Skip to content

Commit 9b54eed

Browse files
miz060miz060
committed
eliminate virtiofs, with AGENT_POLICY=yes
1 parent 1ee72c4 commit 9b54eed

File tree

7 files changed

+48
-48
lines changed

7 files changed

+48
-48
lines changed

‎src/runtime/config/configuration-clh-snp.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ default_maxmemory = @DEFMAXMEMSZ@
137137
# - virtio-fs (default)
138138
# - virtio-fs-nydus
139139
# - none
140-
shared_fs = "@DEFSHAREDFS_CLH_SNP_VIRTIOFS@"
140+
shared_fs = "none"
141141

142142
# Path to vhost-user-fs daemon.
143143
virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"

‎src/runtime/config/configuration-clh.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ default_maxmemory = @DEFMAXMEMSZ@
132132
# - virtio-fs (default)
133133
# - virtio-fs-nydus
134134
# - none
135-
shared_fs = "@DEFSHAREDFS_CLH_VIRTIOFS@"
135+
shared_fs = "none"
136136

137137
# Path to vhost-user-fs daemon.
138138
virtio_fs_daemon = "@DEFVIRTIOFSDAEMON@"

‎tools/osbuilder/node-builder/azure-linux/package_build.sh‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -41,29 +41,27 @@ fi
4141

4242
agent_make_flags="LIBC=gnu OPENSSL_NO_VENDOR=Y DESTDIR=${AGENT_INSTALL_DIR} BUILD_TYPE=${AGENT_BUILD_TYPE}"
4343

44-
if [ "${CONF_PODS}" == "yes" ]; then
45-
agent_make_flags+=" AGENT_POLICY=yes"
46-
fi
44+
#if [ "${CONF_PODS}" == "yes" ]; then
45+
# agent_make_flags+=" AGENT_POLICY=yes"
46+
#fi
47+
agent_make_flags+=" AGENT_POLICY=yes"
4748

4849
pushd "${repo_dir}"
4950

50-
if [ "${CONF_PODS}" == "yes" ]; then
51-
52-
echo "Building utarfs binary"
53-
pushd src/utarfs/
54-
make all
55-
popd
51+
echo "Building utarfs binary"
52+
pushd src/utarfs/
53+
make all
54+
popd
5655

57-
echo "Building kata-overlay binary"
58-
pushd src/overlay/
59-
make all
60-
popd
56+
echo "Building kata-overlay binary"
57+
pushd src/overlay/
58+
make all
59+
popd
6160

62-
echo "Building tardev-snapshotter service binary"
63-
pushd src/tardev-snapshotter/
64-
make all
65-
popd
66-
fi
61+
echo "Building tardev-snapshotter service binary"
62+
pushd src/tardev-snapshotter/
63+
make all
64+
popd
6765

6866
echo "Building shim binary and configuration"
6967
pushd src/runtime/

‎tools/osbuilder/node-builder/azure-linux/package_install.sh‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,21 @@ mkdir -p "${PREFIX}/${SHIM_CONFIG_PATH}"
2929
mkdir -p "${PREFIX}/${DEBUGGING_BINARIES_PATH}"
3030
mkdir -p "${PREFIX}/${SHIM_BINARIES_PATH}"
3131

