diff --git a/cv/README.md b/cv/README.md new file mode 100644 index 000000000..ee6113024 --- /dev/null +++ b/cv/README.md @@ -0,0 +1,14 @@ +# Component versions +**permalink: /cv/** + +The `version_map.yaml` file appears to be a configuration file that maps specific software components to their respective versions. This type of file is commonly used to manage and track the versions of dependencies or tools used in a project. + +## Purpose of version_map.yaml: +### Version Management: +It specifies the exact versions of software components that are required or recommended for a particular setup. This ensures consistency and reproducibility. + +### Dependency Tracking: +Keep track of the versions of critical tools or libraries that their project depends on. + +### Documentation: +It serves as a reference for anyone working on the project, making it clear which versions of the software components are being used. diff --git a/cv/version_map.yml b/cv/version_map.yml new file mode 100644 index 000000000..7319b6102 --- /dev/null +++ b/cv/version_map.yml @@ -0,0 +1,4 @@ +firmware: + qemu: 9.2.0 + libvirt: 10.9.0 + edk2: stable202411 diff --git a/images/edk2/build.sh b/images/edk2/build.sh new file mode 100755 index 000000000..c097c3cc7 --- /dev/null +++ b/images/edk2/build.sh @@ -0,0 +1,232 @@ +#!/usr/bin/env bash + +# Copyright 2024 Flant JSC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# UEFI Revocation List File can be downloaded from https://uefi.org + +usage() { + cat <&1 > /dev/null +build_ovmf_secboot 2>&1 > /dev/null +build_ovmf_amdsev 2>&1 > /dev/null +build_shell 2>&1 > /dev/null + +build_iso $FIRMWARE +no_enroll diff --git a/images/edk2/json/40-edk2-ovmf-x64-sb.json b/images/edk2/json/40-edk2-ovmf-x64-sb.json new file mode 100644 index 000000000..02a762233 --- /dev/null +++ b/images/edk2/json/40-edk2-ovmf-x64-sb.json @@ -0,0 +1,35 @@ +{ + "description": "OVMF with SB+SMM, empty varstore", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "split", + "executable": { + "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "requires-smm", + "secure-boot", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/images/edk2/json/50-edk2-ovmf-x64-nosb.json b/images/edk2/json/50-edk2-ovmf-x64-nosb.json new file mode 100644 index 000000000..c660e0c46 --- /dev/null +++ b/images/edk2/json/50-edk2-ovmf-x64-nosb.json @@ -0,0 +1,35 @@ +{ + "description": "OVMF without SB+SMM, empty varstore", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "split", + "executable": { + "filename": "/usr/share/edk2/ovmf/OVMF_CODE.fd", + "format": "raw" + }, + "nvram-template": { + "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "acpi-s3", + "amd-sev", + "amd-sev-es", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/images/edk2/json/60-edk2-ovmf-x64-amdsev.json b/images/edk2/json/60-edk2-ovmf-x64-amdsev.json new file mode 100644 index 000000000..9a561bc7e --- /dev/null +++ b/images/edk2/json/60-edk2-ovmf-x64-amdsev.json @@ -0,0 +1,31 @@ +{ + "description": "OVMF with SEV-ES support", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "flash", + "mode": "stateless", + "executable": { + "filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd", + "format": "raw" + } + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "amd-sev", + "amd-sev-es", + "amd-sev-snp", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/images/edk2/json/60-edk2-ovmf-x64-inteltdx.json b/images/edk2/json/60-edk2-ovmf-x64-inteltdx.json new file mode 100644 index 000000000..445eb70e0 --- /dev/null +++ b/images/edk2/json/60-edk2-ovmf-x64-inteltdx.json @@ -0,0 +1,27 @@ +{ + "description": "OVMF with TDX support", + "interface-types": [ + "uefi" + ], + "mapping": { + "device": "memory", + "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd" + }, + "targets": [ + { + "architecture": "x86_64", + "machines": [ + "pc-q35-*" + ] + } + ], + "features": [ + "enrolled-keys", + "intel-tdx", + "secure-boot", + "verbose-dynamic" + ], + "tags": [ + + ] +} diff --git a/images/virt-launcher/edk2/Logo.bmp b/images/edk2/logo/Logo.bmp similarity index 100% rename from images/virt-launcher/edk2/Logo.bmp rename to images/edk2/logo/Logo.bmp diff --git a/images/virt-launcher/edk2/README.md b/images/edk2/logo/README.md similarity index 100% rename from images/virt-launcher/edk2/README.md rename to images/edk2/logo/README.md diff --git a/images/virt-launcher/edk2/bmp-info.py b/images/edk2/logo/bmp-info.py similarity index 100% rename from images/virt-launcher/edk2/bmp-info.py rename to images/edk2/logo/bmp-info.py diff --git a/images/edk2/uefi-revocation-list/DBXUpdate-20230509.x64.bin b/images/edk2/uefi-revocation-list/DBXUpdate-20230509.x64.bin new file mode 100644 index 000000000..e2f6b0259 Binary files /dev/null and b/images/edk2/uefi-revocation-list/DBXUpdate-20230509.x64.bin differ diff --git a/images/edk2/werf.inc.yaml b/images/edk2/werf.inc.yaml new file mode 100644 index 000000000..c86d8e418 --- /dev/null +++ b/images/edk2/werf.inc.yaml @@ -0,0 +1,82 @@ +--- +{{- $gitRepoName := "edk2" }} +{{- $version := get $.Version $gitRepoName }} +{{- $gitRepoUrl := cat $.SOURCE_REPO "/tianocore/edk2.git" | nospace }} + +image: {{ $.ImageName }} +final: false +fromImage: base-alt-p11 +git: +- add: /images/{{ $.ImageName }} + to: / + includePaths: + - build.sh + stageDependencies: + setup: + - build.sh +- add: /images/{{ $.ImageName }}/logo + to: / + includePaths: + - Logo.bmp + stageDependencies: + setup: + - '**/*' +- add: /images/{{ $.ImageName }}/json + to: /FIRMWARE + includePaths: + - '*.json' + stageDependencies: + setup: + - '*.json' +- add: /images/{{ $.ImageName }}/uefi-revocation-list + to: /FIRMWARE + includePaths: + - '*.bin' + stageDependencies: + setup: + - '*.bin' +shell: + beforeInstall: + - | + apt-get update && apt-get install -y \ + gcc gcc-c++ \ + git curl \ + bash-completion \ + clang \ + ccache \ + make cmake \ + python3 python3-dev \ + python3-tools python3-module-setuptools \ + python3-module-pip \ + nasm acpica libssl-devel libdwarf-devel libuuid-devel bison flex \ + dosfstools mtools genisoimage binutils-devel \ + qemu-kvm-core \ + iasl \ + python3-modules-sqlite3 python3-module-virt-firmware libuuid-devel \ + qemu-img xorriso libssl-devel \ + bc zlib-devel perl-PathTools perl-IPC-Cmd perl-JSON + + apt-get clean + rm --recursive --force /var/lib/apt/lists/ftp.altlinux.org* /var/cache/apt/*.bin + + install: + - | + git clone --depth=1 --branch {{ $gitRepoName }}-{{ $version }} {{ $gitRepoUrl }} {{ $gitRepoName }}-{{ $version }} + + git clone {{ $.SOURCE_REPO }}/tianocore/edk2-platforms.git + + cd {{ $gitRepoName }}-{{ $version }} + git submodule update --init --recursive + + # Set env edk + export EDK_TOOLS_PATH=$(pwd)/BaseTools + export PACKAGES_PATH=$(pwd)/BaseTools:/edk2-platforms + + echo "Building BaseTools..." + ln /usr/bin/python3 /usr/bin/python + make -C BaseTools -j$(nproc) 2>&1 > /dev/null + + setup: + - | + /build.sh --repo-name {{ $gitRepoName }} --branch {{ $version }} + diff --git a/images/libvirt/install-libvirt.sh b/images/libvirt/install-libvirt.sh new file mode 100755 index 000000000..1c5b29323 --- /dev/null +++ b/images/libvirt/install-libvirt.sh @@ -0,0 +1,592 @@ +#!