Skip to content

Commit c41641a

Browse files
ayuskauskasayuskauskas
committed
feat: initial push
0 parents  commit c41641a

File tree

14 files changed

+732
-0
lines changed

14 files changed

+732
-0
lines changed

‎.github/workflows/build_container.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#
2+
name: Create and publish a Skyhook Package
3+
4+
# Configures this workflow to run every time a change is pushed to the branch called `release`.
5+
on:
6+
push:
7+
tags:
8+
9+
10+
# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
11+
env:
12+
REGISTRY: ghcr.io
13+
IMAGE_NAME: ${{ github.repository }}
14+
15+
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
16+
jobs:
17+
build-and-push-image:
18+
runs-on: ubuntu-latest
19+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
20+
permissions:
21+
contents: read
22+
packages: write
23+
attestations: write
24+
id-token: write
25+
#
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@v4
29+
# Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
30+
- name: Log in to the Container registry
31+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
32+
with:
33+
registry: ${{ env.REGISTRY }}
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
- name: Setup env vars
37+
run: echo "PACKAGE_NAME=$(echo "${{ github.ref_name }}" | sed 's;refs/tags;;g'| cut -f 1 -d /)" >> $GITHUB_ENV
38+
# This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
39+
- name: Extract metadata (tags, labels) for Docker
40+
id: meta
41+
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
42+
with:
43+
images: ${{ env.REGISTRY }}/skyhook-packages/${{ env.PACKAGE_NAME }}
44+
tags: |
45+
type=match,pattern=\d.\d.\d
46+
# This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
47+
# It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see [Usage](https://github.com/docker/build-push-action#usage) in the README of the `docker/build-push-action` repository.
48+
# It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
49+
- name: Build and push Docker image
50+
id: push
51+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
52+
with:
53+
context: .
54+
push: true
55+
tags: ${{ steps.meta.outputs.tags }}
56+
labels: ${{ steps.meta.outputs.labels }}
57+
platform: linux/amd64,linux/arm64
58+
59+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
60+
- name: Generate artifact attestation
61+
uses: actions/attest-build-provenance@v2
62+
with:
63+
subject-name: ${{ env.REGISTRY }}/skyhook-packages/${{ env.PACKAGE_NAME }}
64+
subject-digest: ${{ steps.push.outputs.digest }}
65+
push-to-registry: true
66+

‎README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Package Structure
2+
```
3+
[package name]
4+
|- skyhook_dir
5+
| |- ...
6+
|- root_dir
7+
| |- ...
8+
|- config.json
9+
|- Dockerfile
10+
```
11+
12+
## skyhook_dir
13+
The `skyhook_dir` should contain any scripts you will use in your steps as well as any static files your scripts might want to reference.
14+
15+
## root_dir
16+
The `root_dir` will be copied into the root filesystem directly. For example a root_dir structure of:
17+
```
18+
root_dir
19+
|- etc
20+
|- hosts
21+
```
22+
Would overwrite the /etc/hosts file on the node it was run on.
23+
24+
## config.json
25+
This is the configuration file for the package and must match the [skyhook agent schema](github.com/nvidia/skyhook/...)
26+
27+
## Dockerfile
28+
Copy the `skyhook_dir`, `root_dir` and `config.json` to `/skyhook-package`
29+
30+
# Building a package
31+
1. `docker buildx create builder`
32+
2. `docker buildx build -t {package}:{tag} -f {dockerfile} --platform={','.join(f'linux/{arch}' for arch in architectures)} --push {package directory}"`
33+
34+
# Repository Rules
35+
* All commits MUST be in a conventional commit format with the package name as the object. If it is NOT for a package then it should be prefixed with `general/` Examples:
36+
* feat(shellscript): Add support for uninstall
37+
* fix(tuning): Post-interrupt check for containerd changes did not allow of infinity setting
38+
* docs(general/ci): Update the main README.md for how CI works
39+
* Tags are 1:1 with a package. In the format `{package}/{version}`
40+
* Versions of packages MUST be [semver](https://semver.org/)
41+
* CI builds packages on tag

‎shellscript/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
FROM busybox:latest
2+
3+
RUN mkdir -p /skyhook-package/skyhook_dir
4+
COPY . /skyhook-package

