diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4678ac9 --- /dev/null +++ b/.gitignore @@ -0,0 +1,77 @@ +.vscode +/kata-containers-2.0.0.tar.gz +/kata-containers-2.0.1.tar.gz +/kata-containers-2.0.2.tar.gz +/kata-containers-2.0.3.tar.gz +/kata-containers-2.1.0.tar.gz +/kata-containers-2.2.0.tar.gz +/kata-containers-2.2.0-vendor.tar.gz +/kata-containers-2.2.1.tar.gz +/kata-containers-2.2.1-vendor.tar.gz +/kata-containers-2.2.2.tar.gz +/kata-containers-2.2.2-vendor.tar.gz +/kata-containers-2.2.3.tar.gz +/kata-containers-2.2.3-vendor.tar.gz +/kata-containers-2.3.0.tar.gz +/kata-containers-2.3.0-vendor.tar.gz +/kata-containers-2.3.2.tar.gz +/kata-containers-2.3.2-vendor.tar.gz +/kata-containers-2.3.3.tar.gz +/kata-containers-2.3.3-vendor.tar.gz +/kata-containers-2.4.0-rc0.tar.gz +/kata-containers-2.4.0-rc0-vendor.tar.gz +/kata-containers-2.4.0-vendor.tar.gz +/kata-containers-2.4.0.tar.gz +/kata-containers-2.4.1.tar.gz +/kata-containers-2.4.1-vendor.tar.gz +/kata-containers-2.4.2.tar.gz +/kata-containers-2.4.2-vendor.tar.gz +/kata-containers-2.4.3.tar.gz +/kata-containers-2.4.3-vendor.tar.gz +/kata-containers-2.5.0.tar.gz +/kata-containers-2.5.0-vendor.tar.gz +/kata-containers-2.5.1.tar.gz +/kata-containers-2.5.1-vendor.tar.gz +/kata-containers-2.5.2.tar.gz +/kata-containers-2.5.2-vendor.tar.gz +/kata-containers-3.0.0.tar.gz +/kata-containers-3.0.0-vendor.tar.gz +/kata-containers-3.0.1.tar.gz +/kata-containers-3.0.1-vendor.tar.gz +/kata-containers-3.1.3.tar.gz +/kata-containers-3.1.3-vendor.tar.gz +/kata-containers-3.2.0.tar.gz +/kata-containers-3.2.0-vendor.tar.gz +/kata-containers-3.6.0-vendor.tar.gz +/kata-containers-3.6.0.tar.gz +/kata-containers-3.7.0-vendor.tar.gz +/kata-containers-3.7.0.tar.gz +/kata-containers-3.9.0-vendor.tar.gz +/kata-containers-3.9.0.tar.gz +/kata-containers-3.11.0-vendor.tar.gz +/kata-containers-3.11.0.tar.gz +/kata-containers-3.12.0-vendor.tar.gz +/kata-containers-3.12.0.tar.gz +/kata-containers-3.13.0-vendor.tar.gz +/kata-containers-3.13.0.tar.gz +/kata-containers-3.14.0-vendor.tar.gz +/kata-containers-3.14.0.tar.gz +/kata-containers-3.15.0.tar.gz +/kata-containers-3.15.0-vendor.tar.gz +/kata-containers-3.16.0.tar.gz +/kata-containers-3.16.0-vendor.tar.gz +/kata-containers-3.16.0-fedora-vendor.tar.gz +/kata-containers-3.17.0.tar.gz +/kata-containers-3.17.0-vendor.tar.gz +/kata-containers-3.18.0.tar.gz +/kata-containers-3.18.0-vendor.tar.gz +/kata-containers-3.19.1.tar.gz +/kata-containers-3.19.1-vendor.tar.gz +/kata-containers-3.20.0.tar.gz +/kata-containers-3.20.0-vendor.tar.gz +/kata-containers-3.21.0.tar.gz +/kata-containers-3.21.0-vendor.tar.gz +/kata-containers-3.22.0.tar.gz +/kata-containers-3.22.0-vendor.tar.gz +/kata-containers-3.23.0.tar.gz +/kata-containers-3.23.0-vendor.tar.gz diff --git a/0999-osbuilder-Adjust-agent_version-for-our-builds.patch b/0999-osbuilder-Adjust-agent_version-for-our-builds.patch new file mode 100644 index 0000000..571a077 --- /dev/null +++ b/0999-osbuilder-Adjust-agent_version-for-our-builds.patch @@ -0,0 +1,36 @@ +From dbc78715ffe7b4011383d585548352ca2ea57f32 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= +Date: Wed, 1 Sep 2021 17:39:17 -0300 +Subject: [PATCH] Adjust agent_version for our builds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +As we move things around when installing osbuilder, we need to adapt +where we get the agent_version from. + +Signed-off-by: Fabiano Fidêncio +[gkurz: rebased on top of 3.7.0] +Signed-off-by: Greg Kurz +--- + tools/osbuilder/scripts/lib.sh | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tools/osbuilder/scripts/lib.sh b/tools/osbuilder/scripts/lib.sh +index 5e3687595953..53d544e7b1d0 100644 +--- a/tools/osbuilder/scripts/lib.sh ++++ b/tools/osbuilder/scripts/lib.sh +@@ -180,9 +180,7 @@ create_summary_file() + local agent="${AGENT_DEST}" + [ "$AGENT_INIT" = yes ] && agent="${init}" + +- local -r agentdir="${script_dir}/../../../" +- local agent_version=$(cat ${agentdir}/VERSION 2> /dev/null) +- [ -z "$agent_version" ] && agent_version="unknown" ++ agent_version=$(cat "${script_dir}/../../VERSION") + + cat >"$file"<<-EOF + --- +-- +2.45.2 + diff --git a/1001-Remove-warnings-as-compilation-errors.patch b/1001-Remove-warnings-as-compilation-errors.patch new file mode 100644 index 0000000..19fffda --- /dev/null +++ b/1001-Remove-warnings-as-compilation-errors.patch @@ -0,0 +1,204 @@ +From 983b1fb5ba4a4b8ecbb24938b3fd055c007a73d8 Mon Sep 17 00:00:00 2001 +From: Emanuel Lima +Date: Mon, 6 Jan 2025 16:11:19 -0300 +Subject: [PATCH] Remove warnings as compilation errors + +Signed-off-by: Emanuel Lima +--- + src/agent/Makefile | 4 ++-- + src/dragonball/Makefile | 4 ++-- + src/libs/Makefile | 2 +- + src/runtime-rs/Makefile | 4 ++-- + src/tools/agent-ctl/Makefile | 4 ++-- + src/tools/genpolicy/Makefile | 6 +++--- + src/tools/kata-ctl/Makefile | 6 +++--- + src/tools/runk/Makefile | 2 +- + src/tools/trace-forwarder/Makefile | 2 +- + utils.mk | 2 +- + 10 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/src/agent/Makefile b/src/agent/Makefile +--- a/src/agent/Makefile ++++ b/src/agent/Makefile +@@ -120,7 +120,7 @@ static-checks-build: $(GENERATED_CODE) + $(TARGET): $(GENERATED_CODE) $(TARGET_PATH) + + $(TARGET_PATH): show-summary +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) + + $(GENERATED_FILES): %: %.in $(VERSION_FILE) + @sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@" +@@ -127,7 +127,7 @@ $(GENERATED_FILES): %: %.in $(VERSION_FILE) + + ##TARGET optimize: optimized build + optimize: show-summary show-header +- @RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) + + ##TARGET install: install agent + install: install-services + +diff --git a/src/dragonball/Makefile b/src/dragonball/Makefile +index 40bb7f915..5eb2c1016 100644 +--- a/src/dragonball/Makefile ++++ b/src/dragonball/Makefile +@@ -27,8 +27,8 @@ clippy: + @echo "INFO: cargo clippy..." + cargo clippy --all-targets --all-features \ + -- \ +- -D warnings ++ + + vendor: + @echo "INFO: vendor do nothing.." + +diff --git a/src/libs/Makefile