agent: update the processes hashmap to use exec_id as primary key#358

Draft

Ankita13-code wants to merge 196 commits intomsft-mainfrom

ankitapareek/exec-id-agent-fix

Commits on Mar 26, 2025

Commits on Mar 28, 2025

Commits on Mar 29, 2025

Copy snapshotter bits from cc-msft-prototypes

sprt
authored and
danmihai1
committed
runtime: enable configuring IGVM images

dallasd1
authored and
danmihai1
committed
runtime: add SNP related changes for CLH (#33)

dallasd1
authored and
danmihai1
committed
Update clh-snp config and remove extra rootfs package definition (#38)

dallasd1
authored and
danmihai1
committed
Enable SEV SNP and setting for host_data for CH-SNP (#42)

ms-mahuber
authored and
danmihai1
committed
Re-enable seccomp in clh-snp config (#46)

dallasd1
authored and
danmihai1
committed
Always assign 10 PCI segments and modify IGVM config validation (#92)

ms-mahuber
authored and
danmihai1
committed
agent: Make /dev/sev-guest available to containers (#36)

sprt
authored and
danmihai1
committed
osbuilder: add support to build enable dm-verity protected images (#55)

dallasd1
authored and
danmihai1
committed
image: don't insert the DAX header (#56)
danmihai1
committed
rootfs: delete some of the mariner packages (#45)
danmihai1
committed
rootfs: add back bash to mariner's rootfs (#47)
danmihai1
committed
rootfs: add back coreutils to mariner's image (#48)
danmihai1
committed
rootfs: add back ps to mariner's rootfs (#49)
danmihai1
committed
runtime: agent: SNP HOST_DATA set-up (#43)
danmihai1
committed
runtime: agent: validate policy contents (#50)
danmihai1
committed
runtime: use 10 PCI segments for the Guest (#59)
danmihai1
committed
osbuilder: install device-mapper and enable udevd

wedsonaf
authored and
danmihai1
committed
runtime: add support for layer-src-prefix option

wedsonaf
authored and
danmihai1
committed
runtime: Allow disabling FS sharing for CLH/SNP

sprt
authored and
danmihai1
committed
runtime: Properly specify static resource mgmt

sprt
authored and
danmihai1
committed

Commits on Mar 31, 2025

runtime: configuration-clh-snp.toml.in adjustments
danmihai1
committed
runtime: decode layer string

wedsonaf
authored and
danmihai1
committed
osbuilder: include tardev components to rootfs

wedsonaf
authored and
danmihai1
committed
agent: use dm-verity if io.katacontainers.fs-opt.root-hash is set

wedsonaf
authored and
danmihai1
committed
agent: change to layer directory when mounting overlays

wedsonaf
authored and
danmihai1
committed
agent: add some context to device mapper error

wedsonaf
authored and
danmihai1
committed
agent: unmount storages in reverse order

wedsonaf
authored and
danmihai1
committed
runtime: accomodate slower than expected boot (#44)
danmihai1
committed
Append systemd kernel cmdline params for initrd (#39)

dallasd1
authored and
danmihai1
committed
tools: keep package zstd-libs in the UVM (#104)

dallasd1
authored and
danmihai1
committed
runtime: enable confidential guest by default in non-SNP config (#112)

arc9693
authored and
danmihai1
committed
Add snapshotter build files to .gitignore

sprt
authored and
danmihai1
committed
config: Add SEV SNP config

sprt
authored and
danmihai1
committed
agent: skip mount options that start with "io.katacontainers."

sprt
authored and
danmihai1
committed
Add src/agent/samples/policy/test-input/ to .gitignore

sprt
authored and
danmihai1
committed
genpolicy: Readd agent type definitions (#118)

