4cab8ed06a
Because they need to prepare the hypervisor networking interfaces and have them match the ones created in the pod networking namespace (typically to bridge TAP and veth interfaces), hypervisor based container runtimes need the sandbox pod networking namespace to be set up before it's created. They can then prepare and start the hypervisor interfaces when creating the pod virtual machine. In order to do so, we need to create per pod persitent networking namespaces that we pass to the CNI plugin. This patch leverages the CNI ns package to create such namespaces under /var/run/netns, and assign them to all pod containers. The persitent namespace is removed when either the pod is stopped or removed. Since the StopPodSandbox() API can be called multiple times from kubelet, we track the pod networking namespace state (closed or not) so that we don't get a containernetworking/ns package error when calling its Close() routine multiple times as well. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
61 lines
1.9 KiB
Go
61 lines
1.9 KiB
Go
package server
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/Sirupsen/logrus"
|
|
"github.com/kubernetes-incubator/cri-o/oci"
|
|
"golang.org/x/net/context"
|
|
pb "k8s.io/kubernetes/pkg/kubelet/api/v1alpha1/runtime"
|
|
)
|
|
|
|
// StopPodSandbox stops the sandbox. If there are any running containers in the
|
|
// sandbox, they should be force terminated.
|
|
func (s *Server) StopPodSandbox(ctx context.Context, req *pb.StopPodSandboxRequest) (*pb.StopPodSandboxResponse, error) {
|
|
logrus.Debugf("StopPodSandboxRequest %+v", req)
|
|
sb, err := s.getPodSandboxFromRequest(req)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
podNamespace := ""
|
|
podInfraContainer := sb.infraContainer
|
|
netnsPath, err := podInfraContainer.NetNsPath()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if _, err := os.Stat(netnsPath); err == nil {
|
|
if err2 := s.netPlugin.TearDownPod(netnsPath, podNamespace, sb.id, podInfraContainer.Name()); err2 != nil {
|
|
return nil, fmt.Errorf("failed to destroy network for container %s in sandbox %s: %v",
|
|
podInfraContainer.Name(), sb.id, err2)
|
|
}
|
|
} else if !os.IsNotExist(err) { // it's ok for netnsPath to *not* exist
|
|
return nil, fmt.Errorf("failed to stat netns path for container %s in sandbox %s before tearing down the network: %v",
|
|
podInfraContainer.Name(), sb.id, err)
|
|
}
|
|
|
|
// Close the sandbox networking namespace.
|
|
if err := sb.netNsRemove(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
containers := sb.containers.List()
|
|
containers = append(containers, podInfraContainer)
|
|
|
|
for _, c := range containers {
|
|
if err := s.runtime.UpdateStatus(c); err != nil {
|
|
return nil, err
|
|
}
|
|
cStatus := s.runtime.ContainerStatus(c)
|
|
if cStatus.Status != oci.ContainerStateStopped {
|
|
if err := s.runtime.StopContainer(c); err != nil {
|
|
return nil, fmt.Errorf("failed to stop container %s in sandbox %s: %v", c.Name(), sb.id, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
resp := &pb.StopPodSandboxResponse{}
|
|
logrus.Debugf("StopPodSandboxResponse: %+v", resp)
|
|
return resp, nil
|
|
}
|