Conversation
Build failed (third-party-check pipeline) integration testing with
|
PSS Measurement: Memory inside container: |
I wonder if this works with vm templating |
Retrigger CI now... |
Does it require a new version of QEMU? I'm getting this error |
@bergwolf - looks like you are using a "special build" of qemu? fwics, you have to use |
@jodh-intel I was using self-built qemu-lite. I guess I was missing some qemu feature configs. I'll retry with kata's qemu-lite package. |
@bergwolf - ack. OOI did you build using https://github.com/kata-containers/packaging/blob/master/scripts/configure-hypervisor.sh? |
@bergwolf - see #445 (comment). |
@jodh-intel I was using |
On an Ubuntu 18.04 test box, this PR:
|
@bergwolf @jodh-intel yes qemu-lite breaks virtio-rng, meanwhile is fixed, I added created this PR: |
Build succeeded (third-party-check pipeline).
|
f622035
to
2fc8cae
Compare
Build succeeded (third-party-check pipeline).
|
virtcontainers/qemu_amd64.go
Outdated
@@ -20,7 +20,7 @@ const defaultQemuPath = "/usr/bin/qemu-system-x86_64" | |||
|
|||
const defaultQemuMachineType = QemuPC | |||
|
|||
const defaultQemuMachineOptions = "accel=kvm,kernel_irqchip,nvdimm" | |||
const defaultQemuMachineOptions = "accel=kvm,kernel_irqchip,nvdimm,nostatic_prt" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jcvenegas why do you define nostatic_prt
as a default option for pc
machine type? I thought you said this was only introduced by the very specific qemu-lite branch of qemu. What if we use a vanilla qemu?
I just want to make sure we won't get an error from a vanilla Qemu because we're using a non defined flag by default here.
2fc8cae
to
eb8c0a8
Compare
@sboeuf agree, now that qemu-lite branch |
Build failed (third-party-check pipeline) integration testing with
|
Codecov Report
@@ Coverage Diff @@
## master #676 +/- ##
=========================================
Coverage ? 64.97%
=========================================
Files ? 85
Lines ? 10925
Branches ? 0
=========================================
Hits ? 7098
Misses ? 3133
Partials ? 694 |
Build failed (third-party-check pipeline) integration testing with
|
3679ecd
to
7df8021
Compare
Build failed (third-party-check pipeline) integration testing with
|
update, the PR is failing randomly due to sometimes the boot times take about 30 seconds in the CI machines.
I took a look to the kernel logs and I see the logs jump from @liujing2 any hint why it is taking so long, the CI are VMs so this is nested virtualization. |
7df8021
to
c860ee3
Compare
8ed2991
to
3781551
Compare
PSS Measurement: Memory inside container: |
3781551
to
dba6841
Compare
Build failed (third-party-check pipeline) integration testing with
|
Build failed (third-party-check pipeline) integration testing with
|
PSS Measurement: Memory inside container: |
@jodh-intel @bergwolf @sboeuf kata-containers/govmm#45 is ready to merge, needed to update vendor here. |
@jcvenegas kata-containers/govmm#45 has been merged, please revendor accordingly :) |
Changes: - qemu/qmp: support query-memory-devices qmp command. - qemu: Add virtio RNG device. Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
3f88c1c
to
ebe54a6
Compare
PSS Measurement: Memory inside container: |
@sboeuf updated, note that I am not adding a way to restrict the entropy bandwidth of the host, I wonder if this is something is supported via cgroups (for example if runc support it ). In case this is not possible to do it with cgroups, a possible option is to add it as part of our configuration.toml, this could a nice feature to allow administrators restrict the amount of entropy at node level. |
Build failed (third-party-check pipeline) integration testing with
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jcvenegas one comment, but looks fine otherwise!
virtcontainers/qemu.go
Outdated
@@ -488,6 +488,11 @@ func (q *qemu) createSandbox() error { | |||
if ioThread != nil { | |||
qemuConfig.IOThreads = []govmmQemu.IOThread{*ioThread} | |||
} | |||
// Add RNG device to hypervisor | |||
rngDev := config.RNGDev{ | |||
ID: "rng0", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe you could define a const or var at the top of this file to avoid hardcoding this directly from the code. WDYT?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated, lets wait for the CI again. After that should be ready do merge.
Kata Containers does not have provide a good entropy level, make use of a paravirtual rng device to solve this problem. Fixes: kata-containers#445 Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
Update qemu-lite this disable static PRT on pc platform, needed to use devices like virtio-rng. Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
ebe54a6
to
44e7631
Compare
PSS Measurement: Memory inside container: |
Build failed (third-party-check pipeline) integration testing with
|
Restarted F27 CI (which fell over due to the problem fixed by #710)... |
Add haveged will allow have entropy for PR. kata-containers/runtime#676 Fixes: kata-containers#712 Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
Kata Containers does not provide good entropy. Enable a paravirtual rng device to provide a random number generator source.
Depens on: kata-containers/govmm#45
Fixes: #445