b/src/libs/Makefile +index aabaa3391..1fb6b20c3 100644 +--- a/src/libs/Makefile ++++ b/src/libs/Makefile +@@ -25,7 +25,7 @@ clippy: + @echo "INFO: cargo clippy..." + cargo clippy --all-targets --all-features --release \ + -- \ +- -D warnings ++ + + format: + @echo "INFO: cargo fmt..." +diff --git a/src/runtime-rs/Makefile b/src/runtime-rs/Makefile +--- a/src/runtime-rs/Makefile ++++ b/src/runtime-rs/Makefile +@@ -658,7 +658,7 @@ static-checks-build: $(GENERATED_FILES) + $(TARGET): $(GENERATED_FILES) $(TARGET_PATH) + + $(TARGET_PATH): $(SOURCES) | show-summary +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) + + $(GENERATED_FILES): %: %.in + @sed \ +@@ -668,7 +668,7 @@ $(GENERATED_FILES): %: %.in + + ##TARGET optimize: optimized build + optimize: $(SOURCES) | show-summary show-header +- @RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES) + + ##TARGET clean: clean build + clean: clean-generated-files +diff --git a/src/tools/agent-ctl/Makefile b/src/tools/agent-ctl/Makefile +index a49f88e6b..855017db4 100644 +--- a/src/tools/agent-ctl/Makefile ++++ b/src/tools/agent-ctl/Makefile +@@ -9,7 +9,7 @@ endif + default: build + + build: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) + + static-checks-build: + @echo "INFO: static-checks-build do nothing.." +@@ -23,7 +23,7 @@ vendor: + test: + + install: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path . ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path . + + check: standard_rust_check + +diff --git a/src/tools/genpolicy/Makefile b/src/tools/genpolicy/Makefile +index 7410e20ed..b33541467 100644 +--- a/src/tools/genpolicy/Makefile ++++ b/src/tools/genpolicy/Makefile +@@ -24,7 +24,7 @@ $(GENERATED_FILES): %: %.in + default: build + + build: $(GENERATED_FILES) +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) + + static-checks-build: + @echo "INFO: static-checks-build do nothing.." +@@ -37,10 +37,10 @@ vendor: + cargo vendor + + test: $(GENERATED_FILES) +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --all-targets --all-features --target $(TRIPLE) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --all-targets --all-features --target $(TRIPLE) + + install: $(GENERATED_FILES) +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path . ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path . + + check: $(GENERATED_CODE) standard_rust_check + +diff --git a/src/tools/kata-ctl/Makefile b/src/tools/kata-ctl/Makefile +index 7595c0c23..05d171f5a 100644 +--- a/src/tools/kata-ctl/Makefile ++++ b/src/tools/kata-ctl/Makefile +@@ -43,7 +43,7 @@ default: $(TARGET) build + $(TARGET): $(GENERATED_CODE) + + build: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) + + static-checks-build: $(GENERATED_CODE) + +@@ -59,10 +59,10 @@ vendor: + cargo vendor + + test: $(GENERATED_CODE) +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo test --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES) -- --nocapture + + install: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo install --locked --target $(TRIPLE) --path . --root $(INSTALL_PATH) + + check: $(GENERATED_CODE) standard_rust_check + +diff --git a/src/tools/runk/Makefile b/src/tools/runk/Makefile +index 186955679..b23cab145 100644 +--- a/src/tools/runk/Makefile ++++ b/src/tools/runk/Makefile +@@ -32,7 +32,7 @@ endif + default: build + + build: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) $(EXTRA_RUSTFEATURES) + + static-checks-build: + @echo "INFO: static-checks-build do nothing.." +diff --git a/src/tools/trace-forwarder/Makefile b/src/tools/trace-forwarder/Makefile +index 5d9f71856..bf6b80a54 100644 +--- a/src/tools/trace-forwarder/Makefile ++++ b/src/tools/trace-forwarder/Makefile +@@ -9,7 +9,7 @@ endif + default: build + + build: +- @RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) --$(BUILD_TYPE) ++ @RUSTFLAGS="$(EXTRA_RUSTFLAGS) " cargo build --target $(TRIPLE) --$(BUILD_TYPE) + + static-checks-build: + @echo "INFO: static-checks-build do nothing.." +diff --git a/utils.mk b/utils.mk +index 1a153e26c..4edba5524 100644 +--- a/utils.mk ++++ b/utils.mk +@@ -183,7 +183,7 @@ standard_rust_check: + cargo fmt -- --check + cargo clippy --all-targets --all-features --release \ + -- \ +- -D warnings ++ + + # Install a file (full version). + # +-- +2.47.1 diff --git a/15-dracut.conf b/15-dracut.conf new file mode 100644 index 0000000..c4ced5d --- /dev/null +++ b/15-dracut.conf @@ -0,0 +1,27 @@ +# Custom Fedora dracut config for kata initrd/rootfs generation + + +# Fedora: kernel drivers we want in the initrd. +drivers+=" " +# virtio vsock +drivers+=" vmw_vsock_virtio_transport " +# virtio net +drivers+=" virtio_net " +# virtio fs +drivers+=" virtiofs " +# virtio block +drivers+=" virtio_blk " +# virtio scsi +drivers+=" virtio_scsi " +# virtio serial. Could be dropped eventually, vsock covers us +drivers+=" virtio_console " +# virtio 9p. Could be dropped eventually, virtio-fs covers us +drivers+=" 9p 9pnet_virtio " +# vfio +drivers+=" vfio-pci vfio vfio_iommu_type1 irqbypass vfio_virqfd " + + +# Fedora: extra dracut modules +dracutmodules+=" " +# These aid debugging +dracutmodules+=" bash busybox rescue " diff --git a/50-kata b/50-kata new file mode 100644 index 0000000..ead8f1d --- /dev/null +++ b/50-kata @@ -0,0 +1,8 @@ +[crio.runtime.runtimes.kata] + runtime_path = "/usr/bin/containerd-shim-kata-v2" + runtime_type = "vm" + runtime_root = "/run/vc" + privileged_without_host_devices = true + allowed_annotations = [ + "io.kubernetes.cri-o.Devices", + ] diff --git a/kata-containers.spec b/kata-containers.spec new file mode 100644 index 0000000..2ed9f3c --- /dev/null +++ b/kata-containers.spec @@ -0,0 +1,596 @@ +# go-rpm-macros are not available on RHEL. +%global have_go_rpm_macros 1 +%global with_debug 0 + +# Shamelessly copied from CRI-O spec file. +%if 0%{?with_debug} +%global _find_debuginfo_dwz_opts %{nil} +%global _dwz_low_mem_die_limit 0 +%else +%global debug_package %{nil} +%endif + +# https://github.com/rust-lang/rust/issues/47714 +%undefine _strict_symbol_defs_build + +# We want verbose builds +%global _configure_disable_silent_rules 1 + +# Use bundled deps as we don't ship the exact right versions for all the +# required rust libraries +%global bundled_rust_deps 1 + +# Release candidate version tracking +# global rcver rc0 +%if 0%{?rcver:1} +%global rcrel .