Skip to content
This repository was archived by the owner on Mar 9, 2022. It is now read-only.

Commit 66d158b

Browse files
Random-LiuRandom-Liu
committed
Use new namespace mode and support shared pid namespace.
Signed-off-by: Lantao Liu <[email protected]>
1 parent 8ccdac8 commit 66d158b

8 files changed

+86
-62
lines changed

‎pkg/server/container_create.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import (
4343
"github.com/syndtr/gocapability/capability"
4444
"golang.org/x/net/context"
4545
"golang.org/x/sys/unix"
46-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
46+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
4747

4848
"github.com/containerd/cri-containerd/pkg/annotations"
4949
customopts "github.com/containerd/cri-containerd/pkg/containerd/opts"
@@ -427,7 +427,7 @@ func (c *criContainerdService) generateContainerMounts(sandboxRootDir string, co
427427

428428
if !isInCRIMounts(devShm, config.GetMounts()) {
429429
sandboxDevShm := getSandboxDevShm(sandboxRootDir)
430-
if securityContext.GetNamespaceOptions().GetHostIpc() {
430+
if securityContext.GetNamespaceOptions().GetIpc() == runtime.NamespaceMode_NODE {
431431
sandboxDevShm = devShm
432432
}
433433
mounts = append(mounts, &runtime.Mount{
@@ -718,9 +718,9 @@ func setOCINamespaces(g *generate.Generator, namespaces *runtime.NamespaceOption
718718
g.AddOrReplaceLinuxNamespace(string(runtimespec.NetworkNamespace), getNetworkNamespace(sandboxPid)) // nolint: errcheck
719719
g.AddOrReplaceLinuxNamespace(string(runtimespec.IPCNamespace), getIPCNamespace(sandboxPid)) // nolint: errcheck
720720
g.AddOrReplaceLinuxNamespace(string(runtimespec.UTSNamespace), getUTSNamespace(sandboxPid)) // nolint: errcheck
721-
// Do not share pid namespace for now.
722-
if namespaces.GetHostPid() {
723-
g.RemoveLinuxNamespace(string(runtimespec.PIDNamespace)) // nolint: errcheck
721+
// Do not share pid namespace if namespace mode is CONTAINER.
722+
if namespaces.GetPid() != runtime.NamespaceMode_CONTAINER {
723+
g.AddOrReplaceLinuxNamespace(string(runtimespec.PIDNamespace), getPIDNamespace(sandboxPid)) // nolint: errcheck
724724
}
725725
}
726726

‎pkg/server/container_create_test.go

+37-19
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030
"github.com/opencontainers/runtime-tools/generate"
3131
"github.com/stretchr/testify/assert"
3232
"github.com/stretchr/testify/require"
33-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
33+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
3434

3535
"github.com/containerd/cri-containerd/pkg/annotations"
3636
ostesting "github.com/containerd/cri-containerd/pkg/os/testing"
@@ -169,6 +169,10 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
169169
Type: runtimespec.UTSNamespace,
170170
Path: getUTSNamespace(sandboxPid),
171171
})
172+
assert.Contains(t, spec.Linux.Namespaces, runtimespec.LinuxNamespace{
173+
Type: runtimespec.PIDNamespace,
174+
Path: getPIDNamespace(sandboxPid),
175+
})
172176

