runtime: make kata-check check for newer release

[jodh-intel]

Update kata-check to see if there is a newer version available for download. Useful for users installing static packages (without a package manager).

Fixes: #734.

Signed-off-by: James O. D. Hunt james.o.hunt@intel.com

[jodh-intel]

/test

[jodh-intel]

This won't work for 2.0 yet as we haven't made any releases:

$ ./kata-runtime kata-check --verbose
INFO[0000] IOMMUPlatform is disabled by default.
INFO[0000]                                               arch=amd64 current-version=2.0.0-alpha3 name=kata-runtime pid=21324 source=runtime
No releases available

... But you can test how it would work for Kata 1.x by setting the KATA_RELEASE_URL env var:

$ KATA_RELEASE_URL=https://api.github.com/repos/kata-containers/runtime/releases/latest ./kata-runtime kata-check --verbose
INFO[0000] IOMMUPlatform is disabled by default.
INFO[0000]                                               arch=amd64 current-version=2.0.0-alpha3 latest-version=1.11.3 name=kata-runtime pid=21336 source=runtime
No newer release available for download

Notice the latest-version=1.11.3 output, corresponding to https://github.com/kata-containers/runtime/releases.

[fidencio]

@jodh-intel, first of all, patch itself looks good, thanks for working on this one!

Shall we ensure only official releases are used? If so, we could do that by enforcing a URL check and aborting if the URL doesn't point to the official repos.

[jodh-intel]

@fidencio - agreed and fixed 😄

[jodh-intel]

$ KATA_RELEASE_URL=https://google.com ./kata-runtime kata-check
INFO[0000] IOMMUPlatform is disabled by default.
ERRO[0000] release URL "https://google.com" does not have expected prefix: "https://api.github.com/repos/kata-containers"  arch=amd64 name=kata-runtime pid=24115 source=runtime
release URL "https://google.com" does not have expected prefix: "https://api.github.com/repos/kata-containers"
$ echo $?
1

[jodh-intel]

/test

[fidencio]

lgtm!

Thanks, @jodh-intel!

[jodh-intel]

Marking as dnm for now since this isn't reliable - the "latest" release is simply the most recently uploaded release! The correct solution is to look through all releases, sort by semver and find the newest from that.

Thanks @jcvenegas for pointing this out!

[jodh-intel]

Thanks for reviewing @fidencio - I've just updated the branch quite a lot if you want to take another look?

/test

[jodh-intel]

/test

[jodh-intel]

@GabyCT, @lifupan - the clh CI is failing - looks like we might need to source ~/.cargo/env?:

11:19:31 Rust is installed now. Great!

    :

11:23:36 + rustup show
11:23:36 /tmp/jenkins/workspace/jobs-2.0/kata-2-ubuntu-1804-PR-cloud-hypeprvisor-k8s-containerd/go/src/github.com/kata-containers/kata-containers/tools/osbuilder/rootfs-builder/rootfs.sh: line 544: rustup: command not found

[jodh-intel]

Example behaviour:

• Kata 2.0 isn't available yet:

  $ kata-runtime kata-check 2>&1|grep release
  No releases available

• But pre-release versions are:

  $ kata-runtime kata-check --include-all-releases 2>&1|grep release
  Newer pre-release release available: 2.0.0-rc0 (url: https://github.com/kata-containers/kata-containers/releases/download/2.0.0-rc0/kata-static-2.0.0-rc0-x86_64.tar.xz, date: 2020-09-20T11:05:25Z)

• List of releases available from the Kata 2.x repo (none!):

  $ kata-runtime kata-check --only-list-releases 2>&1|grep release
  $

• But there are some pre-release versions:

  $ kata-runtime kata-check --only-list-releases --include-all-releases 2>&1|grep release
  2.0.0-alpha1;2020-06-06T14:36:48Z;https://github.com/kata-containers/kata-containers/releases/download/2.0.0-alpha1/kata-static-2.0.0-alpha1-x86_64.tar.xz
  2.0.0-alpha2;2020-06-28T05:54:13Z;https://github.com/kata-containers/kata-containers/releases/download/2.0.0-alpha2/kata-static-2.0.0-alpha2-x86_64.tar.xz
  2.0.0-alpha3;2020-07-29T09:02:56Z;https://github.com/kata-containers/kata-containers/releases/download/2.0.0-alpha3/kata-static-2.0.0-alpha3-x86_64.tar.xz
  2.0.0-rc0;2020-09-20T11:05:25Z;https://github.com/kata-containers/kata-containers/releases/download/2.0.0-rc0/kata-static-2.0.0-rc0-x86_64.tar.xz
  $

Newly expanded kata-check usage:

$ ./kata-runtime kata-check --help
NAME:
   kata-runtime kata-check - tests if system can run Kata Containers

USAGE:
   kata-runtime kata-check [command options] [arguments...]

DESCRIPTION:
   tests if system can run Kata Containers and version is current.

ENVIRONMENT VARIABLES:

- KATA_CHECK_NO_NETWORK: If set to any value, act as if "--no-network-checks" was specified.

EXAMPLES:

- Perform basic checks:

  $ kata-runtime kata-check

- Local basic checks only:

  $ kata-runtime kata-check --no-network-checks

- Perform further checks:

  $ sudo kata-runtime kata-check

- Just check if a newer version is available:

  $ kata-runtime kata-check --check-version-only

- List available releases (shows output in format "version;release-date;url"):

  $ kata-runtime kata-check --only-list-releases

- List all available releases (includes pre-release versions):

  $ kata-runtime kata-check --only-list-releases --include-all-releases


OPTIONS:
   --check-version-only     Only compare the current and latest available versions (requires network, non-root only)
   --include-all-releases   Don't filter out pre-release release versions
   --no-network-checks, -n  Do not run any checks using the network
   --only-list-releases     Only list newer available releases (non-root only)
   --strict, -s             perform strict checking
   --verbose, -v            display the list of checks performed

[jodh-intel]

/test

[fidencio]

Thanks for reviewing @fidencio - I've just updated the branch quite a lot if you want to take another look?

Looks even better now! You already have my lgtm, thanks for working on this!

[jodh-intel]

Ping @bergwolf, @devimc.

[devimc]

thanks @jodh-intel

[jodh-intel]

This PR does change the behaviour of kata-check slightly since it will now hit the network to check for a new release by default. That was done by design to make it more difficult for users to either ignore or be unaware of new releases. Since as more and more installations are using the binary packages (without a package manager), the ability to determine whether a new release is available is necessary to ensure those installations have the best chance of being updated to the latest release for security and bug fixes and of course new features.

Note the following:

• The kata-check behaviour can be overriden using either the -n or --no-network-checks CLI option, or by setting KATA_CHECK_NO_NETWORK=1 (that last one is potentially useful if Kata is build in a CI environment that calls kata-check, but which cannot access the network).
• The PR will not perform the network check if run as root under any circumstances.
• The PR has comprehensive tests so the risk of adding this functionality is deemed to be low.
• The kata-check command is not called by a container manager: as the name suggests, it is a Kata-specific command designed to be run by a user or admin. As such, it is not a "core" command or API and does not affect the normal way Kata works.

Given all that, I'm going to merge this...