4.13. kmod イメージのビルドと署名

前提条件

• keySecret および certSecret シークレットが、残りのリソースと同じ namespace に作成されている。

手順

• YAML ファイルを適用します。

  Copy to Clipboard Toggle word wrap

  ---
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: example-module-dockerfile
    namespace: <namespace> 

  1

  
  data:
    Dockerfile: |
      ARG DTK_AUTO
      ARG KERNEL_VERSION
      FROM ${DTK_AUTO} as builder
      WORKDIR /build/
      RUN git clone -b main --single-branch https://github.com/rh-ecosystem-edge/kernel-module-management.git
      WORKDIR kernel-module-management/ci/kmm-kmod/
      RUN make
      FROM registry.access.redhat.com/ubi9/ubi:latest
      ARG KERNEL_VERSION
      RUN yum -y install kmod && yum clean all
      RUN mkdir -p /opt/lib/modules/${KERNEL_VERSION}
      COPY --from=builder /build/kernel-module-management/ci/kmm-kmod/*.ko /opt/lib/modules/${KERNEL_VERSION}/
      RUN /usr/sbin/depmod -b /opt
  ---
  apiVersion: kmm.sigs.x-k8s.io/v1beta1
  kind: Module
  metadata:
    name: example-module
    namespace: <namespace> 

  2

  
  spec:
    moduleLoader:
      serviceAccountName: default 

  3

  
      container:
        modprobe:
          moduleName: simple_kmod
        kernelMappings:
          - regexp: '^.*\.x86_64$'
            containerImage: <final_driver_container_name>
            build:
              dockerfileConfigMap:
                name: example-module-dockerfile
            sign:
              keySecret:
                name: <private_key_secret_name>
              certSecret:
                name: <certificate_secret_name>
              filesToSign:
                - /opt/lib/modules/4.18.0-348.2.1.el8_5.x86_64/kmm_ci_a.ko
    imageRepoSecret: 

  4

  
      name: repo-pull-secret
    selector: # top-level selector
      kubernetes.io/arch: amd64