_CONFIG=${SHIM_USE_DEBUG_CONFIG:-no}
17-
START_SERVICES=${START_SERVICES:-yes}
1817

1918
script_dir="$(dirname $(readlink -f $0))"
2019
repo_dir="${script_dir}/../../../../"
@@ -29,22 +28,6 @@ mkdir -p "${PREFIX}/${SHIM_CONFIG_PATH}"
2928
mkdir -p "${PREFIX}/${DEBUGGING_BINARIES_PATH}"
3029
mkdir -p "${PREFIX}/${SHIM_BINARIES_PATH}"
3130

32-
if [ "${CONF_PODS}" == "yes" ]; then
33-
echo "Installing tardev-snapshotter binaries and service file"
34-
mkdir -p ${PREFIX}/usr/sbin
35-
cp -a --backup=numbered src/utarfs/target/release/utarfs ${PREFIX}/usr/sbin/mount.tar
36-
mkdir -p ${PREFIX}/usr/bin
37-
cp -a --backup=numbered src/overlay/target/release/kata-overlay ${PREFIX}/usr/bin/
38-
cp -a --backup=numbered src/tardev-snapshotter/target/release/tardev-snapshotter ${PREFIX}/usr/bin/
39-
mkdir -p ${PREFIX}/usr/lib/systemd/system/
40-
cp -a --backup=numbered src/tardev-snapshotter/tardev-snapshotter.service ${PREFIX}/usr/lib/systemd/system/
41-
42-
echo "Enabling and starting snapshotter service"
43-
if [ "${START_SERVICES}" == "yes" ]; then
44-
systemctl enable tardev-snapshotter && systemctl daemon-reload && systemctl restart tardev-snapshotter
45-
fi
46-
fi
47-
4831
echo "Installing diagnosability binaries (monitor, runtime, collect-data script)"
4932
cp -a --backup=numbered src/runtime/kata-monitor "${PREFIX}/${DEBUGGING_BINARIES_PATH}"
5033
cp -a --backup=numbered src/runtime/kata-runtime "${PREFIX}/${DEBUGGING_BINARIES_PATH}"
@@ -70,4 +53,9 @@ else
7053
echo "Skipping installation of shim configuration"
7154
fi
7255

56+
if [ "${CONF_PODS}" == "no" ]; then
57+
echo "Installing virtio-blk based shim configuration"
58+
cp -a --backup=numbered src/runtime/config/"${SHIM_CONFIG_FILE_NAME}" "${PREFIX}/${SHIM_CONFIG_PATH}/${SHIM_BLK_CONFIG_INST_FILE_NAME}"
59+
sed -i 's/shared_fs = "virtio-fs"/shared_fs = "none"/' "${PREFIX}/${SHIM_CONFIG_PATH}/${SHIM_BLK_CONFIG_INST_FILE_NAME}"
60+
fi
7361
popd

‎tools/osbuilder/node-builder/azure-linux/package_tardev_build.sh

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright (c) 2024 Microsoft Corporation
4+
#
5+
# SPDX-License-Identifier: Apache-2.0
6+
7+
set -o errexit
8+
set -o pipefail
9+
set -o errtrace
10+
11+
[ -n "$DEBUG" ] && set -x
12+
13+
script_dir="$(dirname $(readlink -f $0))"
14+
repo_dir="${script_dir}/../../../../"
15+
16+
common_file="common.sh"
17+
source "${common_file}"
18+
19+
pushd "${repo_dir}"
20+
21+
echo "Building utarfs binary"
22+
pushd src/utarfs/
23+
make all
24+
popd
25+
26+
echo "Building kata-overlay binary"
27+
pushd src/overlay/
28+
make all
29+
popd
30+
31+
echo "Building tardev-snapshotter service binary"
32+
pushd src/tardev-snapshotter/
33+
make all
34+
popd
35+
36+
popd

‎tools/osbuilder/node-builder/azure-linux/package_tardev_install.sh

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright (c) 2024 Microsoft Corporation
4+
#
5+
# SPDX-License-Identifier: Apache-2.0
6+
7+
set -o errexit
8+
set -o pipefail
9+
set -o errtrace
10+
11+
[ -n "$DEBUG" ] && set -x
12+
13+
PREFIX=${PREFIX:-}
14+
START_SERVICES=${START_SERVICES:-yes}
15+
16+
script_dir="$(dirname $(readlink -f $0))"
17+
repo_dir="${script_dir}/../../../../"
18+
19+
common_file="common.sh"
20+
source "${common_file}"
21+
22+
pushd "${repo_dir}"
23+
24+
echo "Installing utarfs and kata-overlay binaries"
25+
mkdir -p ${PREFIX}/usr/sbin
26+
cp -a --backup=numbered src/utarfs/target/release/utarfs ${PREFIX}/usr/sbin/mount.tar
27+
mkdir -p ${PREFIX}/usr/bin
28+
cp -a --backup=numbered src/overlay/target/release/kata-overlay ${PREFIX}/usr/bin/
29+
mkdir -p ${PREFIX}/usr/lib/systemd/system/
30+
31+
echo "Installing tardev-snapshotter binaries and service file"
32+
mkdir -p ${PREFIX}/usr/bin
33+
cp -a --backup=numbered src/tardev-snapshotter/target/release/tardev-snapshotter ${PREFIX}/usr/bin/
34+
mkdir -p ${PREFIX}/usr/lib/systemd/system/
35+
cp -a --backup=numbered src/tardev-snapshotter/tardev-snapshotter.service ${PREFIX}/usr/lib/systemd/system/
36+
37+
if [ "${START_SERVICES}" == "yes" ]; then
38+
echo "Enabling and starting snapshotter service"
39+
systemctl enable tardev-snapshotter && systemctl daemon-reload && systemctl restart tardev-snapshotter
40+
fi
41+
42+
popd