/usr/bin/env bash + +# Copyright 2024 Flant JSC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +usage() { + cat < 10010, 10.0.5 -> 10005 +lib_version=$(convert_version $VERSION_NUM) + +# List of files and destinations of libvirt +# Commented lines - binary for additional features. +# +# The specific format of the list, 'SOURCE_FILE to DESTINATION', +# is due to the output of the installation scripts. To make it easier to add them to this list. + +FILE_LIST=$(cat < /packages.txt + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + + pip3 install black + + install: + - | + export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" + export CCACHE_DIR="$CCACHE_BASEDIR/ccache" + export CCACHE_BASEDIR="$(pwd)" + export PATH="$CCACHE_WRAPPERSDIR:$PATH" + export MAKE="/usr/bin/make" + export NINJA="/usr/bin/ninja" + export PYTHON="/usr/bin/python3" + + git clone --depth=1 --branch v{{ $version }} {{ $gitRepoUrl }} {{ $gitRepoName }}-{{ $version }} + + cd {{ $gitRepoName }}-{{ $version }} + + CFLAGS="-Wframe-larger-than=262144" meson setup build \ + -Dinit_script=systemd \ + -Dsystem=true \ + -Dremote_default_mode=direct \ + -Dpciaccess=enabled \ + -Dsasl=enabled \ + -Dpolkit=enabled \ + -Dlibssh=enabled \ + -Dlibssh2=enabled \ + -Dnumactl=enabled \ + -Dcapng=enabled \ + -Dudev=enabled \ + -Ddriver_network=enabled \ + -Ddriver_interface=enabled \ + -Ddriver_libvirtd=enabled \ + -Ddriver_qemu=enabled \ + -Ddriver_remote=enabled \ + -Ddriver_esx=disabled -Dcurl=disabled \ + -Dfirewalld=disabled \ + -Dfirewalld_zone=disabled \ + -Ddocs=disabled \ + -Ddriver_ch=disabled \ + -Ddriver_lxc=disabled -Dlogin_shell=disabled \ + -Ddriver_openvz=disabled \ + -Ddriver_test=disabled \ + -Ddriver_vbox=disabled \ + -Ddriver_vmware=disabled \ + -Ddriver_hyperv=disabled -Dopenwsman=disabled \ + -Ddriver_vz=disabled \ + -Ddriver_bhyve=disabled \ + -Dvbox_xpcomc_dir=disabled \ + -Dwireshark_dissector=disabled \ + -Dwireshark_plugindir=disabled \ + -Dstorage_gluster=disabled -Dglusterfs=disabled \ + -Dstorage_fs=disabled \ + -Dstorage_lvm=disabled \ + -Dstorage_zfs=disabled \ + -Dstorage_vstorage=disabled \ + -Dstorage_rbd=disabled \ + -Dstorage_mpath=disabled \ + -Dstorage_iscsi=disabled \ + -Dstorage_iscsi_direct=disabled -Dlibiscsi=disabled \ + -Dlibiscsi=disabled + + ninja -C build -j$(nproc) + + setup: + - | + /install-libvirt.sh --version-num "{{ $version }}" \ + -s /{{ $gitRepoName }}-{{ $version }} \ + -d /BINS \ + -b build diff --git a/images/qemu/install-qemu.sh b/images/qemu/install-qemu.sh new file mode 100755 index 000000000..4a8b18b92 --- /dev/null +++ b/images/qemu/install-qemu.sh @@ -0,0 +1,256 @@ +#!/usr/bin/env bash + +# Copyright 2024 Flant JSC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +usage() { + cat < /packages.txt + + mkdir -p /usr/libexec/ccache-wrappers + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang + ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc + + pip3 install black + + install: + - | + export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers" + export CCACHE_DIR="$CCACHE_BASEDIR/ccache" + export CCACHE_BASEDIR="$(pwd)" + export PATH="$CCACHE_WRAPPERSDIR:$PATH" + export MAKE="/usr/bin/make" + export NINJA="/usr/bin/ninja" + export PYTHON="/usr/bin/python3" + + git clone --depth=1 --branch v{{ $version }} {{ $gitRepoUrl }} {{ $gitRepoName }}-{{ $version }} + + cd {{ $gitRepoName }}-{{ $version }} + + ./configure \ + --target-list="x86_64-softmmu" \ + --with-pkgversion="-dvp" \ + --with-coroutine=ucontext \ + --tls-priority="@QEMU,SYSTEM" \ + --block-drv-rw-whitelist="qcow2,raw,file,host_device,nbd,iscsi,rbd,blkdebug,luks,null-co,nvme,copy-on-read,throttle,compress,virtio-blk-vhost-vdpa,virtio-blk-vfio-pci,virtio-blk-vhost-user,io_uring,nvme-io_uring" \ + --block-drv-ro-whitelist="vdi,vmdk,vhdx,vpc,https" \ + --disable-alsa \ + --disable-attr \ + --disable-auth-pam \ + --disable-avx2 \ + --disable-avx512bw \ + --disable-blkio \ + --disable-block-drv-whitelist-in-tools \ + --disable-bochs \ + --disable-bpf \ + --disable-brlapi \ + --disable-bsd-user \ + --disable-bzip2 \ + --disable-cap-ng \ + --disable-capstone \ + --disable-cfi \ + --disable-cfi-debug \ + --disable-cloop \ + --disable-cocoa \ + --disable-coreaudio \ + --disable-coroutine-pool \ + --disable-crypto-afalg \ + --disable-curl \ + --disable-curses \ + --disable-dbus-display \ + --disable-debug-info \ + --disable-debug-mutex \ + --disable-debug-tcg \ + --disable-dmg \ + --disable-docs \ + --disable-dsound \ + --disable-fdt \ + --disable-fuse \ + --disable-fuse-lseek \ + --disable-gcrypt \ + --disable-gettext \ + --disable-gio \ + --disable-glusterfs \ + --disable-gnutls \ + --disable-gtk \ + --disable-guest-agent \ + --disable-guest-agent-msi \ + --disable-hvf \ + --disable-iconv \ + --disable-jack \ + --disable-kvm \ + --disable-l2tpv3 \ + --disable-libdaxctl \ + --disable-libdw \ + --disable-libiscsi \ + --disable-libnfs \ + --disable-libpmem \ + --disable-libssh \ + --disable-libudev \ + --disable-libusb \ + --disable-libvduse \ + --disable-linux-aio \ + --disable-linux-io-uring \ + --disable-linux-user \ + --disable-lto \ + --disable-lzfse \ + --disable-lzo \ + --disable-malloc-trim \ + --disable-membarrier \ + --disable-modules \ + --disable-module-upgrades \ + --disable-mpath \ + --disable-multiprocess \ + --disable-netmap \ + --disable-nettle \ + --disable-numa \ + --disable-nvmm \ + --disable-opengl \ + --disable-oss \ + --disable-pa \ + --disable-parallels \ + --disable-pie \ + --disable-plugins \ + --disable-qcow1 \ + --disable-qed \ + --disable-qga-vss \ + --disable-qom-cast-debug \ + --disable-rbd \ + --disable-rdma \ + --disable-replication \ + --disable-rng-none \ + --disable-safe-stack \ + --disable-sdl \ + --disable-sdl-image \ + --disable-seccomp \ + --disable-selinux \ + --disable-slirp \ + --disable-slirp-smbd \ + --disable-smartcard \ + --disable-snappy \ + --disable-sndio \ + --disable-sparse \ + --disable-spice \ + --disable-spice-protocol \ + --disable-strip \ + --disable-system \ + --disable-tcg \ + --disable-tools \ + --disable-tpm \ + --disable-u2f \ + --disable-usb-redir \ + --disable-user \ + --disable-vde \ + --disable-vdi \ + --disable-vduse-blk-export \ + --disable-vhost-crypto \ + --disable-vhost-kernel \ + --disable-vhost-net \ + --disable-vhost-user \ + --disable-vhost-user-blk-server \ + --disable-vhost-vdpa \ + --disable-virglrenderer \ + --disable-virtfs \ + --disable-vnc \ + --disable-vnc-jpeg \ + --disable-png \ + --disable-vnc-sasl \ + --disable-vte \ + --disable-vvfat \ + --disable-werror \ + --disable-whpx \ + --disable-xen \ + --disable-xen-pci-passthrough \ + --disable-xkbcommon \ + --disable-zstd \ + --enable-attr \ + --enable-blkio \ + --enable-cap-ng \ + --enable-capstone \ + --enable-coroutine-pool \ + --enable-curl \ + --enable-dbus-display \ + --enable-debug-info \ + --enable-fdt=system \ + --enable-gio \ + --enable-gnutls \ + --enable-guest-agent \ + --enable-iconv \ + --enable-kvm \ + --enable-libusb \ + --enable-libudev \ + --enable-linux-aio \ + --enable-linux-io-uring \ + --enable-lzo \ + --enable-malloc-trim \ + --enable-modules \ + --enable-mpath \ + --enable-numa \ + --enable-opengl \ + --enable-pa \ + --enable-pie \ + --enable-rbd \ + --enable-rdma \ + --enable-seccomp \ + --enable-selinux \ + --enable-slirp \ + --enable-snappy \ + --enable-spice-protocol \ + --enable-system \ + --enable-tcg \ + --enable-tools \ + --enable-tpm \ + --enable-usb-redir \ + --enable-vdi \ + --enable-vhost-kernel \ + --enable-vhost-net \ + --enable-vhost-user \ + --enable-vhost-user-blk-server \ + --enable-vhost-vdpa \ + --enable-vnc \ + --enable-png \ + --enable-vnc-sasl \ + --enable-werror \ + --enable-xkbcommon \ + --enable-zstd + + make -j$(nproc) + + setup: + - | + /install-qemu.sh --version-num "{{ $version }}" \ + -s /{{ $gitRepoName }}-{{ $version }} \ + -d /BINS \ + -b build diff --git a/images/virt-artifact/werf.inc.yaml b/images/virt-artifact/werf.inc.yaml index 50b2904b7..4ff2b8470 100644 --- a/images/virt-artifact/werf.inc.yaml +++ b/images/virt-artifact/werf.inc.yaml @@ -89,46 +89,47 @@ shell: - gcc -static cmd/container-disk-v2alpha/main.c -o /kubevirt-binaries/container-disk - echo ============== Build virt-launcher ==================== - - CGO_ENABLED=1 go build -o /kubevirt-binaries/virt-launcher ./cmd/virt-launcher/ + - CGO_ENABLED=1 go build -ldflags="-s -w" -o /kubevirt-binaries/virt-launcher ./cmd/virt-launcher/ - echo ============== Build virt-handler ===================== - - CGO_ENABLED=1 go build -o /kubevirt-binaries/virt-handler ./cmd/virt-handler/ - + - CGO_ENABLED=1 go build -ldflags="-s -w" -o /kubevirt-binaries/virt-handler ./cmd/virt-handler/ + - echo ============== Build virt-launcher-monitor ============ - - go build -o /kubevirt-binaries/virt-launcher-monitor ./cmd/virt-launcher-monitor/ - + # virt-launcher-monitor is wrapped in the final image. Add suffix here to prevent image size increasing as effect of file renaming. + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-launcher-monitor-orig ./cmd/virt-launcher-monitor/ + - echo ============== Build virt-tail ======================== - - go build -o /kubevirt-binaries/virt-tail ./cmd/virt-tail/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-tail ./cmd/virt-tail/ + - echo ============== Build virt-freezer ===================== - - go build -o /kubevirt-binaries/virt-freezer ./cmd/virt-freezer/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-freezer ./cmd/virt-freezer/ + - echo ============== Build virt-probe ======================= - - go build -o /kubevirt-binaries/virt-probe ./cmd/virt-probe/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-probe ./cmd/virt-probe/ + - echo ============== Build virt-api ========================= - - go build -o /kubevirt-binaries/virt-api ./cmd/virt-api/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-api ./cmd/virt-api/ + - echo ============== Build virt-chroot ====================== - - go build -o /kubevirt-binaries/virt-chroot ./cmd/virt-chroot/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-chroot ./cmd/virt-chroot/ + - echo ============== Build virt-exportproxy ================= - - go build -o /kubevirt-binaries/virt-exportproxy ./cmd/virt-exportproxy/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-exportproxy ./cmd/virt-exportproxy/ + - echo ============== Build virt-exportserver ================ - - go build -o /kubevirt-binaries/virt-exportserver ./cmd/virt-exportserver/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-exportserver ./cmd/virt-exportserver/ + - echo ============== Build virt-controller ================== - - go build -o /kubevirt-binaries/virt-controller ./cmd/virt-controller/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-controller ./cmd/virt-controller/ + - echo ============== Build virt-operator ==================== - - go build -o /kubevirt-binaries/virt-operator ./cmd/virt-operator/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/virt-operator ./cmd/virt-operator/ + - echo ============== Build csv-generator ==================== - - go build -o /kubevirt-binaries/csv-generator ./tools/csv-generator - + - go build -ldflags="-s -w" -o /kubevirt-binaries/csv-generator ./tools/csv-generator + - echo ============== Build sidecars ========================= - - go build -o /kubevirt-binaries/sidecars ./cmd/sidecars/ - + - go build -ldflags="-s -w" -o /kubevirt-binaries/sidecars ./cmd/sidecars/ + - echo ============== Build virtctl ========================== - - go build -o /kubevirt-binaries/virtctl ./cmd/virtctl/ + - go build -ldflags="-s -w" -o /kubevirt-binaries/virtctl ./cmd/virtctl/ diff --git a/images/virt-launcher/libvirt.conf b/images/virt-launcher/libvirt.conf index 7de9a4707..d8d298ecb 100644 --- a/images/virt-launcher/libvirt.conf +++ b/images/virt-launcher/libvirt.conf @@ -15,6 +15,6 @@ # These can be used in cases when no URI is supplied by the application # (@uri_default also prevents probing of the hypervisor driver). # -# Explicitly set uri_default for AltLinux. Libvirt is compiled here without probing modular daemons. +# Explicitly set uri_default for AltLinux and vanila libvirt. Libvirt is compiled here without probing modular daemons. uri_default = "qemu:///system" remote_mode = "direct" diff --git a/images/virt-launcher/reloclibs.sh b/images/virt-launcher/reloclibs.sh new file mode 100755 index 000000000..d74c49bf2 --- /dev/null +++ b/images/virt-launcher/reloclibs.sh @@ -0,0 +1,134 @@ +#!/usr/bin/env bash + +# Copyright 2024 Flant JSC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -Eeuo pipefail +shopt -s failglob + +FILE_TEMPLATE_BINS="" +TEMPLATE_BINS="" +OUT_DIR="" + +tools=("ldd" "readlink" "awk" "dirname" "ls" "cat") +for tool in "${tools[@]}"; do + if ! command -v "$tool" >/dev/null 2>&1; then + echo "$tool is not installed." + exit 1 + fi +done + +function Help() { + # Display Help + cat<<'EOF' + Copy binaries and their libraries to a folder + Only one input parameter allowed (-f or -i) !!! + + Syntax: scriptTemplate [-h|f|i|o] + options: + + -f Files with paths to binaries; Support mask like /sbin/m* + -i Paths to binaries separated by space; Support mask like /sbin/m*; Example: /bin/chmod /bin/mount /sbin/m* + List of binaries should be in double quotes, -i /bin/chmod /bin/mount + -o Output directory (Default value: '/relocate') + -h Print this help + +EOF +} + +while getopts ":h:i:f:o:" option; do + case $option in + h) # display Help + Help + exit;; + f) + FILE_TEMPLATE_BINS=$OPTARG + ;; + i) + TEMPLATE_BINS=$OPTARG + ;; + o) + OUT_DIR=$OPTARG + ;; + \?) + echo "Error: Invalid option" + exit;; + esac +done + +if [[ -z $OUT_DIR ]];then + OUT_DIR="/relocate" +fi +mkdir -p "${OUT_DIR}" + +function relocate_item() { + local file=$1 + local new_place="${OUT_DIR}$(dirname ${file})" + + mkdir -p ${new_place} + cp -a ${file} ${new_place} || true + + # if symlink, copy original file too + local orig_file="$(readlink -f ${file})" + if [[ "${file}" != "${orig_file}" ]]; then + cp -a ${orig_file} ${new_place} || true + fi +} + +function relocate_lib() { + local item=$1 + if ! [[ $item =~ /(BINS|VBINS) ]];then + relocate_item ${item} + fi + + for lib in $(ldd ${item} 2>/dev/null | awk '{if ($2=="=>") print $3; else print $1}'); do + # don't try to relocate linux-vdso.so lib due to this lib is virtual + if [[ "${lib}" =~ "linux-vdso" || "${lib}" == "not" ]]; then + continue + fi + relocate_item ${lib} + done +} + +function get_binary_path () { + local bin + BINARY_LIST=() + + for bin in "$@"; do + if [[ ! -f $bin ]] || [ "${bin}" == "${OUT_DIR}" ]; then + echo "Not found $bin" + exit 1 + fi + BINARY_LIST+=$(ls -la $bin 2>/dev/null | awk '{print $9}')" " + done + + if [[ -z $BINARY_LIST ]]; then echo "No binaryes for replace"; exit 1; fi; +} + +# if get file with binaryes (-f) +if [[ -n $FILE_TEMPLATE_BINS ]] && [[ -f $FILE_TEMPLATE_BINS ]] && [[ -z $TEMPLATE_BINS ]]; then + BIN_TEMPLATE=$(cat $FILE_TEMPLATE_BINS) + get_binary_path ${BIN_TEMPLATE} +# Or get paths to bin via raw input (-i) +elif [[ -n $TEMPLATE_BINS ]] && [[ -z $FILE_TEMPLATE_BINS ]]; then + get_binary_path ${TEMPLATE_BINS} +else + Help + exit +fi + + +for binary in ${BINARY_LIST[@]}; do + relocate_lib ${binary} +done \ No newline at end of file diff --git a/images/virt-launcher/werf.inc.yaml