‎shellscript/README.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
This Skyhook Package allows you to run arbitrary bash scripts defined in your Skyhook Custom Resource.
2+
3+
# Example package configuration
4+
```
5+
example:
6+
version: 1.0.0
7+
image: nvcr.io/skyhook/shellscript
8+
configMap:
9+
apply.sh: |-
10+
#!/bin/bash
11+
echo "hello world" > /skyhook-hello-world
12+
sleep 60
13+
apply_check.sh: |-
14+
#!/bin/bash
15+
cat /skyhook-hello-world
16+
sleep 30
17+
config.sh: |-
18+
#!/bin/bash
19+
echo "a config is run" >> /skyhook-hello-world
20+
sleep 60
21+
config_check.sh: |-
22+
#!/bin/bash
23+
grep "config" /skyhook-hello-world
24+
sleep 30
25+
```

‎shellscript/config.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"schema_version": "v1",
3+
"package_name": "shellscript",
4+
"package_version": "1.0.0",
5+
"expected_config_files": [],
6+
"modes": {
7+
"apply": [
8+
{
9+
"name": "apply",
10+
"path": "shellscript_run.sh",
11+
"arguments": ["apply"],
12+
"returncodes": [
13+
0
14+
],
15+
"on_host": true,
16+
"env": {},
17+
"idempotence": true,
18+
"upgrade_step": false
19+
}
20+
],
21+
"apply-check": [
22+
{
23+
"name": "apply-check",
24+
"path": "shellscript_run.sh",
25+
"arguments": ["apply_check"],
26+
"returncodes": [
27+
0
28+
],
29+
"on_host": true,
30+
"env": {},
31+
"idempotence": true,
32+
"upgrade_step": false
33+
}
34+
],
35+
"config": [
36+
{
37+
"name": "config",
38+
"path": "shellscript_run.sh",
39+
"arguments": ["config"],
40+
"returncodes": [
41+
0
42+
],
43+
"on_host": true,
44+
"env": {},
45+
"idempotence": true,
46+
"upgrade_step": false
47+
}
48+
],
49+
"config-check": [
50+
{
51+
"name": "config-check",
52+
"path": "shellscript_run.sh",
53+
"arguments": ["config_check"],
54+
"returncodes": [
55+
0
56+
],
57+
"on_host": true,
58+
"env": {},
59+
"idempotence": true,
60+
"upgrade_step": false
61+
}
62+
],
63+
"post-interrupt": [
64+
{
65+
"name": "post-interrupt",
66+
"path": "shellscript_run.sh",
67+
"arguments": ["uninstall"],
68+
"returncodes": [
69+
0
70+
],
71+
"on_host": true,
72+
"env": {},
73+
"idempotence": true,
74+
"upgrade_step": false
75+
}
76+
],
77+
"post-interrupt-check": [
78+
{
79+
"name": "uninstall-check",
80+
"path": "shellscript_run.sh",
81+
"arguments": ["uninstall_check"],
82+
"returncodes": [
83+
0
84+
],
85+
"on_host": true,
86+
"env": {},
87+
"idempotence": true,
88+
"upgrade_step": false
89+
}
90+
],
91+
"uninstall": [
92+
{
93+
"name": "uninstall",
94+
"path": "shellscript_run.sh",
95+
"arguments": ["uninstall"],
96+
"returncodes": [
97+
0
98+
],
99+
"on_host": true,
100+
"env": {},
101+
"idempotence": true,
102+
"upgrade_step": false
103+
}
104+
],
105+
"uninstall-check": [
106+
{
107+
"name": "uninstall-check",
108+
"path": "shellscript_run.sh",
109+
"arguments": ["uninstall_check"],
110+
"returncodes": [
111+
0
112+
],
113+
"on_host": true,
114+
"env": {},
115+
"idempotence": true,
116+
"upgrade_step": false
117+
}
118+
]
119+
}
120+
}

‎shellscript/skyhook_dir/shellscript_run.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
# SPDX-FileCopyrightText: Copyright (c) 2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
6+
file=$1
7+
8+
if [ -f ${SKYHOOK_DIR}/configmaps/${file}.sh ]; then
9+
. ${SKYHOOK_DIR}/configmaps/${file}.sh
10+
else
11+
echo "Could not find file ${SKYHOOK_DIR}/configmaps/${file}.sh was this in the configmap?"
12+
fi

