feat: add host-backed entropy device support and update kernel configuration

tests/test_config.py

@@ -27,17 +27,17 @@ class ArchitectureSettingsTests(unittest.TestCase):
                     settings = factory()
 
                     base = (
-                        "https://s3.amazonaws.com/spec.ccfc.min/img/quickstart_guide/"
+                        "https://s3.amazonaws.com/spec.ccfc.min/firecracker-ci/v1.15/"
                         f"{architecture}"
                     )
                     self.assertEqual(settings.architecture, architecture)
-                    self.assertEqual(settings.kernel_url, f"{base}/kernels/vmlinux.bin")
+                    self.assertEqual(settings.kernel_url, f"{base}/vmlinux-6.1.155")
                     self.assertEqual(settings.rootfs_url, "")
 
     def test_preserves_individual_environment_url_overrides_on_arm64(self) -> None:
         kernel = "https://example.com/custom-arm64-kernel"
         rootfs = "https://example.com/custom-arm64-rootfs.ext4"
-        base = "https://s3.amazonaws.com/spec.ccfc.min/img/quickstart_guide/aarch64"
+        base = "https://s3.amazonaws.com/spec.ccfc.min/firecracker-ci/v1.15/aarch64"
         for overrides in (
             {"UVM_KERNEL_URL": kernel},
             {"UVM_ROOTFS_URL": rootfs},
@@ -52,7 +52,7 @@ class ArchitectureSettingsTests(unittest.TestCase):
 
                 self.assertEqual(
                     settings.kernel_url,
-                    overrides.get("UVM_KERNEL_URL", f"{base}/kernels/vmlinux.bin"),
+                    overrides.get("UVM_KERNEL_URL", f"{base}/vmlinux-6.1.155"),
                 )
                 self.assertEqual(
                     settings.rootfs_url,

tests/test_firecracker_config.py

@@ -3,9 +3,11 @@ from __future__ import annotations
 import unittest
 from ipaddress import IPv4Address, IPv4Network
 from pathlib import Path
+from unittest.mock import patch
 
 from uvm.config import Settings
 from uvm.domain import VmRecord
+from uvm.errors import FirecrackerError
 from uvm.firecracker.api import FirecrackerClient
 from uvm.firecracker.config import build_config, vcpu_count
 
@@ -45,6 +47,10 @@ class FirecrackerConfigTests(unittest.TestCase):
                 self.assertEqual("keep_bootcon" in arguments, architecture != "x86_64")
                 self.assertIn("console=ttyS0", arguments)
                 self.assertIn("ip=10.42.0.2::10.42.0.1:255.255.255.0::eth0:off", arguments)
+                client = RecordingFirecrackerClient()
+                client.configure_and_start(config)
+                self.assertEqual(client.calls[-2], ("PUT", "/entropy", {}))
+                self.assertEqual(client.calls[-1], ("PUT", "/actions", {"action_type": "InstanceStart"}))
 
     def test_builds_a_writable_vm_disk_configuration(self) -> None:
         vm = VmRecord(
@@ -101,6 +107,7 @@ class FirecrackerConfigTests(unittest.TestCase):
                 "/boot-source",
                 "/drives/rootfs",
                 "/network-interfaces/eth0",
+                "/entropy",
                 "/actions",
             ],
         )
@@ -110,6 +117,36 @@ class FirecrackerConfigTests(unittest.TestCase):
         )
         self.assertEqual(client.calls[-1][2], {"action_type": "InstanceStart"})
 
+    def test_entropy_failure_prevents_guest_boot(self) -> None:
+        config = {
+            "machine-config": {"vcpu_count": 1, "mem_size_mib": 512},
+            "boot-source": {},
+            "drives": [{}],
+            "network-interfaces": [{}],
+            "entropy": {},
+        }
+        client = RecordingFirecrackerClient()
+
+        def request(method: str, path: str, body: object) -> None:
+            client.calls.append((method, path, body))
+            if path == "/entropy":
+                raise FirecrackerError("entropy device unavailable")
+
+        with patch.object(client, "_request", side_effect=request):
+            with self.assertRaisesRegex(FirecrackerError, "entropy device unavailable"):
+                client.configure_and_start(config)
+
+        self.assertEqual(client.calls[-1], ("PUT", "/entropy", {}))
+        self.assertNotIn("/actions", [path for _method, path, _body in client.calls])
+
+        for entropy in (None, [], False):
+            with self.subTest(entropy=entropy):
+                client.calls.clear()
+                config["entropy"] = entropy
+                with self.assertRaisesRegex(FirecrackerError, "no valid entropy device"):
+                    client.configure_and_start(config)
+                self.assertEqual(client.calls, [])
+
     def test_uses_the_configured_network_netmask_in_guest_boot_arguments(self) -> None:
         settings = Settings(
             network=IPv4Network("10.50.0.0/16"),

tests/test_install.py

@@ -72,7 +72,8 @@ class InstallerArchitectureTests(unittest.TestCase):
                 payloads = {
                     "https://github.com/firecracker-microvm/firecracker/releases/download/"
                     f"{version}/firecracker-{version}-{architecture}.tgz": archive_bytes,
-                    f"{guest_base}/kernels/vmlinux.bin": kernel_bytes,
+                    "https://s3.amazonaws.com/spec.ccfc.min/firecracker-ci/v1.15/"
+                    f"{architecture}/vmlinux-6.1.155": kernel_bytes,
                     f"{guest_base}/rootfs/bionic.rootfs.ext4": rootfs_bytes,
                 }
                 runner = Mock(spec=CommandRunner)