Skip to content

Conversation

@KenGordon
Copy link
Collaborator

Support booting isolated SNP from a GuestStateFile rather than separate kernel and userland (initrd.img)

Mainly this refactors the code that creates the hcs api json document into two paths. One is the previous logic that will create a kernel command line and boot the kernel and userland from individual files using the "LinuxKernelDirect" scheme. With isolation enabled this must be replaced with "GuestState/GuestStateFilePath" etc to load from a vmgs file.

There are updates and addition files in the schema2 directory to support the newer hcs API so that the existing way where an object that represents the hcs api json is built and then serialised to json can be used with isolation_setting etc.

If a SecurityPolicy annotation is present it will boot the vmgs file unless "io.microsoft.virtualmachine.lcow.no_security_hardware" is set to true. The various example pod.json files will need to be updated for use with non SNP machines.

…te kernel and userland (initrd.img)

Mainly this refactors the code that creates the hcs api json document into two paths. One is the previous
logic that will create a kernel command line and boot the kernel and userland from individual files using
the "LinuxKernelDirect" scheme. With isolation enabled this must be replaced with "GuestState/GuestStateFilePath"
etc to load from a vmgs file.

There are updates and addition files in the schema2 directory to support the newer hcs API so that the existing
way where an object that represents the hcs api json is built and then serialised to json can be used with
isolation_setting etc.

If a SecurityPolicy annotation is present it will boot the vmgs file unless
"io.microsoft.virtualmachine.lcow.no_security_hardware" is set to true. The various example pod.json files
will need to be updated for use with non SNP machines.

Signed-off-by: Ken Gordon <[email protected]>
@KenGordon KenGordon marked this pull request as ready for review October 22, 2021 15:34
@KenGordon KenGordon requested a review from a team as a code owner October 22, 2021 15:34
@anmaxvl
Copy link
Contributor

anmaxvl commented Oct 28, 2021

Looks like this needs to be rebased again.

@anmaxvl anmaxvl merged commit 47b6171 into microsoft:master Nov 2, 2021
princepereira pushed a commit to princepereira/hcsshim that referenced this pull request Aug 29, 2024
…te kernel and userland (initrd.img) (microsoft#1206)

Mainly this refactors the code that creates the hcs api json document into two paths. One is the previous
logic that will create a kernel command line and boot the kernel and userland from individual files using
the "LinuxKernelDirect" scheme. With isolation enabled this must be replaced with "GuestState/GuestStateFilePath"
etc to load from a vmgs file.

There are updates and addition files in the schema2 directory to support the newer hcs API so that the existing
way where an object that represents the hcs api json is built and then serialised to json can be used with
isolation_setting etc.

If a SecurityPolicy annotation is present it will boot the vmgs file unless
"io.microsoft.virtualmachine.lcow.no_security_hardware" is set to true. The various example pod.json files
will need to be updated for use with non SNP machines.

Signed-off-by: Ken Gordon <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants