Skip to content

Commit 5c4ebb4

Browse files
jianbingzhujianbingzhu
authored
Merge branch 'OpenVisualCloud:main' into 1ksession
2 parents 1727e71 + 9173407 commit 5c4ebb4

37 files changed

+4371
-390
lines changed

‎.github/workflows/codeql.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,10 @@ jobs:
6666

6767
# Initializes the CodeQL tools for scanning.
6868
- name: Initialize CodeQL
69-
uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
69+
uses: github/codeql-action/init@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
7070
with:
7171
languages: ${{ matrix.language }}
72-
config-file: ./.github/codeql/codeql-config.yml
72+
config-file: ${{github.workspace}}/.github/codeql/codeql-config.yml
7373
# If you wish to specify custom queries, you can do so here or in a config file.
7474
# By default, queries listed here will override any specified in a config file.
7575
# Prefix the list here with "+" to use these queries and those in the config file.
@@ -118,6 +118,6 @@ jobs:
118118
./build.sh
119119
120120
- name: Perform CodeQL Analysis
121-
uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
121+
uses: github/codeql-action/analyze@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
122122
with:
123123
category: "/language:${{matrix.language}}"

‎.github/workflows/scorecard.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
# - you want to enable the Branch-Protection check on a *public* repository, or
5151
# - you are installing Scorecard on a *private* repository
5252
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
53-
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
53+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
5454

5555
# Public repositories:
5656
# - Publish results to OpenSSF REST API for easy access by consumers
@@ -64,14 +64,14 @@ jobs:
6464
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6565
# format to the repository Actions tab.
6666
- name: "Upload artifact"
67-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
67+
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
6868
with:
6969
name: SARIF file
7070
path: results.sarif
7171
retention-days: 5
7272

7373
# Upload the results to GitHub's code scanning dashboard.
7474
- name: "Upload to code-scanning"
75-
uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
75+
uses: github/codeql-action/upload-sarif@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
7676
with:
7777
sarif_file: results.sarif

‎.github/workflows/trivy.yml

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Trivy
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
checkout_code:
12+
runs-on: ubuntu-20.04
13+
name: Checkout code
14+
steps:
15+
- name: Harden Runner
16+
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
17+
with:
18+
egress-policy: audit
19+
- name: Checkout code
20+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
21+
22+
scan_fs:
23+
runs-on: ubuntu-20.04
24+
needs: checkout_code
25+
permissions:
26+
contents: read # for actions/checkout to fetch code
27+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
28+
name: Scan FS
29+
steps:
30+
- name: Run Trivy vulnerability scanner for 'fs'
31+
uses: aquasecurity/trivy-action@91713af97dc80187565512baba96e4364e983601 # master
32+
with:
33+
scan-type: 'fs'
34+
ignore-unfixed: true
35+
format: 'sarif'
36+
output: 'trivy-results-fs.sarif'
37+
severity: 'CRITICAL,HIGH,MEDIUM'
38+
- name: Upload Trivy 'fs' scan results to GitHub Security tab
39+
uses: github/codeql-action/upload-sarif@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
40+
with:
41+
sarif_file: 'trivy-results-fs.sarif'
42+
43+
scan_config:
44+
runs-on: ubuntu-20.04
45+
needs: checkout_code
46+
permissions:
47+
contents: read # for actions/checkout to fetch code
48+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
49+
name: Scan Config
50+
steps:
51+
- name: Run Trivy vulnerability scanner for 'config'
52+
uses: aquasecurity/trivy-action@91713af97dc80187565512baba96e4364e983601 # master
53+
with:
54+
scan-type: 'config'
55+
hide-progress: false
56+
ignore-unfixed: true
57+
format: 'sarif'
58+
output: 'trivy-results-config.sarif'
59+
severity: 'CRITICAL,HIGH,MEDIUM'
60+
- name: Upload Trivy 'config' scan results to GitHub Security tab
61+
uses: github/codeql-action/upload-sarif@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
62+
with:
63+
sarif_file: 'trivy-results-config.sarif'

‎CMakeLists.txt

+3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ set(CMAKE_CXX_EXTENSIONS NO)
1515
set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} -s")
1616
set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -s")
1717

18+
# Disable RPATH
19+
set(CMAKE_SKIP_RPATH TRUE)
20+
1821
# setup components folders
1922
set(MCM_DIR ${CMAKE_CURRENT_SOURCE_DIR})
2023
set(MP_DIR ${CMAKE_CURRENT_SOURCE_DIR}/media-proxy)

