Skip to content

Commit 4f02b05

Browse files
hegao12hegao12
committed
Add workflow for preloading cchost image with oem-perloader
1 parent 064e88e commit 4f02b05

File tree

11 files changed

+358
-0
lines changed

11 files changed

+358
-0
lines changed

‎launcher/image/cchost/cloudbuild.yaml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
substitutions:
2+
'_BASE_IMAGE': ''
3+
'_BASE_IMAGE_PROJECT': ''
4+
'_BUCKET_NAME': ''
5+
'_IMAGE_ENV': ''
6+
'_OUTPUT_IMAGE_NAME': ''
7+
'_OUTPUT_IMAGE_FAMILY': ''
8+
'_CS_LICENSE': ''
9+
'_SHORT_SHA': ''
10+
11+
steps:
12+
- name: golang:1.23
13+
entrypoint: /bin/bash
14+
args:
15+
- -c
16+
- |
17+
cd launcher/launcher
18+
CGO_ENABLED=0 go build -o ../image/cchost/preload-dir/confidential_space/cs_container_launcher -ldflags="-X 'main.BuildCommit=${_SHORT_SHA}'"
19+
- name: 'gcr.io/cloud-builders/gcloud'
20+
id: 'DownloadExpBinary'
21+
entrypoint: 'gcloud'
22+
args: ['storage',
23+
'cp',
24+
'gs://confidential-space-images_third-party/confidential_space_experiments',
25+
'./launcher/image/cchost/preload-dir/confidential_space/confidential_space_experiments']
26+
- name: 'alpine'
27+
args: ['chmod', '+x', './launcher/image/cchost/preload-dir/confidential_space/confidential_space_experiments']
28+
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
29+
id: 'ExportBaseImage'
30+
args:
31+
- 'gcloud'
32+
- 'compute'
33+
- 'images'
34+
- 'export'
35+
- '--image=${_BASE_IMAGE}'
36+
- '--image-project=${_BASE_IMAGE_PROJECT}'
37+
- '--destination-uri=gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_BASE_IMAGE}.tar.gz'
38+
- name: 'gcr.io/cloud-builders/gcloud'
39+
id: 'DownloadImageFromGCS'
40+
entrypoint: 'gcloud'
41+
args: ['storage',
42+
'cp',
43+
'gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_BASE_IMAGE}.tar.gz',
44+
'./src_image.tar.gz']
45+
- name: 'alpine'
46+
id: 'ExtractRawImage'
47+
args: ['tar', '-xf', './src_image.tar.gz']
48+
- name: 'gcr.io/hegao-dev/oem-preloader:v2'
49+
id: 'RunOEMPreloader'
50+
env:
51+
- 'IMAGE_ENV=${_IMAGE_ENV}'
52+
args:
53+
- '--src-image=./disk.raw'
54+
- '--out-image=output.bin'
55+
- '--oem-fs-size=500M'
56+
- '--disk-size-gb=11'
57+
- '--install-dir=./launcher/image/cchost/preload-dir'
58+
- '--cmdline-script=./launcher/image/cchost/cmdline.sh'
59+
- name: 'alpine'
60+
id: 'RenameOutputImage'
61+
args: ['mv', 'output.bin', 'disk.raw']
62+
- name: 'alpine'
63+
id: 'TarOutputImage'
64+
args: ['tar', '-zcf', './out_image.tar.gz', 'disk.raw']
65+
- name: 'gcr.io/cloud-builders/gcloud'
66+
id: 'UploadToGCS'
67+
entrypoint: 'gcloud'
68+
args: ['storage',
69+
'cp',
70+
'./out_image.tar.gz',
71+
'gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_OUTPUT_IMAGE_NAME}.tar.gz']
72+
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
73+
id: 'CreateGCEImage'
74+
args:
75+
- 'gcloud'
76+
- 'compute'
77+
- 'images'
78+
- 'create'
79+
- '--family=${_OUTPUT_IMAGE_FAMILY}'
80+
- '--source-uri=gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_OUTPUT_IMAGE_NAME}.tar.gz'
81+
- '--guest-os-features=UEFI_COMPATIBLE'
82+
- '-licenses=${_CS_LICENSE},projects/confidential-space-images/global/licenses/ek-certificate-license'
83+
- '${_OUTPUT_IMAGE_NAME}'
84+
- name: 'gcr.io/cloud-builders/gcloud'
85+
id: 'RemoveGCSFiles'
86+
entrypoint: 'gcloud'
87+
args: ['storage',
88+
'rm',
89+
'gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_BASE_IMAGE}.tar.gz',
90+
'gs://${_BUCKET_NAME}/oem-preloader-${BUILD_ID}/${_OUTPUT_IMAGE_NAME}.tar.gz']
91+
92+
timeout: '3000s'
93+
94+
options:
95+
dynamic_substitutions: true