Redent0r
authored and
danmihai1
committed
utarfs: implement the enumeration of xattrs (#119)

wedsonaf
authored and
danmihai1
committed
runtime: use shared dir to mount rootfs

wedsonaf
authored and
danmihai1
committed
Add dev directories to .gitignore

sprt
authored and
danmihai1
committed
runtime: Resolve high UVM memory footprint

sprt
authored and
danmihai1
committed
Revert "runtime: use 10 PCI segments for the Guest (#59)"

sprt
authored and
danmihai1
committed
tools: Allow setting policy rego file via environment variable (#123)

ms-mahuber
authored and
danmihai1
committed
Add kata metapackage change

miz060
authored and
danmihai1
committed
Add new varaiable to differntiate vanilla and coco

miz060
authored and
danmihai1
committed
Update package name

miz060
authored and
danmihai1
committed
Revert "Add kata metapackage change"

miz060
authored and
danmihai1
committed
Microsoft mandatory file

microsoft-github-policy-service[bot]
authored and
danmihai1
committed
Create pull_request_template.md

ms-mahuber
authored and
danmihai1
committed
Update pull_request_template.md

ms-mahuber
authored and
danmihai1
committed
Update pull_request_template.md

ms-mahuber
authored and
danmihai1
committed
Update pull_request_template.md

ms-mahuber
authored and
danmihai1
committed
agent: improve policy handling of CopyFile
danmihai1
committed
genpolicy: block some symlink create requests
danmihai1
committed
genpolicy: validate create sandbox storages
danmihai1
committed
runtime: disable protection check

sprt
authored and
danmihai1
committed
osbuilder: use Azure Linux PMC UVM build meta-package

miz060
authored and
danmihai1
committed
github: copy CODEOWNERS from cc-msft-prototypes

christopherco
authored and
danmihai1
committed
genpolicy: "cargo fmt -- --check" clean-up
danmihai1
committed
tools: genpolicy static checks
danmihai1
committed
github: add `upstream-missing` label to PR checklist

sprt
authored and
danmihai1
committed
tarfs: keep ctx->pos up to date because dir_emit uses it

wedsonaf
authored and
danmihai1
committed
tarfs: don't fail if at least one directory was emitted

wedsonaf
authored and
danmihai1
committed
tarfs: unlock the page (and set the error flag) on failure to map it

wedsonaf
authored and
danmihai1
committed
tarfs: don't issue bdev read requests for bad offsets

wedsonaf
authored and
danmihai1
committed
tarfs: call iget_failed on failure post iget_locked

wedsonaf
authored and
danmihai1
committed
tarfs: ensure the underlying block device can hold at least one block

wedsonaf
authored and
danmihai1
committed
tarfs: use GPF_NOFS when allocating memory on a mounted fs

wedsonaf
authored and
danmihai1
committed
runtime: fix error when using the debug console
danmihai1
committed
config: don't hardcode confidential_guest=true for clh

sprt
authored and
danmihai1
committed
runtime: make sev_snp_guest default to false

sprt
authored and
danmihai1
committed
tarindex: Add special symlink name handling

miz060
authored and
danmihai1
committed
genpolicy: support non-default namespace name
danmihai1
committed
agent: add SMB storage handler

arc9693
authored and
danmihai1
committed
runtime: add support to handle SMB mounts

arc9693
authored and
danmihai1
committed
genpolicy: disable containerd pull on Windows

Redent0r
authored and
danmihai1
committed
genpolicy: pass PVCs to get_mount_and_storage()

sprt
authored and
danmihai1
committed
genpolicy: support arbitrary resources with -c

sprt
authored and
danmihai1
committed
genpolicy: support PVCs with -c flag

sprt
authored and
danmihai1
committed
genpolicy: add support for cc-managed-csi

sprt
authored and
danmihai1
committed
genpolicy: add --version flag

Redent0r
authored and
danmihai1
committed
genpolicy: add support for cc-local-csi

sprt
authored and
danmihai1
committed
genpolicy: add support for cc-azurefile-csi driver

arc9693
authored and
danmihai1
committed
genpolicy: bump release version

Redent0r
authored and
danmihai1
committed
runtime: clh: clean-up merge from main
danmihai1
committed
runtime: agent: use PCI segments 1+ for blk devices
danmihai1
committed
samples: pod with ~70 image layers
danmihai1
committed
rootfs: Stop building and shipping OPA

fidencio
authored and
danmihai1
committed
ci: add check for policy samples

sprt
authored and
danmihai1
committed
tools: Add initial igvm-builder and node-builder/azure-linux scripting