b/images/virt-launcher/werf.inc.yaml index afe474bb3..1352b62cb 100644 --- a/images/virt-launcher/werf.inc.yaml +++ b/images/virt-launcher/werf.inc.yaml @@ -1,42 +1,75 @@ --- image: {{ $.ImageName }} +fromImage: {{ $.ImageName }}-prepared +git: + # Add liboverride as a global LD_PRELOAD. + - add: /images/{{ $.ImageName }}/liboverride + to: /etc + stageDependencies: + setup: + - 'ld.so.preload.in' + includePaths: + - ld.so.preload.in +import: + - image: {{ $.ImageName }}-merge-qemu-libvirt-binaries + add: /VBINS + to: /usr + after: install + includePaths: + - lib64 + - image: {{ $.ImageName }}-liboverride-builder + add: /liboverride/ + to: /liboverride + after: install + includePaths: + - liboverride.so +shell: + setup: + # Configure liboverride globally. It should be done in the last stage (setup) to not break stapel commands. + - mv /etc/ld.so.preload.in /etc/ld.so.preload + +--- +{{- $gitRepoName := "libvirt" }} +{{- $version := get $.Version $gitRepoName }} + +image: {{ $.ImageName }}-prepared +final: false fromImage: base-alt-p11 import: # Before install stage. -# Add edk2-ovmf package -- image: {{ $.ImageName }}-edk2-builder - add: /home/builder/RPM/RPMS/noarch +# Add bins from libvirt and qemu artifacts. +- image: {{ $.ImageName }}-merge-qemu-libvirt-binaries + add: /VBINS to: / before: install includePaths: - - edk2-ovmf-20240811-alt2.noarch.rpm - -# After install stage. -# Add libxcrypto library. -- image: {{ $.ImageName }}-libxcrypt-builder - add: /usr/local/lib/ - to: /lib64 - after: install + - etc +- image: {{ $.ImageName }}-merge-qemu-libvirt-binaries + add: /VBINS + to: / + before: install includePaths: - - libcrypt.so.2.0.0 + - usr -# Add OpenSSL libraries. -- image: {{ $.ImageName }}-openssl-builder - add: /usr/local/lib64/ - to: /lib64 - after: install +- image: edk2 + add: /FIRMWARE/ + to: /usr/share/edk2/ovmf + # to: /usr/share/OVMF + before: install includePaths: - - libcrypto.so.3 - - libssl.so.3 + - '*.fd' + - '*.bin' + - '*.efi' + - '*.iso' -# Add liboverride library. -- image: {{ $.ImageName }}-liboverride-builder - add: /liboverride/ - to: /liboverride - after: install +- image: edk2 + add: /FIRMWARE/ + to: /usr/share/qemu/firmware + before: install includePaths: - - liboverride.so + - '*.json' +# After install stage. # Add kubeivrt files from virt-artifact. - image: virt-artifact add: /kubevirt-config-files/ @@ -65,13 +98,15 @@ import: - container-disk - virt-freezer - virt-launcher - - virt-launcher-monitor + - virt-launcher-monitor-orig - virt-probe - virt-tail - image: virt-artifact add: /kubevirt/cmd/{{ $.ImageName }}/node-labeller/ to: /usr/bin before: setup + includePaths: + - '*.sh' git: - add: /images/{{ $.ImageName }} to: / @@ -80,22 +115,6 @@ git: - '**/*' includePaths: - scripts - # Override libvirt daemon configuration. - - add: /images/{{ $.ImageName }} - to: /etc/libvirt - stageDependencies: - setup: - - '**/*' - includePaths: - - libvirt.conf - # Add liboverride as a global LD_PRELOAD. - - add: /images/{{ $.ImageName }}/liboverride - to: /etc - stageDependencies: - setup: - - 'ld.so.preload.in' - includePaths: - - ld.so.preload.in shell: beforeInstall: # Install main packages. @@ -103,115 +122,166 @@ shell: apt-get update && apt-get install --yes \ acl \ pcre \ + procps \ ethtool \ nftables \ - xorriso \ passt \ - seabios \ + swtpm swtpm-tools \ + xorriso \ + dmidecode \ + numactl \ + hwclock \ libffi8 \ - swtpm-tools \ - libvirt-client==10.7.0-alt1 \ - libvirt-daemon-driver-qemu==10.7.0-alt1 \ - qemu-kvm-core==9.1.2-alt1 + glibc-gconv-modules + - apt-get clean - rm --recursive --force /var/lib/apt/lists/ftp.altlinux.org* /var/cache/apt/*.bin + + - | + # Delete unnecessary locales + KEEP_LOCALES=("ru" "en_US" "en_GB") + EXCLUDE_PATTERN=$(printf "! -name %s " "${KEEP_LOCALES[@]}") + echo "Delete unnecessary locales" + find /usr/share/locale -mindepth 1 -maxdepth 1 -type d ${EXCLUDE_PATTERN} -exec rm -rf {} + + + # delete docs + echo "Delete docs" + rm -rf /usr/share/doc/* + install: - # Upgrade edk2-ovmf package to custom build and remove its package. + # Create qemu group and user. + - groupadd --gid 107 qemu && useradd qemu --uid 107 --gid 107 --shell /bin/bash --create-home + + # Link to dir OVMF - | - rpm -Uv /edk2-ovmf-20240811-alt2.noarch.rpm - rm /edk2-ovmf-20240811-alt2.noarch.rpm - # Restructure firware files in /usr/share/OVMF to mimic structure - # in edk2-ovmf package from the original kubevirt. + mkdir -p /usr/share/OVMF + + echo "Create symlinks for OVMF" + ln -sf /usr/share/edk2/ovmf/OVMF_CODE.fd /usr/share/edk2/ovmf/OVMF_CODE.cc.fd + ln -sf /usr/share/edk2/ovmf/OVMF_CODE.cc.fd /usr/share/OVMF/OVMF_CODE.cc.fd + + ln -s /usr/share/edk2/ovmf/OVMF_CODE.secboot.fd /usr/share/OVMF + ln -s /usr/share/edk2/ovmf/OVMF_VARS.fd /usr/share/OVMF + ln -s /usr/share/edk2/ovmf/OVMF_VARS.secboot.fd /usr/share/OVMF + ln -s /usr/share/edk2/ovmf/UefiShell.iso /usr/share/OVMF + + # Create symlinc for libvirt - | - cd /usr/share/OVMF - rm MICROVM.fd - rm OVMF.inteltdx.secboot.fd - rm OVMF_CODE.fd - rm OVMF_CODE.secboot.fd - mv OVMF_CODE_4M.fd OVMF_CODE.cc.fd - rm OVMF_CODE_4M.qcow2 - mv OVMF_CODE_4M.secboot.fd OVMF_CODE.secboot.fd - rm OVMF_CODE_4M.secboot.qcow2 - rm OVMF_VARS.fd - rm OVMF_VARS.ms.fd - rm OVMF_VARS.secboot.fd - mv OVMF_VARS_4M.fd OVMF_VARS.fd - rm OVMF_VARS_4M.ms.fd - rm -f OVMF_VARS_4M.ms.qcow2 - rm -f OVMF_VARS_4M.qcow2 - mv OVMF_VARS_4M.secboot.fd OVMF_VARS.secboot.fd - rm -f OVMF_VARS_4M.secboot.qcow2 - ls -la + convert_version() { + local version="$1" + IFS='.' read -r major minor patch <<< "$version" + printf "%d%03d\n" "$major" "$minor" + } + + libvirt_version=$(convert_version {{ $version }}) + + echo "libvirt_version: $libvirt_version" + + SYMLINC_LIST=$(cat <> /etc/apt/sources.list.d/src.list - - apt-get update - - su - builder -c 'apt-get source edk2-ovmf' - - apt-get clean - - rm --recursive --force /var/lib/apt/lists/ftp.altlinux.org* /var/cache/apt/*.bin - - # Add DVP logo into SOURCES. - - cp /edk2/Logo.bmp /home/builder/RPM/SOURCES/ - - # Build RPMs. edk2 package prints a huge log with about 770k lines, - # we can keep only last 1k lines, it should be enough to get error - # context and troubleshoot it locally. - - | - echo "Build RPMs from:" /home/builder/*.rpm - echo "Note: time consuming operation, be patient ..." - su - builder -c 'trap "echo Build log tail: ; tail -n 1024 /tmp/build.log" EXIT ; rpm -ba /home/builder/RPM/SPECS/edk2.spec > /tmp/build.log 2>&1' + # Build liboverride. + - cd /liboverride + - gcc -shared -fPIC -DPIC -Wall -o liboverride.so override.c -ldl + - strip liboverride.so diff --git a/werf.yaml b/werf.yaml index d9bcc91d6..013438029 100644 --- a/werf.yaml +++ b/werf.yaml @@ -46,6 +46,13 @@ configVersion: 1 # Edition module settings {{- $_ := set . "MODULE_EDITION" (env "MODULE_EDITION") }} +# Component versions +{{ $_ := set . "Version" dict }} +{{- $versions_ctx := (.Files.Get "cv/version_map.yml" | fromYaml) }} +{{- range $k, $v := $versions_ctx.firmware }} + {{- $_ := set $.Version $k $v}} +{{- end }} + # Modules_images {{- define "module_image_template" }} @@ -79,6 +86,7 @@ dockerfile: Dockerfile {{- $_ := set $ctx "Images" $Root.Images }} {{- $_ := set $ctx "SOURCE_REPO" $Root.SOURCE_REPO }} {{- $_ := set $ctx "MODULE_EDITION" $Root.MODULE_EDITION }} + {{- $_ := set $ctx "Version" $Root.Version }} {{- include "module_image_template" $ctx }} {{- range $ImageYamlMainfest := regexSplit "\n?---[ \t]*\n" (include "module_image_template" $ctx) -1 }}