aljaz/kata-containers
1
0
Fork 0
mirror of https://github.com/aljazceru/kata-containers.git synced 2026-02-16 03:54:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

cache_components: Add the ability to cache the rootfs

Browse Source 
This is the most complex part to cache, as the cached component can be
only used if:
* There were no changes in the agent
* There were no changes in the libs (used by the agent)
* There were no changes in the rootfs build scripts
* There is no change in the version of the following components:
  * attestation-agent (part of the rootfs)
  * gperf (used to build libseccomp)
  * libseccomp (used to build the agent)
  * pause image (part of the rootfs)
  * skopeo (part of the rootfs)
  * umoci (part of the rootfs)
  * rust (used to build the kata-containers and attestation agents)

We're relying on the last commit merged on places related to the rootfs
generation  and using that as the rootfs version and that should be good
enough for what we need.

Apart from everything already mentioned, we've also added the ability to
cache the `root_hash_vanilla.txt` and `root_hash_tdx.txt` files, as
those are needed for when building the shim-v2, in order to have
measured boot working there.

It's important to note that we've added the ability to cache *both*
files, and I've taken that path as the shim-v2 cache work (which will
come soon) relies on both files.

Signed-off-by: Fabiano Fidêncio <fabiano.fidencio@intel.com>
This commit is contained in:
Fabiano Fidêncio
2022-12-05 11:27:59 +01:00
parent d3e0190786
commit 4d835f6089
1 changed files with 56 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
tools/packaging/static-build/cache_components.sh
View File

@@ -74,10 +74,43 @@ cache_virtiofsd_artifacts() {
create_cache_asset "${virtiofsd_tarball_name}" "${current_virtiofsd_version}" "${current_virtiofsd_image}"
}
cache_rootfs_artifacts() {
# We need to remove `-dirty` from teh osbuilder_last_commit as the rootfs artefacts are generated on that folder
local osbuilder_last_commit="$(echo $(get_last_modification "${repo_root_dir}/tools/osbuilder") | sed s/-dirty//)"
local guest_image_last_commit="$(get_last_modification "${repo_root_dir}/tools/packaging/guest-image")"
local agent_last_commit="$(get_last_modification "${repo_root_dir}/src/agent")"
local libs_last_commit="$(get_last_modification "${repo_root_dir}/src/libs")"
local attestation_agent_version="$(get_from_kata_deps "externals.attestation-agent.version")"
local gperf_version="$(get_from_kata_deps "externals.gperf.version")"
local libseccomp_version="$(get_from_kata_deps "externals.libseccomp.version")"
local pause_version="$(get_from_kata_deps "externals.pause.version")"
local skopeo_version="$(get_from_kata_deps "externals.skopeo.branch")"
local umoci_version="$(get_from_kata_deps "externals.umoci.tag")"
local rust_version="$(get_from_kata_deps "languages.rust.meta.newest-version")"
local rootfs_tarball_name="kata-static-cc-rootfs-image.tar.xz"
local aa_kbc="offline_fs_kbc"
local image_type="image"
local root_hash_vanilla="${repo_root_dir}/tools/osbuilder/root_hash_vanilla.txt"
local root_hash_tdx=""
if [ -n "${TEE}" ]; then
if [ "${TEE}" == "tdx" ]; then
rootfs_tarball_name="kata-static-cc-tdx-rootfs-image.tar.xz"
aa_kbc="eaa_kbc"
image_type="image"
root_hash_vanilla=""
root_hash_tdx="${repo_root_dir}/tools/osbuilder/root_hash_tdx.txt"
fi
fi
local current_rootfs_version="${osbuilder_last_commit}-${guest_image_last_commit}-${agent_last_commit}-${libs_last_commit}-${attestation_agent_version}-${gperf_version}-${libseccomp_version}-${pause_version}-${skopeo_version}-${umoci_version}-${rust_version}-${image_type}-${aa_kbc}"
create_cache_asset "${rootfs_tarball_name}" "${current_rootfs_version}" "" "${root_hash_vanilla}" "${root_hash_tdx}"
}
create_cache_asset() {
local component_name="${1}"
local component_version="${2}"
local component_image="${3}"
local root_hash_vanilla="${4:-""}"
local root_hash_tdx="${5:-""}"
sudo cp "${repo_root_dir}/tools/packaging/kata-deploy/local-build/build/${component_name}" .
sudo chown -R "${USER}:${USER}" .
@@ -87,6 +120,18 @@ create_cache_asset() {
cat "latest"
echo "${component_image}" > "latest_image"
cat "latest_image"
if [ -n "${root_hash_vanilla}" ]; then
local cached_root_hash_vanilla="$(basename ${root_hash_vanilla})"
sudo cp "${root_hash_vanilla}" "${cached_root_hash_vanilla}"
sudo chown -R "${USER}:${USER}" "${cached_root_hash_vanilla}"
echo "${cached_root_hash_vanilla}: $(cat "${cached_root_hash_vanilla}")"
fi
if [ -n "${root_hash_tdx}" ]; then
local cached_root_hash_tdx="$(basename ${root_hash_tdx})"
sudo cp "${root_hash_tdx}" "${cached_root_hash_tdx}"
sudo chown -R "${USER}:${USER}" "${cached_root_hash_tdx}"
echo "${cached_root_hash_tdx}: $(cat "${cached_root_hash_tdx}")"
fi
}
help() {
@@ -109,6 +154,10 @@ Usage: $0 "[options]"
* tdvf
* td-shim
-v Virtiofsd cache
-r Rootfs Cache
* can receive a TEE environment variable value, valid values are:
* tdx
If not TEE environment is passed, the Rootfs Image will be built without TEE support.
-h Shows help
EOF
)"
@@ -120,8 +169,9 @@ main() {
local kernel_component="${kernel_component:-}"
local firmware_component="${firmware_component:-}"
local virtiofsd_component="${virtiofsd_component:-}"
local rootfs_component="${rootfs_component:-}"
local OPTIND
while getopts ":ckqfvh:" opt
while getopts ":ckqfvrh:" opt
do
case "$opt" in
c)
@@ -139,6 +189,9 @@ main() {
v)
virtiofsd_component="1"
;;
r)
rootfs_component="1"
;;
h)
help
exit 0;
@@ -157,6 +210,7 @@ main() {
[[ -z "${qemu_component}" ]] && \
[[ -z "${firmware_component}" ]] && \
[[ -z "${virtiofsd_component}" ]] && \
[[ -z "${rootfs_component}" ]] && \
help && die "Must choose at least one option"
mkdir -p "${WORKSPACE}/artifacts"
@@ -168,6 +222,7 @@ main() {
[ "${qemu_component}" == "1" ] && cache_qemu_artifacts
[ "${firmware_component}" == "1" ] && cache_firmware_artifacts
[ "${virtiofsd_component}" == "1" ] && cache_virtiofsd_artifacts
[ "${rootfs_component}" == "1" ] && cache_rootfs_artifacts
ls -la "${WORKSPACE}/artifacts/"
popd