ms-mahuber
authored and
danmihai1
committed
clh: update sev snp param

Redent0r
authored and
danmihai1
committed
genpolicy: add persistent storage support for stateful sets

arc9693
authored and
danmihai1
committed
tools: Improve igvm-builder and node-builder/azure-linux scripting

ms-mahuber
authored and
danmihai1
committed
tardev: update tardev-snapshotter.service

miz060
authored and
danmihai1
committed
docs: add guide to install new CSI drivers

sprt
authored and
danmihai1
committed
chore: bump release version

Redent0r
authored and
danmihai1
committed
tools: Add package-tools-install functionality

ms-mahuber
authored and
danmihai1
committed
tools: Enable setting IGVM SVN

ms-mahuber
authored and
danmihai1
committed
node-builder: introduce BUILD_TYPE variable

sprt
authored and
danmihai1
committed
node-builder: introduce SHIM_REDEPLOY_CONFIG

sprt
authored and
danmihai1
committed
node-builder: Use img for Pod Sandboxing

ms-mahuber
authored and
danmihai1
committed
docs: Add more limitations for AKS-CC storage

sprt
authored and
danmihai1
committed
node-builder: Adapt README instructions

ms-mahuber
authored and
danmihai1
committed
pr_template: remove genpolicy windows support check from PR template

Redent0r
authored and
danmihai1
committed
build: Fix RPM build fail due to AGENT_POLICY

Emanuel Lima
authored and
danmihai1
committed
tools: Adapt AGENT_POLICY_FILE path

ms-mahuber
authored and
danmihai1
committed
genpolicy: support dynamic SMB storage class options

arc9693
authored and
danmihai1
committed
node-builder: Use Azure Linux 3 as default path

ms-mahuber
authored and
danmihai1
committed
node-builder: Deploy-only for AzL3 VMs

ms-mahuber
authored and
danmihai1
committed
runtime: Fix make test for virtcontainers.

Sumynwa
authored and
danmihai1
committed
ci: install libdevmapper for agent static checks

Sumynwa
authored and
danmihai1
committed
build(deps): bump rustix in sources

dependabot[bot]
authored and
danmihai1
committed
ci: Fix make static-checks

Sumynwa
authored and
danmihai1
committed
runtime: relax timeout for CreateVM + BootVM in CLH

Sumynwa
authored and
danmihai1
committed
chore: bump release version

Redent0r
authored and
danmihai1
committed
node-builder: Minor updates to README.md

ms-mahuber
authored and
danmihai1
committed
genpolicy: block self symlink paths for copyFile requests

Redent0r
authored and
danmihai1
committed
chore: bump release version

Redent0r
authored and
danmihai1
committed
genpolicy: use process inputs for allow_process()
danmihai1
committed
policy: add constants to rules.rego

Redent0r
authored and
danmihai1
committed
genpolicy: validate process for commands from settings
danmihai1
committed
genpolicy: validate probe process fields
danmihai1
committed
genpolicy: use the tarindex fork
danmihai1
committed
genpolicy: validate probe process fields
danmihai1
committed
genpolicy: add exec container_id comment
danmihai1
committed
genpolicy: tighter symlink source rules
danmihai1
committed
chore: bump genpolicy bump genpolicy version

Redent0r
authored and
danmihai1
committed
image: 2Mb default image size alignment
danmihai1
committed
runtime: virtio-blk root device for AKS-Kata
danmihai1
committed
runtime: improved memory overhead management
danmihai1
committed
runtime: Remove unused VMM options for mem alloc

ms-mahuber
authored and
danmihai1
committed
policy: strengthen bundle id validation

Redent0r
authored and
danmihai1
committed
chore: bump genpolicy version

Redent0r
authored and
danmihai1
committed
runtime: Allocate default workload vcpus

ms-mahuber
authored and
danmihai1
committed
policy: improve pod namespace validation

Redent0r
authored and
danmihai1
committed
agent: avoid "unknown mount flag" for tardev
danmihai1
committed
overlay: use nix::mount for OverlayFS to overcome mounting limitations

miz060
authored and
danmihai1
committed
genpolicy: fix validation of env variables sourced from metadata.namespace

