Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add manifests to run nmos pipeline #57

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions nmos/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -188,10 +188,14 @@ cd <repo>/nmos/k8s
# Install minikube https://minikube.sigs.k8s.io/docs/start/?arch=%2Fwindows%2Fx86-64%2Fstable%2F.exe+download
minikube start
# Build iamges. Refer to 4. Build images
# Adjust ConfigMaps in <repo>/nmos/k8s/nmos-client.yaml, <repo>/nmos/k8s/nmos-registry.yaml and <repo>/nmos/k8s/nmos-testing.yaml
kubectl apply -f <repo>/nmos/k8s/nmos-client.yaml
kubectl apply -f <repo>/nmos/k8s/nmos-registry.yaml
kubectl apply -f <repo>/nmos/k8s/nmos-testing.yaml
# Adjust ConfigMaps in <repo>/nmos/k8s/bcs/nmos-client-<node>.yaml, <repo>/nmos/k8s/testing-dev/nmos-registry.yaml and <repo>/nmos/k8s/testing-dev/nmos-testing.yaml

# Set environment variables: VFIO_PORT_TX and VFIO_PORT_RX that are for virtual functions interfaces
kubectl apply -f <repo>/nmos/k8s/bcs/nmos-client-tx.yaml
kubectl apply -f <repo>/nmos/k8s/bcs/nmos-client-rx.yaml
kubectl apply -f <repo>/nmos/k8s/testing-dev/nmos-registry.yaml
kubectl apply -f <repo>/nmos/k8s/testing-dev/nmos-is-05-controller.yaml
kubectl apply -f <repo>/nmos/k8s/testing-dev/nmos-testing.yaml #optional
# Useful for accessing testing tool browser: https://minikube.sigs.k8s.io/docs/handbook/accessing/
```

Expand Down
158 changes: 158 additions & 0 deletions nmos/k8s/bcs/nmos-client-rx.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,158 @@
#SPDX-FileCopyrightText: Copyright (c) 2024 Intel Corporation
#
#SPDX-License-Identifier: BSD-3-Clause

---
apiVersion: v1
kind: ConfigMap
metadata:
name: nmos-node-config-rx
namespace: default
data:
node.json: |
{
"logging_level": 0,
"http_port": 95,
"label": "intel-broadcast-suite",
"senders": ["v"],
"senders_count": [0],
"receivers": ["v"],
"receivers_count": [1],
"device_tags": {
"pipeline": ["rx-sender"]
},
"function": "rx-sender",
"gpu_hw_acceleration": "none",
"domain": "default.svc.cluster.local",
"ffmpeg_grpc_server_address": "tiber-broadcast-suite-tx.default.svc.cluster.local",
"ffmpeg_grpc_server_port": "50052",
"receiver_payload_type": 112,
"sender": [{
"stream_payload": {
"video": {
"frame_width": 1920,
"frame_height": 1080,
"frame_rate": { "numerator": 60, "denominator": 1 },
"pixel_format": "yuv422p10le",
"video_type": "rawvideo"
},
"audio": {
"channels": 2,
"sampleRate": 48000,
"format": "pcm_s24be",
"packetTime": "1ms"
}
},
"stream_type": {
"file": {
"path": "/root/recv",
"filename": "1920x1080p10le_2.yuv"
}
}
}],
"receiver": [{
"stream_payload": {
"video": {
"frame_width": 960,
"frame_height": 1080,
"frame_rate": { "numerator": 60, "denominator": 1 },
"pixel_format": "yuv422p10le",
"video_type": "rawvideo"
},
"audio": {
"channels": 2,
"sampleRate": 48000,
"format": "pcm_s24be",
"packetTime": "1ms"
}
},
"stream_type": {
"mcm": {
"conn_type": "st2110",
"transport": "st2110-20",
"urn": "NULL",
"transportPixelFormat": "yuv422p10le"
}
}
}]
}

---

Check notice

Code scanning / Trivy

Workloads in the default namespace Low

Artifact: nmos/k8s/bcs/nmos-client-rx.yaml
Type: kubernetes
Vulnerability KSV110
Severity: LOW
Message: deployment nmos-client-rx in default namespace should set metadata.namespace to a non-default namespace
Link: KSV110
apiVersion: apps/v1
