rootfs: Make OPA build working in docker for s390x and pp… #9489

BbolroC · 2024-04-16T10:04:47Z

The PR is to make the OPA build from source working in a docker builder ubuntu-rootfs-osbuilder.
To achieve the goal, the configuration is changed as follows:

Switch the make target to ci-build-linux-static not triggering docker-in-docker build
Install go in the builder image for s390x and ppc64le

Fixes: #9466

Signed-off-by: Hyounggyu Choi Hyounggyu.Choi@ibm.com

stevenhorsman

The code looks okay, but that my brain can't fully validate that Dockerfile templating line , so I've added the ok-to-test and will check the agent-opa job for s390x and ppc64le before I approve :)

stevenhorsman · 2024-04-16T14:30:40Z

The code looks okay, but that my brain can't fully validate that Dockerfile templating line , so I've added the ok-to-test and will check the agent-opa job for s390x and ppc64le before I approve :)

@BbolroC

The changes are failing for the am64 confidential rootfs image:

#6 ERROR: process "/bin/bash -o pipefail -c apt-get update &&     DEBIAN_FRONTEND=noninteractive     apt-get --no-install-recommends -y install     ca-certificates     curl     g++     $(gcc_arch=\"x86_64\" && [ \"$(uname -m)\" != \"$gcc_arch\" ] && (          libc_arch=\"$gcc_arch\" &&          [ \"$gcc_arch\" = aarch64 ] && libc_arch=arm64;          [ \"$gcc_arch\" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el;          [ \"$gcc_arch\" = s390x ] && gcc_arch=s390x && libc_arch=s390x;          [ \"$gcc_arch\" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64;          echo \"gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross\"))     git     gnupg2     make     makedev     multistrap     musl-tools     protobuf-compiler     xz-utils &&     ( go_version=\"@GOVERSION@\" && [ \"${go_version}\" = \"\" ] || (     echo \"Installing go \" && curl -sSL \"[https://golang.org/dl/go.linux-x86_64.tar.gz\](https://golang.org/dl/go.linux-x86_64.tar.gz/)" | tar -xz -C /usr/local ))" did not complete successfully: exit code: 2
------
 > [3/6] RUN apt-get update &&     DEBIAN_FRONTEND=noninteractive     apt-get --no-install-recommends -y install     ca-certificates     curl     g++     $(gcc_arch="x86_64" && [ "$(uname -m)" != "$gcc_arch" ] && (          libc_arch="$gcc_arch" &&          [ "$gcc_arch" = aarch64 ] && libc_arch=arm64;          [ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el;          [ "$gcc_arch" = s390x ] && gcc_arch=s390x && libc_arch=s390x;          [ "$gcc_arch" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64;          echo "gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross"))     git     gnupg2     make     makedev     multistrap     musl-tools     protobuf-compiler     xz-utils &&     ( go_version="@GOVERSION@" && [ "${go_version}" = "" ] || (     echo "Installing go " && curl -sSL "https://golang.org/dl/go.linux-x86_64.tar.gz" | tar -xz -C /usr/local )):
17.29 Processing triggers for ca-certificates (20230311ubuntu0.20.04.1) ...
17.30 Updating certificates in /etc/ssl/certs...
17.76 0 added, 0 removed; done.
17.76 Running hooks in /etc/ca-certificates/update.d...
17.76 done.
17.80 Installing go 
17.96 
17.96 gzip: stdin: not in gzip format
17.96 tar: Child returned status 1
17.96 tar: Error is not recoverable: exiting now
------
Dockerfile:13
--------------------
  12 |     # hadolint ignore=DL3009,SC2046
  13 | >>> RUN apt-get update && \
  14 | >>>     DEBIAN_FRONTEND=noninteractive \
  15 | >>>     apt-get --no-install-recommends -y install \
  16 | >>>     ca-certificates \
  17 | >>>     curl \
  18 | >>>     g++ \
  19 | >>>     $(gcc_arch="x86_64" && [ "$(uname -m)" != "$gcc_arch" ] && ( \
  20 | >>>          libc_arch="$gcc_arch" && \
  21 | >>>          [ "$gcc_arch" = aarch64 ] && libc_arch=arm64; \
  22 | >>>          [ "$gcc_arch" = ppc64le ] && gcc_arch=powerpc64le && libc_arch=ppc64el; \
  23 | >>>          [ "$gcc_arch" = s390x ] && gcc_arch=s390x && libc_arch=s390x; \
  24 | >>>          [ "$gcc_arch" = x86_64 ] && gcc_arch=x86-64 && libc_arch=amd64; \
  25 | >>>          echo "gcc-$gcc_arch-linux-gnu libc6-dev-$libc_arch-cross")) \
  26 | >>>     git \
  27 | >>>     gnupg2 \
  28 | >>>     make \
  29 | >>>     makedev \
  30 | >>>     multistrap \
  31 | >>>     musl-tools \
  32 | >>>     protobuf-compiler \
  33 | >>>     xz-utils && \
  34 | >>>     ( go_version="@GOVERSION@" && [ "${go_version}" = "" ] || ( \
  35 | >>>     echo "Installing go " && curl -sSL "https://golang.org/dl/go.linux-x86_64.tar.gz" | tar -xz -C /usr/local ))
  36 |     # aarch64 requires this name -- link for all