‎tools/osbuilder/node-builder/azure-linux/package_tools_install.sh

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/rootfs-builder/cbl-mariner"
2727
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/image-builder"
2828
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/bin"
2929
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system"
30+
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs"
31+
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa"
3032

3133
if [ "${CONF_PODS}" == "yes" ]; then
32-
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa"
33-
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs"
3434
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux"
3535
fi
3636

@@ -52,11 +52,13 @@ cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/u
5252
cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-containers.target "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system/"
5353
cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system/"
5454

55+
cp -a --backup=numbered src/tarfs/Makefile "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
56+
cp -a --backup=numbered src/tarfs/tarfs.c "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
57+
58+
cp -a --backup=numbered src/kata-opa/allow-all.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
59+
5560
if [ "${CONF_PODS}" == "yes" ]; then
56-
cp -a --backup=numbered src/kata-opa/allow-all.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
5761
cp -a --backup=numbered src/kata-opa/allow-set-policy.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
58-
cp -a --backup=numbered src/tarfs/Makefile "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
59-
cp -a --backup=numbered src/tarfs/tarfs.c "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
6062
cp -a --backup=numbered tools/osbuilder/igvm-builder/igvm_builder.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/"
6163
cp -a --backup=numbered tools/osbuilder/igvm-builder/azure-linux/config.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux/"
6264
cp -a --backup=numbered tools/osbuilder/igvm-builder/azure-linux/igvm_lib.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux/"

‎tools/osbuilder/node-builder/azure-linux/uvm_build.sh

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,15 @@ source "${common_file}"
2727
rootfs_make_flags="AGENT_SOURCE_BIN=${AGENT_INSTALL_DIR}/usr/bin/kata-agent OS_VERSION=${OS_VERSION}"
2828

2929
if [ "${CONF_PODS}" == "yes" ]; then
30-
rootfs_make_flags+=" AGENT_POLICY=yes CONF_GUEST=yes AGENT_POLICY_FILE=${agent_policy_file_abs}"
30+
rootfs_make_flags+=" CONF_GUEST=yes AGENT_POLICY=yes AGENT_POLICY_FILE=${agent_policy_file_abs}"
31+
else
32+
agent_policy_allow_all="${repo_dir}/src/kata-opa/allow-all.rego"
33+
rootfs_make_flags+=" AGENT_POLICY=yes AGENT_POLICY_FILE=${agent_policy_file_allow_all}"
3134
fi
3235

33-
if [ "${CONF_PODS}" == "yes" ]; then
34-
set_uvm_kernel_vars
35-
if [ -z "${UVM_KERNEL_HEADER_DIR}}" ]; then
36-
exit 1
37-
fi
36+
set_uvm_kernel_vars
37+
if [ -z "${UVM_KERNEL_HEADER_DIR}}" ]; then
38+
exit 1
3839
fi
3940

4041
pushd "${repo_dir}"
@@ -63,12 +64,13 @@ echo "Installing agent service files into rootfs"
6364
sudo cp ${AGENT_INSTALL_DIR}/usr/lib/systemd/system/kata-containers.target ${ROOTFS_PATH}/usr/lib/systemd/system/kata-containers.target
6465
sudo cp ${AGENT_INSTALL_DIR}/usr/lib/systemd/system/kata-agent.service ${ROOTFS_PATH}/usr/lib/systemd/system/kata-agent.service
6566

67+
echo "Building tarfs kernel driver and installing into rootfs"
68+
pushd src/tarfs
69+
make KDIR=${UVM_KERNEL_HEADER_DIR}
70+
sudo make KDIR=${UVM_KERNEL_HEADER_DIR} KVER=${UVM_KERNEL_VERSION} INSTALL_MOD_PATH=${ROOTFS_PATH} install
71+
popd
72+
6673
if [ "${CONF_PODS}" == "yes" ]; then
67-
echo "Building tarfs kernel driver and installing into rootfs"
68-
pushd src/tarfs
69-
make KDIR=${UVM_KERNEL_HEADER_DIR}
70-
sudo make KDIR=${UVM_KERNEL_HEADER_DIR} KVER=${UVM_KERNEL_VERSION} INSTALL_MOD_PATH=${ROOTFS_PATH} install
71-
popd
7274
echo "Building dm-verity protected image based on rootfs"
7375
pushd tools/osbuilder
7476
sudo -E PATH=${PATH} IMAGE_NAME=${LOCAL_IMAGE_NAME} make DISTRO=cbl-mariner MEASURED_ROOTFS=yes DM_VERITY_FORMAT=kernelinit image

0 commit comments

Comments
 (0)