Commit graph

230 commits

Author SHA1 Message Date
Mrunal Patel
8c83014476 Merge pull request from edsantiago/safe_netcat
nc (netcat): don't block when run interactively
2017-10-10 16:23:07 -07:00
Daniel J Walsh
772f4b1515 Merge pull request from umohnani8/libpod-part2
Continue switching from libkpod to libpod
2017-10-10 16:55:53 -04:00
Daniel J Walsh
680f3a09e1 Merge pull request from edsantiago/parameterize_cni_plugin
Parameterize CRIO_CNI_PLUGIN
2017-10-10 16:55:03 -04:00
Ed Santiago
d54a139f6d nc (netcat): don't block when run interactively
When running the test suite interactively, "Connect to pod
hostport from the host" test hangs because nc thinks it's
got a bidirectional connection. Running with </dev/null
closes the connection after receiving the expected data,
letting the tests proceed.

This is just a suggestion for n00b-friendliness. Running
interactively is rare, but it's exactly where a n00b
will begin, and the hang costs a little time and energy
to track down.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2017-10-10 13:03:08 -06:00
umohnani8
356df5d18e Continue switching from libkpod to libpod
Refactored rmi, images, diff, and history.
Made fixes to kpod images in the way it was handing the templates as well as printing the image names

Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-10-10 11:22:09 -04:00
Daniel J Walsh
974bafe012 Merge pull request from sameo/topic/loglevel
main: Define -log-level option
2017-10-06 09:51:07 -04:00
Dan Williams
cc2b27132e test/network: clean up tests
Signed-off-by: Dan Williams <dcbw@redhat.com>
2017-10-05 16:41:54 -05:00
Dan Williams
8392f5f757 test: add test for network teardown on sandbox setup errors
Signed-off-by: Dan Williams <dcbw@redhat.com>
2017-10-05 16:41:54 -05:00
Samuel Ortiz
a5e5ccb365 main: Replace -debug with -log-level
Running crio with -debug is very verbose. Having more granularity
on the log level can be useful when e.g. only looking for errors.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2017-10-05 22:53:20 +02:00
Nalin Dahyabhai
2491d38e03 Also refactor setting flags for running kpod
* Remove duplicate definitions of storage-related flags for kpod, since
  we set them in helpers.bash now, and the other locations that were
  also setting it were doing so after loading the definitions in
  helpers.
* Set kpod storage flags after checking if we need to force use of the
  "vfs" storage driver for cri-o, to make sure kpod also ends up with
  the same override if we're using one.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-09-29 16:37:07 -04:00
Daniel J Walsh
e16bb3feb3 Refactor kpod tests
Move kpod tests from kpod.bats to kpod_[commandname].bats
Also make sure all status checks have a echo $output before them.

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-09-29 16:37:07 -04:00
baude
7b062cf4c1 Add support for kpod kill
Kill one or more containers using a user-provided signal.  If not signal
is provided, KILL is used.

Signed-off-by: baude <bbaude@redhat.com>
2017-09-28 09:34:21 -05:00
Ed Santiago
b2d347d8cd Parameterize CRIO_CNI_PLUGIN
Allow overriding CRIO_CNI_PLUGIN (default: /opt/cni/bin) and
make sure it gets written to our crio.conf file. This is
intended for running cri-o tests with containernetworking-cni
rpm which installs into /usr/libexec/cni

Signed-off-by: Ed Santiago <santiago@redhat.com>
2017-09-27 14:19:20 -06:00
baude
3bf23b684a Add kpod wait
Waits on one or more containers to stop and prints the container's
return code

