feat(urunc-deploy): ship hluk and install it on the nodes

.github/workflows/urunc-deploy-test.yml

@@ -161,6 +161,7 @@ jobs:
         run: |
           docker exec urunc-deploy-test-control-plane ls -la /usr/local/bin/urunc || exit 1
           docker exec urunc-deploy-test-control-plane ls -la /usr/local/bin/containerd-shim-urunc-v2 || exit 1
+          docker exec urunc-deploy-test-control-plane ls -la /opt/urunc/bin/hluk || exit 1
 
       - name: Deploy nginx-spt unikernel (arm64)
         if: matrix.arch == 'arm64'
@@ -228,6 +229,36 @@ jobs:
           cat /tmp/logs.txt
           kubectl describe pod httpreply-fc-amd64 || true
 
+      - name: Deploy hello-hyperlight-unikraft unikernel (amd64)
+        if: matrix.arch == 'amd64'
+        run: |
+          cat <<EOF | kubectl apply -f -
+            apiVersion: v1
+            kind: Pod
+            metadata:
+              name: hello-hyperlight-amd64
+              labels:
+                run: hello-hyperlight-amd64
+            spec:
+              runtimeClassName: urunc
+              restartPolicy: Never
+              containers:
+                - name: hello-hyperlight
+                  image: docker.io/urunc/hello-hyperlight-unikraft:v0.18.0
+                  imagePullPolicy: Always
+                  resources:
+                    requests:
+                      cpu: 10m
+          EOF
+
+      - name: Verify hello-hyperlight-unikraft deployment (amd64)
+        if: matrix.arch == 'amd64'
+        run: |
+          kubectl wait --for=jsonpath='{.status.phase}'=Succeeded pod/hello-hyperlight-amd64 --timeout=180s || true
+          kubectl describe pod hello-hyperlight-amd64 || true
+          kubectl logs hello-hyperlight-amd64 | tee /tmp/logs-hyperlight.txt || true
+          grep -q "hello from Python" /tmp/logs-hyperlight.txt
+
       - name: Uninstall urunc-deploy DaemonSet
         run: |
           docker exec urunc-deploy-test-control-plane \

deployment/urunc-deploy/Dockerfile

@@ -74,6 +74,27 @@ RUN ARCH=$(uname -m) && \
 WORKDIR /artifacts
 RUN cp /cloud-hypervisor .
 
+FROM alpine:3.21@sha256:b6a6be0ff92ab6db8acd94f5d1b7a6c2f0f5d10ce3c24af348d333ac6da80685 AS hluk-builder
+RUN apk update && apk add --no-cache curl tar
+# hluk, the monitor of Hyperlight guests, embeds the Unikraft kernel it boots
+# and its Linux releases are static binaries, so the release tarball is all a
+# node needs. The download is checked against the checksums of the release.
+# Images built for one hluk release do not run on another, so this version
+# moves together with HLUK_VERSION in vm_test.yml, hyperlight-unikraft in
+# docs/variables/versions.yml and the image tag in urunc-deploy-test.yml.
+ARG HLUK_VERSION=v0.18.0
+RUN ARCH=$(uname -m) && \
+    VERSION="${HLUK_VERSION}" && \
+    RELEASE_URL="https://github.com/hyperlight-dev/hyperlight-unikraft/releases" && \
+    ASSET="hluk-${VERSION}-${ARCH}-unknown-linux-musl.tar.gz" && \
+    curl -fL -o "${ASSET}" "${RELEASE_URL}/download/${VERSION}/${ASSET}" && \
+    curl -fL -o SHA256SUMS "${RELEASE_URL}/download/${VERSION}/SHA256SUMS" && \
+    grep " ${ASSET}\$" SHA256SUMS | sha256sum -c - && \
+    tar xzf "${ASSET}" && \
+    test -x hluk
+WORKDIR /artifacts
+RUN cp /hluk .
+
 FROM quay.io/kata-containers/kata-deploy:3.15.0@sha256:fbab8bdbe910b52cf9396261f887f894cd3e71f86abe68ec11595ab7628b4a10 AS qemu-builder
 WORKDIR /artifacts
 RUN ARCH=$(uname -m) && \
@@ -88,6 +109,7 @@ COPY --from=qemu-builder /opt/kata-artifacts/opt/kata/share/kata-qemu/qemu /urun
 COPY --from=qemu-builder /opt/kata-artifacts/opt/kata/libexec/virtiofsd /urunc-artifacts/libexec/virtiofsd
 COPY --from=firecracker-builder /artifacts /urunc-artifacts/hypervisors
 COPY --from=cloud-hypervisor-builder /artifacts /urunc-artifacts/hypervisors
+COPY --from=hluk-builder /artifacts /urunc-artifacts/hypervisors
 COPY --from=urunc-builder /artifacts/dist /urunc-artifacts
 
