2 Commits

Include renames

Author	SHA1	Message	Date
Taylor MutchandSeth Jennings	8eacb4779f	feat(kubernetes): add sidecar supervisor topology (#2076) ... * feat(kubernetes): add sidecar supervisor topology Add the Kubernetes sidecar supervisor topology, its Helm/Skaffold configuration, topology documentation, and sidecar e2e matrix coverage. Skip root-only sandbox identity rewriting when process enforcement is network-only so the low-permission sidecar process container can start successfully. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): avoid similar proxy id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(kubernetes): clarify sidecar topology limits Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): keep sidecar process leaf capless Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): refresh sidecar provider env snapshots Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(supervisor): align hot-swap identity regression Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): stage sidecar mtls files before proxy chown Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): simplify sidecar supervisor topology Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(helm): reuse sidecar skaffold values Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar iptables helper names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(e2e): harden kube gateway wrapper setup Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid nft batch rollback on OCP Run nftables setup as individual commands so optional conntrack and log expressions can fail without rolling back required table, chain, and reject rules. Signed-off-by: Seth Jennings <sjenning@redhat.com> Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): preserve process identity in sidecar topology Render sidecar pods with a shared process namespace, keep binary-aware network policy enabled, and move Kubernetes sidecar settings under the nested sidecar config table. Also apply unprivileged Landlock/seccomp setup in NetworkOnly supervisor mode so sidecar topology keeps sandbox child hardening without privileged process setup. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): replace sidecar snapshots with control socket Coordinate sidecar policy and provider bootstrap over a local Unix socket so the process leaf no longer reads policy/provider snapshot files. Report entrypoint startup through the control channel and keep gateway credentials confined to the network sidecar. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * feat(kubernetes): support relaxed sidecar network identity Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy sidecar clippy lint Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): standardize topology naming Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy linux clippy timeout import Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): support kata sidecar on ipv4 pods Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): satisfy linux clippy for sidecar fallback Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(kubernetes): remove stale supervisor topology references Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): enable sidecar binary policy inspection Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): harden sidecar control boundary Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): couple sidecar supervisor lifecycles Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Seth Jennings <sjenning@redhat.com> Co-authored-by: Seth Jennings <sjenning@redhat.com>	2026-07-10 13:01:39 -07:00
Taylor MutchandDrew Newberry	ba77967fc4	refactor(docker): split gateway/supervisor Dockerfiles and use native rust builds (#1316) ... * wip * refactor(docker): use native rust builds for split gateway/supervisor images Drop the in-Docker BUILD_FROM_SOURCE path so both images consume only prebuilt binaries staged natively via tasks/scripts/stage-prebuilt-binaries.sh. This mirrors what CI does and reuses the host's cargo target cache and sccache across rebuilds. - Dockerfile.gateway: nvcr.io/nvidia/distroless/cc:v4.0.4 base (the 4.0.0 tag does not exist on nvcr.io; the registry uses a v prefix). GNU-linked binary copied to /usr/local/bin. - Dockerfile.supervisor: scratch base, static musl binary. Static linkage lets the image stay scratch while still being executable as a Kubernetes init container. - skaffold.yaml: each artifact invokes tasks/scripts/docker-build-image.sh, which stages the binary natively (cargo / cargo-zigbuild) and then builds the image. Drops the cross-build.sh dependency from the supervisor build. - seccomp.rs: add a local SYS_kexec_file_load constant for musl/aarch64. libc 0.2.185 omits the symbol from its musl/aarch64 bindings, so the supervisor's seccomp filter previously failed to compile for that target. - architecture/build.md: describe the native-first pipeline and per-image runtime choices. Local validation: gateway image 101MB (was 194MB), supervisor image 21.7MB. helm:skaffold:run deploys cleanly; the static musl supervisor binary runs correctly in a non-glibc agent container. * refactor(docker): tighten binary perms via --chown + 0550 Replace `COPY --chmod=755` with `COPY --chown=<user> --chmod=0550` in the gateway and supervisor Dockerfiles. The binary is no longer world-readable or world-executable; ownership is pinned to the runtime user. - Gateway uses `--chown=nvs:nvs` + `USER nvs:nvs`, matching the only non-root user defined in `nvcr.io/nvidia/distroless/cc` (UID 1000) and the Helm chart's `securityContext.runAsUser: 1000`, which overrides the Dockerfile USER at runtime. - Supervisor uses numeric `--chown=65534:65534` because the scratch base has no `/etc/passwd` for name resolution. The supervisor image is only consumed by the init-container copy-self path; the destination pod's runAsUser governs execute access. Validated by deploying to a local k3d cluster via `helm:skaffold:run` and confirming the gateway StatefulSet reaches 1/1 Running. * ci(gpu): repoint GPU probe image lookup at Dockerfile.gateway The previous awk parsed `FROM <image> AS gateway` from the now-deleted `Dockerfile.images`. The new `Dockerfile.gateway` uses an ARG with a default (`ARG GATEWAY_BASE_IMAGE=nvcr.io/nvidia/distroless/cc:v4.0.4`) and `FROM ${GATEWAY_BASE_IMAGE} AS gateway`, so the old script returns nothing. Parse the ARG default value directly so the GPU prerequisites check keeps using the gateway base image as a `nvidia-smi` probe target. * ci(gpu): pin GPU probe to nvcr.io/nvidia/base/ubuntu:noble The previous probe parsed the gateway base image out of the Dockerfile, relying on the fact that the gateway ran on `nvcr.io/nvidia/base/ubuntu` and that NVIDIA Container Toolkit CDI injection would populate `nvidia-smi` and the supporting libs at runtime. The new gateway base (`nvcr.io/nvidia/distroless/cc`) lacks `ldconfig`, a populated `/usr/bin`, and the broader filesystem layout CDI injection assumes, so it cannot serve as a GPU probe. Pin the probe image explicitly to the NVIDIA-managed Ubuntu base. The probe is independent of the gateway runtime and survives future base swaps. * fix(e2e-gpu): pass GPU probe image via env, drop Dockerfile.images parse The Rust e2e test `gpu_request_for_each_discovered_device_matches_plain_container` was still parsing the deleted `Dockerfile.images` to derive its GPU probe image, panicking with `No such file or directory` after this PR's Dockerfile split. Move the probe image to a single source of truth in the workflow (`OPENSHELL_E2E_GPU_PROBE_IMAGE` env at the job level) and require the e2e test to read it from there. No silent codebase default — the test panics with a pointer at the workflow if the env is missing, so it fails loudly rather than drifting from CI. The prereq probe step in the workflow now consumes the same env, so the probe image is declared exactly once. * fix(docker): keep supervisor binary root-owned for rootless Podman The Podman driver mounts the supervisor image read-only into the sandbox container at /opt/openshell/bin and runs that container as UID 0, but deliberately drops DAC_OVERRIDE for hardening (container.rs:419). With --chown=65534:65534 --chmod=0550 the binary was r-xr-x--- owned by UID 65534, so the container's UID 0 fell into "other" with no read or exec access and the supervisor crashed on start (ContainerExited code 1). Docker and Kubernetes both retain DAC_OVERRIDE, so root could still exec the file — which is why this regression only surfaced in the Podman e2e job. Drop --chown from the supervisor COPY so the binary stays root-owned. Keep --chmod=0550: the security win was dropping world-execute, not changing the owner. The chown bought nothing here because the container is always UID 0 regardless of driver, but it actively broke the only driver that drops DAC_OVERRIDE. --------- Co-authored-by: Drew Newberry <anewberry@nvidia.com>	2026-05-12 16:05:49 -07:00