From fa1bf8f75ce527cf5449fce47f0bd493c713ed70 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 15:11:16 +0200 Subject: [PATCH 01/23] packaging: Add and export CC_BUILDER_REGISTRY MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CC_BUILD_REGISTRY, which points to quay.io/kata-containers/cc-builder, will be used for storing the builder images used to build the artefacts via the kata-deploy scripts. The plan is to tag, whenever it's possible and makes sense, images like: * ${CC_BUILDER_REGISTRY}:kernel-${sha} * ${CC_BUILDER_REGISTRY}:qemu-${sha} * ${CC_BUILDER_REGISTRY}:ovmf-${sha} * ${CC_BUILDER_REGISTRY}:shim-v2-${go-toolchain}-{rust-toolchain}-${sha} * ${CC_BUILDER_REGISTRY}:td-shim-${toolchain}-${sha} * ${CC_BUILDER_REGISTRY}:virtiofsd-${toolchain}-${sha} Where ${sha} is the sha of the last commit modifying the Dockerfile used by the builder. Signed-off-by: Fabiano Fidêncio --- tools/packaging/scripts/lib.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/packaging/scripts/lib.sh b/tools/packaging/scripts/lib.sh index 640b1b79e..86698ee26 100644 --- a/tools/packaging/scripts/lib.sh +++ b/tools/packaging/scripts/lib.sh @@ -8,6 +8,7 @@ export GOPATH=${GOPATH:-${HOME}/go} export tests_repo="${tests_repo:-github.com/kata-containers/tests}" export tests_repo_dir="$GOPATH/src/$tests_repo" +export CC_BUILDER_REGISTRY="quay.io/kata-containers/cc-builders" this_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" From b1454dbcaa6c8c1e0b903ee1708dc8daf5f640b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:20:52 +0200 Subject: [PATCH 02/23] packaging: Add get_last_modification() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add a function to get the hash of the last commit modifying a specific file. This will help to avoid writing `git rev-list ...` into every single build script used by the kata-deploy. Signed-off-by: Fabiano Fidêncio --- tools/packaging/scripts/lib.sh | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tools/packaging/scripts/lib.sh b/tools/packaging/scripts/lib.sh index 86698ee26..eed0fe9f0 100644 --- a/tools/packaging/scripts/lib.sh +++ b/tools/packaging/scripts/lib.sh @@ -113,4 +113,19 @@ get_config_version() { else die "failed to find ${config_version_file}" fi -} \ No newline at end of file +} + +# $1 - Repo's root dir +# $2 - The file we're looking for the last modification +get_last_modification() { + local repo_root_dir="${1}" + local file="${2}" + + # This is a workaround needed for when running this code on Jenkins + git config --global --add safe.directory ${repo_root_dir} &> /dev/null + + dirty="" + [ $(git status --porcelain | grep "${file}" | wc -l) -gt 0 ] && dirty="-dirty" + + echo "$(git log -1 --pretty=format:"%H" ${file})${dirty}" +} From a6c0bf882378335356917f5de48836f3be6f67de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:38:38 +0200 Subject: [PATCH 03/23] packaging: Add push_to_registry() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This function will push a specific tag to a registry, whenever the PUSH_TO_REGISTRY environment variable is set, otherwise it's a no-op. This will be used in the future to avoid replicating that logic in every builder used by the kata-deploy scripts. Signed-off-by: Fabiano Fidêncio --- .../kata-deploy-binaries-in-docker.sh | 1 + tools/packaging/scripts/lib.sh | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh index 0b7c4b238..91a1f5abc 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh @@ -56,6 +56,7 @@ docker run \ --env AA_KBC="${AA_KBC:-}" \ --env KATA_BUILD_CC="${KATA_BUILD_CC:-}" \ --env INCLUDE_ROOTFS="$(realpath "${INCLUDE_ROOTFS:-}" 2> /dev/null || true)" \ + --env PUSH_TO_REGISTRY="${PUSH_TO_REGISTRY:-"no"}" \ -v "${kata_dir}:${kata_dir}" \ --rm \ -w ${script_dir} \ diff --git a/tools/packaging/scripts/lib.sh b/tools/packaging/scripts/lib.sh index eed0fe9f0..43e9d4c11 100644 --- a/tools/packaging/scripts/lib.sh +++ b/tools/packaging/scripts/lib.sh @@ -9,6 +9,7 @@ export GOPATH=${GOPATH:-${HOME}/go} export tests_repo="${tests_repo:-github.com/kata-containers/tests}" export tests_repo_dir="$GOPATH/src/$tests_repo" export CC_BUILDER_REGISTRY="quay.io/kata-containers/cc-builders" +export PUSH_TO_REGISTRY="${PUSH_TO_REGISTRY:-"no"}" this_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -129,3 +130,18 @@ get_last_modification() { echo "$(git log -1 --pretty=format:"%H" ${file})${dirty}" } + +# $1 - The tag to be pushed to the registry +# $2 - "yes" to use sudo, "no" otherwise +push_to_registry() { + local tag="${1}" + local use_sudo="${2:-"yes"}" + + if [ "${PUSH_TO_REGISTRY}" == "yes" ]; then + if [ "${use_sudo}" == "yes" ]; then + sudo docker push ${tag} + else + docker push ${tag} + fi + fi +} From c1aac0cdeab66b2ee7f2e2fd822d837c3dcd544f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 18:51:01 +0200 Subject: [PATCH 04/23] packaging: Use existing image for the kata-deploy-build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of building our own, to be used as a builder image for the kata-deploy artefacts. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- .../local-build/kata-deploy-binaries-in-docker.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh index 91a1f5abc..3deb1fc3a 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh @@ -16,6 +16,8 @@ kata_deploy_create="${script_dir}/kata-deploy-binaries.sh" uid=$(id -u ${USER}) gid=$(id -g ${USER}) +source "${script_dir}/../../scripts/lib.sh" + if [ "${script_dir}" != "${PWD}" ]; then ln -sf "${script_dir}/build" "${PWD}/build" fi @@ -37,7 +39,9 @@ if [ ! -d "$HOME/.docker" ]; then remove_dot_docker_dir=true fi -docker build -q -t build-kata-deploy \ +container_image="${CC_BUILDER_REGISTRY}:build-kata-deploy-$(get_last_modification ${kata_dir} ${script_dir})" + +docker pull "${container_image}" || docker build -q -t "${container_image}" \ --build-arg IMG_USER="${USER}" \ --build-arg UID=${uid} \ --build-arg GID=${gid} \ @@ -60,7 +64,7 @@ docker run \ -v "${kata_dir}:${kata_dir}" \ --rm \ -w ${script_dir} \ - build-kata-deploy "${kata_deploy_create}" $@ + "${container_image}" "${kata_deploy_create}" $@ if [ $remove_dot_docker_dir == true ]; then rm -rf "$HOME/.docker" From fe8b246ae4f3945fc5816cefcee5cf67bf233a59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 18:53:22 +0200 Subject: [PATCH 05/23] packaging: Add infra to push the kata-deploy builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the image used to build the kata-deploy artefacts to the Kata Containers' quay.io registry. Fixes: #5475 Signed-off-by: Fabiano Fidêncio --- .../local-build/kata-deploy-binaries-in-docker.sh | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh index 3deb1fc3a..50cd797c3 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries-in-docker.sh @@ -41,12 +41,15 @@ fi container_image="${CC_BUILDER_REGISTRY}:build-kata-deploy-$(get_last_modification ${kata_dir} ${script_dir})" -docker pull "${container_image}" || docker build -q -t "${container_image}" \ - --build-arg IMG_USER="${USER}" \ - --build-arg UID=${uid} \ - --build-arg GID=${gid} \ - --build-arg HOST_DOCKER_GID=${docker_gid} \ - "${script_dir}/dockerbuild/" +docker pull "${container_image}" || \ + (docker build -q -t "${container_image}" \ + --build-arg IMG_USER="${USER}" \ + --build-arg UID=${uid} \ + --build-arg GID=${gid} \ + --build-arg HOST_DOCKER_GID=${docker_gid} \ + "${script_dir}/dockerbuild/" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}" "no") docker run \ --privileged \ From 3cd900da6d54c02bb1f8fb7a16f850e3b19af084 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:04:11 +0200 Subject: [PATCH 06/23] packaging: Use existing image to build the kernel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of building our own, to be used as a builder image for the kernel. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/kernel/build.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/kernel/build.sh b/tools/packaging/static-build/kernel/build.sh index 13570f49a..98ee0e926 100755 --- a/tools/packaging/static-build/kernel/build.sh +++ b/tools/packaging/static-build/kernel/build.sh @@ -12,12 +12,13 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" readonly repo_root_dir="$(cd "${script_dir}/../../../.." && pwd)" readonly kernel_builder="${repo_root_dir}/tools/packaging/kernel/build-kernel.sh" +source "${script_dir}/../../scripts/lib.sh" DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} -container_image="kata-kernel-builder" +container_image="${CC_BUILDER_REGISTRY}:kernel-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker build -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || sudo docker build -t "${container_image}" "${script_dir}" sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 31a13e80815dd38497cb7daa80fa97b42f63fbc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:08:05 +0200 Subject: [PATCH 07/23] packaging: Add infra to push the kernel builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the kernel builder image to the Kata Containers' quay.io registry. Fixes: #5476 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/kernel/build.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/packaging/static-build/kernel/build.sh b/tools/packaging/static-build/kernel/build.sh index 98ee0e926..4206decff 100755 --- a/tools/packaging/static-build/kernel/build.sh +++ b/tools/packaging/static-build/kernel/build.sh @@ -18,7 +18,10 @@ DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} container_image="${CC_BUILDER_REGISTRY}:kernel-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker pull ${container_image} || sudo docker build -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || \ + (sudo docker build -t "${container_image}" "${script_dir}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 5cef4d983726936c591ecc62cbdc64434f84f245 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:12:34 +0200 Subject: [PATCH 08/23] packaging: Use existing image to build OVMF MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of buildinf our own, to be used as a builder image for OVMF. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/ovmf/build.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/ovmf/build.sh b/tools/packaging/static-build/ovmf/build.sh index fcbbd9321..51818f453 100755 --- a/tools/packaging/static-build/ovmf/build.sh +++ b/tools/packaging/static-build/ovmf/build.sh @@ -16,7 +16,7 @@ source "${script_dir}/../../scripts/lib.sh" DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} -container_image="kata-ovmf-builder" +container_image="${CC_BUILDER_REGISTRY}:ovmf-$(get_last_modification ${repo_root_dir} ${script_dir})" ovmf_build="${ovmf_build:-x86_64}" kata_version="${kata_version:-}" ovmf_repo="${ovmf_repo:-}" @@ -52,7 +52,7 @@ fi [ -n "$ovmf_package" ] || die "failed to get ovmf package or commit" [ -n "$package_output_dir" ] || die "failed to get ovmf package or commit" -sudo docker build -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || sudo docker build -t "${container_image}" "${script_dir}" sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 92d5dbb20c7770ddae337f6818481ae07e1eed00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:42:50 +0200 Subject: [PATCH 09/23] packaging: Add infra to push the OVMF builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for building and pushing the OVMF builder image to the Kata Containers' quay.io registry. Fixes: #5477 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/ovmf/build.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/packaging/static-build/ovmf/build.sh b/tools/packaging/static-build/ovmf/build.sh index 51818f453..16a52756a 100755 --- a/tools/packaging/static-build/ovmf/build.sh +++ b/tools/packaging/static-build/ovmf/build.sh @@ -52,7 +52,10 @@ fi [ -n "$ovmf_package" ] || die "failed to get ovmf package or commit" [ -n "$package_output_dir" ] || die "failed to get ovmf package or commit" -sudo docker pull ${container_image} || sudo docker build -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || \ + (sudo docker build -t "${container_image}" "${script_dir}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 1c1034255a109a10f80576fde911094711b8b04c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:57:02 +0200 Subject: [PATCH 10/23] packaging: Use existing image to build the shim-v2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's try to pull a pre-existing image, instead of building our own, to be used as a builder for the shim-v2. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/shim-v2/build.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh index bb883765a..498d64f2e 100755 --- a/tools/packaging/static-build/shim-v2/build.sh +++ b/tools/packaging/static-build/shim-v2/build.sh @@ -12,18 +12,22 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" readonly repo_root_dir="$(cd "${script_dir}/../../../.." && pwd)" readonly kernel_builder="${repo_root_dir}/tools/packaging/kernel/build-kernel.sh" +source "${script_dir}/../../scripts/lib.sh" GO_VERSION=${GO_VERSION} RUST_VERSION=${RUST_VERSION:-} DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} -container_image="shim-v2-builder" +container_image="${CC_BUILDER_REGISTRY}:shim-v2-go-${GO_VERSION}-rust-${RUST_VERSION}-$(get_last_modification ${repo_root_dir} ${script_dir})" EXTRA_OPTS="${EXTRA_OPTS:-""}" REMOVE_VMM_CONFIGS="${REMOVE_VMM_CONFIGS:-""}" -sudo docker build --build-arg GO_VERSION="${GO_VERSION}" --build-arg RUST_VERSION="${RUST_VERSION}" -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || sudo docker build \ + --build-arg GO_VERSION="${GO_VERSION}" \ + --build-arg RUST_VERSION="${RUST_VERSION}" \ + -t "${container_image}" "${script_dir}" arch=$(uname -m) if [ ${arch} = "ppc64le" ]; then From ca8abc6cae414b47ca62908ff10bbc14989bd21d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 16:59:13 +0200 Subject: [PATCH 11/23] packaging: Add infra to push the shim-v2 builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the shim-v2 builder image to the Kata Containers' quay.io registry. Fixes: #5478 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/shim-v2/build.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/tools/packaging/static-build/shim-v2/build.sh b/tools/packaging/static-build/shim-v2/build.sh index 498d64f2e..564e5cb9a 100755 --- a/tools/packaging/static-build/shim-v2/build.sh +++ b/tools/packaging/static-build/shim-v2/build.sh @@ -24,10 +24,13 @@ container_image="${CC_BUILDER_REGISTRY}:shim-v2-go-${GO_VERSION}-rust-${RUST_VER EXTRA_OPTS="${EXTRA_OPTS:-""}" REMOVE_VMM_CONFIGS="${REMOVE_VMM_CONFIGS:-""}" -sudo docker pull ${container_image} || sudo docker build \ - --build-arg GO_VERSION="${GO_VERSION}" \ - --build-arg RUST_VERSION="${RUST_VERSION}" \ - -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || \ + (sudo docker build \ + --build-arg GO_VERSION="${GO_VERSION}" \ + --build-arg RUST_VERSION="${RUST_VERSION}" \ + -t "${container_image}" "${script_dir}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") arch=$(uname -m) if [ ${arch} = "ppc64le" ]; then From 55cdd92b576a42cba8559efdf0a762a15f60e389 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 17:08:30 +0200 Subject: [PATCH 12/23] packaging: Use existing image to build td-shim MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of building our own, to be used as a builder image for the td-shim. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/td-shim/build.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/packaging/static-build/td-shim/build.sh b/tools/packaging/static-build/td-shim/build.sh index 580c4a337..3a3505b79 100755 --- a/tools/packaging/static-build/td-shim/build.sh +++ b/tools/packaging/static-build/td-shim/build.sh @@ -16,7 +16,6 @@ source "${script_dir}/../../scripts/lib.sh" DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} -container_image="kata-td-shim-builder" kata_version="${kata_version:-}" tdshim_repo="${tdshim_repo:-}" tdshim_version="${tdshim_version:-}" @@ -31,9 +30,12 @@ package_output_dir="${package_output_dir:-}" [ -n "${tdshim_version}" ] || die "Failed to get TD-shim version or commit" [ -n "${tdshim_toolchain}" ] || die "Failed to get TD-shim toolchain to be used to build the project" -sudo docker build \ +container_image="${CC_BUILDER_REGISTRY}:td-shim-${tdshim_toolchain}-$(get_last_modification ${repo_root_dir} ${script_dir})" + +sudo docker pull ${container_image} || sudo docker build \ --build-arg RUST_TOOLCHAIN="${tdshim_toolchain}" \ - -t "${container_image}" "${script_dir}" + -t "${container_image}" \ + "${script_dir}" sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 42fd229f26c6645b780ff7d64521501c7cd28a77 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 17:09:35 +0200 Subject: [PATCH 13/23] packaging: Add infra to push the td-shim builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the td-shim builder image to the Kata Containers' quay.io registry. Fixes: #5479 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/td-shim/build.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/tools/packaging/static-build/td-shim/build.sh b/tools/packaging/static-build/td-shim/build.sh index 3a3505b79..8a6c978af 100755 --- a/tools/packaging/static-build/td-shim/build.sh +++ b/tools/packaging/static-build/td-shim/build.sh @@ -32,10 +32,13 @@ package_output_dir="${package_output_dir:-}" container_image="${CC_BUILDER_REGISTRY}:td-shim-${tdshim_toolchain}-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker pull ${container_image} || sudo docker build \ - --build-arg RUST_TOOLCHAIN="${tdshim_toolchain}" \ - -t "${container_image}" \ - "${script_dir}" +sudo docker pull ${container_image} || \ + (sudo docker build \ + --build-arg RUST_TOOLCHAIN="${tdshim_toolchain}" \ + -t "${container_image}" \ + "${script_dir}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From 9ba01f36dee9646978138a24c33cbac5fc7fa0c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 17:20:27 +0200 Subject: [PATCH 14/23] virtiofsd: Pass the expected toolchain to the build container MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's ensure we're building virtiofsd with a specific toolchain that's known to not cause any issues, instead of always using the latest one. On each bump of the virtiofsd, we'll make sure to adjust this according to what's been used by the virtiofsd community. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/virtiofsd/build.sh | 4 ++++ tools/packaging/static-build/virtiofsd/gnu/Dockerfile | 3 ++- tools/packaging/static-build/virtiofsd/musl/Dockerfile | 3 ++- versions.yaml | 1 + 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/virtiofsd/build.sh b/tools/packaging/static-build/virtiofsd/build.sh index 64441d2ae..ec9d7e248 100755 --- a/tools/packaging/static-build/virtiofsd/build.sh +++ b/tools/packaging/static-build/virtiofsd/build.sh @@ -20,15 +20,18 @@ container_image="kata-virtiofsd-builder" kata_version="${kata_version:-}" virtiofsd_repo="${virtiofsd_repo:-}" virtiofsd_version="${virtiofsd_version:-}" +virtiofsd_toolchain="${virtiofsd_toolchain:-}" virtiofsd_zip="${virtiofsd_zip:-}" package_output_dir="${package_output_dir:-}" [ -n "${virtiofsd_repo}" ] || virtiofsd_repo=$(get_from_kata_deps "externals.virtiofsd.url") [ -n "${virtiofsd_version}" ] || virtiofsd_version=$(get_from_kata_deps "externals.virtiofsd.version") +[ -n "${virtiofsd_toolchain}" ] || virtiofsd_toolchain=$(get_from_kata_deps "externals.virtiofsd.toolchain") [ -n "${virtiofsd_zip}" ] || virtiofsd_zip=$(get_from_kata_deps "externals.virtiofsd.meta.binary") [ -n "${virtiofsd_repo}" ] || die "Failed to get virtiofsd repo" [ -n "${virtiofsd_version}" ] || die "Failed to get virtiofsd version or commit" +[ -n "${virtiofsd_toolchain}" ] || die "Failed to get the rust toolchain to build virtiofsd" [ -n "${virtiofsd_zip}" ] || die "Failed to