Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CRI: using typed filed for sysctls #41766

Merged
merged 3 commits into from
May 15, 2017
Merged

CRI: using typed filed for sysctls #41766

merged 3 commits into from
May 15, 2017

Conversation

feiskyer
Copy link
Member

What this PR does / why we need it:

CRI supports sysctls via annotations today, we should move them to typed and structured fields instead. (refer here)

Which issue this PR fixes

Part of #39130.

Release note:

NONE

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Feb 21, 2017
@k8s-reviewable
Copy link

This change is Reviewable

@feiskyer feiskyer mentioned this pull request Feb 21, 2017
Closed
3 tasks
@k8s-github-robot k8s-github-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. release-note-none Denotes a PR that doesn't merit a release note. labels Feb 21, 2017
@feiskyer
Copy link
Member Author

@k8s-bot unit test this

@feiskyer
Copy link
Member Author

Ready for review.

cc @yujuhong @timstclair @kubernetes/sig-node-pr-reviews

@feiskyer
Copy link
Member Author

@k8s-bot unit test this

@derekwaynecarr
Copy link
Member

i took a pass, and this looks pretty good to me, assigning @yujuhong for final review

@k8s-github-robot k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 27, 2017
@yujuhong yujuhong added this to the v1.7 milestone Mar 1, 2017
@k8s-github-robot k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 5, 2017
@k8s-github-robot k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 13, 2017
@feiskyer
Copy link
Member Author

Rebased. @yujuhong @derekwaynecarr PTAL.

@k8s-github-robot k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 14, 2017
@feiskyer
Copy link
Member Author

@k8s-bot cvm gce e2e test this

@k8s-github-robot k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 24, 2017
@k8s-github-robot k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 1, 2017
@feiskyer
Copy link
Member Author

feiskyer commented May 1, 2017

/assign @timstclair @yujuhong

@feiskyer
Copy link
Member Author

feiskyer commented May 1, 2017

Rebased. @timstclair @yujuhong PTAL.

@k8s-github-robot k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 1, 2017
@k8s-github-robot k8s-github-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 4, 2017
@feiskyer
Copy link
Member Author

feiskyer commented May 4, 2017

Rebased. ping @yujuhong @timstclair

@feiskyer
Copy link
Member Author

feiskyer commented May 5, 2017

/assign @Random-Liu

timstclair
timstclair suggested changes May 8, 2017
View reviewed changes
pkg/kubelet/api/v1alpha1/runtime/api.proto Outdated
// List of safe sysctls which are set for the sandbox.
map<string, string> sysctls = 1;
// List of unsafe sysctls which are set for the sandbox.
map<string, string> unsafe_sysctls = 2;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why have a separate field for unsafe_sysctls? IIUC, the distinction is just so that the Kubelet can perform extra validation. Since it's already been validated by the time it's passed to the CRI, shouldn't we just take a single list of sysctls to set here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure whether runtimes want to distinguish those two.

@yujuhong @mrunalp What do you think?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @timstclair. kubelet will make the judgement call about what type of sysctls can be set given the kubelet configuration. Whatever kubelet decides to pass to the runtime, the runtime should simply try to apply them. Let's remove the safe/unsafe distinction in CRI.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure what sysctls are namespaced, but it seems the namespaces of the ones we support (mostly .net) are shared among containers in the pod. In the future, if that's not the case, we'll have to make sure they are set for individual containers as well. Since unsafe ones are only experimental, I think it's okay for now.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK. Will merge them into one.

yujuhong
yujuhong suggested changes May 11, 2017
View reviewed changes
pkg/kubelet/kuberuntime/kuberuntime_sandbox.go Outdated
if len(portMappings) > 0 {
podSandboxConfig.PortMappings = portMappings
}

cgroupParent := m.runtimeHelper.GetPodCgroupParent(pod)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cgroupParent is not used anywhere in this function. We can move it to geneartePodSandboxLinuxConfig()

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK

pkg/kubelet/api/v1alpha1/runtime/api.proto Outdated
// List of safe sysctls which are set for the sandbox.
map<string, string> sysctls = 1;
// List of unsafe sysctls which are set for the sandbox.
map<string, string> unsafe_sysctls = 2;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @timstclair. kubelet will make the judgement call about what type of sysctls can be set given the kubelet configuration. Whatever kubelet decides to pass to the runtime, the runtime should simply try to apply them. Let's remove the safe/unsafe distinction in CRI.

pkg/kubelet/api/v1alpha1/runtime/api.proto Outdated
// List of safe sysctls which are set for the sandbox.
map<string, string> sysctls = 1;
// List of unsafe sysctls which are set for the sandbox.
map<string, string> unsafe_sysctls = 2;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure what sysctls are namespaced, but it seems the namespaces of the ones we support (mostly .net) are shared among containers in the pod. In the future, if that's not the case, we'll have to make sure they are set for individual containers as well. Since unsafe ones are only experimental, I think it's okay for now.

@k8s-github-robot k8s-github-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 12, 2017
@feiskyer
Copy link
Member Author

@timstclair @yujuhong Addressed comments. PTAL.

@yujuhong
Copy link
Contributor

/approve

LGTM, but not applying labels to give @timstclair a chance to respond.

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 12, 2017
@timstclair
Copy link

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 12, 2017
@k8s-github-robot k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 13, 2017
@k8s-github-robot k8s-github-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels May 15, 2017
@feiskyer
Copy link
Member Author

@k8s-bot pull-kubernetes-federation-e2e-gce test this

@feiskyer
Copy link
Member Author

@yujuhong @timstclair Rebased. PTAL.

@yujuhong
Copy link
Contributor

@k8s-bot pull-kubernetes-federation-e2e-gce test this

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 15, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: feiskyer, timstclair, yujuhong

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 45826, 45747, 45548, 45606, 41766)

@k8s-github-robot k8s-github-robot merged commit 1b7dacd into kubernetes:master May 15, 2017
@feiskyer feiskyer deleted the sysctls branch May 15, 2017 22:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@timstclair timstclair timstclair requested changes

@yujuhong yujuhong yujuhong approved these changes

Assignees

@timstclair timstclair

@Random-Liu Random-Liu

@yujuhong yujuhong

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
v1.7
Development

Successfully merging this pull request may close these issues.
8 participants
@feiskyer @k8s-reviewable @derekwaynecarr @yujuhong @timstclair @k8s-github-robot @Random-Liu @k8s-ci-robot