‎launcher/image/cchost/cmdline.sh‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/bash
2+
3+
GRUB_FILE="$1"
4+
5+
readonly OEM_PATH='/usr/share/oem'
6+
readonly CS_PATH="${OEM_PATH}/confidential_space"
7+
8+
append_cmdline() {
9+
local arg="$1"
10+
sed -i -e "s|cros_efi|cros_efi ${arg}|g" "${GRUB_FILE}"
11+
}
12+
13+
set_default_boot_target() {
14+
append_cmdline "systemd.unit=$1"
15+
}
16+
17+
disable_unit() {
18+
append_cmdline "systemd.mask=$1"
19+
}
20+
21+
enable_unit() {
22+
append_cmdline "systemd.wants=$1"
23+
}
24+
25+
configure_entrypoint() {
26+
append_cmdline "'ds=nocloud;s=${OEM_PATH}/'"
27+
}
28+
29+
configure_necessary_systemd_units() {
30+
# Include basic services.
31+
enable_unit "basic.target"
32+
33+
# gcr-wait-online.service is WantedBy=gcr-online.target.
34+
# The hostname gcr.io does not resolve until systemd-resolved is enabled.
35+
enable_unit "systemd-resolved.service"
36+
37+
# Dependencies of container-runner.service.
38+
enable_unit "network-online.target"
39+
enable_unit "gcr-online.target"
40+
41+
}
42+
43+
configure_systemd_units_for_hardened() {
44+
configure_necessary_systemd_units
45+
# Make entrypoint (via cloud-init) the default unit.
46+
set_default_boot_target "cloud-final.service"
47+
48+
disable_unit "var-lib-docker.mount"
49+
disable_unit "docker.service"
50+
disable_unit "google-guest-agent.service"
51+
disable_unit "google-osconfig-init.service"
52+
disable_unit "google-osconfig-agent.service"
53+
disable_unit "google-startup-scripts.service"
54+
disable_unit "google-shutdown-scripts.service"
55+
disable_unit "konlet-startup.service"
56+
disable_unit "crash-reporter.service"
57+
disable_unit "device_policy_manager.service"
58+
disable_unit "docker-events-collector-fluent-bit.service"
59+
disable_unit "sshd.service"
60+
disable_unit "var-lib-toolbox.mount"
61+
}
62+
63+
configure_systemd_units_for_debug() {
64+
disable_unit "konlet-startup.service"
65+
}
66+
67+
fix_oem() {
68+
sed -i -e 's|systemd.mask=usr-share-oem.mount||g' "${GRUB_FILE}"
69+
70+
# TODO: Remove this fix once the upstream customizer fixed the bug.
71+
# Fix a string manipulation bug in the dm part of the kernel cmd.
72+
if grep -q "dm-m2d" "${GRUB_FILE}"; then
73+
sed -i -e 's|dm-m2d|dm-mod|g' "${GRUB_FILE}"
74+
sed -i -e 's|,oemroot|;oemroot|g' "${GRUB_FILE}"
75+
fi
76+
77+
# Print grub.cfg's kernel command line.
78+
grep -i '^\s*linux' "${GRUB_FILE}" | \
79+
sed -e 's|.*|[BEGIN_CS_GRUB_CMDLINE]&[END_CS_GRUB_CMDLINE]|g'
80+
81+
# Convert grub.cfg's kernel command line into what GRUB passes to the kernel.
82+
grep -i '^\s*linux' "${GRUB_FILE}" | \
83+
sed -e "s|'ds=nocloud;s=/usr/share/oem/'|ds=nocloud;s=/usr/share/oem/|g" | \
84+
sed -e 's|\\"|"|g' | \
85+
sed -e 's|dm-mod.create="|"dm-mod.create=|g' | \
86+
sed -e 's|.*|[BEGIN_CS_CMDLINE]&[END_CS_CMDLINE]|g'
87+
}
88+
89+
main() {
90+
configure_entrypoint
91+
append_cmdline "cos.protected_stateful_partition=m"
92+
append_cmdline "systemd.default_timeout_start_sec=900s"
93+
if [[ "${IMAGE_ENV}" == "debug" ]]; then
94+
configure_systemd_units_for_debug
95+
append_cmdline "confidential-space.hardened=false"
96+
elif [[ "${IMAGE_ENV}" == "hardened" ]]; then
97+
configure_systemd_units_for_hardened
98+
append_cmdline "confidential-space.hardened=true"
99+
fi
100+
fix_oem
101+
}
102+
103+
main