get virtiofsd binary URL" ARCH=$(uname -m) @@ -48,6 +51,7 @@ case ${ARCH} in esac sudo docker build \ + --build-arg RUST_TOOLCHAIN="${virtiofsd_toolchain}" \ -t "${container_image}" "${script_dir}/${libc}" sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ diff --git a/tools/packaging/static-build/virtiofsd/gnu/Dockerfile b/tools/packaging/static-build/virtiofsd/gnu/Dockerfile index c214dfc41..c10b8db49 100644 --- a/tools/packaging/static-build/virtiofsd/gnu/Dockerfile +++ b/tools/packaging/static-build/virtiofsd/gnu/Dockerfile @@ -4,6 +4,7 @@ FROM ubuntu:20.04 ENV DEBIAN_FRONTEND=noninteractive +ARG RUST_TOOLCHAIN SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN apt-get update && \ @@ -16,4 +17,4 @@ RUN apt-get update && \ libseccomp-dev \ unzip && \ apt-get clean && rm -rf /var/lib/lists/ && \ - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN} diff --git a/tools/packaging/static-build/virtiofsd/musl/Dockerfile b/tools/packaging/static-build/virtiofsd/musl/Dockerfile index 9b9bb93b9..1236010e0 100644 --- a/tools/packaging/static-build/virtiofsd/musl/Dockerfile +++ b/tools/packaging/static-build/virtiofsd/musl/Dockerfile @@ -3,6 +3,7 @@ # SPDX-License-Identifier: Apache-2.0 FROM alpine:3.16.2 +ARG RUST_TOOLCHAIN SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN apk --no-cache add \ @@ -13,4 +14,4 @@ RUN apk --no-cache add \ libcap-ng-static \ libseccomp-static \ musl-dev && \ - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y + curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain ${RUST_TOOLCHAIN} diff --git a/versions.yaml b/versions.yaml index ad71900e0..01b33367f 100644 --- a/versions.yaml +++ b/versions.yaml @@ -314,6 +314,7 @@ externals: description: "vhost-user virtio-fs device backend written in Rust" url: "https://gitlab.com/virtio-fs/virtiofsd" version: "v1.3.0" + toolchain: "1.62.0" meta: # From https://gitlab.com/virtio-fs/virtiofsd/-/releases/v1.3.0, # this is the link labelled virtiofsd-v1.3.0.zip From 29f64d6181e30bb0090fe41386e9238a5ba438cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 17:12:18 +0200 Subject: [PATCH 15/23] packaging: Use existing image to build virtiofsd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of building our own, to be used as a builder image for the virtiofsd. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/virtiofsd/build.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/virtiofsd/build.sh b/tools/packaging/static-build/virtiofsd/build.sh index ec9d7e248..a0e8c8d20 100755 --- a/tools/packaging/static-build/virtiofsd/build.sh +++ b/tools/packaging/static-build/virtiofsd/build.sh @@ -16,7 +16,6 @@ source "${script_dir}/../../scripts/lib.sh" DESTDIR=${DESTDIR:-${PWD}} PREFIX=${PREFIX:-/opt/kata} -container_image="kata-virtiofsd-builder" kata_version="${kata_version:-}" virtiofsd_repo="${virtiofsd_repo:-}" virtiofsd_version="${virtiofsd_version:-}" @@ -50,7 +49,9 @@ case ${ARCH} in ;; esac -sudo docker build \ +container_image="${CC_BUILDER_REGISTRY}:virtiofsd-${virtiofsd_toolchain}-${libc}-$(get_last_modification ${repo_root_dir} ${script_dir})" + +sudo docker pull ${container_image} || sudo docker build \ --build-arg RUST_TOOLCHAIN="${virtiofsd_toolchain}" \ -t "${container_image}" "${script_dir}/${libc}" From a036584ed93483dae2c0133f7ef659753225ae68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 17:28:52 +0200 Subject: [PATCH 16/23] packaging: Add infra to push the virtiofsd builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the virtiofsd builder image to the Kata Containers' quay.io registry. Fixes: #5480 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/virtiofsd/build.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/tools/packaging/static-build/virtiofsd/build.sh b/tools/packaging/static-build/virtiofsd/build.sh index a0e8c8d20..18b50a79e 100755 --- a/tools/packaging/static-build/virtiofsd/build.sh +++ b/tools/packaging/static-build/virtiofsd/build.sh @@ -51,9 +51,12 @@ esac container_image="${CC_BUILDER_REGISTRY}:virtiofsd-${virtiofsd_toolchain}-${libc}-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker pull ${container_image} || sudo docker build \ - --build-arg RUST_TOOLCHAIN="${virtiofsd_toolchain}" \ - -t "${container_image}" "${script_dir}/${libc}" +sudo docker pull ${container_image} || \ + (sudo docker build \ + --build-arg RUST_TOOLCHAIN="${virtiofsd_toolchain}" \ + -t "${container_image}" "${script_dir}/${libc}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From b26cd250c87090b17bafc3a6a220f925afb53286 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 19 Oct 2022 21:12:08 +0200 Subject: [PATCH 17/23] qemu: Re-work static-build Dockerfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Differently than every single other bit that's part of our repo, QEMU has been using a single Dockerfile that prepares an environment where the project can be built, but *also* building the project as part of that very same Dockerfile. This