Skip to content

Commit 650f120

Browse files
RozziiRozzii
committed
enable tpm simulation for virtual machines
This commit: - Appends the libvirt VM definition xml templates to include tpm simulation. This commit is needed to enable the testing of use-cases where tpm features e.g. disk encryption, remote secure boot attestation, random hash generation, measured boot etc are used. Signed-off-by: Adam Rozman <[email protected]>
1 parent df3b640 commit 650f120

File tree

6 files changed

+501
-10
lines changed

6 files changed

+501
-10
lines changed

‎tests/roles/run_tests/files/manifests/v1beta1_cluster_centos.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
apiVersion: cluster.x-k8s.io/v1beta1
2+
kind: Cluster
3+
metadata:
4+
name: test1
5+
namespace: metal3
6+
spec:
7+
clusterNetwork:
8+
pods:
9+
cidrBlocks:
10+
- 192.168.0.0/18
11+
services:
12+
cidrBlocks:
13+
- 10.96.0.0/12
14+
controlPlaneRef:
15+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
16+
kind: KubeadmControlPlane
17+
name: test1
18+
infrastructureRef:
19+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
20+
kind: Metal3Cluster
21+
name: test1
22+
---
23+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
24+
kind: Metal3Cluster
25+
metadata:
26+
name: test1
27+
namespace: metal3
28+
spec:
29+
controlPlaneEndpoint:
30+
host: 192.168.111.249
31+
port: 6443
32+
noCloudProvider: true
33+
---
34+
apiVersion: ipam.metal3.io/v1alpha1
35+
kind: IPPool
36+
metadata:
37+
name: provisioning-pool
38+
namespace: metal3
39+
spec:
40+
clusterName: test1
41+
namePrefix: test1-prov
42+
pools:
43+
- end: 172.22.0.200
44+
start: 172.22.0.100
45+
prefix: 24
46+
---
47+
apiVersion: ipam.metal3.io/v1alpha1
48+
kind: IPPool
49+
metadata:
50+
name: externalv4-pool
51+
namespace: metal3
52+
spec:
53+
clusterName: test1
54+
gateway: 192.168.111.1
55+
namePrefix: test1-bmv4
56+
pools:
57+
- end: 192.168.111.200
58+
start: 192.168.111.100
59+
prefix: 24