%{rcver} +%global rcstr -%{rcver} +%endif + +# https://github.com/kata-containers/kata-containers +Version: 3.23.0 +%global tag %{version}%{?rcstr} + +%global domain github.com +%global org kata-containers +%global repo kata-containers +%global download %{domain}/%{org}/%{repo} +%global importname %{download} + + +%global common_description %{expand: +Kata Containers version 3.x repository. Kata Containers is an open source +project and community working to build a standard implementation of lightweight +Virtual Machines (VMs) that feel and perform like containers, but provide the +workload isolation and security advantages of VMs. https://katacontainers.io/.} + +%global golicenses LICENSE \\\ + src/agent/LICENSE + +%global godocs README.md \\\ + CODE_OF_CONDUCT.md \\\ + CONTRIBUTING.md\\\ + src/agent/README.md + +# Note: the original vendor tarball is quite big (918M for 3.16) +# Unlike for RHEL, we cannot strip it down because we build all components +# (RHEL builds only build kata-agent) +Name: %{repo} +Release: 1%{?rcrel}%{?dist} +Summary: Kata Containers version 3.x repository +License: Apache-2.0 +Url: https://%{download} +Source0: https://%{download}/archive/%{version}%{?rcstr}/%{repo}-%{version}%{?rcstr}.tar.gz +Source1: https://%{download}/releases/download/%{version}/%{repo}-%{version}%{?rcstr}-vendor.tar.gz +Source2: kata-osbuilder.sh +Source3: kata-osbuilder-generate.service +Source4: 15-dracut.conf +Source5: 50-kata + +# Keep this patch downstream as it'd be hard to justify such change upstream +Patch0999: 0999-osbuilder-Adjust-agent_version-for-our-builds.patch +Patch1001: 1001-Remove-warnings-as-compilation-errors.patch + +%if 0%{?have_go_rpm_macros} +BuildRequires: go-rpm-macros +%else +BuildRequires: compiler(go-compiler) +BuildRequires: golang +%endif + +BuildRequires: git-core +BuildRequires: libselinux-devel +BuildRequires: libseccomp-devel +BuildRequires: make +BuildRequires: openssl-devel +BuildRequires: systemd +BuildRequires: gcc +BuildRequires: protobuf-compiler +BuildRequires: clang-libs + +%{?systemd_requires} +# %%check requirements +BuildRequires: dbus +BuildRequires: dbus-daemon +BuildRequires: dracut +BuildRequires: kernel +BuildRequires: busybox +BuildRequires: rsyslog + +%if 0%{?bundled_rust_deps} +BuildRequires: cargo +BuildRequires: rust +%else +# Generated using rust2rpm +# [dependencies] +BuildRequires: rust-packaging +BuildRequires: (crate(anyhow/default) >= 1.0.32 with crate(anyhow/default) < 2.0.0) +BuildRequires: (crate(lazy_static/default) >= 1.3.0 with crate(lazy_static/default) < 2.0.0) +BuildRequires: (crate(libc/default) >= 0.2.58 with crate(libc/default) < 0.3.0) +BuildRequires: (crate(log/default) >= 0.4.11 with crate(log/default) < 0.5.0) +BuildRequires: (crate(nix/default) >= 0.17.0 with crate(nix/default) < 0.18.0) +BuildRequires: (crate(prctl/default) >= 1.0.0 with crate(prctl/default) < 2.0.0) +BuildRequires: (crate(procfs/default) >= 0.7.9 with crate(procfs/default) < 0.8.0) +BuildRequires: (crate(prometheus/default) >= 0.9.0 with crate(prometheus/default) < 0.10.0) +BuildRequires: (crate(prometheus/process) >= 0.9.0 with crate(prometheus/process) < 0.10.0) +BuildRequires: (crate(regex/default) >= 1.0.0 with crate(regex/default) < 2.0.0) +BuildRequires: (crate(scan_fmt/default) >= 0.2.3 with crate(scan_fmt/default) < 0.3.0) +BuildRequires: (crate(scopeguard/default) >= 1.0.0 with crate(scopeguard/default) < 2.0.0) +BuildRequires: (crate(serde_json/default) >= 1.0.39 with crate(serde_json/default) < 2.0.0) +BuildRequires: (crate(signal-hook/default) >= 0.1.9 with crate(signal-hook/default) < 0.2.0) +BuildRequires: (crate(slog-scope/default) >= 4.1.2 with crate(slog-scope/default) < 5.0.0) +BuildRequires: (crate(slog-stdlog/default) >= 4.0.0 with crate(slog-stdlog/default) < 5.0.0) +BuildRequires: (crate(slog/default) >= 2.5.2 with crate(slog/default) < 3.0.0) +BuildRequires: (crate(slog/dynamic-keys) >= 2.5.2 with crate(slog/dynamic-keys) < 3.0.0) +BuildRequires: (crate(slog/max_level_trace) >= 2.5.2 with crate(slog/max_level_trace) < 3.0.0) +BuildRequires: (crate(slog/release_max_level_info) >= 2.5.2 with crate(slog/release_max_level_info) < 3.0.0) +BuildRequires: (crate(tempfile/default) >= 3.1.0 with crate(tempfile/default) < 4.0.0) +BuildRequires: crate(cgroups/default) >= 0.0.0 +BuildRequires: crate(logging/default) >= 0.0.0 +BuildRequires: crate(netlink/default) >= 0.0.0 +BuildRequires: crate(netlink/with-agent-handler) >= 0.0.0 +BuildRequires: crate(netlink/with-log) >= 0.0.0 +BuildRequires: crate(oci/default) >= 0.0.0 +BuildRequires: crate(protobuf/default) = 2.14.0 +BuildRequires: crate(protocols/default) >= 0.0.0 +BuildRequires: crate(rustjail/default) >= 0.0.0 +BuildRequires: crate(ttrpc/default) >= 0.0.0 +%endif + +Requires: busybox +Requires: binutils +Requires: dracut +Requires: kernel +Requires: qemu-kvm-core >= 8.2.0-1 +# For /usr/libexec/virtiofsd +Requires: (virtiofsd or qemu-virtiofsd) +Suggests: virtiofsd + +Conflicts: kata-agent +Conflicts: kata-ksm-throttler +Conflicts: kata-osbuilder +Conflicts: kata-proxy +Conflicts: kata-runtime +Conflicts: kata-shim + +# The following architectures lack the required qemu support +ExcludeArch: %{arm} %{ix86} s390 s390x + +# Building kata-ctl on ppc64le is currently being skipped +ExcludeArch: ppc64le + +%description +%{common_description} + +%gopkg + + +# Common variables to pass to 'make' +# The machine type uses a modern default +# The kernel parameters workaround an issue with cgroupsv2 after kernel 5.3 +# To-do: add BUILDFLAGS=gobuildflags when the macro becomes available +%global qemu qemu-system-%{_arch} +%global qemupath %{_bindir}/%{qemu} + +# The machine type to be used is architecture specific: +# aarch64: virt +# ppc64le: pseries +# s390x: s390-ccw-virtio +# x86_64: q35 +%ifarch aarch64 +%global machinetype "virt" +%endif +%ifarch ppc64le +%global machinetype "pseries" +%endif +%ifarch s390x +%global machinetype "s390-ccw-virtio" +%endif +%ifarch x86_64 +%global machinetype "q35" +%endif + +%global kata_build_dir %{repo}-%{version}%{?rcstr} +%global katadatadir %{_datadir}/kata-containers +%global katadefaults %{katadatadir}/defaults +%global katacache %{_localstatedir}/cache +%global katalibexecdir %{_libexecdir}/kata-containers +%global katalocalstatecachedir %{katacache}/kata-containers + +%global kataagentdir %{katalibexecdir}/agent +%global kataosbuilderdir %{katalibexecdir}/osbuilder +%global rust_make_vars LIBC=gnu + +%global runtime_make_vars QEMUPATH=%{qemupath} \\\ + KERNELTYPE="compressed" \\\ + DEFSHAREDFS="virtio-fs" \\\ + DEFVIRTIOFSDAEMON=%{_libexecdir}/"virtiofsd" \\\ + DEFVIRTIOFSCACHESIZE=0 \\\ + DEFSANDBOXCGROUPONLY=true \\\ + SKIP_GO_VERSION_CHECK=y \\\ + MACHINETYPE=%{machinetype} \\\ + SCRIPTS_DIR=%{_bindir} \\\ + DESTDIR=%{buildroot} \\\ + PREFIX=/usr \\\ + DEFAULTSDIR=%{katadefaults} \\\ + CONFDIR=%{katadefaults} \\\ + FEATURE_SELINUX="yes" \\\ + DEFENABLEANNOTATIONS=['\\\".*\\\"'] + +%global agent_make_vars %{rust_make_vars} \\\ + DESTDIR=%{buildroot}%{kataagentdir} +%global kata_ctl_vars %{rust_make_vars} \\\ + INSTALL_PATH=%{buildroot}%{_prefix} + +%prep +%autosetup -S git -p1 -n %{kata_build_dir} + +cd %{_builddir}/%{kata_build_dir} +tar -xf %{SOURCE1} + +# Not using gobuild here in order to stick to how upstream builds +# (This builds multiple binaries) +%build +%set_build_flags + +export PATH=$PATH:"$(pwd)/go/bin" +export GOPATH="$(pwd)/go" + +mkdir -p go/src/%{domain}/%{org} +ln -s $(pwd)/../%{kata_build_dir} go/src/%{importname} +cd go/src/%{importname} + +pushd src/runtime +%make_build %{runtime_make_vars} +popd + +pushd src/agent +%make_build %{agent_make_vars} +touch kata-agent +popd + +pushd src/tools/kata-ctl +%make_build %{kata_ctl_vars} +popd + +pushd tools/osbuilder +# Manually build nsdax tool +gcc %{build_cflags} image-builder/nsdax.gpl.c -o nsdax +popd + +# Not using gopkginstall here in order to stick to how upstream builds +%install +export GOPATH=$(pwd)/go +export PATH=$PATH:$GOPATH/bin + +cd go/src/%{importname} + +install -m 0644 -D -t %{buildroot}%{katalibexecdir} VERSION + +pushd src/runtime +%make_install %{runtime_make_vars} +popd + +pushd src/agent +%make_install %{agent_make_vars} +popd + +pushd src/tools/kata-ctl +%make_install %{kata_ctl_vars} +rm -f %{buildroot}%{_prefix}/.crates.toml +rm -f %{buildroot}%{_prefix}/.crates2.json +popd + +pushd tools/osbuilder +rm .gitignore +rm rootfs-builder/.gitignore +mkdir -p %{buildroot}%{katalocalstatecachedir} + +install -m 0644 -D -t %{buildroot}%{_unitdir} %{SOURCE3} +install -m 0755 -D -t %{buildroot}%{kataosbuilderdir} nsdax +install -m 0644 -D -t %{buildroot}%{kataosbuilderdir} %{SOURCE2} + +cp -aR rootfs-builder %{buildroot}%{kataosbuilderdir} +cp -aR image-builder %{buildroot}%{kataosbuilderdir} +cp -aR initrd-builder %{buildroot}%{kataosbuilderdir} +cp -aR scripts %{buildroot}%{kataosbuilderdir} +cp -aR dracut %{buildroot}%{kataosbuilderdir} + +rm -f %{buildroot}%{kataosbuilderdir}/image-builder/nsdax.gpl.c +install -m 0644 -D -t %{buildroot}%{kataosbuilderdir}/dracut/dracut.conf.d/ %{SOURCE4} +chmod +x %{buildroot}%{kataosbuilderdir}/scripts/lib.sh +chmod +x %{buildroot}%{kataosbuilderdir}/kata-osbuilder.sh +popd + +# Install the CRI-O config drop-in file +install -m 0644 -D -t %{buildroot}%{_sysconfdir}/crio/crio.conf.d %{SOURCE5} + +# Disable the image= option, so we use initrd= by default +# The kernels kata-osbuilder creates are in /var/cache now, see rhbz#1792216 +sed -i -e 's|^kernel = "%{_datadir}|kernel = "%{katacache}|' \ + -e 's|^image = "%{_datadir}/kata-containers/kata-containers.img"|initrd = "%{katacache}/kata-containers/kata-containers-initrd.img"|' \ + %{buildroot}%{katadefaults}/configuration.toml + +# Enable vsock as transport instead of virtio-serial +sed -i -e 's/^#use_vsock =/use_vsock =/' %{buildroot}%{katadefaults}/configuration.toml + +# We could be run in a mock chroot, where uname will report +# different kernel than what we have installed in the chroot. +# So we need to determine a valid kernel version to test against. +for kernelpath in /lib/modules/*/vmlinu*; do + KVERSION="$(echo $kernelpath | cut -d "/" -f 4)" + break +done +TEST_MODE=1 %{buildroot}%{kataosbuilderdir}/kata-osbuilder.sh \ + -o %{buildroot}%{kataosbuilderdir} \ + -k "$KVERSION" \ + -a %{buildroot} + + +%preun +%systemd_preun kata-osbuilder-generate.service + +%postun +%systemd_postun kata-osbuilder-generate.service + +%post +%systemd_post kata-osbuilder-generate.service +# Skip running this on Fedora CoreOS / Red Hat CoreOS +if test -w %{katalocalstatecachedir}; then + TMPOUT="$(mktemp -t kata-rpm-post-XXXXXX.log)" + echo "Creating kata appliance initrd..." + %{kataosbuilderdir}/kata-osbuilder.sh > ${TMPOUT} 2>&1 + if test "$?" != "0" ; then + echo "Building failed. Here is the log details:" + cat ${TMPOUT} + exit 1 + fi +fi + + +%files +# runtime +%{_bindir}/kata-runtime +%{_bindir}/kata-monitor +%{_bindir}/containerd-shim-kata-v2 +%{_bindir}/kata-collect-data.sh +%dir %{katalibexecdir} +%{katalibexecdir}/VERSION +%dir %{katadatadir} +%dir %{katadefaults} +%{katadefaults}/configuration.toml +%{_datadir}/bash-completion/completions/kata-runtime +%license LICENSE +%doc README.md CONTRIBUTING.md + +#agent +%dir %{kataagentdir} +%{kataagentdir}/* + +#kata-ctl +%{_bindir}/kata-ctl + +#osbuilder +%dir %{kataosbuilderdir} +%dir %{katalocalstatecachedir} + +%{kataosbuilderdir}/* +%{_unitdir}/kata-osbuilder-generate.service + +# CRI-O drop-in file +%{_sysconfdir}/crio/crio.conf.d/50-kata + +# Remove some scripts we don't use +%exclude %{katadefaults}/configuration-*.toml +%exclude %{kataosbuilderdir}/rootfs-builder/alpine +%exclude %{kataosbuilderdir}/rootfs-builder/centos +%exclude %{kataosbuilderdir}/rootfs-builder/debian +%exclude %{kataosbuilderdir}/rootfs-builder/template +%exclude %{kataosbuilderdir}/rootfs-builder/ubuntu + + +%changelog +* Mon Nov 03 2025 Christophe de Dinechin - 3.22.0-1 +- kata-containers 3.22.0 + +* Sun Oct 12 2025 Maxwell G - 3.21.0-1.2 +- Rebuild for golang 1.25.2 + +* Fri Oct 10 2025 Alejandro Sáez - 3.21.0-1.1 +- rebuild + +* Thu Sep 25 2025 Christophe de Dinechin - 3.21.0-1 +- kata-containers 3.21.0 + +* Wed Sep 10 2025 Christophe de Dinechin - 3.20.0-1 +- kata-containers 3.20.0 + +* Fri Aug 15 2025 Maxwell G - 3.19.1-1.1 +- Rebuild for golang-1.25.0 + +* Mon Jul 28 2025 Christophe de Dinechin - 3.19.1-1 +- kata-containers 3.19.0 + +* Mon Jul 28 2025 Christophe de Dinechin - 3.18.0-1 +- kata-containers 3.18.0 + +* Fri Jul 25 2025 Christophe de Dinechin - 3.17.0-1 +- kata-containers 3.17.0 + +* Thu Jul 24 2025 Christophe de Dinechin - 3.16.0-1 +- kata-containers 3.16.0 + +* Thu Jul 24 2025 Christophe de Dinechin - 3.15.0-1 +- kata-containers 3.15.0 + +* Wed Jul 23 2025 Christophe de Dinechin - 3.14.1-1 +- kata-containers 3.14.1, add fix for systemd configuration and rpm sanity test + +* Tue Jul 08 2025 Christophe de Dinechin - 3.14.0-1 +- kata-containers 3.14.0, update to latest release + +* Mon Jul 07 2025 Christophe de Dinechin - 3.13.0-1 +- kata-containers 3.13.0, required vendor source correction + +* Mon Jan 20 2025 Fedora Release Engineering - 3.12.0-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Fri Jan 17 2025 Fedora Release Engineering - 3.12.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Mon Jan 06 2025 Emanuel Lima - 3.12.0-1 +- kata-containers 3.12.0 + +* Tue Nov 26 2024 Emanuel Lima - 3.11.0-1 +- kata-containers 3.11.0 + +* Mon Oct 07 2024 Emanuel Lima - 3.9.0-1 +- kata-containers 3.9.0 + Fix warnings as compilation errors patch + Add time dependency compilation error patch + Add arch name compilation failure patch + Add binutils and rsyslog as dependencies + Add AGENT_POLICY patch + +* Mon Sep 16 2024 Emanuel Lima - 3.7.0-1 +- kata-containers 3.7.0 + Add "io.kubernetes.cri-o.Devices" to cri-o config + Remove the openssl feature patch + Bump QEMU to 8.2 + Add Remove-warnings-as-compilation-errors patch + +* Thu Jul 18 2024 Fedora Release Engineering - 3.6.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jun 18 2024 Emanuel Lima - 3.6.0-2 +- Add openssl-devel as a dependency +- Build kata-ctl instead of log-parser +- Add clang-libs, dbus and dbus-daemon as build dependencies +- Exclude ppc64le from the build pipeline + +* Tue Jun 18 2024 Emanuel Lima - 3.6.0-1 +- Bump to kata-containers-3.6.0 +- Fix agent-Remove-openssl-vendored-feature patch + +* Fri Apr 05 2024 Emanuel Lima - 3.3.0-1 +- Add clang-libs as a build dependency + Apply spec-Bump-Kata-Containers-to-its-3.3.0-release.patch + Apply agent-Remove-vendored-features-from-openssl-sys.patch + Apply spec-Add-openssl-devel-as-a-dependency.patch + Apply spec-Build-kata-ctl-instead-of-log-parser.patch + +* Sun Feb 11 2024 Maxwell G - 3.2.0-2.3 +- Rebuild for golang 1.22.0 + +* Wed Jan 24 2024 Fedora Release Engineering - 3.2.0-2.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jan 20 2024 Fedora Release Engineering - 3.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Nov 06 2023 Emanuel Lima - 3.2.0-2 +- migrated to SPDX license +- kata-containers-3.2.0 final + +* Thu Sep 28 2023 Emanuel Lima - 3.2.0-1 +- kata-containers-3.2.0 + +* Thu Jul 20 2023 Fedora Release Engineering - 3.0.1-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jan 19 2023 Fedora Release Engineering - 3.0.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Dec 22 2022 Eduardo Lima (Etrunko) - 3.0.1-1 +- kata-containers-3.0.1 + +* Wed Oct 26 2022 Eduardo Lima (Etrunko) - 3.0.0-1 +- kata-containers-3.0.0 + +* Wed Oct 26 2022 Eduardo Lima (Etrunko) - 2.5.2-1 +- kata-containers-2.5.2 + +* Wed Oct 26 2022 Eduardo Lima (Etrunko) - 2.5.1-1 +- kata-containers-2.5.1 + +* Wed Oct 26 2022 Eduardo Lima (Etrunko) - 2.5.0-1 +- kata-containers-2.5.0 + +* Wed Oct 26 2022 Eduardo Lima (Etrunko) - 2.4.3-1 +- kata-containers-2.4.3 + +* Thu Jul 21 2022 Fedora Release Engineering - 2.4.2-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jun 18 2022 Robert-André Mauchin - 2.4.2-1.1 +- Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, + CVE-2022-29526, CVE-2022-30629 + +* Tue Jun 14 2022 Eduardo Lima (Etrunko) - 2.4.2-1 +- kata-containers-2.4.2 + +* Thu May 12 2022 Eduardo Lima (Etrunko) - 2.4.1-1 +- kata-containers-2.4.1 + +* Fri Apr 01 2022 Eduardo Lima (Etrunko) - 2.4.0-1 +- kata-containers-2.4.0 + +* Wed Mar 09 2022 Eduardo Lima (Etrunko) - 2.3.3-1 +- kata-containers-2.3.3 + +* Thu Feb 10 2022 Cole Robinson - 2.3.2-2 +- Add explicit dep on /usr/libexec/virtiofsd + +* Thu Feb 03 2022 Eduardo Lima (Etrunko) - 2.3.2-1 +- kata-containers-2.3.2 + +* Thu Jan 20 2022 Fedora Release Engineering - 2.3.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Mon Nov 29 2021 Eduardo Lima (Etrunko) - 2.3.0-1 +- kata-containers-2.3.0 + +* Mon Nov 08 2021 Eduardo Lima (Etrunko) - 2.2.3-1 +- kata-containers-2.2.3 + +* Mon Oct 18 2021 Eduardo Lima (Etrunko) - 2.2.2-1 +- kata-containers-2.2.2 + +* Mon Sep 27 2021 Eduardo Lima (Etrunko) - 2.2.1-1 +- kata-containers-2.2.1 + +* Fri Sep 17 2021 Jakob Naucke - 2.2.0-3 +- Add an s390x build target + +* Thu Sep 02 2021 Eduardo Lima (Etrunko) - 2.2.0-2 +- Provide vendored code as a tarball instead of patch + +* Wed Sep 01 2021 Eduardo Lima (Etrunko) - 2.2.0-1 +- kata-containers-2.2.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 2.1.