forked from kata-containers/tests
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: Add test cases for CoCo image pulling without forked containerd
Additional tests are necessary to verify new feature that pulling image without forked containerd in CoCo. 1)image sharing on the host without dm-verity. 2)image sharing on the host with dm-verity. 3)image pulling in the guest with nydus-snapshotter. Fixes kata-containers#5763 Depends-on: github.com/kata-containers/kata-containers#7676 Signed-off-by: ChengyuZhu6 <[email protected]>
- Loading branch information
1 parent
6cf4306
commit ee3ce77
Showing
13 changed files
with
326 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/bin/bash | ||
| # | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
| set -o errtrace | ||
|
|
||
| cidir=$(dirname "$0") | ||
| source "${cidir}/lib.sh" | ||
|
|
||
| target_dir="/opt/confidential-containers" | ||
|
|
||
| nydus_snapshotter_repo=${nydus_snapshotter_repo:-"github.com/containerd/nydus-snapshotter"} | ||
| nydus_snapshotter_repo_git="https://${nydus_snapshotter_repo}.git" | ||
| nydus_snapshotter_version=${nydus_snapshotter_version:-"v0.12.0"} | ||
| nydus_snapshotter_repo_dir="${GOPATH}/src/${nydus_snapshotter_repo}" | ||
| nydus_snapshotter_binary_target_dir="$target_dir/bin" | ||
| nydus_snapshotter_config_target_dir="$target_dir/share/nydus-snapshotter" | ||
|
|
||
| nydus_repo=${nydus_repo:-"https://github.com/dragonflyoss/image-service"} | ||
| nydus_version=${nydus_version:-"v2.2.3"} | ||
|
|
||
| arch="$(uname -m)" | ||
|
|
||
| clone_nydus_snapshotter_repo() { | ||
| add_repo_to_git_safe_directory "${nydus_snapshotter_repo_dir}" | ||
|
|
||
| if [ ! -d "${nydus_snapshotter_repo_dir}" ]; then | ||
| sudo mkdir -p "${nydus_snapshotter_repo_dir}" | ||
| git clone ${nydus_snapshotter_repo_git} "${nydus_snapshotter_repo_dir}" || true | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| git checkout "${nydus_snapshotter_version}" | ||
| popd | ||
| fi | ||
| } | ||
|
|
||
| build_nydus_snapshotter() { | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| if [ "$arch" = "s390x" ]; then | ||
| export GOARCH=$arch | ||
| fi | ||
| sudo -E PATH=$PATH make | ||
|
|
||
| if [ ! -d "$nydus_snapshotter_binary_target_dir" ]; then | ||
| sudo mkdir -p $nydus_snapshotter_binary_target_dir | ||
| fi | ||
| sudo install -D -m 755 "bin/containerd-nydus-grpc" "$nydus_snapshotter_binary_target_dir/containerd-nydus-grpc" | ||
| sudo install -D -m 755 "bin/nydus-overlayfs" "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" | ||
| if [ ! -f "/usr/local/bin/nydus-overlayfs" ]; then | ||
| echo " /usr/local/bin/nydus-overlayfs exists, now we will replace it." | ||
| sudo cp -f "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" "/usr/local/bin/nydus-overlayfs" | ||
| fi | ||
| sudo rm -rf "$nydus_snapshotter_repo_dir/bin" | ||
| popd >/dev/null | ||
| } | ||
|
|
||
| download_nydus_snapshotter_config() { | ||
| if [ ! -d "$nydus_snapshotter_config_target_dir" ]; then | ||
| mkdir -p "$nydus_snapshotter_config_target_dir" | ||
| fi | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-guest-pulling.toml -o "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-host-sharing.toml -o "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
|
|
||
| } | ||
|
|
||
| download_nydus_from_tarball() { | ||
| if [ "$arch" = "s390x" ]; then | ||
| echo "Skip to download nydus for $arch, it doesn't work for $arch now." | ||
| return | ||
| fi | ||
| local goarch="$(${cidir}/kata-arch.sh --golang)" | ||
| local tarball_url="${nydus_repo}/releases/download/${nydus_version}/nydus-static-${nydus_version}-linux-$goarch.tgz" | ||
| echo "Download tarball from ${tarball_url}" | ||
| tmp_dir=$(mktemp -d -t install-nydus-tmp.XXXXXXXXXX) | ||
| curl -Ls "$tarball_url" | sudo tar xfz - -C $tmp_dir --strip-components=1 | ||
| sudo install -D -m 755 "$tmp_dir/nydus-image" "/usr/local/bin/" | ||
| } | ||
|
|
||
| download_nydus_from_tarball | ||
| clone_nydus_snapshotter_repo | ||
| build_nydus_snapshotter | ||
| download_nydus_snapshotter_config | ||
| echo "install nydus-snapshotter successful" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
94 changes: 94 additions & 0 deletions
94
integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| #!/usr/bin/env bats | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| load "${BATS_TEST_DIRNAME}/tests_common.sh" | ||
|
|
||
| tag_suffix="" | ||
| if [ "$(uname -m)" != "x86_64" ]; then | ||
| tag_suffix="-$(uname -m)" | ||
| fi | ||
|
|
||
| # Images used on the tests. | ||
|
|
||
| image_unsigned_protected="quay.io/kata-containers/confidential-containers:unsigned${tag_suffix}" | ||
|
|
||
| original_kernel_params=$(get_kernel_params) | ||
| # Allow to configure the runtimeClassName on pod configuration. | ||
| RUNTIMECLASS="${RUNTIMECLASS:-kata}" | ||
| test_tag="[cc][agent][kubernetes][containerd]" | ||
|
|
||
| setup() { | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| setup_containerd | ||
| configure_containerd_for_nydus_snapshotter "/etc/containerd/config.toml" | ||
| restart_containerd | ||
| reconfigure_kata | ||
| switch_image_service_offload off | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest with dm-verity enabled" { | ||
| if [ "$(uname -m)" = "s390x" ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest without dm-verity" { | ||
| if [ "$(uname -m)" = "s390x" ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can create two pods with pulling the image only once with dm-verity enabled" { | ||
| if [ "$(uname -m)" = "s390x" ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ ! is_containerd_support_per_runtime_snapshotter ]; then | ||
| skip "test only for containerd 1.7.x or above. See https://github.com/kata-containers/tests/issues/5772" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
|
|
||
| pod_config="$(new_pod_config "$image_unsigned_protected" "1")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| pod_config="$(new_pod_config "$image_unsigned_protected" "2")" | ||
| echo $pod_config | ||
| create_test_pod | ||
|
|
||
| pull_times=$(journalctl -t containerd --since "$test_start_date" -g "PullImage \"$image_unsigned_protected\" with snapshotter nydus" | wc -l) | ||
| [ ${pull_times} -eq 1 ] | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image inside the guest with remote-snapshotter" { | ||
| switch_image_service_offload on | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_guest_pull" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| teardown() { | ||
| teardown_common | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| kill_nydus_snapshotter_process | ||
| unset_vanilla_containerd | ||
| restart_containerd | ||
| } |
Oops, something went wrong.