‎launcher/image/cchost/preload-dir/confidential_space/boot-disk-size-consistency-monitor-cs.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"plugin": "custom",
3+
"pluginConfig": {
4+
"invoke_interval": "30m",
5+
"timeout": "7s",
6+
"max_output_length": 80,
7+
"enable_message_change_based_condition_update": false
8+
},
9+
"source": "boot-disk-size-consistency-monitor",
10+
"metricsReporting": false,
11+
"rules": []
12+
}

‎launcher/image/cchost/preload-dir/confidential_space/container-runner.service‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[Unit]
2+
Description=Confidential Space Launcher
3+
Wants=network-online.target gcr-online.target containerd.service
4+
After=network-online.target gcr-online.target containerd.service
5+
6+
[Service]
7+
ExecStart=/usr/share/oem/confidential_space/cs_container_launcher
8+
ExecStopPost=/usr/share/oem/confidential_space/exit_script.sh
9+
Restart=no
10+
StandardOutput=journal
11+
StandardError=journal
12+
13+
[Install]
14+
WantedBy=multi-user.target

‎launcher/image/cchost/preload-dir/confidential_space/docker-monitor-cs.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"plugin": "journald",
3+
"pluginConfig": {
4+
"source": "dockerd"
5+
},
6+
"logPath": "/var/log/journal",
7+
"lookback": "5m",
8+
"bufferSize": 10,
9+
"source": "docker-monitor",
10+
"metricsReporting": false,
11+
"conditions": []
12+
}

‎launcher/image/cchost/preload-dir/confidential_space/exit_script.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#! /bin/bash
2+
3+
if [[ $EXIT_STATUS -eq 3 ]]
4+
then
5+
# reboot after 2 min
6+
shutdown --reboot +2
7+
fi
8+
9+
if [[ $EXIT_STATUS -eq 0 ]] || [[ $EXIT_STATUS -eq 1 ]] || [[ $EXIT_STATUS -eq 2 ]]
10+
then
11+
# poweroff after 2 min
12+
shutdown --poweroff +2
13+
fi

‎launcher/image/cchost/preload-dir/confidential_space/fluent-bit-cs.conf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#
2+
# Copyright 2022 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
# Forked from https://cos.googlesource.com/cos/overlays/board-overlays/+/refs/heads/master/project-lakitu/app-admin/fluent-bit/files/fluent-bit.conf
18+
19+
[SERVICE]
20+
# Flush
21+
# =====
22+
# set an interval of seconds before to flush records to a destination
23+
flush 1
24+
# Daemon
25+
# ======
26+
# instruct Fluent Bit to run in foreground or background mode.
27+
daemon Off
28+
# Log_Level
29+
# =========
30+
# Set the verbosity level of the service, values can be:
31+
#
32+
# - error
33+
# - warning
34+
# - info
35+
# - debug
36+
# - trace
37+
#
38+
# by default 'info' is set, that means it includes 'error' and 'warning'.
39+
log_level info
40+
# Storage
41+
# =======
42+
# Fluent Bit can use memory and filesystem buffering based mechanisms
43+
#
44+
# - https://docs.fluentbit.io/manual/administration/buffering-and-storage
45+
#
46+
# storage metrics
47+
# ---------------
48+
# publish storage pipeline metrics in '/api/v1/storage'. The metrics are
49+
# exported only if the 'http_server' option is enabled.
50+
#
51+
storage.metrics on
52+
53+
# Collects CS launcher and workload logs.
54+
[INPUT]
55+
Name systemd
56+
Tag confidential-space-launcher
57+
Systemd_Filter _SYSTEMD_UNIT=container-runner.service
58+
DB /var/log/google-fluentbit/container-runner.log.db
59+
Read_From_Tail False
60+
61+
[OUTPUT]
62+
Name stackdriver
63+
Match *
64+
Resource gce_instance
65+
severity_key severity

‎launcher/image/cchost/preload-dir/confidential_space/kernel-monitor-cs.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"plugin": "kmsg",
3+
"logPath": "/dev/kmsg",
4+
"lookback": "5m",
5+
"bufferSize": 10,
6+
"source": "kernel-monitor",
7+
"metricsReporting": false,
8+
"conditions": [],
9+
"rules": []
10+
}

‎launcher/image/cchost/preload-dir/confidential_space/system-stats-monitor-cs.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"memory": {
3+
"metricsConfigs": {
4+
"memory/bytes_used": {
5+
"displayName": "memory/bytes_used"
6+
}
7+
}
8+
},
9+
"invokeInterval": "60s"
10+
}

‎launcher/image/cchost/preload-dir/metadata‎

Whitespace-only changes.

0 commit comments

Comments
 (0)