This repository has been archived by the owner on Jun 28, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 196
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: Add test cases for CoCo image pulling without forked containerd
Additional tests are necessary to verify new feature that pulling image without forked containerd in CoCo. 1)image sharing on the host without dm-verity. 2)image sharing on the host with dm-verity. 3)two pods with pulling image only once. 4)image pulling in the guest with nydus-snapshotter. Fixes #5763 Depends-on: github.com/kata-containers/kata-containers#7676 Signed-off-by: ChengyuZhu6 <[email protected]>
- Loading branch information
1 parent
6d7723a
commit db5f227
Showing
8 changed files
with
285 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/bin/bash | ||
| # | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
| set -o errtrace | ||
|
|
||
| cidir=$(dirname "$0") | ||
| source "${cidir}/lib.sh" | ||
|
|
||
| target_dir="/opt/confidential-containers" | ||
|
|
||
| nydus_snapshotter_repo=${nydus_snapshotter_repo:-"github.com/containerd/nydus-snapshotter"} | ||
| nydus_snapshotter_repo_git="https://${nydus_snapshotter_repo}.git" | ||
| nydus_snapshotter_version=${nydus_snapshotter_version:-"v0.12.0"} | ||
| nydus_snapshotter_repo_dir="${GOPATH}/src/${nydus_snapshotter_repo}" | ||
| nydus_snapshotter_binary_target_dir="$target_dir/bin" | ||
| nydus_snapshotter_config_target_dir="$target_dir/share/nydus-snapshotter" | ||
|
|
||
| nydus_repo=${nydus_repo:-"https://github.com/dragonflyoss/image-service"} | ||
| nydus_version=${nydus_version:-"v2.2.3"} | ||
|
|
||
| arch="$(uname -m)" | ||
|
|
||
| clone_nydus_snapshotter_repo() { | ||
| add_repo_to_git_safe_directory "${nydus_snapshotter_repo_dir}" | ||
|
|
||
| if [ ! -d "${nydus_snapshotter_repo_dir}" ]; then | ||
| sudo mkdir -p "${nydus_snapshotter_repo_dir}" | ||
| git clone ${nydus_snapshotter_repo_git} "${nydus_snapshotter_repo_dir}" || true | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| git checkout "${nydus_snapshotter_version}" | ||
| popd | ||
| fi | ||
| } | ||
|
|
||
| build_nydus_snapshotter() { | ||
| pushd "${nydus_snapshotter_repo_dir}" | ||
| if [ "$arch" = "s390x" ]; then | ||
| export GOARCH=$arch | ||
| fi | ||
| sudo -E PATH=$PATH make | ||
|
|
||
| if [ ! -d "$nydus_snapshotter_binary_target_dir" ]; then | ||
| sudo mkdir -p $nydus_snapshotter_binary_target_dir | ||
| fi | ||
| sudo install -D -m 755 "bin/containerd-nydus-grpc" "$nydus_snapshotter_binary_target_dir/containerd-nydus-grpc" | ||
| sudo install -D -m 755 "bin/nydus-overlayfs" "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" | ||
| if [ ! -f "/usr/local/bin/nydus-overlayfs" ]; then | ||
| echo " /usr/local/bin/nydus-overlayfs exists, now we will replace it." | ||
| sudo cp -f "$nydus_snapshotter_binary_target_dir/nydus-overlayfs" "/usr/local/bin/nydus-overlayfs" | ||
| fi | ||
| sudo rm -rf "$nydus_snapshotter_repo_dir/bin" | ||
| popd >/dev/null | ||
| } | ||
|
|
||
| download_nydus_snapshotter_config() { | ||
| if [ ! -d "$nydus_snapshotter_config_target_dir" ]; then | ||
| mkdir -p "$nydus_snapshotter_config_target_dir" | ||
| fi | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-guest-pulling.toml -o "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo curl -L https://raw.githubusercontent.com/containerd/nydus-snapshotter/main/misc/snapshotter/config-coco-host-sharing.toml -o "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-guest-pulling.toml" | ||
| sudo chmod 644 "$nydus_snapshotter_config_target_dir/config-coco-host-sharing.toml" | ||
|
|
||
