msft-main: runtime: upgrade to CH v51.1

[Redent0r]

see commits for details.

CI: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1084733&view=results
bb: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1084750&view=results
image build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1084762&view=results
conformance: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1084823&view=results
performance: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1084825&view=results

[Copilot]

Pull request overview

Updates the Kata Containers Cloud Hypervisor (CLH) integration to align with Cloud Hypervisor v51.1.56, primarily by bumping the tracked version and regenerating the CLH OpenAPI spec + Go client bindings, with corresponding runtime adaptations.

Changes:

• Bump Cloud Hypervisor version reference to v51.1.56.
• Regenerate CLH OpenAPI specifications and Go client: add /vm.resize-disk, add new config fields (e.g., CPU nested, net offloads, disk image options), and remove SGX EPC from the client API surface.
• Update CLH runtime code to account for regenerated client changes (e.g., DiskConfig constructor signature, CPU nested handling, SGX EPC behavior).

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
versions.yaml	Bumps referenced Cloud Hypervisor version to v51.1.56.
src/runtime/virtcontainers/pkg/cloud-hypervisor/cloud-hypervisor.yaml	Updates the upstream OpenAPI schema used for client generation (new endpoint/fields, removed SGX EPC).
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/README.md	Regenerated client README to include new API/model entries (e.g., resize-disk).
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_vm_resize_disk.go	Adds generated model for disk resize requests.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_vm_config.go	Removes SGX EPC fields from generated VM config model.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_sgx_epc_config.go	Removes generated SGX EPC model (no longer present in spec).
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_platform_config.go	Adds platform iommu_address_width field support.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_numa_config.go	Updates NUMA config fields (removes SGX EPC sections, adds device_id).
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_net_config.go	Adds net offload flags and clarifies IP/mask descriptions.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_disk_config.go	Makes path optional/pointer, adjusts constructor, adds disk image options.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/model_cpus_config.go	Adds CPU nested option (default true) in generated model.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/VmResizeDisk.md	Adds generated docs for the new disk resize model.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/VmConfig.md	Regenerated docs reflecting removal of SGX EPC from VM config.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/SgxEpcConfig.md	Removes generated SGX EPC docs (no longer present in spec).
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/PlatformConfig.md	Regenerated docs for new platform fields.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/NumaConfig.md	Regenerated docs reflecting NUMA schema changes.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/NetConfig.md	Regenerated docs reflecting net schema changes and new offload fields.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DiskConfig.md	Regenerated docs reflecting disk schema/constructor changes.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md	Regenerated API docs to include /vm.resize-disk and updated examples.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/CpusConfig.md	Regenerated docs for new CPU nested field.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api/openapi.yaml	Updates the generated OpenAPI document used by the client.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/api_default.go	Adds generated client method for /vm.resize-disk.
src/runtime/virtcontainers/pkg/cloud-hypervisor/client/.openapi-generator/FILES	Updates generator manifest for added/removed generated files.
src/runtime/virtcontainers/clh.go	Adapts runtime to regenerated client APIs (DiskConfig changes, nested CPU handling, SGX EPC behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md:646

• The VmAddDiskPut example now constructs DiskConfig without setting path, which makes the snippet invalid/unclear for the common file-backed disk case. Consider updating the example to explicitly set the path (e.g., via diskConfig.SetPath(...)) or add a short note explaining when omitting path is valid (such as vhost-user).

    diskConfig := *openapiclient.NewDiskConfig() // DiskConfig | The details of the new disk

    configuration := openapiclient.NewConfiguration()
    api_client := openapiclient.NewAPIClient(configuration)
    resp, r, err := api_client.DefaultApi.VmAddDiskPut(context.Background()).DiskConfig(diskConfig).Execute()
    if err != nil {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Under mapping.test.names, all CI-on-push functional test entries are now commented out, leaving the test test-set with no required check names. If gatekeeper ever selects the test set (via path mapping or labels), it would be considered satisfied without actually running functional CI. Consider restoring the required check list (or moving it behind a clearly-scoped conditional config) rather than commenting out the entire set.

[Copilot]

mapping.build.names has been entirely commented out, so the build test-set no longer enforces any build artifacts/checks. If gatekeeper selects the build set, this would allow merges without validating that release artifacts can be produced. Consider reinstating these required checks or handling the msft-main CI naming/runner issue in a conditional way instead of disabling the gate.

