mirror of
https://github.com/aljazceru/kata-containers.git
synced 2026-01-11 02:14:20 +01:00
ab829d1038
Fixes: #7573 To enable this feature, build your rootfs using AGENT_POLICY=yes. The default is AGENT_POLICY=no. Building rootfs using AGENT_POLICY=yes has the following effects: 1. The kata-opa service gets included in the Guest image. 2. The agent gets built using AGENT_POLICY=yes. After this patch, the shim calls SetPolicy if and only if a Policy annotation is attached to the sandbox/pod. When creating a sandbox/pod that doesn't have an attached Policy annotation: 1. If the agent was built using AGENT_POLICY=yes, the new sandbox uses the default agent settings, that might include a default Policy too. 2. If the agent was built using AGENT_POLICY=no, the new sandbox is executed the same way as before this patch. Any SetPolicy calls from the shim to the agent fail if the agent was built using AGENT_POLICY=no. If the agent was built using AGENT_POLICY=yes: 1. The agent reads the contents of a default policy file during sandbox start-up. 2. The agent then connects to the OPA service on localhost and sends the default policy to OPA. 3. If the shim calls SetPolicy: a. The agent checks if SetPolicy is allowed by the current policy (the current policy is typically the default policy mentioned above). b. If SetPolicy is allowed, the agent deletes the current policy from OPA and replaces it with the new policy it received from the shim. A typical new policy from the shim doesn't allow any future SetPolicy calls. 4. For every agent rpc API call, the agent asks OPA if that call should be allowed. OPA allows or not a call based on the current policy, the name of the agent API, and the API call's inputs. The agent rejects any calls that are rejected by OPA. When building using AGENT_POLICY_DEBUG=yes, additional Policy logging gets enabled in the agent. In particular, information about the inputs for agent rpc API calls is logged in /tmp/policy.txt, on the Guest VM. These inputs can be useful for investigating API calls that might have been rejected by the Policy. Examples: 1. Load a failing policy file test1.rego on a different machine: opa run --server --addr 127.0.0.1:8181 test1.rego 2. Collect the API inputs from Guest's /tmp/policy.txt and test on the machine where the failing policy has been loaded: curl -X POST http://localhost:8181/v1/data/agent_policy/CreateContainerRequest \ --data-binary @test1-inputs.json Signed-off-by: Dan Mihai <dmihai@microsoft.com>
225 lines
6.0 KiB
Makefile
225 lines
6.0 KiB
Makefile
# Copyright (c) 2019 Intel Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
# To show variables or targets help on `make help`
|
|
# Use the following format:
|
|
# '##VAR VARIABLE_NAME: help about variable'
|
|
# '##TARGET TARGET_NAME: help about target'
|
|
|
|
PROJECT_NAME = Kata Containers
|
|
PROJECT_URL = https://github.com/kata-containers
|
|
PROJECT_COMPONENT = kata-agent
|
|
|
|
TARGET = $(PROJECT_COMPONENT)
|
|
|
|
VERSION_FILE := ./VERSION
|
|
VERSION := $(shell grep -v ^\# $(VERSION_FILE))
|
|
COMMIT_NO := $(shell git rev-parse HEAD 2>/dev/null || true)