Signed-off-by: baude <bbaude@redhat.com>
2017-09-27 09:03:33 -05:00
Daniel J Walsh
214adee0ef Merge pull request from TomSweeneyRedHat/pause
Add `kpod pause` and `kpod unpause`
2017-09-27 09:33:22 -04:00
Antonio Murdaca
0ff3580f05 Merge pull request from mrunalp/cfg_log_max
Max log size config
2017-09-26 17:04:57 +02:00
Daniel J Walsh
9db7cf1370 Add kpod pause and kpod unpause
Implement the ability to pause and unpause running containers.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
2017-09-26 08:38:07 -04:00
Mrunal Patel
d47061ac57 test: Add a test for log size max
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-09-25 15:37:55 -07:00
Mrunal Patel
db0bd66fca Merge pull request from runcom/fixes-rc3-0
Fix Origin test and update kube to v1.7.6
2017-09-25 14:55:42 -07:00
Antonio Murdaca
7b0bde4362
container_create: fix seccomp annotations
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-25 21:08:11 +02:00
Antonio Murdaca
e8cfe3b867
container_create: support seccomp docker/default annotation
Fixes the following Origin/Kube test:

```
• Failure [10.323 seconds]
[k8s.io] Security Context [Feature:SecurityContext]
/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/framework/framework.go:619
  should support seccomp alpha docker/default annotation
[Feature:Seccomp] [It]
  /go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/security_context.go:133

  Expected error:
      <*errors.errorString | 0xc420cbacf0>: {
          s: "expected \"2\" in container output: Expected\n
<string>: Seccomp:\t0\n    \nto contain substring\n    <string>: 2",
      }
      expected "2" in container output: Expected
          <string>: Seccomp:	0

      to contain substring
          <string>: 2
  not to have occurred
}
```

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-25 21:08:11 +02:00
Mrunal Patel
1beb75d839 test: Add steps for testing crio client
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-09-25 11:59:40 -07:00
Mrunal Patel
7e7a097395 Merge pull request from runcom/v1.0.0-rc2-patches
V1.0.0 rc2 patches
2017-09-17 21:03:54 -07:00
Antonio Murdaca
a11b8cd8ec
sandbox, ctr: SELinux fixes
server: fix selinux labels for pod and containers

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

sandbox: set selinux labels from request, not defaults

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

container_create: use sandbox's selinux if container's nil

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

sandbox: correctly init selinux labels

First, we weren't correctly initializing selinux labels. If any of
(level, user, role, type) was missing from kube selinux options, we
were erroring out. This is wrong as kube sends just `level=s0`
sometimes and docker itself allows `--security-opt label=level:s0`.
This patch directly initializes selinux labels, correctly, and adds a
test to verify it.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

test: testdata: use container_runtime_t selinux type

RHEL SELinux policy doesn't have `container_t` type but we're using it
in our fixtures. That means Fedora integration tests pass because
`container_t` is in Fedora's container policy but RHEL is broken.
Fix it by using `container_runtime_t` which is aliased in Fedora policy
to `container_t`.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-17 22:40:17 +02:00
Antonio Murdaca
9ec518491f
server: correctly set hostname
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-17 10:19:31 +02:00
Antonio Murdaca
0c1383fd30
test: add inspect integration tests
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-17 10:19:31 +02:00
Daniel J Walsh
dbc2b404a3 Merge pull request from baude/kpod_pull_name
libkpod/image/copy.go: Add pull by short-name
2017-09-16 05:12:47 -04:00
umohnani8
036658b844 Modified namespace field in json struct
The namespace field was not being omitted when empty

Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-09-15 17:30:25 -04:00
baude
951a943d16 libkpod/image/copy.go: Add pull by short-name
If the user provides kpod pull a short name like 'debian', we
still want the pull to be sucessful.  As such, when a short
name is provided, we get the list of searchable registries via
the systemregistries code in containers-storage.  We then
append a tag of 'latest' (if not provided) and we formulate
a list of possible fully-qualified image names to try.

Vendor update for containers-storage to bring in the system_registries
code.

Also includes a patch from Nalin to fix compilation errors.

Signed-off-by: baude <bbaude@redhat.com>
2017-09-14 08:33:10 -05:00
baude
aca658b423 kpod stop -- stop one or more containers
Stop one or more containers. Specific a timeout value
that if the stop operation exceeds, will forcibly stop
the container.