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu May 27 2021 Eduardo Lima (Etrunko) - 2.1.0-2 +- Add the CRI-O drop-in file to the package + Resolves: rhbz#1967594 +- qemu: Update QEMU binary & its location + Resolves: rhbz#1967602 + +* Thu May 27 2021 Eduardo Lima (Etrunko) - 2.1.0-1 +- kata-containers 2.1.0 + +* Fri Apr 09 2021 Eduardo Lima (Etrunko) - 2.0.3-1 +- kata-containers 2.0.3 + +* Tue Apr 06 2021 Eduardo Lima (Etrunko) - 2.0.2-1 +- kata-containers 2.0.2 + +* Mon Mar 08 2021 Eduardo Lima (Etrunko) - 2.0.1-1 +- Kata-containers 2.0.1 + +* Thu Dec 17 2020 Eduardo Lima (Etrunko) - 2.0.0-1 +- Adjust package for Fedora review. + +* Thu Nov 26 2020 Fabiano Fidêncio - 2.0.0-0 +- Initial packaging diff --git a/kata-osbuilder-generate.service b/kata-osbuilder-generate.service new file mode 100644 index 0000000..906a809 --- /dev/null +++ b/kata-osbuilder-generate.service @@ -0,0 +1,10 @@ +[Unit] +Description=Generate Kata appliance image for host kernel + +[Service] +Type=oneshot +ExecStart=/usr/libexec/kata-containers/osbuilder/kata-osbuilder.sh -c +ExecReload=/usr/libexec/kata-containers/osbuilder/kata-osbuilder.sh + +[Install] +WantedBy=kubelet.service diff --git a/kata-osbuilder.sh b/kata-osbuilder.sh new file mode 100755 index 0000000..c523d05 --- /dev/null +++ b/kata-osbuilder.sh @@ -0,0 +1,286 @@ +#!/bin/bash + +set -o errexit +set -o nounset +set -o pipefail + +[ -n "${DEBUG:-}" ] && set -o xtrace + +readonly IMAGE_TOPDIR="/var/cache/kata-containers" +readonly KERNEL_SYMLINK="${IMAGE_TOPDIR}/vmlinuz.container" +readonly SCRIPTNAME="$0" + +readonly DRACUT_ROOTFS=`mktemp --directory -t kata-dracut-rootfs-XXXXXX` +readonly DRACUT_IMAGES=`mktemp --directory -t kata-dracut-images-XXXXXX` +trap exit_handler EXIT + +readonly GENERATED_IMAGE="${DRACUT_IMAGES}/kata-containers.img" +readonly GENERATED_INITRD="${DRACUT_IMAGES}/kata-containers-initrd.img" + +readonly DISTRO=`grep '^ID=' /etc/os-release | awk '{print $2}' FS='='` + + +KVERSION=`uname -r` +KERNEL_PATH="" +COMMAND="" +OSBUILDER_DIR="/usr/libexec/kata-containers/osbuilder" +GENERATE_IMAGE="" +AGENT_DIR_PREFIX="" + +# rpm %check sets this to run the script without overwriting host +# content, and not requiring root +TEST_MODE="${TEST_MODE:-}" + + +die() +{ + error "$*" + exit 1 +} + + +error() +{ + echo "ERROR: ${SCRIPTNAME}: $*" >&2 +} + + +info() +{ + echo "${SCRIPTNAME}: $*" +} + + +exit_handler() +{ + rm -rf "${DRACUT_ROOTFS}" "${DRACUT_IMAGES}" +} + + +usage() +{ + cat <> $loadfile + done +} + + +generate_rootfs() +{ + # To generate the rootfs, we build an initrd with dracut, extract + # the initrd content, and then discard the initrd. We then rebuild + # the initrd using the osbuilder native scripts. + # + # This is a bit wasteful, but it's the easiest way to work around + # obuilder script inflexibility for now, which expect that some rootfs.sh + # code is called on a fully populated distro root. + + local agent_dir="${AGENT_DIR_PREFIX}/usr/libexec/kata-containers/agent" + + if [ -n "${TEST_MODE}" ] ; then + nsdax_bin="${OSBUILDER_DIR}/nsdax" + fi + + local agent_source_bin="${agent_dir}/usr/bin/kata-agent" + local osbuilder_version="${DISTRO}-osbuilder-version-unknown" + local dracut_conf_dir="./dracut/dracut.conf.d" + local tmp_initrd=`mktemp --tmpdir=${DRACUT_IMAGES}` + unlink "$tmp_initrd" + + # Build the initrd + echo -e "+ Building dracut initrd" + dracut \ + --confdir "${dracut_conf_dir}" \ + --no-compress \ + ${tmp_initrd} ${KVERSION} + + # Extract the generated rootfs + echo "+ Extracting dracut initrd rootfs" + cat ${tmp_initrd} | \ + cpio --extract --preserve-modification-time --make-directories --directory=${DRACUT_ROOTFS} + + # Using the busybox dracut module sets /sbin/init -> busybox + # We don't want that. Reset it to systemd + ln -sf ../lib/systemd/systemd ${DRACUT_ROOTFS}/usr/sbin/init + + echo "+ Copying agent directory tree into place" + cp -ar ${agent_dir}/* ${DRACUT_ROOTFS} + + # Make kata specific adjustments to our rootfs + echo "Calling osbuilder rootfs.sh on extracted rootfs" + AGENT_SOURCE_BIN="${agent_source_bin}" RUST_AGENT="yes" \ + ./rootfs-builder/rootfs.sh \ + -o ${osbuilder_version} \ + -r ${DRACUT_ROOTFS} + + # Generate modules-load.d file + generate_modules_load_conf + + # Mask initrd.target and default to multi-user.target + # Temporary workaround for KATA-3944 + systemctl mask --root=${DRACUT_ROOTFS} initrd.target + systemctl set-default --root=${DRACUT_ROOTFS} multi-user.target +} + + +move_images() +{ + # Move images into place + local image_osbuilder_dir="${IMAGE_TOPDIR}/osbuilder-images" + local image_dir="${image_osbuilder_dir}/$KVERSION" + local initrd_dest_path="${image_dir}/${DISTRO}-kata-${KVERSION}.initrd" + local image_dest_path="${image_dir}/${DISTRO}-kata-${KVERSION}.img" + local image_dest_link="${IMAGE_TOPDIR}/kata-containers.img" + + # This blows away the entire osbuilder-images/ dir, deleting any + # previously cached content + rm -rf "${image_osbuilder_dir}" + mkdir -p "${image_dir}" + + ln -sf ${KERNEL_PATH} ${KERNEL_SYMLINK} + + mv -Z ${GENERATED_INITRD} ${initrd_dest_path} + ln -sf ${initrd_dest_path} ${IMAGE_TOPDIR}/kata-containers-initrd.img + + if [ -n "${GENERATE_IMAGE}" ]; then + mv -Z ${GENERATED_IMAGE} ${image_dest_path} + ln -sf ${image_dest_path} ${image_dest_link} + else + rm -f ${image_dest_link} + fi +} + + +main() +{ + parse_args $* + + if [ -z "${TEST_MODE}" ]; then + [ "$(id -u)" -eq 0 ] || die "$0: must be run as root" + fi + + find_host_kernel_path + + cd "${OSBUILDER_DIR}" + + # Generate the rootfs using dracut + generate_rootfs + + if [ -n "${TEST_MODE}" ]; then + echo "+ Exiting TEST_MODE successfully" + return + fi + + # Build the initrd + echo "+ Calling osbuilder initrd_builder.sh" + ./initrd-builder/initrd_builder.sh -o ${GENERATED_INITRD} ${DRACUT_ROOTFS} + + if [ -n "${GENERATE_IMAGE}" ]; then + # Build the FS image + local nsdax_bin="/usr/libexec/kata-containers/osbuilder/nsdax" + echo "+ Calling osbuilder image_builder.sh" + NSDAX_BIN="${nsdax_bin}" \ + ./image-builder/image_builder.sh \ + -o ${GENERATED_IMAGE} ${DRACUT_ROOTFS} + fi + + move_images +} + + +main $* diff --git a/sources b/sources new file mode 100644 index 0000000..0c1fe9f --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (kata-containers-3.23.0.tar.gz) = d921dace40545fab47647c68357d88bf2807b74d5b3546ed0d91416b98fbad4ecaabf449abcc20e34cee8fbcacffe4a66a6012b63815e6b2c60c0319f982cc6e +SHA512 (kata-containers-3.23.0-vendor.tar.gz) = 484c2dececc31a4fa9d4662f0a0051d52a916728e673396fbb70ab8ef02eb3ac225b815a03e2799aa7bcfe6478dd3ad785c628879914b0b113123f3952795c7b diff --git a/test-kata-rpm-containerd.sh b/test-kata-rpm-containerd.sh new file mode 100755 index 0000000..f34c27a --- /dev/null +++ b/test-kata-rpm-containerd.sh @@ -0,0 +1,93 @@ +#!