Repository navigation
Conversation
Kata was deferred when IG moved into the VHD, not excluded for a technical reason. The Kata host kernel has BTF and the eBPF/tracing support IG needs. Resolve ig through azurelinuxkata, copy the gadget import assets, and require baked IG in content tests. Kata hosts already run the VM extension's IG; baking it keeps the same host view (host processes and runc pods, not workloads inside Kata guest VMs) and moves ownership and version in line with regular Azure Linux 3.
github-actions
Bot
added
the
components
Contributor
Windows Unit Test Results 3 files 18 suites 1m 15s ⏱️ Results for commit ed4e82c. |
Contributor
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Manual validation is encouraging, but the actual Kata VHD build and PR-gate E2E results remain pending.
No open issues 🎉
What changed in this PR
Moves Inspektor Gadget ownership from the VM extension to the Azure Linux 3 Kata VHD, matching regular Azure Linux 3.
Changes:
- Adds IG 0.57.0 for Azure Linux 3 Kata.
- Enables baking IG packages, scripts, and service assets into Kata images.
- Requires baked assets in content tests; updates E2E documentation without changing validation logic.
| File | Description |
|---|---|
| vhdbuilder/packer/test/linux-vhd-content-test.sh | Requires IG assets on Kata images. |
| vhdbuilder/packer/packer_source.sh | Enables copying IG scripts and unit for Kata. |
| vhdbuilder/packer/install-dependencies.sh | Removes the Kata installation exclusion. |
| parts/common/components.json | Adds the Kata IG package version. |
| e2e/scenario/validators.go | Clarifies Kata support in a comment. |
Review effort: Balanced
Contributor
|
Contributor
|
lilypan26
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Bakes Inspektor Gadget (IG) into Azure Linux 3 Kata (Pod Sandboxing) VHDs, so Kata uses the same VHD-owned IG as regular Azure Linux 3 instead of the copy the AKS VM extension installs.
Kata was left out when IG moved into the VHD (#7371) only to keep that PR's scope small. No technical reason was recorded. The Kata host kernel (
kernel-mshv) has what IG needs: BTF, eBPF, kprobes, uprobes, tracepoints and syscall tracing, with lockdown off. It doesn't have BPF LSM, which IG doesn't use; Azure Linux 3 CVM already ships IG without it.Changes
components.json: adds anazurelinuxkataentry forinspektor-gadget, mirroringazurelinuxv3.0. Kata builds look up packages underazurelinuxkata, so before this no version resolved.install-dependencies.sh/packer_source.sh: removes the Kata skips for the install and for the gadget import/remove scripts and unit. Both are removed together, since the build disables and imports through those files.AzureLinuxV3Gen2Katascenario already runsValidateInspektorGadgetonceskip_vhd_igexists, including thetrace_execfunctional check.What changes for Kata nodes
Kata hosts already run IG today. The extension installs IG 0.53.2 because Kata VHDs have no
skip_vhd_igmarker. This PR changes who installs it and the version (0.53.2 → 0.57.0, matching regular Azure Linux 3). It does not add IG to Kata nodes for the first time.Known limitations (same with the extension's IG today)
These come from where IG runs (on the host, outside the Kata guest VM). They apply equally to the extension-installed IG on Kata nodes, so baking keeps parity and is not a regression:
ig list-containerslists Kata pods (via containerd)top_processattributes each Kata pod'scontainerd-shim/cloud-hypervisorto the right podtrace_execof commands in a Kata pod)top_cpu_throttlefor Kata pods (throttling is visible only on the pod cgroup, which holds the VMM, shim and virtiofsd; there is no per-container cgroup on the host)Upstream IG lists Kata Containers as unsupported for in-container visibility (inspektor-gadget/inspektor-gadget#5743). NPD's CPU-throttle IG check falls back to node-level stats on Kata (the host kernel also lacks PSI, microsoft/azurelinux#19417). This behaves the same with either IG.
Validation
spec/vhdbuilderShellSpec (451 examples, includinginstall_ig_spec.sh), e2ego vetand components/config tests.6.18.34.mshv3-1.azl3), with the RP-installedAKSLinuxExtension1.519:ig-0.57.0-3.azl3andig-gadgets-0.57.0-1.azl3, AgentBaker's import/remove scripts and disabled unit, gadget import (43/43) andskip_vhd_ig. The E2Etrace_execfunctional check passed.list-containers,trace_exec,top_processandtop_cpu_throttlewith runc,kataandkata-v2pods on IG 0.53.2 (extension) and 0.57.0 (VHD). Results were identical; see the table above.trace_execpassed, and the Kata pods returned to Running.Which issue(s) this PR fixes:
Related: #9810 (node-exporter on Kata)