Signed-off-by: baude <bbaude@redhat.com>
2017-09-11 17:03:27 -05:00
Daniel J Walsh
a3a0bb5e55 Merge pull request from umohnani8/kpod_ps
Add namespace flag to kpod ps
2017-09-11 10:14:39 -04:00
Aaron Weitekamp
adb0d19416
Add image pull with signature integration test
Signed-off-by: Aaron Weitekamp <aweiteka@redhat.com>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-11 13:34:30 +02:00
umohnani8
38e9f07844 Add namespace flag to kpod ps
The namespace flag prints out information about the namespaces

Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-09-10 11:21:49 -04:00
Daniel J Walsh
36584e6f34 Merge pull request from umohnani8/update_load-save
Update kpod load and save for oci-archive
2017-09-09 05:58:54 -04:00
Daniel J Walsh
b5ed8b34c0 Merge pull request from baude/kpod_tag
cmd/kpod/tag.go: Do not assume docker.io for tagging
2017-09-09 05:43:15 -04:00
umohnani8
79c09d4343 Update kpod load and save for oci-archive
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-09-08 10:33:58 -04:00
Antonio Murdaca
09a8d1a751
contrib: test: run kube tests in CI with same cgroup driver
Our CI tests on RHEL and Fedora and we want to test the systemd cgroup
driver. However, kubelet needs to run in tests with systemd cgroup
driver as well, or tests fail. This patch fixes broken CI because of
not matching cgroup driver between CRI-O and the kubelet.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-08 14:26:39 +02:00
Antonio Murdaca
b8a6d358e7 Merge pull request from rhatdan/hooks
Add support for running oci-hooks
2017-09-07 19:06:01 +02:00
Antonio Murdaca
af0a494251
container_create: handle cap add/drop ALL
Kubelet can send cap add/drop ALL. Handle that in CRI-O as well.
Also, this PR is re-vendoring runtime-tools to fix capabilities add to
add caps to _all_ caps set **and** fix a shared memory issue (caps set
were initialized with the same slice, if one modifies one slice, it's
reflected on the other slices, the vendoring fixes this as well)

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-07 16:43:33 +02:00
Mrunal Patel
ac12018973 Merge pull request from runcom/cache-ip-sandbox
cache sandbox's IP address
2017-09-06 09:51:03 -07:00
Antonio Murdaca
5947698818
test: replace bash CNI plugin with a custom bridge
Because we need a working CNI plugin to setup a correct netns so
sandbox_run can grab a working IP address.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-06 17:14:53 +02:00
baude
529eb5bdb7 cmd/kpod/tag.go: Do not assume docker.io for tagging
When performing a tag, if a shortname was provided, tag.go would
preprend docker.io to the shortname through the ParseNormalized
function.  Here we work around that such that is a short name
and tag are provided, the resulting tag will be shortname:tag.  If
a shortname is provided without a tag, we append "latest" as the
tag.

Added specific tag tests too

Signed-off-by: baude <bbaude@redhat.com>
2017-09-06 09:00:00 -05:00
Daniel J Walsh
c88bc13b07 Implement kpod rm
Kpod rm removes a container from the system

Signed-off-by: Ryan Cole <rcyoalne@gmail.com>

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-09-05 14:35:36 -04:00
Daniel J Walsh
139d0841e8 Add support for oci-hooks to libkpod
Add new directory /etc/crio/hooks.d, where packagers can drop a json config
file to specify a hook.

The json must specify a valid executable to run.
The json must also specify which stage(s) to run the hook:
prestart, poststart, poststop
The json must specify under which criteria the hook should be launched
If the container HasBindMounts
If the container cmd matches a list of regular expressions
If the containers annotations matches a list of regular expressions.
If any of these match the the hook will be launched.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2017-09-05 07:39:31 -04:00
Antonio Murdaca
2ac2832686
server: container_create: store sandbox's ip in annotations
So it can be later retrieved when needed (cadvisor)

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-09-02 02:05:58 +02:00
umohnani8
3d23f22292 Vendor in changes made to containers/image for OCI
Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-08-31 16:40:13 -04:00
Ryan Cole
865612c3db Disable compression by default
Signed-off-by: Ryan Cole <rcyoalne@gmail.com>
2017-08-28 08:29:42 -04:00
Antonio Murdaca
59ba89d64d
*: fix crictl vendor
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-08-27 10:54:36 +02:00
Daniel J Walsh
7af1ae71ed Merge pull request from umohnani8/kpod_ps
Add 'kpod ps' command
2017-08-23 07:08:31 -04:00
umohnani8
35ca80abe6 Add 'kpod ps' command
kpod ps lists the containers currently stored

Displays the list of containers

Signed-off-by: umohnani8 <umohnani@redhat.com>
2017-08-22 16:40:45 -04:00