173177
t.Logf("Check PodSandbox annotations")
174178
assert.Contains(t, spec.Annotations, annotations.SandboxID)
@@ -543,7 +547,7 @@ func TestGenerateContainerMounts(t *testing.T) {
543547
},
544548
"should use host /dev/shm when host ipc is set": {
545549
securityContext: &runtime.LinuxContainerSecurityContext{
546-
NamespaceOptions: &runtime.NamespaceOption{HostIpc: true},
550+
NamespaceOptions: &runtime.NamespaceOption{Ipc: runtime.NamespaceMode_NODE},
547551
},
548552
expectedMounts: []*runtime.Mount{
549553
{
@@ -748,25 +752,39 @@ func TestPidNamespace(t *testing.T) {
748752
testID := "test-id"
749753
testPid := uint32(1234)
750754
testSandboxID := "sandbox-id"
751-
config, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
755+
config, sandboxConfig, imageConfig, _ := getCreateContainerTestData()
752756
c := newTestCRIContainerdService()
753-
t.Logf("should not set pid namespace when host pid is true")
754-
config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{HostPid: true}
755-
spec, err := c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
756-
require.NoError(t, err)
757-
specCheck(t, testID, testSandboxID, testPid, spec)
758-
for _, ns := range spec.Linux.Namespaces {
759-
assert.NotEqual(t, ns.Type, runtimespec.PIDNamespace)
757+
for desc, test := range map[string]struct {
758+
pidNS runtime.NamespaceMode
759+
expected runtimespec.LinuxNamespace
760+
}{
761+
"node namespace mode": {
762+
pidNS: runtime.NamespaceMode_NODE,
763+
expected: runtimespec.LinuxNamespace{
764+
Type: runtimespec.PIDNamespace,
765+
Path: getPIDNamespace(testPid),
766+
},
767+
},
768+
"container namespace mode": {
769+
pidNS: runtime.NamespaceMode_CONTAINER,
770+
expected: runtimespec.LinuxNamespace{
771+
Type: runtimespec.PIDNamespace,
772+
},
773+
},
774+
"pod namespace mode": {
775+
pidNS: runtime.NamespaceMode_POD,
776+
expected: runtimespec.LinuxNamespace{
777+
Type: runtimespec.PIDNamespace,
778+
Path: getPIDNamespace(testPid),
779+
},
780+
},
781+
} {
782+
t.Logf("TestCase %q", desc)
783+
config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS}
784+
spec, err := c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
785+
require.NoError(t, err)
786+
assert.Contains(t, spec.Linux.Namespaces, test.expected)
760787
}
761-
762-
t.Logf("should set pid namespace when host pid is false")
763-
config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{HostPid: false}
764-
spec, err = c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
765-
require.NoError(t, err)
766-
specCheck(t, testID, testSandboxID, testPid, spec)
767-
assert.Contains(t, spec.Linux.Namespaces, runtimespec.LinuxNamespace{
768-
Type: runtimespec.PIDNamespace,
769-
})
770788
}
771789

772790
func TestDefaultRuntimeSpec(t *testing.T) {

‎pkg/server/helpers.go

+8-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ import (
3636
"github.com/opencontainers/selinux/go-selinux"
3737
"github.com/opencontainers/selinux/go-selinux/label"
3838
"golang.org/x/net/context"
39-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
39+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
4040
"k8s.io/kubernetes/pkg/util/sysctl"
4141

4242
"github.com/containerd/cri-containerd/pkg/store"
@@ -84,6 +84,8 @@ const (
8484
ipcNSFormat = "/proc/%v/ns/ipc"
8585
// utsNSFormat is the format of uts namespace of a process.
8686
utsNSFormat = "/proc/%v/ns/uts"
87+
// pidNSFormat is the format of pid namespace of a process.
88+
pidNSFormat = "/proc/%v/ns/pid"
8789
// devShm is the default path of /dev/shm.
8890
devShm = "/dev/shm"
8991
// etcHosts is the default path of /etc/hosts file.
@@ -183,6 +185,11 @@ func getUTSNamespace(pid uint32) string {
183185
return fmt.Sprintf(utsNSFormat, pid)
184186
}
185187

188+
// getPIDNamespace returns the pid namespace of a process.
189+
func getPIDNamespace(pid uint32) string {
190+
return fmt.Sprintf(pidNSFormat, pid)
191+
}
192+
186193
// criContainerStateToString formats CRI container state to string.
187194
func criContainerStateToString(state runtime.ContainerState) string {
188195
return runtime.ContainerState_name[int32(state)]

‎pkg/server/restart.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import (
3333
"github.com/docker/docker/pkg/system"
3434
"github.com/sirupsen/logrus"
3535
"golang.org/x/net/context"
36-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
36+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
3737

3838
cio "github.com/containerd/cri-containerd/pkg/server/io"
3939
containerstore "github.com/containerd/cri-containerd/pkg/store/container"
@@ -352,7 +352,7 @@ func loadSandbox(ctx context.Context, cntr containerd.Container) (sandboxstore.S
352352
sandbox.Container = cntr
353353

354354
// Load network namespace.
355-
if meta.Config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostNetwork() {
355+
if meta.Config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetNetwork() == runtime.NamespaceMode_NODE {
356356
// Don't need to load netns for host network sandbox.
357357
return sandbox, nil
358358
}

‎pkg/server/sandbox_run.go

+7-8
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import (
3333
"github.com/sirupsen/logrus"
3434
"golang.org/x/net/context"
3535
"golang.org/x/sys/unix"
36-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
36+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
3737

3838
"github.com/containerd/cri-containerd/pkg/annotations"
3939
customopts "github.com/containerd/cri-containerd/pkg/containerd/opts"
@@ -87,7 +87,7 @@ func (c *criContainerdService) RunPodSandbox(ctx context.Context, r *runtime.Run
8787
}
8888
securityContext := config.GetLinux().GetSecurityContext()
8989
//Create Network Namespace if it is not in host network
90-
hostNet := securityContext.GetNamespaceOptions().GetHostNetwork()
90+
hostNet := securityContext.GetNamespaceOptions().GetNetwork() == runtime.NamespaceMode_NODE
9191
if !hostNet {
9292
// If it is not in host network namespace then create a namespace and set the sandbox
9393
// handle. NetNSPath in sandbox metadata and NetNS is non empty only for non host network
@@ -362,17 +362,16 @@ func (c *criContainerdService) generateSandboxContainerSpec(id string, config *r
362362
// Set namespace options.
363363
securityContext := config.GetLinux().GetSecurityContext()
364364
nsOptions := securityContext.GetNamespaceOptions()
365-
if nsOptions.GetHostNetwork() {
365+
if nsOptions.GetNetwork() == runtime.NamespaceMode_NODE {
366366
g.RemoveLinuxNamespace(string(runtimespec.NetworkNamespace)) // nolint: errcheck
367367
} else {
368368
//TODO(Abhi): May be move this to containerd spec opts (WithLinuxSpaceOption)
369369
g.AddOrReplaceLinuxNamespace(string(runtimespec.NetworkNamespace), nsPath) // nolint: errcheck
370370
}
371-
if nsOptions.GetHostPid() {
371+
if nsOptions.GetPid() == runtime.NamespaceMode_NODE {
372372
g.RemoveLinuxNamespace(string(runtimespec.PIDNamespace)) // nolint: errcheck
373373
}
374-
375-
if nsOptions.GetHostIpc() {
374+
if nsOptions.GetIpc() == runtime.NamespaceMode_NODE {
376375
g.RemoveLinuxNamespace(string(runtimespec.IPCNamespace)) // nolint: errcheck
377376
}
378377

@@ -439,7 +438,7 @@ func (c *criContainerdService) setupSandboxFiles(rootDir string, config *runtime
439438
}
440439

441440
// Setup sandbox /dev/shm.
442-
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
441+
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetIpc() == runtime.NamespaceMode_NODE {
443442
if _, err := c.os.Stat(devShm); err != nil {
444443
return fmt.Errorf("host %q is not available for host ipc: %v", devShm, err)
445444
}
@@ -486,7 +485,7 @@ func parseDNSOptions(servers, searches, options []string) (string, error) {
486485
// 1) The mount point is already unmounted.
487486
// 2) The mount point doesn't exist.
488487
func (c *criContainerdService) unmountSandboxFiles(rootDir string, config *runtime.PodSandboxConfig) error {
489-
if !config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostIpc() {
488+
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetIpc() != runtime.NamespaceMode_NODE {
490489
if err := c.os.Unmount(getSandboxDevShm(rootDir), unix.MNT_DETACH); err != nil && !os.IsNotExist(err) {
491490
return err
492491
}

‎pkg/server/sandbox_run_test.go

+14-14
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
2828
"github.com/stretchr/testify/assert"
2929
"github.com/stretchr/testify/require"
30-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
30+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
3131

3232
ostesting "github.com/containerd/cri-containerd/pkg/os/testing"
3333
sandboxstore "github.com/containerd/cri-containerd/pkg/store/sandbox"
@@ -105,9 +105,9 @@ func TestGenerateSandboxContainerSpec(t *testing.T) {
105105
configChange: func(c *runtime.PodSandboxConfig) {
106106
c.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
107107
NamespaceOptions: &runtime.NamespaceOption{
108-
HostNetwork: true,
109-
HostPid: true,
110-
HostIpc: true,
108+
Network: runtime.NamespaceMode_NODE,
109+
Pid: runtime.NamespaceMode_NODE,
110+
Ipc: runtime.NamespaceMode_NODE,
111111
},
112112
}
113113
},
@@ -179,11 +179,11 @@ func TestSetupSandboxFiles(t *testing.T) {
179179
testRootDir := "test-sandbox-root"
180180
for desc, test := range map[string]struct {
181181
dnsConfig *runtime.DNSConfig
182-
hostIpc bool
182+
ipcMode runtime.NamespaceMode
183183
expectedCalls []ostesting.CalledDetail
184184
}{
185-
"should check host /dev/shm existence when hostIpc is true": {
186-
hostIpc: true,
185+
"should check host /dev/shm existence when ipc mode is NODE": {
186+
ipcMode: runtime.NamespaceMode_NODE,
187187
expectedCalls: []ostesting.CalledDetail{
188188
{
189189
Name: "CopyFile",
@@ -209,7 +209,7 @@ func TestSetupSandboxFiles(t *testing.T) {
209209
Searches: []string{"114.114.114.114"},
210210
Options: []string{"timeout:1"},
211211
},
212-
hostIpc: true,
212+
ipcMode: runtime.NamespaceMode_NODE,
213213
expectedCalls: []ostesting.CalledDetail{
214214
{
215215
Name: "CopyFile",
@@ -232,8 +232,8 @@ options timeout:1
232232
},
233233
},
234234
},
235-
"should create sandbox shm when hostIpc is false": {
236-
hostIpc: false,
235+
"should create sandbox shm when ipc namespace mode is not NODE": {
236+
ipcMode: runtime.NamespaceMode_POD,
237237
expectedCalls: []ostesting.CalledDetail{
238238
{
239239
Name: "CopyFile",
@@ -267,7 +267,7 @@ options timeout:1
267267
Linux: &runtime.LinuxPodSandboxConfig{
268268
SecurityContext: &runtime.LinuxSandboxSecurityContext{
269269
NamespaceOptions: &runtime.NamespaceOption{
270-
HostIpc: test.hostIpc,
270+
Ipc: test.ipcMode,
271271
},
272272
},
273273
},
@@ -402,9 +402,9 @@ func TestTypeurlMarshalUnmarshalSandboxMeta(t *testing.T) {
402402
configChange: func(c *runtime.PodSandboxConfig) {
403403
c.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
404404
NamespaceOptions: &runtime.NamespaceOption{
405-
HostNetwork: true,
406-
HostPid: true,
407-
HostIpc: true,
405+
Network: runtime.NamespaceMode_NODE,
406+
Pid: runtime.NamespaceMode_NODE,
407+
Ipc: runtime.NamespaceMode_NODE,
408408
},
409409
SupplementalGroups: []int64{1111, 2222},
410410
}