The commit is to make the OPA build from source working in `ubuntu-rootfs-osbuilder`. To achieve the goal, the configuration is changed as follows: - Switch the make target to `ci-build-linux-static` not triggering docker-in-docker build - Install go in the builder image for s390x and ppc64le Fixes: kata-containers#9466 Signed-off-by: Hyounggyu Choi <Hyounggyu.Choi@ibm.com>

BbolroC · 2024-04-16T14:52:23Z

The changes are failing for the am64 confidential rootfs image:

Ah, I missed an underscore between GO and VERSION. Thanks!

stevenhorsman · 2024-04-16T16:28:53Z

/test

stevenhorsman

The agent-opa and confidential images jobs are passing now, so looks good to me. Thanks

BbolroC · 2024-04-16T19:54:57Z

For reviewers: rootfs-image-confidential and rootfs-initrd-confidential were successfully built on a s390x runner at https://github.com/BbolroC/kata-containers/actions/runs/8708635945

wainersm · 2024-04-16T23:53:44Z

tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh

@@ -384,6 +389,11 @@ install_initrd() {
 		if [ "${variant}" == "confidential" ]; then
 			export COCO_GUEST_COMPONENTS_TARBALL="$(get_coco_guest_components_tarball_path)"
 			export PAUSE_IMAGE_TARBALL="$(get_pause_image_tarball_path)"
+			# GO_VERSION should be exported to install the package in ubuntu-rootfs-osbuilder
+			# This is necessary for installing opa from the source for s390x and ppc64le
+			if [ "${AGENT_POLICY}" == "yes" ] && [ "${ARCH}" == "s390x" -o "${ARCH}" == "ppc64le" ]; then


Hi @BbolroC ! I've some doubts that I won't be able to study more today. However, one thing that I can ask now before going offline:

Is this if block in the path of s390x builds? I figured that variant==confidential when you build the rootfs-image-confidential asset. The .github/workflows/build-kata-static-tarball-s390x.yaml workflow seems to build both rootfs-image and rootfs-initrd only.

Yes, you are right. The mentioned code block is not reached by the current workflow. The PR is tested (see https://github.com/BbolroC/kata-containers/actions/runs/8711566342/job/23908856311) and raised based on an assumption that a follow-up PR #9494 uses the change of this PR (it includes building 3 new confidential artifacts). Thanks!

Cool! thanks for the info!

Amulyam24

LGTM, Thanks @BbolroC!