32-
if [ "${CONF_PODS}" == "yes" ]; then
33-
echo "Installing tardev-snapshotter binaries and service file"
34-
mkdir -p ${PREFIX}/usr/sbin
35-
cp -a --backup=numbered src/utarfs/target/release/utarfs ${PREFIX}/usr/sbin/mount.tar
36-
mkdir -p ${PREFIX}/usr/bin
37-
cp -a --backup=numbered src/overlay/target/release/kata-overlay ${PREFIX}/usr/bin/
38-
cp -a --backup=numbered src/tardev-snapshotter/target/release/tardev-snapshotter ${PREFIX}/usr/bin/
39-
mkdir -p ${PREFIX}/usr/lib/systemd/system/
40-
cp -a --backup=numbered src/tardev-snapshotter/tardev-snapshotter.service ${PREFIX}/usr/lib/systemd/system/
32+
echo "Installing tardev-snapshotter binaries and service file"
33+
mkdir -p ${PREFIX}/usr/sbin
34+
cp -a --backup=numbered src/utarfs/target/release/utarfs ${PREFIX}/usr/sbin/mount.tar
35+
mkdir -p ${PREFIX}/usr/bin
36+
cp -a --backup=numbered src/overlay/target/release/kata-overlay ${PREFIX}/usr/bin/
37+
cp -a --backup=numbered src/tardev-snapshotter/target/release/tardev-snapshotter ${PREFIX}/usr/bin/
38+
mkdir -p ${PREFIX}/usr/lib/systemd/system/
39+
cp -a --backup=numbered src/tardev-snapshotter/tardev-snapshotter.service ${PREFIX}/usr/lib/systemd/system/
40+
41+
echo "Enabling and starting snapshotter service"
42+
if [ "${START_SERVICES}" == "yes" ]; then
43+
systemctl enable tardev-snapshotter && systemctl daemon-reload && systemctl restart tardev-snapshotter
44+
fi
4145

46+
if [ "${CONF_PODS}" == "yes" ]; then
4247
if [ "${SHIM_REDEPLOY_CONFIG}" == "yes" ]; then
4348
echo "Installing SNP shim debug configuration"
4449
cp -a --backup=numbered src/runtime/config/"${SHIM_DBG_CONFIG_FILE_NAME}" "${PREFIX}/${SHIM_CONFIG_PATH}"/"${SHIM_DBG_CONFIG_INST_FILE_NAME}"
@@ -51,11 +56,6 @@ if [ "${CONF_PODS}" == "yes" ]; then
5156
# which is probably fine when debugging.
5257
ln -sf src/runtime/config/"${SHIM_DBG_CONFIG_FILE_NAME}" src/runtime/config/"${SHIM_CONFIG_FILE_NAME}"
5358
fi
54-
55-
echo "Enabling and starting snapshotter service"
56-
if [ "${START_SERVICES}" == "yes" ]; then
57-
systemctl enable tardev-snapshotter && systemctl daemon-reload && systemctl restart tardev-snapshotter
58-
fi
5959
fi
6060

6161
echo "Installing diagnosability binaries (monitor, runtime, collect-data script)"

‎tools/osbuilder/node-builder/azure-linux/package_tools_install.sh‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/rootfs-builder/cbl-mariner"
2727
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/image-builder"
2828
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/bin"
2929
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system"
30+
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs"
31+
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa"
3032

3133
if [ "${CONF_PODS}" == "yes" ]; then
32-
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa"
33-
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs"
3434
mkdir -p "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux"
3535
fi
3636

@@ -52,11 +52,13 @@ cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/u
5252
cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-containers.target "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system/"
5353
cp -a --backup=numbered tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service "${PREFIX}/${UVM_TOOLS_PATH_OSB}/node-builder/azure-linux/agent-install/usr/lib/systemd/system/"
5454

55+
cp -a --backup=numbered src/tarfs/Makefile "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
56+
cp -a --backup=numbered src/tarfs/tarfs.c "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
57+
58+
cp -a --backup=numbered src/kata-opa/allow-all.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
59+
5560
if [ "${CONF_PODS}" == "yes" ]; then
56-
cp -a --backup=numbered src/kata-opa/allow-all.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
5761
cp -a --backup=numbered src/kata-opa/allow-set-policy.rego "${PREFIX}/${UVM_TOOLS_PATH_SRC}/kata-opa/"
58-
cp -a --backup=numbered src/tarfs/Makefile "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
59-
cp -a --backup=numbered src/tarfs/tarfs.c "${PREFIX}/${UVM_TOOLS_PATH_SRC}/tarfs/"
6062
cp -a --backup=numbered tools/osbuilder/igvm-builder/igvm_builder.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/"
6163
cp -a --backup=numbered tools/osbuilder/igvm-builder/azure-linux/config.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux/"
6264
cp -a --backup=numbered tools/osbuilder/igvm-builder/azure-linux/igvm_lib.sh "${PREFIX}/${UVM_TOOLS_PATH_OSB}/igvm-builder/azure-linux/"