‎pkg/server/sandbox_status.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
"github.com/containerd/containerd/errdefs"
2525
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
2626
"golang.org/x/net/context"
27-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
27+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
2828

2929
sandboxstore "github.com/containerd/cri-containerd/pkg/store/sandbox"
3030
)
@@ -57,8 +57,8 @@ func (c *criContainerdService) PodSandboxStatus(ctx context.Context, r *runtime.
5757
func (c *criContainerdService) getIP(sandbox sandboxstore.Sandbox) string {
5858
config := sandbox.Config
5959

60-
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetHostNetwork() {
61-
// For sandboxes using the host network we are not
60+
if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetNetwork() == runtime.NamespaceMode_NODE {
61+
// For sandboxes using the node network we are not
6262
// responsible for reporting the IP.
6363
return ""
6464
}
@@ -88,9 +88,9 @@ func toCRISandboxStatus(meta sandboxstore.Metadata, status sandboxstore.Status,
8888
Linux: &runtime.LinuxPodSandboxStatus{
8989
Namespaces: &runtime.Namespace{
9090
Options: &runtime.NamespaceOption{
91-
HostNetwork: nsOpts.GetHostNetwork(),
92-
HostPid: nsOpts.GetHostPid(),
93-
HostIpc: nsOpts.GetHostIpc(),
91+
Network: nsOpts.GetNetwork(),
92+
Pid: nsOpts.GetPid(),
93+
Ipc: nsOpts.GetIpc(),
9494
},
9595
},
9696
},

‎pkg/server/sandbox_status_test.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import (
2121
"time"
2222

2323
"github.com/stretchr/testify/assert"
24-
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
24+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
2525

2626
sandboxstore "github.com/containerd/cri-containerd/pkg/store/sandbox"
2727
)
@@ -42,9 +42,9 @@ func TestPodSandboxStatus(t *testing.T) {
4242
Linux: &runtime.LinuxPodSandboxConfig{
4343
SecurityContext: &runtime.LinuxSandboxSecurityContext{
4444
NamespaceOptions: &runtime.NamespaceOption{
45-
HostNetwork: true,
46-
HostPid: false,
47-
HostIpc: true,
45+
Network: runtime.NamespaceMode_POD,
46+
Pid: runtime.NamespaceMode_CONTAINER,
47+
Ipc: runtime.NamespaceMode_NODE,
4848
},
4949
},
5050
},
@@ -65,9 +65,9 @@ func TestPodSandboxStatus(t *testing.T) {
6565
Linux: &runtime.LinuxPodSandboxStatus{
6666
Namespaces: &runtime.Namespace{
6767
Options: &runtime.NamespaceOption{
68-
HostNetwork: true,
69-
HostPid: false,
70-
HostIpc: true,
68+
Network: runtime.NamespaceMode_POD,
69+
Pid: runtime.NamespaceMode_CONTAINER,
70+
Ipc: runtime.NamespaceMode_NODE,
7171
},
7272
},
7373
},

0 commit comments

Comments
 (0)