is a problem, for several different reasons, including: * It's very hard to have a reproducible build if you don't have an archived image of the builder * One cannot cache / ipload the image of the builder, as that contains already a specific version of QEMU * Every single CI run we end up building the builder image, which includes building dependencies (such as liburing) Let's split the logic into a new build script, and pass the build script to be executed inside the builder image, which will be only responsible for providing an environment where QEMU can be built. Fixes: #5464 Backports: #5465 Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/qemu/Dockerfile | 36 +------------------ .../static-build/qemu/build-base-qemu.sh | 21 ++++++----- .../packaging/static-build/qemu/build-qemu.sh | 28 +++++++++++++++ 3 files changed, 41 insertions(+), 44 deletions(-) create mode 100755 tools/packaging/static-build/qemu/build-qemu.sh diff --git a/tools/packaging/static-build/qemu/Dockerfile b/tools/packaging/static-build/qemu/Dockerfile index 1e4441dae..930a90781 100644 --- a/tools/packaging/static-build/qemu/Dockerfile +++ b/tools/packaging/static-build/qemu/Dockerfile @@ -4,15 +4,12 @@ # SPDX-License-Identifier: Apache-2.0 from ubuntu:20.04 - -WORKDIR /root/qemu - # CACHE_TIMEOUT: date to invalid cache, if the date changes the image will be rebuild # This is required to keep build dependencies with security fixes. ARG CACHE_TIMEOUT -RUN echo "$CACHE_TIMEOUT" ARG DEBIAN_FRONTEND=noninteractive +SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN apt-get update && apt-get upgrade -y && \ apt-get --no-install-recommends install -y \ apt-utils \ @@ -52,38 +49,7 @@ RUN apt-get update && apt-get upgrade -y && \ if [ "$(uname -m)" != "s390x" ]; then apt-get install -y --no-install-recommends libpmem-dev; fi && \ apt-get clean && rm -rf /var/lib/apt/lists/ -ARG QEMU_REPO -# commit/tag/branch -ARG QEMU_VERSION -ARG PREFIX -# BUILD_SUFFIX is used by the qemu-build-post.sh script to -# properly rename non vanilla versions of the QEMU -ARG BUILD_SUFFIX -ARG HYPERVISOR_NAME -ARG PKGVERSION -ARG QEMU_DESTDIR -ARG QEMU_TARBALL - -SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN git clone https://github.com/axboe/liburing/ ~/liburing && \ cd ~/liburing && \ git checkout tags/liburing-2.1 && \ make && make install && ldconfig - -COPY scripts/configure-hypervisor.sh /root/configure-hypervisor.sh -COPY qemu /root/kata_qemu -COPY scripts/apply_patches.sh /root/apply_patches.sh -COPY scripts/patch_qemu.sh /root/patch_qemu.sh -COPY static-build/scripts/qemu-build-post.sh /root/static-build/scripts/qemu-build-post.sh -COPY static-build/qemu.blacklist /root/static-build/qemu.blacklist - -RUN git clone --depth=1 "${QEMU_REPO}" qemu && \ - cd qemu && \ - git fetch --depth=1 origin "${QEMU_VERSION}" && git checkout FETCH_HEAD && \ - scripts/git-submodule.sh update meson capstone && \ - /root/patch_qemu.sh "${QEMU_VERSION}" "/root/kata_qemu/patches" && \ - (PREFIX="${PREFIX}" /root/configure-hypervisor.sh -s "${HYPERVISOR_NAME}" | xargs ./configure \ - --with-pkgversion="${PKGVERSION}") && \ - make -j"$(nproc ${CI:+--ignore 1})" && \ - make install DESTDIR="${QEMU_DESTDIR}" && \ - /root/static-build/scripts/qemu-build-post.sh diff --git a/tools/packaging/static-build/qemu/build-base-qemu.sh b/tools/packaging/static-build/qemu/build-base-qemu.sh index cda5563c4..1a9713120 100755 --- a/tools/packaging/static-build/qemu/build-base-qemu.sh +++ b/tools/packaging/static-build/qemu/build-base-qemu.sh @@ -9,6 +9,8 @@ set -o nounset set -o pipefail script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +readonly repo_root_dir="$(cd "${script_dir}/../../../.." && pwd)" +readonly qemu_builder="${script_dir}/build-qemu.sh" source "${script_dir}/../../scripts/lib.sh" source "${script_dir}/../qemu.blacklist" @@ -41,16 +43,8 @@ container_image="qemu-static-${qemu_version,,}" sudo "${container_engine}" build \ --build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \ - --build-arg BUILD_SUFFIX=${build_suffix} \ - --build-arg HYPERVISOR_NAME="${HYPERVISOR_NAME}" \ - --build-arg PKGVERSION="${PKGVERSION}" \ --build-arg http_proxy="${http_proxy}" \ --build-arg https_proxy="${https_proxy}" \ - --build-arg QEMU_DESTDIR="${qemu_destdir}" \ - --build-arg QEMU_REPO="${qemu_repo}" \ - --build-arg QEMU_VERSION="${qemu_version}" \ - --build-arg QEMU_TARBALL="${qemu_tar}" \ - --build-arg PREFIX="${prefix}" \ "${packaging_dir}" \ -f "${script_dir}/Dockerfile" \ -t "${container_image}" @@ -58,8 +52,17 @@ sudo "${container_engine}" build \ sudo "${container_engine}" run \ --rm \ -i \ + --env BUILD_SUFFIX="${build_suffix}" \ + --env HYPERVISOR_NAME="${HYPERVISOR_NAME}" \ + --env PKGVERSION="${PKGVERSION}" \ + --env QEMU_DESTDIR="${qemu_destdir}" \ + --env QEMU_REPO="${qemu_repo}" \ + --env QEMU_VERSION="${qemu_version}" \ + --env QEMU_TARBALL="${qemu_tar}" \ + --env PREFIX="${prefix}" \ + -v "${repo_root_dir}:/root/kata-containers" \ -v "${PWD}":/share "${container_image}" \ - mv "${qemu_destdir}/${qemu_tar}" /share/ + bash -c "/root/kata-containers/tools/packaging/static-build/qemu/build-qemu.sh" sudo docker image rm "${container_image}" diff --git a/tools/packaging/static-build/qemu/build-qemu.sh b/tools/packaging/static-build/qemu/build-qemu.sh new file mode 100755 index 000000000..edab34891 --- /dev/null +++ b/tools/packaging/static-build/qemu/build-qemu.