Commit graph

223 commits

Author SHA1 Message Date
Michał Żyłowski
5c81217e09 Applying k8s.io v3 API for ocic and ocid
Signed-off-by: Michał Żyłowski <michal.zylowski@intel.com>
2017-02-06 13:05:10 +01:00
Michał Żyłowski
a48336f981 Imports: Fix imports after vendoring (apimachinery)
Signed-off-by: Michał Żyłowski <michal.zylowski@intel.com>
2017-02-03 16:05:06 +01:00
Antonio Murdaca
dfa93414c5 Merge pull request #352 from mrunalp/deps
Switch to github.com/golang/dep for vendoring
2017-02-02 18:32:44 +01:00
Mrunal Patel
8e5b17cf13 Switch to github.com/golang/dep for vendoring
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
2017-01-31 16:45:59 -08:00
Antonio Murdaca
2202c1a460
storage: fix image retrieval by id
kubelet sends a request to create a container with an image ID (as
opposed as an image name). That ID comes from the ImageStatus response.
This patch fixes that by setting the image ID as well as the image name
and fix the login to lookup for image ID as well.

Found while running `make test-e2e-node`.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-31 16:32:30 +01:00
Aleksa Sarai
d5abfa1ecf
server: respect ocid.network.plugin_dir setting
Previously ocicni did not have support for setting the plugin directory.
Now that it has grown support for it, use it to actually respect the
setting a user has provided for ocid.network.* options.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2017-01-25 04:12:51 +11:00
Rajat Chopra
c04040fa95 move ocicni from vendors to pkg/
Signed-off-by: Rajat Chopra <rchopra@redhat.com>
2017-01-19 17:45:54 -05:00
Antonio Murdaca
0e3ff61350 server: fix ImagePullResponse
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Nalin Dahyabhai
aeea656581 Limit implicit image pulling to the pause image
The CRI doesn't expect us to implicitly pull an image if it isn't
already present before we're asked to use it to create a container, and
the tests no longer depend on us doing so, either.

Limit the logic which attempts to pull an image, if it isn't present, to
only pulling the configured "pause" image, since our use of that image
for running pod sandboxes is an implementation detail that our clients
can't be expected to know or care about.  Include the name of the image
that we didn't pull in the error we return when we don't pull one.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-01-18 10:23:30 -05:00
Antonio Murdaca
749d24fbab server: cleanup on failed restore
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Antonio Murdaca
437459bd64 server: do not add ctrs with bad state when restoring
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Antonio Murdaca
c61a83a930 server: skip pods containers in bad state on disk
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Antonio Murdaca
7bd7595b18 server: skip pods in bad state on disk
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Antonio Murdaca
dc37d36759 server: image_status: ignore storage.ErrImageUnknown
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2017-01-18 10:23:30 -05:00
Nalin Dahyabhai
c0333b102b Integrate containers/storage
Use containers/storage to store images, pod sandboxes, and containers.
A pod sandbox's infrastructure container has the same ID as the pod to
which it belongs, and all containers also keep track of their pod's ID.

The container configuration that we build using the data in a
CreateContainerRequest is stored in the container's ContainerDirectory
and ContainerRunDirectory.

We catch SIGTERM and SIGINT, and when we receive either, we gracefully
exit the grpc loop.  If we also think that there aren't any container
filesystems in use, we attempt to do a clean shutdown of the storage
driver.

The test harness now waits for ocid to exit before attempting to delete
the storage root directory.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-01-18 10:23:30 -05:00
Nalin Dahyabhai
caee4a99c9 Vendor containers/image and containers/storage
Vendor updated containers/image and containers/storage, along
with any new dependencies they drag in, and updated versions of other
dependencies that happen to get pulled in.

github.com/coreos/go-systemd/daemon/SdNotify() now takes a boolean to
control whether or not it unsets the NOTIFY_SOCKET variable from the
calling process's environment.  Adapt.

github.com/opencontainers/runtime-tools/generate/Generator.AddProcessEnv()
now takes the environment variable name and value as two arguments, not
one.  Adapt.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2017-01-18 10:21:59 -05:00
Mrunal Patel
3243cf7307 Merge pull request #316 from intelsdi-x/kubelet-net-fix
sandbox_run: Do not run net plugin in host namespace
2017-01-17 09:39:03 -08:00
Jonathan Yu
d5d297d50b
Promote DefaultConfig() to server package
The default configuration can only be accessed from the cmd/server
package, which cannot be imported (since it's a "package main").
This change promotes DefaultConfig() to the "server" package.