|
|
COMMIT := $(if $(shell git status --porcelain --untracked-files=no 2>/dev/null || true),${COMMIT_NO}-dirty,${COMMIT_NO})
|
|
COMMIT_MSG = $(if $(COMMIT),$(COMMIT),unknown)
|
|
|
|
# Exported to allow cargo to see it
|
|
export VERSION_COMMIT := $(if $(COMMIT),$(VERSION)-$(COMMIT),$(VERSION))
|
|
|
|
EXTRA_RUSTFEATURES :=
|
|
|
|
##VAR SECCOMP=yes|no define if agent enables seccomp feature
|
|
SECCOMP ?= yes
|
|
|
|
# Enable seccomp feature of rust build
|
|
ifeq ($(SECCOMP),yes)
|
|
override EXTRA_RUSTFEATURES += seccomp
|
|
endif
|
|
|
|
##VAR AGENT_POLICY=yes|no define if agent enables the policy feature
|
|
AGENT_POLICY := no
|
|
|
|
# Enable the policy feature of rust build
|
|
ifeq ($(AGENT_POLICY),yes)
|
|
override EXTRA_RUSTFEATURES += agent-policy
|
|
endif
|
|
|
|
include ../../utils.mk
|
|
|
|
ifeq ($(ARCH), ppc64le)
|
|
override ARCH = powerpc64le
|
|
endif
|
|
|
|
##VAR STANDARD_OCI_RUNTIME=yes|no define if agent enables standard oci runtime feature
|
|
STANDARD_OCI_RUNTIME := no
|
|
|
|
# Enable standard oci runtime feature of rust build
|
|
ifeq ($(STANDARD_OCI_RUNTIME),yes)
|
|
override EXTRA_RUSTFEATURES += standard-oci-runtime
|
|
endif
|
|
|
|
ifneq ($(EXTRA_RUSTFEATURES),)
|
|
override EXTRA_RUSTFEATURES := --features "$(EXTRA_RUSTFEATURES)"
|
|
endif
|
|
|
|
TARGET_PATH = target/$(TRIPLE)/$(BUILD_TYPE)/$(TARGET)
|
|
|
|
##VAR DESTDIR=<path> is a directory prepended to each installed target file
|
|
DESTDIR :=
|
|
##VAR BINDIR=<path> is a directory for installing executable programs
|
|
BINDIR := /usr/bin
|
|
|
|
##VAR INIT=yes|no define if agent will be installed as init
|
|
INIT := no
|
|
|
|
# Path to systemd unit directory if installed as not init.
|
|
UNIT_DIR := /usr/lib/systemd/system
|
|
|
|
GENERATED_CODE = src/version.rs
|
|
|
|
AGENT_NAME=$(TARGET)
|
|
API_VERSION=0.0.1
|
|
AGENT_VERSION=$(VERSION)
|
|
|
|
GENERATED_REPLACEMENTS= \
|
|
AGENT_NAME \
|
|
AGENT_VERSION \
|
|
API_VERSION \
|
|
BINDIR \
|
|
COMMIT \
|
|
VERSION_COMMIT
|
|
GENERATED_FILES :=
|
|
|
|
GENERATED_FILES += $(GENERATED_CODE)
|
|
|
|
ifeq ($(INIT),no)
|
|
# Unit file to start kata agent in systemd systems
|
|
UNIT_FILES = kata-agent.service
|
|
GENERATED_FILES += $(UNIT_FILES)
|
|
# Target to be reached in systemd services
|
|
UNIT_FILES += kata-containers.target
|
|
endif
|
|
|
|
# Display name of command and it's version (or a message if not available).
|
|
#
|
|
# Arguments:
|
|
#
|
|
# 1: Name of command
|
|
define get_command_version
|
|
$(shell printf "%s: %s\\n" $(1) "$(or $(shell $(1) --version 2>/dev/null), (not available))")
|
|
endef
|
|
|
|
define get_toolchain_version
|
|
$(shell printf "%s: %s\\n" "toolchain" "$(or $(shell rustup show active-toolchain 2>/dev/null), (unknown))")
|
|
endef
|
|
|
|
define INSTALL_FILE
|
|
install -D -m 644 $1 $(DESTDIR)$2/$1 || exit 1;
|
|
endef
|
|
|
|
.DEFAULT_GOAL := default
|
|
|
|
##TARGET default: build code
|
|
default: $(TARGET) show-header
|
|
|
|
static-checks-build: $(GENERATED_CODE)
|
|
|
|
$(TARGET): $(GENERATED_CODE) $(TARGET_PATH)
|
|
|
|
$(TARGET_PATH): show-summary