 RUN apk update && \

deployment/urunc-deploy/config.toml

@@ -45,6 +45,7 @@ path = "/opt/urunc/bin/solo5-hvt"
 [monitors.hyperlight-unikraft]
 default_memory_mb = 256
 default_vcpus = 1
+path = "/opt/urunc/bin/hluk"
 
 [extra_binaries.virtiofsd]
 path = "/opt/urunc/libexec/virtiofsd"

deployment/urunc-deploy/scripts/install.sh

@@ -62,7 +62,7 @@ container_runtime_version_file="${urunc_install_dir}/container-runtime-version"
 # Configurable keys discovered from config.toml
 urunc_config_keys=""
 
-HYPERVISORS="${HYPERVISORS:-"firecracker cloud-hypervisor qemu solo5-hvt solo5-spt"}"
+HYPERVISORS="${HYPERVISORS:-"firecracker cloud-hypervisor qemu solo5-hvt solo5-spt hluk"}"
 IFS=' ' read -a hypervisors <<< "$HYPERVISORS"
 
 function host_systemctl() {
@@ -120,6 +120,10 @@ function install_artifacts() {
             echo "Installing solo5-hvt"
             install_artifact /urunc-artifacts/hypervisors/solo5-hvt /host${urunc_bin_dir}/solo5-hvt
             ;;
+        hluk)
+            echo "Installing hluk"
+            install_artifact /urunc-artifacts/hypervisors/hluk /host${urunc_bin_dir}/hluk
+            ;;
         *)
             echo "Unsupported hypervisor: $hypervisor"
             ;;
@@ -276,6 +280,13 @@ function install_urunc_config() {
     echo "Installing urunc configuration file"
     mkdir -p /host${urunc_config_dir}
     sed "s|qemu-system-x86_64|qemu-system-$(uname -m)|" /deployment/config.toml > /host${urunc_config_file}
+    # The path of hluk is only kept when urunc-deploy installed it: until now
+    # hluk went on the PATH by hand, and a configured path that does not exist
+    # would hide a binary that does. URUNC_MONITORS_HYPERLIGHT_UNIKRAFT_PATH
+    # still sets it either way.
+    if ! printf '%s\n' "${hypervisors[@]}" | grep -qx hluk; then
+        sed -i '\|^path = "/opt/urunc/bin/hluk"$|d' /host${urunc_config_file}
+    fi
     override_urunc_config_from_env "/host${urunc_config_file}"
     echo "urunc configuration file installed at ${urunc_config_file}"
 }

deployment/urunc-deploy/urunc-deploy/base/urunc-deploy.yaml

@@ -48,7 +48,7 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: HYPERVISORS
-              value: "firecracker cloud-hypervisor qemu solo5-hvt solo5-spt"
+              value: "firecracker cloud-hypervisor qemu solo5-hvt solo5-spt hluk"
             - name: DEBUG
               value: "false"
             # Optional overrides for /etc/urunc/config.toml. Any URUNC_* variable

docs/hypervisor-support.md

@@ -298,6 +298,11 @@ install it:
 sudo install -m0755 hluk /usr/local/bin/hluk
 ```
 
+On Kubernetes, [`urunc-deploy`](../tutorials/How-to-urunc-on-k8s#urunc-deploy)
+ships `hluk` and, with `hluk` in its `HYPERVISORS` list as it is by default,
+installs it on every node under `/opt/urunc/bin` and points the configuration
+it writes at it, so there is nothing to install by hand.
+
 #### Hyperlight and `urunc`
 
 In the case of [Hyperlight](https://github.com/hyperlight-dev/hyperlight),

docs/tutorials/How-to-urunc-on-k8s.md

@@ -230,7 +230,9 @@ During installation, the following steps take place:
 - The `urunc-deploy` Pod is deployed with privileges on the host, and the `containerd` configuration is mounted inside the Pod.
 - `urunc-deploy` performs the following tasks:
     * Copies `urunc` and `containerd-shim-urunc-v2` binaries to the host under `/usr/local/bin`.
-    * Copies hypervisor binaries to the host under `/opt/urunc/bin`.
+    * Copies the hypervisor binaries to the host under `/opt/urunc/bin`. The
+      `HYPERVISORS` environment variable of the DaemonSet names the ones to
+      install, all of them by default.
     * Copies QEMU data files to `/opt/urunc/share`.
     * Installs a configuration file at `/etc/urunc/config.toml`.
     * Registers `urunc` as a `containerd` runtime: with containerd 2.x through a