Closes: #315

Signed-off-by: Jonathan Yu <jawnsy@redhat.com>
2017-01-16 16:22:35 -08:00
Jacek J. Łakis
b034072d6a sandbox_run: Do not run net plugin in host namespace
Signed-off-by: Jacek J. Łakis <jacek.lakis@intel.com>
2017-01-16 16:53:29 +01:00
Antonio Murdaca
ac7943c707 Merge pull request #285 from sameo/topic/network-bats
Add Initial networking BATs
2016-12-20 16:49:04 +01:00
Nalin Dahyabhai
d6225894af Clear index entries when removing pods or ctrs
When removing a pod sandbox or container, remove the ID of the item from
the corresponding ID index, so that we can correctly determine if it was
us or another actor that cleaned them up.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2016-12-20 09:06:39 -05:00
Samuel Ortiz
c525459000
main: Add CNI options
We add 2 ocid options for choosing the CNI configuration and plugin
binaries directories: --cni-config-dir and --cni-plugin-dir.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-20 12:50:17 +01:00
Mrunal Patel
6df58df215 Add support for systemd cgroups
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-19 16:31:29 -08:00
Mrunal Patel
5eab56e002 Pass cgroup manager to oci runtime manager
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-19 15:05:32 -08:00
Mrunal Patel
edad8f866d Add configuration for specifying cgroup manager
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-19 15:04:34 -08:00
Nalin Dahyabhai
9b88295f69 Update containers/storage and containers/image
Update the versions of containers/storage and containers/image, and add
new dependencies that they pull in.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
2016-12-19 11:44:34 -05:00
Mrunal Patel
b2fbd828e1 Merge pull request #271 from resouer/pod-level-qos
Support pod level qos in cri-o
2016-12-16 13:32:22 -08:00
Mrunal Patel
5a769f72ca Merge pull request #274 from Crazykev/gofmt-check
Enable Gofmt check in CI
2016-12-15 16:57:16 -08:00
Antonio Murdaca
d157c1427c
server: mock UpdateRuntimeConfig
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-15 14:31:42 +01:00
Harry Zhang
02dfe877e4 Add container to pod qos cgroup
Signed-off-by: Harry Zhang <harryz@hyper.sh>
2016-12-15 14:42:59 +08:00
Crazykev
eb3990ead9 fix gofmt problem in existing code
Signed-off-by: Crazykev <crazykev@zju.edu.cn>
2016-12-15 14:17:22 +08:00
Samuel Ortiz
ad6ac9391c
sandbox: Force netns unmount and removal when restoring
ns.Close() will not remove and unmount the networking namespace
if it's not currently marked as mounted.
When we restore a sandbox, we generate the sandbox netns from
ns.GetNS() which does not mark the sandbox as mounted.

There currently is a PR open to fix that in the ns package:
https://github.com/containernetworking/cni/pull/342

but meanwhile this patch fixes a netns leak when restoring a pod.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-14 19:47:05 +01:00
Antonio Murdaca
d2f6a4c0e2
server: remove reaper, let runc take care of reaping
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-14 12:15:20 +01:00
Mrunal Patel
4cb5af00f6 Merge pull request #262 from runcom/fix-commands
Read command from ContainerCreateRequest
2016-12-13 10:13:38 -08:00
Antonio Murdaca
f99c0a089c
Read command from ContainerCreateRequest
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-13 16:59:16 +01:00
Antonio Murdaca
4bb0830c37 Merge pull request #239 from xlgao-zju/reload-apparmor-profile
reload default apparmor profile if it is unloaded
2016-12-13 11:10:26 +01:00
Samuel Ortiz
0df8200e12
sandbox: Create a symbolic link to the networking namespace
In order to workaround a bug introduced with runc commit bc84f833,
we create a symbolic link to our permanent networking namespace so
that runC realizes that this is not the host namespace.