|
|
@RUSTFLAGS="$(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
|
|
|
|
$(GENERATED_FILES): %: %.in
|
|
@sed $(foreach r,$(GENERATED_REPLACEMENTS),-e 's|@$r@|$($r)|g') "$<" > "$@"
|
|
|
|
##TARGET optimize: optimized build
|
|
optimize: show-summary show-header
|
|
@RUSTFLAGS="-C link-arg=-s $(EXTRA_RUSTFLAGS) --deny warnings" cargo build --target $(TRIPLE) $(if $(findstring release,$(BUILD_TYPE)),--release) $(EXTRA_RUSTFEATURES)
|
|
|
|
##TARGET install: install agent
|
|
install: install-services
|
|
@install -D $(TARGET_PATH) $(DESTDIR)/$(BINDIR)/$(TARGET)
|
|
|
|
##TARGET clean: clean build
|
|
clean:
|
|
@cargo clean
|
|
@rm -f $(GENERATED_FILES)
|
|
@rm -f tarpaulin-report.html
|
|
|
|
vendor:
|
|
@cargo vendor
|
|
|
|
|
|
#TARGET test: run cargo tests
|
|
test:
|
|
@cargo test --all --target $(TRIPLE) $(EXTRA_RUSTFEATURES) -- --nocapture
|
|
|
|
##TARGET check: run test
|
|
check: $(GENERATED_FILES) standard_rust_check
|
|
|
|
##TARGET run: build and run agent
|
|
run:
|
|
@cargo run --target $(TRIPLE)
|
|
|
|
install-services: $(GENERATED_FILES)
|
|
ifeq ($(INIT),no)
|
|
@echo "Installing systemd unit files..."
|
|
$(foreach f,$(UNIT_FILES),$(call INSTALL_FILE,$f,$(UNIT_DIR)))
|
|
endif
|
|
|
|
show-header:
|
|
@printf "%s - version %s (commit %s)\n\n" "$(TARGET)" "$(VERSION)" "$(COMMIT_MSG)"
|
|
|
|
show-summary: show-header
|
|
@printf "project:\n"
|
|
@printf " name: $(PROJECT_NAME)\n"
|
|
@printf " url: $(PROJECT_URL)\n"
|
|
@printf " component: $(PROJECT_COMPONENT)\n"
|
|
@printf "target: $(TARGET)\n"
|
|
@printf "architecture:\n"
|
|
@printf " host: $(ARCH)\n"
|
|
@printf "rust:\n"
|
|
@printf " %s\n" "$(call get_command_version,cargo)"
|
|
@printf " %s\n" "$(call get_command_version,rustc)"
|
|
@printf " %s\n" "$(call get_command_version,rustup)"
|
|
@printf " %s\n" "$(call get_toolchain_version)"
|
|
@printf "\n"
|
|
|
|
## help: Show help comments that start with `##VAR` and `##TARGET`
|
|
help: Makefile show-summary
|
|
@echo "==========================Help============================="
|
|
@echo "Variables:"
|
|
@sed -n 's/^##VAR//p' $< | sort
|
|
@echo ""
|
|
@echo "Targets:"
|
|
@sed -n 's/^##TARGET//p' $< | sort
|
|
|
|
TARPAULIN_ARGS:=-v --workspace
|
|
install-tarpaulin:
|
|
cargo install cargo-tarpaulin
|
|
|
|
# Check if cargo tarpaulin is installed
|
|
HAS_TARPAULIN:= $(shell cargo --list | grep tarpaulin 2>/dev/null)
|
|
check_tarpaulin:
|
|
ifndef HAS_TARPAULIN
|
|
$(error "tarpaulin is not available please: run make install-tarpaulin ")
|
|
else
|
|
$(info OK: tarpaulin installed)
|
|
endif
|
|
|
|
##TARGET codecov: Generate code coverage report
|
|
codecov: check_tarpaulin
|
|
cargo tarpaulin $(TARPAULIN_ARGS)
|
|
|
|
##TARGET codecov-html: Generate code coverage html report
|
|
codecov-html: check_tarpaulin
|
|
cargo tarpaulin $(TARPAULIN_ARGS) -o Html
|
|
|
|
.PHONY: \
|
|
help \
|
|
optimize \
|
|
show-header \
|
|
show-summary \
|
|
vendor
|
|
|
|
##TARGET generate-protocols: generate/update grpc agent protocols
|
|
generate-protocols:
|
|
../libs/protocols/hack/update-generated-proto.sh all
|