Redent0r
authored and
danmihai1
committed
rootfs: delete systemd units/files from rootfs.sh
danmihai1
committed
config: add hypervisor_loglevel

Camelron
authored and
danmihai1
committed
rootfs: don't delete systemd-tmpfiles-cleanup.timer
danmihai1
committed
rootfs: add support for deleting *.timer files
danmihai1
committed
rootfs: delete the remaining systemd-tmpfiles files
danmihai1
committed
rootfs: add support for deleting *.path files
danmihai1
committed
rootfs: delete systemd-ask-password
danmihai1
committed
rootfs: delete bins with same name as unit files
danmihai1
committed
rootfs: delete systemd-pcr*
danmihai1
committed
rootfs: delete more systemd journal files
danmihai1
committed
rootfs: delete blk-availability and blkdeactivate
danmihai1
committed
rootfs: delete systemd-boot-update.service
danmihai1
committed
rootfs: delete systemd-logind.service
danmihai1
committed
rootfs: delete systemd-pstore.service
danmihai1
committed
rootfs: delete systemd-sysupdate
danmihai1
committed
rootfs: delete systemd-network-generator files
danmihai1
committed
rootfs: delete systemd-tpm2-setup
danmihai1
committed
rootfs: add support for deleting *.mount files
danmihai1
committed
rootfs: delete sys-fs-fuse-connections.mount
danmihai1
committed
rootfs: delete sys-kernel-config.mount
danmihai1
committed
rootfs: delete more systemd-update-utmp files
danmihai1
committed
rootfs: delete systemd-vconsole-setup
danmihai1
committed
node-builder: Updates to README.md

ms-mahuber
authored and
danmihai1
committed
genpolicy: add crate-scoped integration test

burgerdev
authored and
danmihai1
committed
genpolicy: fix env variables that are always allowed

Redent0r
authored and
danmihai1
committed
genpolicy: update settings for testing

Redent0r
authored and
danmihai1
committed
tests: fix regex used in settings for testing genpolicy

Redent0r
authored and
danmihai1
committed
genpolicy: Validate storage source

sprt
authored and
danmihai1
committed
genpolicy: Validate mount source

sprt
authored and
danmihai1
committed
genpolicy: Validate storage fstype

sprt
authored and
danmihai1
committed
agent: add support for PolicyCreateContainerRequest

Redent0r
authored and
danmihai1
committed
policy: add environment variable map

Redent0r
authored and
danmihai1
committed
policy: mark old way of validating args as deprecated

Redent0r
authored and
danmihai1
committed
policy: add arg validation by substitution

Redent0r
authored and
danmihai1
committed
node-builder: Fix SHIM_USE_DEBUG_CONFIG behavior

sprt
authored and
danmihai1
committed
policy: fix regression in rules.rego

Redent0r
authored and
danmihai1
committed
agent: move policy module into separate crate

3u13r
authored and
danmihai1
committed
policy: use agent policy crate in genpolicy test

3u13r
authored and
danmihai1
committed
policy: enable unit tests for copyfile

Redent0r
authored and
danmihai1
committed
gitignore: Remove vendor folder

ms-mahuber
authored and
danmihai1
committed
genpolicy: Introduce UpdateRoutesRequest rules in genpolicy-settings

Camelron
authored and
danmihai1
committed
genpolicy: Introduce UpdateInterfaceRequest rules in genpolicy-settings

Camelron
authored and
danmihai1
committed
policy: add tests for createContainerRequest

Redent0r
authored and
danmihai1
committed
policy: validate pod generated name

Redent0r
authored and
danmihai1
committed
samples: copy samples from msft-main
danmihai1
committed
genpolicy: fix the sample/test scripts
danmihai1
committed
protocols: re-generate Cargo.lock
danmihai1
committed
samples: update sample yaml files after rebase
danmihai1
committed

Commits on Apr 3, 2025

samples: write test settings to /tmp

Redent0r
authored and
danmihai1
committed

Commits on May 21, 2025

samples: update samples
Redent0r
committed

Commits on May 23, 2025

agent: update the processes hashmap to use exec_id as primary key
Ankita13-code
committed