归档：Kata / microVM runner 实验（2026-09-17 工作区快照）

从旧工作区 chore/recover-old-workspace 清理时保存，内容与 2026-09-17 stash@{0} 快照中的版本一致；未合并、未在 main 上使用，仅作参考，不开 PR。被 gitignore 的 tfstate 与凭据文件不在此分支，仍留在本地工作区。 Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-01 17:30:48 +00:00
parent 69d3476a6b
commit 55bb5be8b6
39 changed files with 1891 additions and 0 deletions
@@ -0,0 +1,125 @@
+---
+- name: Verify Kata isolation with a disposable Pod
+  hosts: kata-lab
+  gather_facts: false
+  tasks:
+    - name: Remove an earlier smoke Pod
+      ansible.builtin.command:
+        cmd: k3s kubectl delete pod kata-smoke --ignore-not-found --wait=true
+      changed_when: false
+
+    - name: Create the Kata smoke Pod
+      ansible.builtin.shell:
+        cmd: |
+          set -o pipefail
+          k3s kubectl apply -f - <<'EOF'
+          apiVersion: v1
+          kind: Pod
+          metadata:
+            name: kata-smoke
+          spec:
+            runtimeClassName: kata
+            restartPolicy: Never
+            containers:
+              - name: smoke
+                image: docker.io/library/busybox:1.37
+                command:
+                  - sh
+                  - -c
+                  - 'printf "guest-kernel="; uname -r; test -c /dev/kvm && exit 1 || true'
+          EOF
+        executable: /bin/bash
+      changed_when: true
+
+    - name: Wait for the Kata Pod to finish
+      ansible.builtin.command:
+        cmd: k3s kubectl wait --for=jsonpath='{.status.phase}'=Succeeded pod/kata-smoke --timeout=10m
+      changed_when: false
+
+    - name: Read the guest kernel version
+      ansible.builtin.command:
+        cmd: k3s kubectl logs kata-smoke
+      register: kata_smoke_log
+      changed_when: false
+
+    - name: Read the host kernel version
+      ansible.builtin.command:
+        cmd: uname -r
+      register: kata_host_kernel
+      changed_when: false
+
+    - name: Require a distinct guest kernel
+      ansible.builtin.assert:
+        that:
+          - kata_smoke_log.stdout is match('^guest-kernel=.+')
+          - kata_smoke_log.stdout | regex_replace('^guest-kernel=', '') != kata_host_kernel.stdout
+        success_msg: >-
+          Kata guest {{ kata_smoke_log.stdout }} differs from host-kernel={{ kata_host_kernel.stdout }}
+
+    - name: Remove an earlier Docker sidecar smoke Pod
+      ansible.builtin.command:
+        cmd: k3s kubectl delete pod kata-docker-smoke --ignore-not-found --wait=true
+      changed_when: false
+
+    - name: Create a Kata Pod with a Docker daemon sidecar
+      ansible.builtin.shell:
+        cmd: |
+          set -o pipefail
+          k3s kubectl apply -f - <<'EOF'
+          apiVersion: v1
+          kind: Pod
+          metadata:
+            name: kata-docker-smoke
+          spec:
+            runtimeClassName: kata
+            restartPolicy: Never
+            volumes:
+              - name: docker-run
+                emptyDir: {}
+            containers:
+              - name: dockerd
+                image: docker.io/library/docker:27-dind
+                securityContext:
+                  privileged: true
+                env:
+                  - name: DOCKER_TLS_CERTDIR
+                    value: ""
+                volumeMounts:
+                  - name: docker-run
+                    mountPath: /var/run
+              - name: client
+                image: docker.io/library/docker:27-cli
+                env:
+                  - name: DOCKER_HOST
+                    value: tcp://127.0.0.1:2375
+                volumeMounts:
+                  - name: docker-run
+                    mountPath: /var/run
+                command:
+                  - sh
+                  - -c
+                  - |
+                    until docker info >/dev/null 2>&1; do sleep 1; done
+                    docker run --rm docker.io/library/busybox:1.37 echo nested-docker-ok
+          EOF
+        executable: /bin/bash
+      changed_when: true
+
+    - name: Wait for the Docker client to finish
+      ansible.builtin.command:
+        cmd: >-
+          k3s kubectl wait --for=jsonpath='{.status.containerStatuses[?(@.name=="client")].state.terminated.exitCode}'=0
+          pod/kata-docker-smoke --timeout=10m
+      changed_when: false
+
+    - name: Read the Docker client result
+      ansible.builtin.command:
+        cmd: k3s kubectl logs kata-docker-smoke -c client
+      register: kata_docker_smoke_log
+      changed_when: false
+
+    - name: Require Docker to run a nested container
+      ansible.builtin.assert:
+        that:
+          - "'nested-docker-ok' in kata_docker_smoke_log.stdout"
+        success_msg: Docker daemon sidecar completed a nested container inside the Kata VM