BbolroC · 2024-04-17T11:24:54Z

Please do not merge this until the review from @wainersm is finished. Thanks!

wainersm

Hi @BbolroC ! Sorry for holding this for too long. LGTM!

BbolroC changed the title ~~rootfs: Make OPA build from source working in docker for s390x and pp…~~ rootfs: Make OPA build working in docker for s390x and pp… Apr 16, 2024

katacontainersbot added the size/small Small and simple task label Apr 16, 2024

BbolroC force-pushed the install-opa-in-docker branch from 22adfb0 to 6c24530 Compare April 16, 2024 10:05

BbolroC requested a review from Amulyam24 April 16, 2024 10:06

BbolroC force-pushed the install-opa-in-docker branch from 6c24530 to 7762f9a Compare April 16, 2024 12:34

BbolroC requested a review from wainersm April 16, 2024 12:44

stevenhorsman added the ok-to-test label Apr 16, 2024

stevenhorsman reviewed Apr 16, 2024

View reviewed changes

BbolroC force-pushed the install-opa-in-docker branch from 7762f9a to d523e86 Compare April 16, 2024 14:49

BbolroC force-pushed the install-opa-in-docker branch from 354c16c to d523e86 Compare April 16, 2024 15:10

stevenhorsman approved these changes Apr 16, 2024

View reviewed changes

wainersm reviewed Apr 16, 2024

View reviewed changes

BbolroC mentioned this pull request Apr 17, 2024

CC: Enable guest-pull tests on non-TEE for s390x #9494

Merged

Amulyam24 approved these changes Apr 17, 2024

View reviewed changes

BbolroC added do-not-merge PR has problems or depends on another and removed ok-to-test labels Apr 17, 2024

wainersm approved these changes Apr 17, 2024

View reviewed changes

wainersm added ok-to-test and removed do-not-merge PR has problems or depends on another labels Apr 17, 2024

BbolroC merged commit cc22dc3 into kata-containers:main Apr 17, 2024
966 of 1058 checks passed

BbolroC deleted the install-opa-in-docker branch April 17, 2024 22:26

BbolroC mentioned this pull request Apr 26, 2024

rootfs: Stop building and shipping OPA #9559

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rootfs: Make OPA build working in docker for s390x and pp… #9489

rootfs: Make OPA build working in docker for s390x and pp… #9489

BbolroC commented Apr 16, 2024

stevenhorsman left a comment

stevenhorsman commented Apr 16, 2024 •

edited

BbolroC commented Apr 16, 2024

stevenhorsman commented Apr 16, 2024

stevenhorsman left a comment

BbolroC commented Apr 16, 2024

wainersm Apr 16, 2024 •

edited

BbolroC Apr 17, 2024

wainersm Apr 17, 2024

Amulyam24 left a comment

BbolroC commented Apr 17, 2024 •

edited

wainersm left a comment

rootfs: Make OPA build working in docker for s390x and pp… #9489

rootfs: Make OPA build working in docker for s390x and pp… #9489

Conversation

BbolroC commented Apr 16, 2024

stevenhorsman left a comment

Choose a reason for hiding this comment

stevenhorsman commented Apr 16, 2024 • edited

BbolroC commented Apr 16, 2024

stevenhorsman commented Apr 16, 2024

stevenhorsman left a comment

Choose a reason for hiding this comment

BbolroC commented Apr 16, 2024

wainersm Apr 16, 2024 • edited

Choose a reason for hiding this comment

BbolroC Apr 17, 2024

Choose a reason for hiding this comment

wainersm Apr 17, 2024

Choose a reason for hiding this comment

Amulyam24 left a comment

Choose a reason for hiding this comment

BbolroC commented Apr 17, 2024 • edited

wainersm left a comment

Choose a reason for hiding this comment

stevenhorsman commented Apr 16, 2024 •

edited

wainersm Apr 16, 2024 •

edited

BbolroC commented Apr 17, 2024 •

edited