Although this bug is now fixed upstream (See commit f33de5ab4), this
patch works with pre rc3 runC versions.
We may want to revert that patch once runC 1.0.0 is released.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-12 19:48:23 +01:00
Samuel Ortiz
a9724c2c9c
sandbox: Fix gocyclo complexity
With the networking namespace code added, we were reaching a
gocyclo complexitiy of 52. By moving the container creation and
starting code path out, we're back to reasonable levels.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-12 19:48:23 +01:00
Samuel Ortiz
482eb460d6
sandbox: Setup networking namespace before sandbox creation
In order for hypervisor based container runtimes to be able to
fully prepare their pod virtual machines networking interfaces,
this patch sets the pod networking namespace before creating the
sandbox container.

Once the sandbox networking namespace is prepared, the runtime
can scan the networking namespace interfaces and build the pod VM
matching interfaces (typically TAP interfaces) at pod sandbox
creation time. Not doing so means those runtimes would have to
rely on all hypervisors to support networking interfaces hotplug.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-12 19:48:23 +01:00
Samuel Ortiz
4cab8ed06a
sandbox: Use persistent networking namespace
Because they need to prepare the hypervisor networking interfaces
and have them match the ones created in the pod networking
namespace (typically to bridge TAP and veth interfaces), hypervisor
based container runtimes need the sandbox pod networking namespace
to be set up before it's created. They can then prepare and start
the hypervisor interfaces when creating the pod virtual machine.

In order to do so, we need to create per pod persitent networking
namespaces that we pass to the CNI plugin. This patch leverages
the CNI ns package to create such namespaces under /var/run/netns,
and assign them to all pod containers.
The persitent namespace is removed when either the pod is stopped
or removed.

Since the StopPodSandbox() API can be called multiple times from
kubelet, we track the pod networking namespace state (closed or
not) so that we don't get a containernetworking/ns package error
when calling its Close() routine multiple times as well.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-12 19:48:23 +01:00
Samuel Ortiz
70ede1a5fe
container: Store annotations under ocid/annotations
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-12 19:16:05 +01:00
Antonio Murdaca
430297dd81
store annotations and image for a container
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-12 11:12:03 +01:00
Xianglin Gao
ca7d5c77c2 Do not load ocid-default if configured apparmor profile is set up.
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
2016-12-12 15:55:17 +08:00
Antonio Murdaca
5a1605bad5
server: fix calls to logrus again
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-11 18:29:59 +01:00
Antonio Murdaca
67055e20bc
server: fix call to logrus.Warnf
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
2016-12-10 19:21:52 +01:00
Mrunal Patel
a0177ced09 Remove unnecessary check for mount label for /dev/shm
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-09 09:37:47 -08:00
Antonio Murdaca
d9edbe6817 Merge pull request #249 from mrunalp/dev_shm
Add support for pod /dev/shm that is shared by the pod ctrs
2016-12-09 09:46:27 +01:00
Mrunal Patel
868e18614a Fix couple of lint issues
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-08 15:40:59 -08:00
Mrunal Patel
be29524ba4 Add support for pod /dev/shm that is shared by the pod ctrs
Signed-off-by: Mrunal Patel <mpatel@redhat.com>
2016-12-08 15:32:17 -08:00
Samuel Ortiz
365c291f1a
server: Make RemovePodSandbox idempotent
And in particular make it not fail when removing an already removed
sandbox pod. According to the CRI spec:

  [RemovePodSandbox] is idempotent, and must not return an error if
  the sandbox has already been removed.

We now only print a warning instead of returning an error.
We still return an error when the passed pod ID is empty.

Fixes #240

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2016-12-08 10:40:14 +01:00