/bin/bash +set -euo pipefail + +# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm + +RPM_PATH=${1:-} + +if [[ -z "$RPM_PATH" ]]; then + echo "Usage: $0 /path/to/kata-containers-*.rpm" + exit 1 +fi + +# 1. Remove existing kata-containers packages and install the RPM +echo "[1/7] Removing existing kata-containers packages..." +sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove" + +echo "[2/7] Installing Kata Containers RPM: $RPM_PATH" +sudo rpm -i "$RPM_PATH" + +echo "[3/7] Checking installed binaries and versions..." +# kata-agent is not expected on the host; it runs inside the Kata VM image. +if command -v kata-runtime >/dev/null 2>&1; then + kata-runtime --version +else + echo "kata-runtime not found in PATH!"; exit 1 +fi +if command -v kata-ctl >/dev/null 2>&1; then + kata-ctl version +else + echo "kata-ctl not found in PATH!"; exit 1 +fi + +echo "[4/7] Checking QEMU version..." +if command -v qemu-system-x86_64 >/dev/null 2>&1; then + qemu-system-x86_64 --version +else + echo "qemu-system-x86_64 not found in PATH!"; exit 1 +fi + +echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..." +sudo modprobe vhost_net + +# 6. Run kata-runtime check (system compatibility) +echo "[6/7] Running kata-runtime check (system compatibility)..." +if ! kata-runtime check; then + echo "[ERROR] System is not capable of running Kata Containers." + exit 1 +fi + +# 7. Run a simple Kata container using containerd (if available) +echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..." +if command -v ctr >/dev/null 2>&1; then + # Clean up any existing test containers + echo "[Test] Cleaning up any existing test containers..." + sudo ctr task kill kata-test-bg 2>/dev/null || true + sudo ctr task rm kata-test-bg 2>/dev/null || true + sudo ctr container rm kata-test-bg 2>/dev/null || true + + sudo ctr images pull docker.io/library/alpine:latest + # Start a container in the background (do not use --rm so we can exec into it) + sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300 + # Wait a moment for the container to be up + sleep 2 + echo "[Test] Exec into the running container and run 'uname -a'..." + sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a + echo "[Test] Show /etc/os-release inside the container..." + sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release + + echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..." + HOST_CMDLINE=$(cat /proc/cmdline) + GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline) + echo "[Test] Host cmdline: ${HOST_CMDLINE}" + echo "[Test] Container cmdline: ${GUEST_CMDLINE}" + if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then + echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!" + exit 1 + else + echo "[SUCCESS] Kata VM isolation is working correctly!" + fi + # Clean up: kill the task and delete the container + echo "[Cleanup] Deleting test container..." + sudo ctr task kill kata-test-bg || true + sudo ctr task rm kata-test-bg || true + sudo ctr container rm kata-test-bg || true + # Also run the original test (run+rm) + sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test uname -a || { + echo "Failed to run container with Kata runtime."; exit 1; + } +else + echo "containerd (ctr) not found, skipping container test." +fi + +echo "All tests completed. If no errors above, the RPM is likely working with containerd." diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh new file mode 100755 index 0000000..fc5365b --- /dev/null +++ b/test-kata-rpm-crio.sh @@ -0,0 +1,208 @@ +#!/bin/bash +set -euo pipefail + +# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm + +RPM_PATH=${1:-} + +if [[ -z "$RPM_PATH" ]]; then + echo "Usage: $0 /path/to/kata-containers-*.rpm" + exit 1 +fi + +# 1. Remove existing kata-containers packages and install the RPM +echo "[1/7] Removing existing kata-containers packages..." +sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove" + +echo "[2/7] Installing Kata Containers RPM: $RPM_PATH" +sudo rpm -i "$RPM_PATH" + +echo "[3/7] Checking installed binaries and versions..." +# kata-agent is not expected on the host; it runs inside the Kata VM image. +if command -v kata-runtime >/dev/null 2>&1; then + kata-runtime --version +else + echo "kata-runtime not found in PATH!"; exit 1 +fi +if command -v kata-ctl >/dev/null 2>&1; then + kata-ctl version +else + echo "kata-ctl not found in PATH!"; exit 1 +fi + +echo "[4/7] Checking QEMU version..." +if command -v qemu-system-x86_64 >/dev/null 2>&1; then + qemu-system-x86_64 --version +else + echo "qemu-system-x86_64 not found in PATH!"; exit 1 +fi + +echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..." +sudo modprobe vhost_net + +# 6. Run kata-runtime check (system compatibility) +echo "[6/7] Running kata-runtime check (system compatibility)..." +if ! kata-runtime check; then + echo "[ERROR] System is not capable of running Kata Containers." + exit 1 +fi + +# 7. Run a simple Kata container using CRI-O (if available) +echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..." +if command -v crictl >/dev/null 2>&1; then + # Check if CRI-O is running, if not try to start it + if ! systemctl is-active --quiet crio; then + echo "[Test] CRI-O is not running, attempting to start it..." + sudo systemctl start crio || { + echo "[WARNING] Failed to start CRI-O..." + exit 1 + } + fi + + # Configure crictl to use CRI-O instead of containerd + echo "[Test] Configuring crictl to use CRI-O..." + sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock + sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock + # Pull the image + echo "[Test] Pulling alpine image..." + sudo crictl pull docker.io/library/alpine:latest + + # Create temporary pod and container config files + echo "[Test] Creating pod and container configurations..." + + # Create pod config (minimal Kata documentation config) + cat > /tmp/pod-config.json << 'EOF' +{ + "metadata": { + "name": "busybox-pod", + "uid": "busybox-pod", + "namespace": "test.kata" + }, + "hostname": "busybox_host", + "log_directory": "", + "dns_config": { + }, + "port_mappings": [], + "resources": { + }, + "labels": { + }, + "annotations": { + }, + "linux": { + } +} +EOF + + # Create container config + cat > /tmp/container-config.json << 'EOF' +{ + "metadata": { + "name": "busybox-container" + }, + "image": { + "image": "docker.io/library/alpine:latest" + }, + "command": ["sleep", "300"], + "linux": {} +} +EOF + + # Create pod sandbox + echo "[Test] Creating pod sandbox with kata runtime..." + POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "") + if [[ -z "$POD_ID" ]]; then + echo "[Test] Failed to create pod sandbox with Kata runtime" + journalctl -g kata + echo "[Test] Failed to create pod sandbox with Kata runtime, exiting" + exit 1 + fi + + if [[ -n "$POD_ID" ]]; then + echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..." + # Wait for pod to be ready (up to 30 seconds) + for i in {1..30}; do + if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then + echo "[Test] Pod is ready!" + break + fi + echo "[Test] Waiting for pod to be ready... ($i/30)" + sleep 1 + done + + # Create container + echo "[Test] Creating container..." + CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "") + if [[ -z "$CONTAINER_ID" ]]; then + echo "[Test] Creating container with default runtime..." + CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "") + fi + + if [[ -n "$CONTAINER_ID" ]]; then + echo "[Test] Container created with ID: $CONTAINER_ID" + + # Start container + echo "[Test] Starting container..." + if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then + # Clean up and retry + echo "[Test] Container start failed, cleaning up and retrying..." + sudo crictl stop $CONTAINER_ID 2>/dev/null || true + sudo crictl rm $CONTAINER_ID 2>/dev/null || true + CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "") + if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then + echo "[ERROR] Failed to start container after cleanup" + exit 1 + fi + fi + + # Wait a moment for the container to be up + sleep 2 + + # Execute commands in the container + echo "[Test] Exec into the running container and run 'uname -a'..." + sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed" + + echo "[Test] Show /etc/os-release inside the container..." + sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed" + + echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..." + HOST_CMDLINE=$(cat /proc/cmdline) + GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed") + echo "[Test] Host cmdline: ${HOST_CMDLINE}" + echo "[Test] Container cmdline: ${GUEST_CMDLINE}" + if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then + echo "[ERROR] The container is NOT running in a Kata VM!" + else + echo "[SUCCESS] Kata VM isolation is working correctly!" + fi + + # Clean up + echo "[Cleanup] Stopping and removing container..." + sudo crictl stop $CONTAINER_ID || true + sudo crictl rm $CONTAINER_ID || true + + if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then + echo "[ERROR] Container was running but not with Kata runtime" + exit 1 + fi + else + echo "[ERROR] Failed to create container" + fi + + # Clean up pod + echo "[Cleanup] Removing pod sandbox..." + sudo crictl stopp $POD_ID || true + sudo crictl rmp $POD_ID || true + else + echo "[ERROR] Failed to create pod sandbox" + fi + + # Clean up temp files + rm -f /tmp/pod-config.json /tmp/container-config.json + + echo "[Test] CRI-O container test completed." +else + echo "CRI-O (crictl) not found, skipping container test." +fi + +echo "All tests completed. If no errors above, the RPM is likely working with CRI-O." diff --git a/vendor-tarball.sh b/vendor-tarball.sh new file mode 100755 index 0000000..6676c88 --- /dev/null +++ b/vendor-tarball.sh @@ -0,0 +1,59 @@ +#!/bin/bash +set -xeuo pipefail + +# Kata version +KATA_VERSION=3.20.0 +RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl" + +# Original vendor tarball downloaded from upstream +ORIG_TARBALL="kata-containers-${KATA_VERSION}.tar.gz" +ORIG_VENDOR_TARBALL="kata-containers-${KATA_VERSION}-vendor.tar.gz" +TMPDIR="tmp_vendor_extract" + +# Build directories for agent and kata-ctl +RPM_BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}" +KATA_AGENT_BUILD_DIR="$RPM_BUILD_DIR/src/agent" +KATA_CTL_BUILD_DIR="$RPM_BUILD_DIR/src/tools/kata-ctl" + +# Extracted directories in the tarball +KATA_AGENT_EXTRACTED_DIR="$TMPDIR/src/agent" +KATA_CTL_EXTRACTED_DIR="$TMPDIR/src/tools/kata-ctl" + +# 1. Extract the original vendor tarball +rm -rf "$TMPDIR" +mkdir -p "$TMPDIR" +[ -f "$ORIG_VENDOR_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/releases/download/$KATA_VERSION/$ORIG_VENDOR_TARBALL + +tar xzf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR" + +# 2. Run cargo vendor in both build directories +mkdir -p $RPM_BUILD_DIR +[ -f "$ORIG_TARBALL" ] || wget https://github.com/kata-containers/kata-containers/archive/$KATA_VERSION/$ORIG_TARBALL +tar xzf "$ORIG_TARBALL" -C $RPM_BUILD_DIR/.. +for dir in "$KATA_AGENT_BUILD_DIR" "$KATA_CTL_BUILD_DIR"; do + pushd "$dir" + cargo vendor + popd +done + +# 3. Copy updated vendor and Cargo.lock into the extracted tree for both components +for src_dir in $RUST_SOURCES_TO_FIX; do + BUILD_DIR="$HOME/rpmbuild/BUILD/kata-containers-${KATA_VERSION}-build/kata-containers-${KATA_VERSION}/$src_dir" + EXTRACTED_DIR="$TMPDIR/$src_dir" + rm -rf "$EXTRACTED_DIR/vendor" + cp -a "$BUILD_DIR/vendor" "$EXTRACTED_DIR/" + cp "$BUILD_DIR/Cargo.lock" "$EXTRACTED_DIR/" +done + +# 4. Remove stale ext.rs if both ext.rs and ext/mod.rs exist in time crate for both +for EXTRACTED_DIR in "$KATA_AGENT_EXTRACTED_DIR" "$KATA_CTL_EXTRACTED_DIR"; do + TIME_SRC="$EXTRACTED_DIR/vendor/time/src" + if [[ -f "$TIME_SRC/ext.rs" && -d "$TIME_SRC/ext" ]]; then + rm -f "$TIME_SRC/ext.rs" + fi +done + +# 5. Repack the updated vendor tarball +tar czf "$ORIG_VENDOR_TARBALL" -C "$TMPDIR" . + +echo "Updated vendor tarball created: $ORIG_VENDOR_TARBALL"