kind: Deployment
metadata:
name: nmos-client-rx
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: nmos-client-rx
template:
metadata:
labels:
app: nmos-client-rx
spec:
containers:
- name: nmos-client-rx
image: nmos-cpp-node:1.2A-f549712
ports:
- containerPort: 1084
env:
- name: RUN_NODE
value: "TRUE"
- name: VFIO_PORT_TX
value: "${VFIO_PORT_TX}"
- name: VFIO_PORT_RX
value: "${VFIO_PORT_RX}"
volumeMounts:
- name: nmos-node-config-rx
mountPath: /home/node.json
subPath: node.json
resources:
requests:
cpu: 1
memory: 500Mi
limits:
cpu: 1
memory: 500Mi
securityContext:
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readinessProbe:
httpGet:
path: /
port: 50052
host: tiber-broadcast-suite-rx.default.svc.cluster.local
initialDelaySeconds: 5
periodSeconds: 10

Check warning

Code scanning / Trivy

Runs as root user Medium

Artifact: nmos/k8s/bcs/nmos-client-rx.yaml
Type: kubernetes
Vulnerability KSV012
Severity: MEDIUM
Message: Container 'nmos-client-rx' of Deployment 'nmos-client-rx' should set 'securityContext.runAsNonRoot' to true
Link: KSV012

Check failure

Code scanning / Trivy

Root file system is not read-only High

Artifact: nmos/k8s/bcs/nmos-client-rx.yaml
Type: kubernetes
Vulnerability KSV014
Severity: HIGH
Message: Container 'nmos-client-rx' of Deployment 'nmos-client-rx' should set 'securityContext.readOnlyRootFilesystem' to true
Link: KSV014

Check notice

Code scanning / Trivy

Runs with UID &lt;= 10000 Low

Artifact: nmos/k8s/bcs/nmos-client-rx.yaml
Type: kubernetes
Vulnerability KSV020
Severity: LOW
Message: Container 'nmos-client-rx' of Deployment 'nmos-client-rx' should set 'securityContext.runAsUser' > 10000
Link: KSV020

Check notice

Code scanning / Trivy

Runs with GID &lt;= 10000 Low

Artifact: nmos/k8s/bcs/nmos-client-rx.yaml
Type: kubernetes
Vulnerability KSV021
Severity: LOW
Message: Container 'nmos-client-rx' of Deployment 'nmos-client-rx' should set 'securityContext.runAsGroup' > 10000
Link: KSV021
volumes:
- name: nmos-node-config-rx
configMap:
name: nmos-node-config-rx

---
apiVersion: v1
kind: Service
metadata:
name: nmos-client-rx
namespace: default
spec:
type: NodePort
selector:
app: nmos-client-rx
ports:
- protocol: TCP
port: 1085
targetPort: 1085
name: nmos-client-rx-node-port-http
nodePort: 30085
- protocol: TCP
port: 50052
targetPort: 50052
name: grpc-client-to-ffmpeg
nodePort: 30052
157 changes: 157 additions & 0 deletions nmos/k8s/bcs/nmos-client-tx.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,157 @@
# SPDX-FileCopyrightText: Copyright (c) 2024 Intel Corporation
#
# SPDX-License-Identifier: BSD-3-Clause
---
apiVersion: v1
kind: ConfigMap
metadata:
name: nmos-node-config-tx
namespace: default
data:
node.json: |
{
"logging_level": 0,
"http_port": 90,
"label": "intel-broadcast-suite",
"senders": ["v"],
"senders_count": [1],
"receivers": ["v"],
"receivers_count": [0],
"device_tags": {
"pipeline": ["tx-sender"]
},
"function": "tx-sender",
"gpu_hw_acceleration": "none",
"domain": "default.svc.cluster.local",
"ffmpeg_grpc_server_address": "tiber-broadcast-suite-rx.default.svc.cluster.local",
"ffmpeg_grpc_server_port": "50051",
"sender_payload_type": 112,
"sender": [{
"stream_payload": {
"video": {
"frame_width": 1960,
"frame_height": 1080,
"frame_rate": { "numerator": 60, "denominator": 1 },
"pixel_format": "yuv422p10le",