‎tests/roles/run_tests/files/manifests/v1beta1_controlplane_centos.yaml

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
apiVersion: controlplane.cluster.x-k8s.io/v1beta1
2+
kind: KubeadmControlPlane
3+
metadata:
4+
name: test1
5+
namespace: metal3
6+
spec:
7+
kubeadmConfigSpec:
8+
clusterConfiguration: {}
9+
files:
10+
- content: |
11+
#!/bin/bash
12+
set -e
13+
url="$1"
14+
dst="$2"
15+
filename="$(basename $url)"
16+
tmpfile="/tmp/$filename"
17+
curl -sSL -w "%{http_code}" "$url" | sed "s:/usr/bin:/usr/local/bin:g" > /tmp/"$filename"
18+
http_status=$(cat "$tmpfile" | tail -n 1)
19+
if [ "$http_status" != "200" ]; then
20+
echo "Error: unable to retrieve $filename file";
21+
exit 1;
22+
else
23+
cat "$tmpfile"| sed '$d' > "$dst";
24+
fi
25+
owner: root:root
26+
path: /usr/local/bin/retrieve.configuration.files.sh
27+
permissions: "0755"
28+
- content: |
29+
! Configuration File for keepalived
30+
31+
script k8s_api_check {
32+
script "curl -sk https://127.0.0.1:6443/healthz"
33+
interval 5
34+
timeout 5
35+
rise 3
36+
fall 3
37+
}
38+
39+
vrrp_instance VI_1 {
40+
state MASTER
41+
interface eth1
42+
virtual_router_id 1
43+
priority 101
44+
advert_int 1
45+
virtual_ipaddress {
46+
192.168.111.249
47+
}
48+
track_script {
49+
k8s_api_check
50+
}
51+
}
52+
path: /etc/keepalived/keepalived.conf
53+
- content: |
54+
[connection]
55+
id=eth0
56+
type=ethernet
57+
interface-name=eth0
58+
master=ironicendpoint
59+
slave-type=bridge
60+
owner: root:root
61+
path: /etc/NetworkManager/system-connections/eth0.nmconnection
62+
permissions: "0600"
63+
- content: |
64+
[connection]
65+
id=ironicendpoint
66+
interface-name=ironicendpoint
67+
type=bridge
68+
autoconnect=yes
69+
autoconnect-priority=1
70+
[bridge]
71+
interface-name=ironicendpoint
72+
stp=false
73+
[ipv4]
74+
address1={{ ds.meta_data.provisioningIP }}/{{ ds.meta_data.provisioningCIDR }}
75+
method=manual
76+
[ipv6]
77+
addr-gen-mode=eui64
78+
method=ignore
79+
owner: root:root
80+
path: /etc/NetworkManager/system-connections/ironicendpoint.nmconnection
81+
permissions: "0600"
82+
- content: |
83+
[kubernetes]
84+
name=Kubernetes
85+
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
86+
enabled=1
87+
gpgcheck=1
88+
repo_gpgcheck=0
89+
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
90+
owner: root:root
91+
path: /etc/yum.repos.d/kubernetes.repo
92+
permissions: "0644"
93+
- content: |
94+
[registries.search]
95+
registries = ['docker.io']
96+
97+
[registries.insecure]
98+
registries = ['192.168.111.1:5000']
99+
path: /etc/containers/registries.conf
100+
initConfiguration:
101+
nodeRegistration:
102+
kubeletExtraArgs:
103+
cgroup-driver: systemd
104+
container-runtime-endpoint: unix:///var/run/crio/crio.sock
105+
feature-gates: AllAlpha=false
106+
node-labels: metal3.io/uuid={{ ds.meta_data.uuid }}
107+
provider-id: metal3://{{ ds.meta_data.providerid }}
108+
runtime-request-timeout: 5m
109+
name: '{{ ds.meta_data.name }}'
110+
joinConfiguration:
111+
controlPlane: {}
112+
nodeRegistration:
113+
kubeletExtraArgs:
114+
cgroup-driver: systemd
115+
container-runtime-endpoint: unix:///var/run/crio/crio.sock
116+
feature-gates: AllAlpha=false
117+
node-labels: metal3.io/uuid={{ ds.meta_data.uuid }}
118+
provider-id: metal3://{{ ds.meta_data.providerid }}
119+
runtime-request-timeout: 5m
120+
name: '{{ ds.meta_data.name }}'
121+
postKubeadmCommands:
122+
- mkdir -p /home/metal3/.kube
123+
- chown metal3:metal3 /home/metal3/.kube
124+
- cp /etc/kubernetes/admin.conf /home/metal3/.kube/config
125+
- chown metal3:metal3 /home/metal3/.kube/config
126+
preKubeadmCommands:
127+
- systemctl restart NetworkManager.service
128+
- nmcli connection load /etc/NetworkManager/system-connections/ironicendpoint.nmconnection
129+
- nmcli connection up ironicendpoint
130+
- nmcli connection load /etc/NetworkManager/system-connections/eth0.nmconnection
131+
- nmcli connection up eth0
132+
- rm /etc/cni/net.d/*
133+
- systemctl enable --now keepalived
134+
- sleep 30
135+
- systemctl enable --now crio
136+
- sleep 30
137+
- systemctl enable --now kubelet
138+
- sleep 120
139+
users:
140+
- name: metal3
141+
sshAuthorizedKeys:
142+
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC/Xee3UwIcrrlYv9AR2fg++HYS8HhUqSVlOMY7Z44PH/2afG5eNgJy2n/5KhUBUSC6c/QnrduNAhnGcaa0tn6OYNEe+LPFIK9EJBTR2Ps7jY2CYuVcEVAo0OsfH6z4lwXx7Z7v2+4i0Azk1eICJKCJwu2QnkKiH2VQyR1h6/s88z1vPsk2I0LYHzCxDIc1tl279v9c0ytOQ+ZX2sbBQ1jBZChlijlPcwcvXozQJRb0Nn4J21m2spY0tRq9HRY4oUeCqig8SvXp4CwZcBLO3yFwR2EYQWWGKF/zEpvgp0QZA6ujpOddNP7fHjYk4Ct8/9f2SkZvvqZRiI/ZVhsryBC0mBhLibOX66qIZaNSO5qSnr/WUmuNeCEOUxlBBMSeBdHoJHpKXkMvB/LzkjFza6RzhNxBa3wiX07LIa4euR5eoObMiCFmgJYHA12/Lfn+GtszssomYvJjHuww8lPvBs1CtLky3GKWuWTQMOTt+p+Vd1HGMYD6bRZ7w5OJXvoL70U=
143+
erozada@adam-ubi
144+
sudo: ALL=(ALL) NOPASSWD:ALL
145+
machineTemplate:
146+
infrastructureRef:
147+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
148+
kind: Metal3MachineTemplate
149+
name: test1-controlplane
150+
nodeDrainTimeout: 0s
151+
replicas: 1
152+
rolloutStrategy:
153+
rollingUpdate:
154+
maxSurge: 1
155+
version: v1.32.0
156+
---
157+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
158+
kind: Metal3MachineTemplate
159+
metadata:
160+
name: test1-controlplane
161+
namespace: metal3
162+
spec:
163+
template:
164+
spec:
165+
dataTemplate:
166+
name: test1-controlplane-template
167+
image:
168+
checksum: http://172.22.0.1/images/CENTOS_9_NODE_IMAGE_K8S_v1.32.0-raw.img.sha256sum
169+
checksumType: sha256
170+
format: raw
171+
url: http://172.22.0.1/images/CENTOS_9_NODE_IMAGE_K8S_v1.32.0-raw.img
172+
---
173+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
174+
kind: Metal3DataTemplate
175+
metadata:
176+
name: test1-controlplane-template
177+
namespace: metal3
178+
spec:
179+
clusterName: test1
180+
metaData:
181+
ipAddressesFromIPPool:
182+
- key: provisioningIP
183+
name: provisioning-pool
184+
objectNames:
185+
- key: name
186+
object: machine
187+
- key: local-hostname
188+
object: machine
189+
- key: local_hostname
190+
object: machine
191+
prefixesFromIPPool:
192+
- key: provisioningCIDR
193+
name: provisioning-pool
194+
networkData:
195+
links:
196+
ethernets:
197+
- id: enp1s0
198+
macAddress:
199+
fromHostInterface: enp1s0
200+
type: phy
201+
- id: enp2s0
202+
macAddress:
203+
fromHostInterface: enp2s0
204+
type: phy
205+
networks:
206+
ipv4:
207+
- id: externalv4
208+
ipAddressFromIPPool: externalv4-pool
209+
link: enp2s0
210+
routes:
211+
- gateway:
212+
fromIPPool: externalv4-pool
213+
network: 0.0.0.0
214+
prefix: 0
215+
services:
216+
dns:
217+
- 8.8.8.8

0 commit comments

Comments
 (0)