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash +# +# Copyright (c) 2022 Intel Corporation +# +# SPDX-License-Identifier: Apache-2.0 + +set -o errexit +set -o nounset +set -o pipefail + +kata_packaging_dir="/root/kata-containers/tools/packaging" +kata_packaging_scripts="${kata_packaging_dir}/scripts" + +kata_static_build_dir="${kata_packaging_dir}/static-build" +kata_static_build_scripts="${kata_static_build_dir}/scripts" + +git clone --depth=1 "${QEMU_REPO}" qemu +pushd qemu +git fetch --depth=1 origin "${QEMU_VERSION}" +git checkout FETCH_HEAD +scripts/git-submodule.sh update meson capstone +${kata_packaging_scripts}/patch_qemu.sh "${QEMU_VERSION}" "${kata_packaging_dir}/qemu/patches" +PREFIX="${PREFIX}" ${kata_packaging_scripts}/configure-hypervisor.sh -s "${HYPERVISOR_NAME}" | xargs ./configure --with-pkgversion="${PKGVERSION}" +make -j"$(nproc +--ignore 1)" +make install DESTDIR="${QEMU_DESTDIR}" +popd +${kata_static_build_scripts}/qemu-build-post.sh +mv "${QEMU_DESTDIR}/${QEMU_TARBALL}" /share/ From 9e1df04e66a2b52010bbc316bf8bb62ffdb07224 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 09:40:14 +0200 Subject: [PATCH 18/23] packaging: Use existing image to build QEMU MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existsing image, instead of building our own, to be used as a builder image for QEMU. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/qemu/build-base-qemu.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/qemu/build-base-qemu.sh b/tools/packaging/static-build/qemu/build-base-qemu.sh index 1a9713120..c2f6587a2 100755 --- a/tools/packaging/static-build/qemu/build-base-qemu.sh +++ b/tools/packaging/static-build/qemu/build-base-qemu.sh @@ -39,9 +39,9 @@ CACHE_TIMEOUT=$(date +"%Y-%m-%d") [ -n "${build_suffix}" ] && HYPERVISOR_NAME="kata-qemu-${build_suffix}" || HYPERVISOR_NAME="kata-qemu" [ -n "${build_suffix}" ] && PKGVERSION="kata-static-${build_suffix}" || PKGVERSION="kata-static" -container_image="qemu-static-${qemu_version,,}" +container_image="${CC_BUILDER_REGISTRY}:qemu-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo "${container_engine}" build \ +sudo docker pull ${container_image} || sudo "${container_engine}" build \ --build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \ --build-arg http_proxy="${http_proxy}" \ --build-arg https_proxy="${https_proxy}" \ From d4db7ed3c8d5fb19fbe2c32ee7d8591bad493e23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 09:41:34 +0200 Subject: [PATCH 19/23] packaging: Add infra to push the QEMU builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the QEMU builder image to the Kata Containers' quay.io registry. Fixes: #5481 Signed-off-by: Fabiano Fidêncio --- .../static-build/qemu/build-base-qemu.sh | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/tools/packaging/static-build/qemu/build-base-qemu.sh b/tools/packaging/static-build/qemu/build-base-qemu.sh index c2f6587a2..9be55bedc 100755 --- a/tools/packaging/static-build/qemu/build-base-qemu.sh +++ b/tools/packaging/static-build/qemu/build-base-qemu.sh @@ -41,13 +41,16 @@ CACHE_TIMEOUT=$(date +"%Y-%m-%d") container_image="${CC_BUILDER_REGISTRY}:qemu-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker pull ${container_image} || sudo "${container_engine}" build \ - --build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \ - --build-arg http_proxy="${http_proxy}" \ - --build-arg https_proxy="${https_proxy}" \ - "${packaging_dir}" \ - -f "${script_dir}/Dockerfile" \ - -t "${container_image}" +sudo docker pull ${container_image} || \ + (sudo "${container_engine}" build \ + --build-arg CACHE_TIMEOUT="${CACHE_TIMEOUT}" \ + --build-arg http_proxy="${http_proxy}" \ + --build-arg https_proxy="${https_proxy}" \ + "${packaging_dir}" \ + -f "${script_dir}/Dockerfile" \ + -t "${container_image}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo "${container_engine}" run \ --rm \ From 94807e73e72ebddad4df96a85c24b9110391db22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 11:12:09 +0200 Subject: [PATCH 20/23] packaging: Don't remove QEMU image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Now that the QEMU builder image provides only the environment used for building QEMU, let's ensure it doesn't get removed. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/qemu/build-base-qemu.