‎deployment/DaemonSet/media-proxy-rx.yaml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: media-proxy-rx
5+
namespace: mcm
6+
labels:
7+
app: media-proxy-rx
8+
spec:
9+
selector:
10+
matchLabels:
11+
app: media-proxy-rx
12+
template:
13+
metadata:
14+
labels:
15+
app: media-proxy-rx
16+
spec:
17+
nodeSelector:
18+
node-role.kubernetes.io/worker: "true"
19+
mcm-type: rx
20+
containers:
21+
- name: media-proxy-rx
22+
image: mcm/media-proxy:latest
23+
imagePullPolicy: Never
24+
command: [ "media_proxy" ]
25+
args: [ "-d", "0000:31:11.5", "-i", "192.168.96.20" ]
26+
env:
27+
- name: NODE_NAME
28+
valueFrom:
29+
fieldRef:
30+
fieldPath: spec.nodeName
31+
resources:
32+
requests:
33+
cpu: 2
34+
memory: 4Gi
35+
limits:
36+
cpu: 2
37+
memory: 8Gi
38+
hugepages-2Mi: 1Gi
39+
hugepages-1Gi: 2Gi
40+
securityContext:
41+
privileged: true
42+
runAsUser: 0
43+
runAsGroup: 0
44+
ports:
45+
- containerPort: 8001
46+
hostPort: 8001
47+
protocol: TCP
48+
name: grpc-port
49+
- containerPort: 8002
50+
hostPort: 8002
51+
protocol: TCP
52+
name: sdk-port
53+
volumeMounts:
54+
- name: memif-dir # Using hostPath volume
55+
mountPath: /run/mcm # Mount path in the pod
56+
- name: dev-vfio
57+
mountPath: /dev/vfio
58+
- mountPath: /hugepages-2Mi
59+
name: hugepage-2mi
60+
- mountPath: /hugepages-1Gi
61+
name: hugepage-1gi
62+
- mountPath: /dev/shm
63+
name: cache-volume
64+
- name: imtl-mgr # Communicate with IMTL manager
65+
mountPath: /var/run/imtl # Mount path in the pod
66+
volumes:
67+
- name: memif-dir # Using hostPath volume
68+
hostPath:
69+
path: /tmp/mcm/memif
70+
- name: dev-vfio
71+
hostPath:
72+
path: /dev/vfio
73+
- name: hugepage-2mi
74+
emptyDir:
75+
medium: HugePages-2Mi
76+
- name: hugepage-1gi
77+
emptyDir:
78+
medium: HugePages-1Gi
79+
- name: cache-volume
80+
emptyDir:
81+
medium: Memory
82+
sizeLimit: 4Gi
83+
- name: imtl-mgr
84+
persistentVolumeClaim:
85+
claimName: imtl-pvc

‎deployment/DaemonSet/media-proxy-tx.yaml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: media-proxy-tx
5+
namespace: mcm
6+
labels:
7+
app: media-proxy-tx
8+
spec:
9+
selector:
10+
matchLabels:
11+
app: media-proxy-tx
12+
template:
13+
metadata:
14+
labels:
15+
app: media-proxy-tx
16+
spec:
17+
nodeSelector:
18+
node-role.kubernetes.io/worker: "true"
19+
mcm-type: tx
20+
containers:
21+
- name: media-proxy-tx
22+
image: mcm/media-proxy:latest
23+
imagePullPolicy: Never
24+
command: [ "media_proxy" ]
25+
args: [ "-d", "0000:31:01.5", "-i", "192.168.96.10" ]
26+
env:
27+
- name: NODE_NAME
28+
valueFrom:
29+
fieldRef:
30+
fieldPath: spec.nodeName
31+
resources:
32+
requests:
33+
cpu: 2
34+
memory: 4Gi
35+
limits:
36+
cpu: 2
37+
memory: 8Gi
38+
hugepages-2Mi: 1Gi
39+
hugepages-1Gi: 2Gi
40+
securityContext:
41+
privileged: true
42+
runAsUser: 0
43+
runAsGroup: 0
44+
ports:
45+
- containerPort: 8001
46+
hostPort: 8001
47+
protocol: TCP
48+
name: grpc-port
49+
- containerPort: 8002
50+
hostPort: 8002
51+
protocol: TCP
52+
name: sdk-port
53+
volumeMounts:
54+
- name: memif-dir # Using hostPath volume
55+
mountPath: /run/mcm # Mount path in the pod
56+
- name: dev-vfio
57+
mountPath: /dev/vfio
58+
- mountPath: /hugepages-2Mi
59+
name: hugepage-2mi
60+
- mountPath: /hugepages-1Gi
61+
name: hugepage-1gi
62+
- mountPath: /dev/shm
63+
name: cache-volume
64+
- name: imtl-mgr # Communicate with IMTL manager
65+
mountPath: /var/run/imtl # Mount path in the pod
66+
volumes:
67+
- name: memif-dir # Using hostPath volume
68+
hostPath:
69+
path: /tmp/mcm/memif
70+
- name: dev-vfio
71+
hostPath:
72+
path: /dev/vfio
73+
- name: hugepage-2mi
74+
emptyDir:
75+
medium: HugePages-2Mi
76+
- name: hugepage-1gi
77+
emptyDir:
78+
medium: HugePages-1Gi
79+
- name: cache-volume
80+
emptyDir:
81+
medium: Memory
82+
sizeLimit: 4Gi
83+
- name: imtl-mgr
84+
persistentVolumeClaim:
85+
claimName: imtl-pvc