Suggested change

	# - Kata Containers CI / kata-containers-ci-on-push / build-and-publish-tee-confidential-unencrypted-image
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (agent-ctl, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (cloud-hypervisor-glibc, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (cloud-hypervisor, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (firecracker, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kata-ctl, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel-dragonball-experimental, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel-nvidia-gpu, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (nydus, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (ovmf-sev, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (ovmf, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (qemu-snp-experimental, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (qemu, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (trace-forwarder, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (virtiofsd, test)
	# - Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / create-kata-tarball
	# - Kata Containers CI / kata-containers-ci-on-push / publish-kata-deploy-payload-amd64 / kata-payload
	- Kata Containers CI / kata-containers-ci-on-push / build-and-publish-tee-confidential-unencrypted-image
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (agent-ctl, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (cloud-hypervisor-glibc, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (cloud-hypervisor, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (firecracker, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kata-ctl, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel-dragonball-experimental, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel-nvidia-gpu, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (kernel, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (nydus, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (ovmf-sev, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (ovmf, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (qemu-snp-experimental, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (qemu, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (trace-forwarder, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / build-asset (virtiofsd, test)
	- Kata Containers CI / kata-containers-ci-on-push / build-kata-static-tarball-amd64 / create-kata-tarball
	- Kata Containers CI / kata-containers-ci-on-push / publish-kata-deploy-payload-amd64 / kata-payload

[Copilot]

The VmResizeDiskPut example assigns three return values (resp, r, err := ...Execute()), but the generated Execute() method for this endpoint returns only (*http.Response, error). Update the example to match the actual signature (capture only the HTTP response and error, or use _ appropriately) so it compiles.

[Copilot]

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md:646

• The VmAddDiskPut Go example now constructs DiskConfig with NewDiskConfig() but never sets either path (file-backed disk) or vhost_socket (vhost-user). As written, the request body is ambiguous and likely invalid for typical usage. Update the example to explicitly set the backing path (or show a vhost-user example) so it’s runnable.

func main() {
    diskConfig := *openapiclient.NewDiskConfig() // DiskConfig | The details of the new disk

    configuration := openapiclient.NewConfiguration()
    api_client := openapiclient.NewAPIClient(configuration)
    resp, r, err := api_client.DefaultApi.VmAddDiskPut(context.Background()).DiskConfig(diskConfig).Execute()
    if err != nil {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In the test test-set, all names: entries are now commented out, leaving the set effectively with no required CI jobs beyond the ok-to-test label. That means changes mapped to test can merge without any of the functional CI actually running. Consider re-enabling at least a minimal smoke/stability job (or using regexps: to match whichever replacement workflow is running on msft-main) so gatekeeper still enforces some execution signal while the full suite is fixed.

[Copilot]

The build test-set has all required CI names: commented out, so gatekeeper will not enforce that any build artifacts (static tarball, payload, etc.) are produced for changes mapped to build. If builds are intentionally disabled temporarily, consider removing/adjusting the paths: -> build mapping or adding a placeholder required job that always runs, to avoid accidental merges without build validation.

[Copilot]

chclient.NewCpusConfig() now initializes nested to true (and the generated client will serialize it), which changes the CreateVM payload compared to previous releases where this field did not exist. If nested virtualization should remain opt-in, consider explicitly setting nested=false here unless a user config enables it, rather than inheriting the OpenAPI default (and only overriding for MSHV).

Suggested change

	if pathExists("/dev/mshv") {
	// The nested property is true by default, but is not supported yet on MSHV.
	// Keep nested virtualization opt-in rather than inheriting the client default.
	clh.vmconfig.Cpus.SetNested(false)
	if pathExists("/dev/mshv") {
	// Nested virtualization is not supported yet on MSHV.

[Copilot]

Pull request overview

Copilot reviewed 35 out of 35 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/runtime/virtcontainers/pkg/cloud-hypervisor/client/docs/DefaultApi.md:646

• The VmAddDiskPut example now constructs DiskConfig with no fields set. In practice, adding a disk typically requires at least a backing path (or an alternative like vhost-user settings), so this example is likely to produce a failing request. Update the example to populate a valid minimal disk configuration (e.g., set path) or explicitly document when an empty DiskConfig is acceptable.

    diskConfig := *openapiclient.NewDiskConfig() // DiskConfig | The details of the new disk

    configuration := openapiclient.NewConfiguration()
    api_client := openapiclient.NewAPIClient(configuration)
    resp, r, err := api_client.DefaultApi.VmAddDiskPut(context.Background()).DiskConfig(diskConfig).Execute()
    if err != nil {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

mapping.test.names is currently left without any list items (only commented-out entries). YAML will parse this as null, so skips.py will not add any required CI jobs for the test feature set—effectively disabling functional test requirements while still requiring the ok-to-test label. If the intent is to temporarily require zero tests, make this explicit with names: [] (and consider whether required-labels should also be empty) to avoid accidental coverage loss and future type/validation issues.