"video_type": "rawvideo"
},
"audio": {
"channels": 2,
"sample_rate": 48000,
"format": "pcm_s24be",
"packet_time": "1ms"
}
},
"stream_type": {
"mcm": {
"conn_type": "st2110",
"transport": "st2110-20",
"urn": "NULL",
"transport_pixel_format": "yuv422p10le"
}
}
}],
"receiver": [{
"stream_payload": {
"video": {
"frame_width": 1920,
"frame_height": 1080,
"frame_rate": { "numerator": 60, "denominator": 1 },
"pixel_format": "yuv422p10le",
"video_type": "rawvideo"
},
"audio": {
"channels": 2,
"sample_rate": 48000,
"format": "pcm_s24be",
"packet_time": "1ms"
}
},
"stream_type": {
"file": {
"path": "/root",
"filename": "1920x1080p10le_1.yuv"
}
}
}]
}

---

Check notice

Code scanning / Trivy

Workloads in the default namespace Low

Artifact: nmos/k8s/bcs/nmos-client-tx.yaml
Type: kubernetes
Vulnerability KSV110
Severity: LOW
Message: deployment nmos-client-tx in default namespace should set metadata.namespace to a non-default namespace
Link: KSV110
apiVersion: apps/v1
kind: Deployment
metadata:
name: nmos-client-tx
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: nmos-client-tx
template:
metadata:
labels:
app: nmos-client-tx
spec:
containers:
- name: nmos-client-tx
image: nmos-cpp-node:1.2A-f549712
ports:
- containerPort: 1084
env:
- name: RUN_NODE
value: "TRUE"
- name: VFIO_PORT_TX
value: "${VFIO_PORT_TX}"
- name: VFIO_PORT_RX
value: "${VFIO_PORT_RX}"
volumeMounts:
- name: nmos-node-config-tx
mountPath: /home/node.json
subPath: node.json
resources:
requests:
cpu: 1
memory: 500Mi
limits:
cpu: 1
memory: 500Mi
securityContext:
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readinessProbe:
httpGet:
path: /
port: 50051
host: tiber-broadcast-suite-tx.default.svc.cluster.local
initialDelaySeconds: 5
periodSeconds: 10

Check warning

Code scanning / Trivy

Runs as root user Medium

Artifact: nmos/k8s/bcs/nmos-client-tx.yaml
Type: kubernetes
Vulnerability KSV012
Severity: MEDIUM
Message: Container 'nmos-client-tx' of Deployment 'nmos-client-tx' should set 'securityContext.runAsNonRoot' to true
Link: KSV012

Check failure

Code scanning / Trivy

Root file system is not read-only High

Artifact: nmos/k8s/bcs/nmos-client-tx.yaml
Type: kubernetes
Vulnerability KSV014
Severity: HIGH
Message: Container 'nmos-client-tx' of Deployment 'nmos-client-tx' should set 'securityContext.readOnlyRootFilesystem' to true
Link: KSV014

Check notice

Code scanning / Trivy

Runs with UID &lt;= 10000 Low

Artifact: nmos/k8s/bcs/nmos-client-tx.yaml
Type: kubernetes
Vulnerability KSV020
Severity: LOW
Message: Container 'nmos-client-tx' of Deployment 'nmos-client-tx' should set 'securityContext.runAsUser' > 10000
Link: KSV020

Check notice

Code scanning / Trivy

Runs with GID &lt;= 10000 Low

Artifact: nmos/k8s/bcs/nmos-client-tx.yaml
Type: kubernetes
Vulnerability KSV021
Severity: LOW
Message: Container 'nmos-client-tx' of Deployment 'nmos-client-tx' should set 'securityContext.runAsGroup' > 10000
Link: KSV021
volumes:
- name: nmos-node-config-tx
configMap:
name: nmos-node-config-tx

---
apiVersion: v1
kind: Service
metadata:
name: nmos-client-tx
namespace: default
spec:
type: NodePort
selector:
app: nmos-client-tx
ports:
- protocol: TCP
port: 1084
targetPort: 1084
name: nmos-client-tx-node-port-http
nodePort: 30084
- protocol: TCP
port: 50051
targetPort: 50051
name: grpc-client-to-ffmpeg
nodePort: 30051
Loading