使能Kata机密容器

git clone https://gitcode.com/openeuler/virtCCA_sdk.git
cd virtCCA_sdk/kata-v3.15.0/tools && chmod 755 build.sh
./build.sh containerd && ./build.sh k8s

kubectl get pod -A确保集群pod状态正常。

kubectl taint nodes <node-name> node-role.kubernetes.io/control-plane:NoSchedule- 
kubectl label node <node-name> node.kubernetes.io/worker=

wget https://get.helm.sh/helm-v4.1.4-linux-arm64.tar.gz
tar -zxvf helm-v4.1.4-linux-arm64.tar.gz
cp linux-arm64/helm /usr/local/bin/

helm version回显有版本打印即说明安装成功。

export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy"
export VERSION=3.30.0
helm install kata-deploy --set shims.disableAll=true --set shims.qemu.enabled=true --set shims.qemu-cca.enabled=true  --set debug=true "${CHART}" --version "${VERSION}"

验证kata-deploy安装成功：

社区kata-deploy安装指导：https://kata-containers.github.io/kata-containers/installation/

卸载kata-deploy命令：helm uninstall kata-deploy

1. runtime kata-qemu前新增runtime kata-qemu-cca相关配置。

   [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu-cca]
   runtime_type = "io.containerd.kata-qemu.v2"
   runtime_path = "/opt/kata/bin/containerd-shim-kata-v2"
   privileged_without_host_devices = true
   pod_annotations = ["io.katacontainers.*"]
   container_annotations = ["io.kubernetes.container.terminationMessage*"]
   snapshotter = "nydus-for-kata-tee"
   
   [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu-cca.options]
   ConfigPath = "/opt/kata/share/defaults/kata-containers/configuration-qemu-cca.toml"

   

2. containerd默认snapshotter修改为nydus-for-kata-tee。

   

3. 重启containerd使配置生效：systemctl restart containerd。

sudo sed -i 's#experimental_force_guest_pull = false#experimental_force_guest_pull = true#; s#firmware = "/opt/kata/share/aavmf/AAVMF_CODE.fd"#firmware = ""#; s#firmware_volume = "/opt/kata/share/aavmf/AAVMF_VARS.fd"#firmware_volume = ""#' /opt/kata/share/defaults/kata-containers/configuration-qemu-cca.toml

git clone https://github.com/kata-containers/kata-containers.git -b 3.30.0
cd kata-containers

# OpenEuler/kernel宏定义与linaro/kernel不一致
sed -i 's/KVM_ARM_CAP_RME_ID = 240/KVM_ARM_CAP_RME_ID = 300/' src/runtime/virtcontainers/hypervisor_linux_arm64.go

# 容器化编译参考下面的说明
docker exec -it coco-build-env /bin/bash
make -C src/runtime

# 拷贝到目标路径
cp src/runtime/containerd-shim-kata-v2 /opt/kata/bin/containerd-shim-kata-v2

参考社区文档部署远程证明组件步骤1完成容器编译环境构建

# 固定tag：6.6.0-147.0.0
git clone https://gitcode.com/openeuler/kernel.git -b 6.6.0-147.0.0 --depth=1

# 准备启动kata的编译选项
cd ./kernel
make openeuler_defconfig
opts="VSOCKETS VSOCKETS_LOOPBACK VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON NET_9P NET_9P_FD NET_9P_VIRTIO FAILOVER VIRTIO_BLK SCSI_VIRTIO VIRTIO_NET NET_FAILOVER VIRTIO_CONSOLE VIRTIO VIRTIO_PCI_LIB VIRTIO_PCI_LIB_LEGACY VIRTIO_PCI VIRTIO_BALLOON VIRTIO_MMIO EXT4_FS JBD2 FS_MBCACHE FUSE_FS VIRTIO_FS NETFS_SUPPORT 9P_FS CONFIG_TSM_REPORTS CONFIG_ARM_CCA_GUEST CONFIG_OVERLAY_FS"
for opt in $opts; do ./scripts/config -e $opt; done

# 编译kernel
make -j`nproc`

# 软链到当前编译生成的Image
sudo ln -s ./arch/arm64/boot/Image /opt/kata/share/kata-containers/vmlinuz-confidential.container

losetup -fP --show /opt/kata/share/kata-containers/kata-containers-confidential.img
mount /dev/loop0p1 /mnt  //loop0p1为参考值，具体loop号以实际部署为准。
cat rootCA.crt >> /mnt/etc/ssl/certs/ca-certificates.crt
echo "<IP> registry.hw.com" >> /mnt/etc/hosts
umount /mnt
losetup -d /dev/loop0

rootCA.crt请替换成实际本地镜像仓根证书文件路径；IP和registry.hw.com请分别替换成本地镜像仓IP和域名。

test-cca.yaml示例配置如下：

apiVersion: v1
kind: Pod
metadata:
  name: test-kata-qemu-cca
  annotations:
    io.containerd.cri.runtime-handler: "kata-qemu-cca"
    io.katacontainers.config.hypervisor.kernel_params: "agent.debug_console agent.log=debug rodata=full"
spec:
  runtimeClassName: kata-qemu-cca
  terminationGracePeriodSeconds: 5
  containers:
  - name: box-1
    image: registry.hw.com:5000/busybox:latest
    imagePullPolicy: Always
    command:
    - sh
    tty: true

启动容器：

kubectl apply -f test-cca.yaml

参考社区文档部署远程证明组件完成远程证明组件编译部署。