test(e2e): Kata Containers E2E lane (v1 plain Kata) - #450
Open
ArangoGutierrez wants to merge 20 commits into
Open
test(e2e): Kata Containers E2E lane (v1 plain Kata)#450ArangoGutierrez wants to merge 20 commits into
ArangoGutierrez wants to merge 20 commits into
Conversation
Stands up kata-deploy 3.32.0 on kind with /dev/kvm and asserts a kata-qemu pod boots its own guest kernel (kernel-inequality guard: GitHub runners are VMs, so /proc/cpuinfo hypervisor flags cannot discriminate a silent runc fallback). Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Chart 3.32.0 models defaultShim as a per-arch map (amd64/arm64/...) already defaulting to qemu; --set defaultShim=qemu flattened it to a string and broke the runtimeclasses template render (CI round 1). Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
CI round 2: sandbox creation timed out connecting to the guest agent vsock (CID:1024) — the kata shim's AF_VSOCK channel needs the vhost_vsock module loaded on the runner and the device visible in the node container. Also enable kata debug and widen the failure-collect step (devices, qemu processes, kata/containerd journals, drop-in config) so a further red round carries evidence. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
CI round 3 journal shows the mechanical cause of the vsock timeout: QEMU backs the 2G guest RAM with a share=on file on the node's /dev/shm (virtiofsd requirement), but kind node containers get the 64M Docker default — the guest hangs before kata-agent starts. Remount to 8G (virtual until touched). Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Device plugin switches to cdi-cri for the kata lane: the default envvar strategy needs the NVIDIA runtime wrapper on the host, which the kata handler bypasses. Asserts guest-kernel inequality, exact profile GPU name, config-derived enumeration, and a no-request negative control. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
CI round 1 of the workload stage proved the core delivery: the pod is in a kata VM, kata-agent mknod'd /dev/nvidia0 + /dev/nvidiactl from the CDI edits, and virtiofs carried the nvidia-smi file mount. Two gaps, both from the device plugin's generated CDI spec winning the injection over setup.sh's spec: the lib arrives only at its VERSIONED path (the .so.1 soname link comes from the update-ldcache hook, which never runs inside the guest), and no config mount/env is included. Probe now asserts the versioned lib (the honest CDI-delivery check), creates the soname link itself, and gets the profile config via an explicit hostPath volume + MOCK_NVML_CONFIG. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
CI round 2 allocated GPU 1, so /dev/nvidia0 wasn't injected — the per-GPU node index follows the scheduler's pick. Assert exactly one allocated /dev/nvidiaN instead (stronger: proves allocation-scoped injection), and widen the negative control's globs the same way. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
CI round 3 showed the mock NVML surface fully working in-guest (exact profile name, driver version, live telemetry) with -L reporting 1 GPU. That is the engine's real semantics — detectVisibleDevices() only enumerates devices whose /dev/nvidiaN node exists, and kata-agent creates exactly the allocated one — the same view a real driver gives an allocated container. The expect-2 assertion was a plan bug (the runc lanes never assert a count in an allocated pod). Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Four one-liners from the whole-branch review: readOnly on the mock-config hostPath mount (workflow pod + doc example — doc readers copy it), failure-collect glob widened to catch the plugin's .json CDI spec, device-plugin-kata header comment made accurate (two args + a volume, not one), a keep-me note on kata-deploy debug=true, and the doc's install snippet aligned with the CI-verified NFD-disabled form. Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
ArangoGutierrez
force-pushed
the
test/377-kata-v1-e2e
branch
from
July 14, 2026 16:55
21c5a47 to
072767d
Compare
Collaborator
Author
|
@giuliocalzo, could you please review this NRI-native Kata rebase? CI is 29/29 green. Thanks! |
ArangoGutierrez
marked this pull request as ready for review
July 14, 2026 18:27
giuliocalzo
approved these changes
Jul 15, 2026
giuliocalzo
left a comment
giuliocalzo
left a comment
Collaborator
There was a problem hiding this comment.
LGTM, I would be happy to convert the tests/e2e/kata-nri-contract_test.sh into a golang step as part #442
ArangoGutierrez
added
priority/p2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v1 of the Kata/CoCo integration (Slack thread w/ Fabiano; related #377).
Verifies nvml-mock's CDI delivery under runtimeClassName kata-qemu:
virtiofs library mounts + kata-agent guest mknod of the inert device
nodes. docs/integrations/kata.md added in a follow-up commit on this PR.
Phase v2 (CoCo guest payload, no host sharing) is a follow-up.