| } | ||
|
|
||
| download_nydus_from_tarball() { | ||
| if [ "$arch" = "s390x" ]; then | ||
| echo "Skip to download nydus for $arch, it doesn't work for $arch now." | ||
| return | ||
| fi | ||
| local goarch="$(${cidir}/kata-arch.sh --golang)" | ||
| local tarball_url="${nydus_repo}/releases/download/${nydus_version}/nydus-static-${nydus_version}-linux-$goarch.tgz" | ||
| echo "Download tarball from ${tarball_url}" | ||
| tmp_dir=$(mktemp -d -t install-nydus-tmp.XXXXXXXXXX) | ||
| curl -Ls "$tarball_url" | sudo tar xfz - -C $tmp_dir --strip-components=1 | ||
| sudo install -D -m 755 "$tmp_dir/nydus-image" "/usr/local/bin/" | ||
| } | ||
|
|
||
| download_nydus_from_tarball | ||
| clone_nydus_snapshotter_repo | ||
| build_nydus_snapshotter | ||
| download_nydus_snapshotter_config | ||
| echo "install nydus-snapshotter successful" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
90 changes: 90 additions & 0 deletions
90
integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| #!/usr/bin/env bats | ||
| # Copyright (c) 2023 Intel Corporation | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
|
|
||
| load "${BATS_TEST_DIRNAME}/lib.sh" | ||
| load "${BATS_TEST_DIRNAME}/../../confidential/lib.sh" | ||
| load "${BATS_TEST_DIRNAME}/tests_common.sh" | ||
|
|
||
| tag_suffix="" | ||
| if [ "$(uname -m)" != "x86_64" ]; then | ||
| tag_suffix="-$(uname -m)" | ||
| fi | ||
|
|
||
| # Images used on the tests. | ||
|
|
||
| image_unsigned_protected="quay.io/kata-containers/confidential-containers:unsigned${tag_suffix}" | ||
|
|
||
| original_kernel_params=$(get_kernel_params) | ||
| # Allow to configure the runtimeClassName on pod configuration. | ||
| RUNTIMECLASS="${RUNTIMECLASS:-kata}" | ||
| test_tag="[cc][agent][kubernetes][containerd]" | ||
|
|
||
| setup() { | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| setup_containerd | ||
| configure_containerd_for_nydus_snapshotter "$containerd_conf_file" | ||
| restart_containerd | ||
| reconfigure_kata | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest with dm-verity enabled" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image as a raw block disk image to guest without dm-verity" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can create two pods with pulling the image only once with dm-verity enabled" { | ||
| if [ "$(uname -m)" = s390x ]; then | ||
| skip "test for s390x as nydus-image doesn't currently support this platform" | ||
| fi | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_block_with_verity" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
|
|
||
| pod_config="$(new_pod_config "$image_unsigned_protected" "1")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| pod_config="$(new_pod_config "$image_unsigned_protected" "2")" | ||
| echo $pod_config | ||
| create_test_pod | ||
|
|
||
| pull_times=$(journalctl -g "PullImage \"$image_unsigned_protected\" with snapshotter nydus" | wc -l) | ||
| [ ${pull_times} -eq 1 ] | ||
| fi | ||
| } | ||
|
|
||
| @test "$test_tag Test can pull an image inside the guest with remote-snapshotter" { | ||
| switch_image_service_offload on | ||
| if [ "$SNAPSHOTTER" = "nydus" ]; then | ||
| EXPORT_MODE="image_guest_pull" RUNTIMECLASS="$RUNTIMECLASS" SNAPSHOTTER="nydus" configure_remote_snapshotter | ||
| pod_config="$(new_pod_config "$image_unsigned_protected")" | ||
| echo $pod_config | ||
| create_test_pod | ||
| fi | ||
| } | ||
|
|
||
| teardown() { | ||
| teardown_common | ||
| remove_test_image "$image_unsigned_protected" || true | ||
| kill_nydus_snapshotter_process | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.