‎tools/osbuilder/node-builder/azure-linux/uvm_build.sh‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,15 @@ source "${common_file}"
2626
rootfs_make_flags="AGENT_SOURCE_BIN=${AGENT_INSTALL_DIR}/usr/bin/kata-agent OS_VERSION=${OS_VERSION}"
2727

2828
if [ "${CONF_PODS}" == "yes" ]; then
29-
rootfs_make_flags+=" AGENT_POLICY=yes CONF_GUEST=yes AGENT_POLICY_FILE=${agent_policy_file_abs}"
29+
rootfs_make_flags+=" CONF_GUEST=yes AGENT_POLICY=yes AGENT_POLICY_FILE=${agent_policy_file_abs}"
30+
else
31+
agent_policy_allow_all="${repo_dir}/src/kata-opa/allow-all.rego"
32+
rootfs_make_flags+=" AGENT_POLICY=yes AGENT_POLICY_FILE=${agent_policy_file_allow_all}"
3033
fi
3134

32-
if [ "${CONF_PODS}" == "yes" ]; then
33-
set_uvm_kernel_vars
34-
if [ -z "${UVM_KERNEL_HEADER_DIR}}" ]; then
35-
exit 1
36-
fi
35+
set_uvm_kernel_vars
36+
if [ -z "${UVM_KERNEL_HEADER_DIR}}" ]; then
37+
exit 1
3738
fi
3839

3940
pushd "${repo_dir}"
@@ -49,13 +50,13 @@ echo "Installing agent service files into rootfs"
4950
sudo cp ${AGENT_INSTALL_DIR}/usr/lib/systemd/system/kata-containers.target ${ROOTFS_PATH}/usr/lib/systemd/system/kata-containers.target
5051
sudo cp ${AGENT_INSTALL_DIR}/usr/lib/systemd/system/kata-agent.service ${ROOTFS_PATH}/usr/lib/systemd/system/kata-agent.service
5152

52-
if [ "${CONF_PODS}" == "yes" ]; then
53-
echo "Building tarfs kernel driver and installing into rootfs"
53+
echo "Building tarfs kernel driver and installing into rootfs"
5454
pushd src/tarfs
5555
make KDIR=${UVM_KERNEL_HEADER_DIR}
5656
sudo make KDIR=${UVM_KERNEL_HEADER_DIR} KVER=${UVM_KERNEL_VERSION} INSTALL_MOD_PATH=${ROOTFS_PATH} install
5757
popd
5858

59+
if [ "${CONF_PODS}" == "yes" ]; then
5960
echo "Building dm-verity protected image based on rootfs"
6061
pushd tools/osbuilder
6162
sudo -E PATH=$PATH make DISTRO=cbl-mariner MEASURED_ROOTFS=yes DM_VERITY_FORMAT=kernelinit image

‎tools/osbuilder/rootfs-builder/cbl-mariner/config.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,5 @@ OS_NAME=cbl-mariner
66
OS_VERSION=${OS_VERSION:-3.0}
77
LIBC="gnu"
88
PACKAGES="kata-packages-uvm"
9-
[ "$CONF_GUEST" = yes ] && PACKAGES+=" kata-packages-uvm-coco"
109
[ "$AGENT_INIT" = no ] && PACKAGES+=" systemd"
1110
[ "$SECCOMP" = yes ] && PACKAGES+=" libseccomp"

0 commit comments

Comments
 (0)