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/tools/packaging/static-build/qemu/build-base-qemu.sh b/tools/packaging/static-build/qemu/build-base-qemu.sh index 9be55bedc..7bc6805d1 100755 --- a/tools/packaging/static-build/qemu/build-base-qemu.sh +++ b/tools/packaging/static-build/qemu/build-base-qemu.sh @@ -67,6 +67,4 @@ sudo "${container_engine}" run \ -v "${PWD}":/share "${container_image}" \ bash -c "/root/kata-containers/tools/packaging/static-build/qemu/build-qemu.sh" -sudo docker image rm "${container_image}" - sudo chown ${USER}:$(id -gn ${USER}) "${PWD}/${qemu_tar}" From ebf6c8383983e78a071baf0aed565f38453226ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 25 Oct 2022 15:07:11 +0200 Subject: [PATCH 21/23] packaging: Use exissting image to build the initramfs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's first try to pull a pre-existing image, instead of building our own, to be used as a builder for the initramds. This will save us some CI time. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/initramfs/build.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/initramfs/build.sh b/tools/packaging/static-build/initramfs/build.sh index 0f4beddb7..cc309e598 100755 --- a/tools/packaging/static-build/initramfs/build.sh +++ b/tools/packaging/static-build/initramfs/build.sh @@ -15,7 +15,6 @@ readonly default_install_dir="$(cd "${script_dir}/../../kernel" && pwd)" source "${script_dir}/../../scripts/lib.sh" -container_image="kata-initramfs-builder" kata_version="${kata_version:-}" cryptsetup_repo="${cryptsetup_repo:-}" cryptsetup_version="${cryptsetup_version:-}" @@ -33,7 +32,9 @@ package_output_dir="${package_output_dir:-}" [ -n "${lvm2_repo}" ] || die "Failed to get lvm2 repo" [ -n "${lvm2_version}" ] || die "Failed to get lvm2 version" -sudo docker build \ +container_image="${CC_BUILDER_REGISTRY}:initramfs-cryptsetup-${cryptsetup_version}-lvm2-${lvm2_version}-$(get_last_modification ${repo_root_dir} ${script_dir})" + +sudo docker pull ${container_image} || sudo docker build \ -t "${container_image}" "${script_dir}" sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ From 111ad87828e479dd986ac1a158637d195c0283bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Tue, 25 Oct 2022 15:09:11 +0200 Subject: [PATCH 22/23] packaging: Add infra to push the initramfs builder image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's add the needed infra for only building and pushing the initramfs builder image to the Kata Containers' quay.io registry. Signed-off-by: Fabiano Fidêncio --- tools/packaging/static-build/initramfs/build.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tools/packaging/static-build/initramfs/build.sh b/tools/packaging/static-build/initramfs/build.sh index cc309e598..96d09763c 100755 --- a/tools/packaging/static-build/initramfs/build.sh +++ b/tools/packaging/static-build/initramfs/build.sh @@ -34,8 +34,10 @@ package_output_dir="${package_output_dir:-}" container_image="${CC_BUILDER_REGISTRY}:initramfs-cryptsetup-${cryptsetup_version}-lvm2-${lvm2_version}-$(get_last_modification ${repo_root_dir} ${script_dir})" -sudo docker pull ${container_image} || sudo docker build \ - -t "${container_image}" "${script_dir}" +sudo docker pull ${container_image} || (sudo docker build \ + -t "${container_image}" "${script_dir}" && \ + # No-op unless PUSH_TO_REGISTRY is exported as "yes" + push_to_registry "${container_image}") sudo docker run --rm -i -v "${repo_root_dir}:${repo_root_dir}" \ -w "${PWD}" \ From c916c98ab503b27b247ad2a99984f6888e4e8b79 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Thu, 20 Oct 2022 18:27:36 +0200 Subject: [PATCH 23/23] actions: Push the builder images as part of the payload generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Let's take advantge of an existing action that publishes the payload after each pull request, to also publish the "builder images" used to build each one of the artefacts. Signed-off-by: Fabiano Fidêncio --- .github/workflows/cc-payload-after-push.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cc-payload-after-push.yaml b/.github/workflows/cc-payload-after-push.yaml index f9315b903..b7b08dd23 100644 --- a/.github/workflows/cc-payload-after-push.yaml +++ b/.github/workflows/cc-payload-after-push.yaml @@ -24,7 +24,16 @@ jobs: - cc-tdx-td-shim - cc-tdx-tdvf steps: + - name: Login to Kata Containers quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.QUAY_DEPLOYER_USERNAME }} + password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} + - uses: actions/checkout@v3 + with: + fetch-depth: 0 # This is needed in order to keep the commit ids history - name: Build ${{ matrix.asset }} run: | make "${KATA_ASSET}-tarball" @@ -34,6 +43,7 @@ jobs: env: KATA_ASSET: ${{ matrix.asset }} TAR_OUTPUT: ${{ matrix.asset }}.tar.gz + PUSH_TO_REGISTRY: yes - name: store-artifact ${{ matrix.asset }} uses: actions/upload-artifact@v3 @@ -68,7 +78,7 @@ jobs: needs: create-kata-tarball runs-on: ubuntu-latest steps: - - name: Login to quay.io + - name: Login to Confidential Containers quay.io uses: docker/login-action@v2 with: registry: quay.io