forked from kata-containers/tests
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: Add test cases for CoCo image pulling without forked containerd
Additional tests are necessary to verify new feature that pulling image without forked containerd in CoCo. 1)image sharing on the host without dm-verity. 2)image sharing on the host with dm-verity. 3)two pods with pulling image only once. 4)image pulling in the guest with nydus-snapshotter. Fixes kata-containers#5763 Depends-on: github.com/kata-containers/kata-containers#7676 Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
- Loading branch information
1 parent
6d7723a
commit 3a681d2
Showing
12 changed files
with
294 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/bin/bash | ||
| # | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
| set -o errtrace | ||
|
|
||
| cidir=$(dirname "$0") | ||
| source "${cidir}/lib.sh" | ||
|
|
||
| target_dir="/opt/confidential-containers" | ||
|
|
||
| nydus_snapshotter_repo=${nydus_snapshotter_repo:-"github.com/containerd/nydus-snapshotter"} | ||
| nydus_snapshotter_repo_git="https://${nydus_snapshotter_repo}.git" | ||
| nydus_snapshotter_version=${nydus_snapshotter_version:-"v0.12.0"} | ||
| nydus_snapshotter_repo_dir="${GOPATH}/src/${nydus_snapshotter_repo}" | ||
| nydus_snapshotter_binary_target_dir="$target_dir/bin" | ||
| nydus_snapshotter_config_target_dir="$target_dir/share/nydus-snapshotter" | ||
|
|
||
| nydus_repo=${nydus_repo:-"https://github.com/dragonflyoss/image-service"} | ||
| nydus_version=${nydus_version:-"v2.2.3"} | ||
|
|
||
| arch="$(uname -m)" | ||
|
|
||
| clone_nydus_snapshotter_repo() { | ||
| add_repo_to_git_safe_directory "${nydus_snapshotter_repo_dir}" | ||
|
|
||
| if [ ! -d "${nydus_snapshotter_repo_dir}" ]; then | ||
| sudo mkdir -p "${nydus_snapshotter_repo_dir}" | ||
| git clone ${nydus_snapshotter_repo_git} "${nydus_snapshotter_repo_dir}" || true | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| git checkout "${nydus_snapshotter_version}" | ||
| popd | ||
| fi | ||
| } | ||
|
|
||
| build_nydus_snapshotter() { | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| if [ "$arch" = "s390x" ]; then | ||
| export GOARCH=$arch | ||
| fi | ||
| sudo -E PATH=$PATH make | ||
|
|
||
| if [ ! -d "$nydus_snapshotter_binary_target_dir" ]; then | ||
| sudo mkdir -p $nydus_snapshotter_binary_target_dir | ||
| fi | ||
| sudo install -D -m 755 "bin/containerd-nydus-grpc" "$nydus_snapshotter_binary_target_dir/containerd-nydus-grpc" | ||
| sudo install -D -m 755 "bin/nydus-overlayfs" "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" | ||
| if [ ! -f "/usr/local/bin/nydus-overlayfs" ]; then | ||
| echo " /usr/local/bin/nydus-overlayfs exists, now we will replace it." | ||
| sudo cp -f "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" "/usr/local/bin/nydus-overlayfs" | ||
| fi | ||
| sudo rm -rf "$nydus_snapshotter_repo_dir/bin" | ||
| popd >/dev/null | ||
| } | ||
|
|
||
| download_nydus_snapshotter_config() { | ||
| if [ ! -d "$nydus_snapshotter_config_target_dir" ]; then | ||
| mkdir -p "$nydus_snapshotter_config_target_dir" | ||
| fi | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-guest-pulling.toml -o "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-host-sharing.toml -o "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
|
|
||
| } | ||
|
|
||
| download_nydus_from_tarball() { | ||
| if [ "$arch" = "s390x" ]; then | ||
| echo "Skip to download nydus for $arch, it doesn't work for $arch now." | ||
| return | ||
| fi | ||
| local goarch="$(${cidir}/kata-arch.sh --golang)" | ||
| local tarball_url="${nydus_repo}/releases/download/${nydus_version}/nydus-static-${nydus_version}-linux-$goarch.tgz" | ||
| echo "Download tarball from ${tarball_url}" | ||
| tmp_dir=$(mktemp -d -t install-nydus-tmp.XXXXXXXXXX) | ||
| curl -Ls "$tarball_url" | sudo tar xfz - -C $tmp_dir --strip-components=1 | ||
| sudo install -D -m 755 "$tmp_dir/nydus-image" "/usr/local/bin/" | ||
| } | ||
|
|
||
| download_nydus_from_tarball | ||
| clone_nydus_snapshotter_repo | ||
| build_nydus_snapshotter | ||
| download_nydus_snapshotter_config | ||
| echo "install nydus-snapshotter successful" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
90 changes: 90 additions & 0 deletions
90
integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/usr/bin/env bats | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| load "${BATS_TEST_DIRNAME}/lib.sh" | ||
| load "${BATS_TEST_DIRNAME}/../../confidential/lib.sh" | ||
| load "${BATS_TEST_DIRNAME}/tests_common.sh" | ||
|
|
||
| tag_suffix="" | ||
| if [ "$(uname -m)" != "x86_64" ]; then | ||
| tag_suffix="-$(uname -m)" | ||
| fi | ||
|
|
||
| # Images used on the tests. | ||
|
|
||
| image_unsigned_protected="quay.io/kata-containers/confidential-containers:unsigned${tag_suffix}" | ||
|
|
||
| original_kernel_params=$(get_kernel_params) | ||
| # Allow to configure the runtimeClassName on pod configuration. | ||
| RUNTIMECLASS="${RUNTIMECLASS:-kata}" | ||
| test_tag="[cc][agent][kubernetes][containerd]" | ||
|
|
||
| setup() { | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| setup_containerd | ||
| configure_containerd_for_nydus_snapshotter "$containerd_conf_file" | ||
| restart_containerd | ||
| reconfigure_kata | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest with dm-verity enabled" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest without dm-verity" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can create two pods with pulling the image only once with dm-verity enabled" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
|
|
||
| pod_config="$(new_pod_config "$image_unsigned_protected" "1")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| pod_config="$(new_pod_config "$image_unsigned_protected" "2")" | ||
| echo $pod_config | ||
| create_test_pod | ||
|
|
||
| pull_times=$(journalctl -g "PullImage \"$image_unsigned_protected\" with snapshotter nydus" | wc -l) | ||
| [ ${pull_times} -eq 1 ] | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image inside the guest with remote-snapshotter" { | ||
| switch_image_service_offload on | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_guest_pull" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| teardown() { | ||
| teardown_common | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| kill_nydus_snapshotter_process | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.