‎deployment/DaemonSet/media-proxy.yaml

+30-24
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,3 @@
1-
apiVersion: v1
2-
kind: Namespace
3-
metadata:
4-
name: mcm
5-
---
6-
apiVersion: v1
7-
kind: PersistentVolumeClaim
8-
metadata:
9-
name: memif-socket-fs
10-
namespace: mcm
11-
spec:
12-
accessModes:
13-
- ReadWriteOnce
14-
resources:
15-
requests:
16-
storage: 64Mi
17-
---
181
apiVersion: apps/v1
192
kind: DaemonSet
203
metadata:
@@ -32,17 +15,26 @@ spec:
3215
app: media-proxy
3316
spec:
3417
nodeSelector:
35-
node-role.mcm.intel.com/worker: "true"
18+
node-role.kubernetes.io/worker: "true"
3619
containers:
3720
- name: media-proxy
3821
image: mcm/media-proxy:latest
3922
imagePullPolicy: Never
40-
command: [ "media_proxy" ]
4123
env:
4224
- name: NODE_NAME
4325
valueFrom:
4426
fieldRef:
4527
fieldPath: spec.nodeName
28+
- name: NODE_IP
29+
valueFrom:
30+
fieldRef:
31+
fieldPath: status.hostIP
32+
- name: POD_IP
33+
valueFrom:
34+
fieldRef:
35+
fieldPath: status.podIP
36+
command: [ "media_proxy" ]
37+
args: [ "-d", "kernel:eth0", "-i", $(POD_IP) ]
4638
resources:
4739
limits:
4840
cpu: 2
@@ -53,9 +45,18 @@ spec:
5345
privileged: true
5446
runAsUser: 0
5547
runAsGroup: 0
48+
ports:
49+
- containerPort: 8001
50+
hostPort: 8001
51+
protocol: TCP
52+
name: grpc-port
53+
- containerPort: 8002
54+
hostPort: 8002
55+
protocol: TCP
56+
name: sdk-port
5657
volumeMounts:
57-
- name: memif-socket
58-
mountPath: /run/mcm
58+
- name: memif-dir # Using hostPath volume
59+
mountPath: /run/mcm # Mount path in the pod
5960
- name: dev-vfio
6061
mountPath: /dev/vfio
6162
- mountPath: /hugepages-2Mi
@@ -64,10 +65,12 @@ spec:
6465
name: hugepage-1gi
6566
- mountPath: /dev/shm
6667
name: cache-volume
68+
- name: imtl-mgr # Communicate with IMTL manager
69+
mountPath: /var/run/imtl # Mount path in the pod
6770
volumes:
68-
- name: memif-socket
69-
persistentVolumeClaim:
70-
claimName: memif-socket-fs
71+
- name: memif-dir # Using hostPath volume
72+
hostPath:
73+
path: /tmp/mcm/memif
7174
- name: dev-vfio
7275
hostPath:
7376
# Do not mount the top-level /dev/ directory for security reasons.
@@ -83,3 +86,6 @@ spec:
8386
emptyDir:
8487
medium: Memory
8588
sizeLimit: 4Gi
89+
- name: imtl-mgr
90+
persistentVolumeClaim:
91+
claimName: imtl-pvc

0 commit comments

Comments
 (0)