‎tuning/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
FROM busybox:latest
2+
3+
RUN mkdir -p /skyhook-package/skyhook_dir
4+
COPY . /skyhook-package

‎tuning/README.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
Use configmaps to set:
2+
* service settings
3+
* Requires a restart_all_services interrupt
4+
* Or a restart of the service changed
5+
* ulimit settings
6+
* No interrupt required
7+
* container limit settings (ulimits as seen by containers)
8+
* requires a reboot interrupt
9+
* grub configuration
10+
* requires a reboot interrupt
11+
12+
All changes are made via a drop-in file so they can be uninstalled later without conflicts with other things that might alter the same setting.
13+
14+
# Supported configmaps
15+
* `grub.conf` - This will be used to set grub. The format is one line per argumennt which are turned into space separated values for `GRUB_CMDLINE_LINUX_DEFAULT`. Suggested to use a reboot so changes are applied
16+
* `sysctl.conf` - This will be set into `/etc/systctl.d`. Suggested to use a reboot or restart_all_services to ensure changes are picked up
17+
* `ulimit.conf` - This set a drop in file in /etc/security/limits.d. It also can call ulimit directly for the following values:
18+
* memlock
19+
* nofile
20+
* fsize
21+
* stack
22+
* nproc
23+
* `service_{service name}.conf` - This will make a drop-in file in `/etc/systemd/system/{service name}.service.d`. Suggested to use a service restart for this service. `systemctl daemon-reload` is called for you if any are set.
24+
25+
## Special service config files
26+
If you use `service_containerd.conf` or `service_crio.conf` post-interrupt check will do a further validation on the settings. If the following lines are in your configmap:
27+
* LimitNOFILE
28+
* LimitFSIZE
29+
* LimitSTACK
30+
* LimitNPROC
31+
* LimitMEMLOCK
32+
It will use ulimit to check that the expected value is actually set. Note: for `LimitSTACK` and `LimitMEMLOCK` it compares against expected_value/1024 due to formatting output of the ulimit call.
33+
34+
35+
# Example Skyhook Custom Resource
36+
Update grub and sysctl.
37+
Use main reboot interrupt for the first apply.
38+
Specify different interrupts for the configmap interrupts to apply a more limited one depending on which one changes.
39+
```yaml
40+
tuning:
41+
version: 1.0.0
42+
image: nvcr.io/skyhook/tuning:1.0.0
43+
interrupt:
44+
type: reboot
45+
configInterrupts:
46+
grub.conf:
47+
type: reboot
48+
sysctl.conf:
49+
type: restart_all_services
50+
configMap:
51+
grub.conf: |-
52+
hugepagesz=1G
53+
hugepages=2
54+
hugepagesz=2M
55+
hugepages=5128
56+
sysctl.conf: |-
57+
fs.inotify.max_user_instances=65535
58+
fs.inotify.max_user_watches=524288
59+
kernel.threads-max=16512444
60+
vm.max_map_count=262144
61+
vm.min_free_kbytes=65536
62+
ulimit.conf: |-
63+
memlock: 128
64+
fsize: 1000
65+
```
66+
67+
Update just sysctl
68+
```yaml
69+
tuning:
70+
version: 1.0.0
71+
image: nvcr.io/skyhook/tuning:1.0.0
72+
interrupt:
73+
type: restart_all_services
74+
configMap:
75+
sysctl.conf: |-
76+
fs.inotify.max_user_instances=65535
77+
fs.inotify.max_user_watches=524288
78+
kernel.threads-max=16512444
79+
vm.max_map_count=262144
80+
vm.min_free_kbytes=65536
81+
```
82+
83+
Update containerd stack size
84+
```yaml
85+
tuning:
86+
version: 1.0.0
87+
image: nvcr.io/skyhook/tuning:1.0.0
88+
interrupt:
89+
type: service
90+
services:
91+
- containerd
92+
configMap:
93+
service_containerd.conf: |-
94+
[Service]
95+
LimitSTACK=67108864
96+
LimitMEMLOCK=infinity
97+
```
98+

0 commit comments

Comments
 (0)