mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-29 21:03:03 +00:00
Merge pull request #1344 from liubin/fix/1329-improvements-for-console-access
runtime: connect guest debug console bypass kata-monitor
This commit is contained in:
commit
4f67bf919d
@ -37,7 +37,6 @@
|
||||
* [Set up a debug console](#set-up-a-debug-console)
|
||||
* [Simple debug console setup](#simple-debug-console-setup)
|
||||
* [Enable agent debug console](#enable-agent-debug-console)
|
||||
* [Start `kata-monitor`](#start-kata-monitor)
|
||||
* [Connect to debug console](#connect-to-debug-console)
|
||||
* [Traditional debug console setup](#traditional-debug-console-setup)
|
||||
* [Create a custom image containing a shell](#create-a-custom-image-containing-a-shell)
|
||||
@ -477,17 +476,6 @@ debug_console_enabled = true
|
||||
|
||||
This will pass `agent.debug_console agent.debug_console_vport=1026` to agent as kernel parameters, and sandboxes created using this parameters will start a shell in guest if new connection is accept from VSOCK.
|
||||
|
||||
#### Start `kata-monitor`
|
||||
|
||||
The `kata-runtime exec` command needs `kata-monitor` to get the sandbox's `vsock` address to connect to, first start `kata-monitor`.
|
||||
|
||||
```
|
||||
$ sudo kata-monitor
|
||||
```
|
||||
|
||||
`kata-monitor` will serve at `localhost:8090` by default.
|
||||
|
||||
|
||||
#### Connect to debug console
|
||||
|
||||
Command `kata-runtime exec` is used to connect to the debug console.
|
||||
@ -502,6 +490,10 @@ bash-4.2# exit
|
||||
exit
|
||||
```
|
||||
|
||||
`kata-runtime exec` has a command-line option `runtime-namespace`, which is used to specify under which [runtime namespace](https://github.com/containerd/containerd/blob/master/docs/namespaces.md) the particular pod was created. By default, it is set to `k8s.io` and works for containerd when configured
|
||||
with Kubernetes. For CRI-O, the namespace should set to `default` explicitly. This should not be confused with [Kubernetes namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/).
|
||||
For other CRI-runtimes and configurations, you may need to set the namespace utilizing the `runtime-namespace` option.
|
||||
|
||||
If you want to access guest OS through a traditional way, see [Traditional debug console setup)](#traditional-debug-console-setup).
|
||||
|
||||
### Traditional debug console setup
|
||||
|
@ -1,4 +1,5 @@
|
||||
// Copyright (c) 2017-2019 Intel Corporation
|
||||
// Copyright (c) 2020 Ant Group
|
||||
//
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
//
|
||||
@ -13,12 +14,14 @@ import (
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/containerd/console"
|
||||
kataMonitor "github.com/kata-containers/kata-containers/src/runtime/pkg/kata-monitor"
|
||||
"github.com/kata-containers/kata-containers/src/runtime/pkg/katautils"
|
||||
clientUtils "github.com/kata-containers/kata-containers/src/runtime/virtcontainers/pkg/agent/protocols/client"
|
||||
"github.com/pkg/errors"
|
||||
@ -35,10 +38,10 @@ const (
|
||||
|
||||
subCommandName = "exec"
|
||||
// command-line parameters name
|
||||
paramKataMonitorAddr = "kata-monitor-addr"
|
||||
paramRuntimeNamespace = "runtime-namespace"
|
||||
paramDebugConsolePort = "kata-debug-port"
|
||||
defaultKernelParamDebugConsoleVPortValue = 1026
|
||||
defaultParamKataMonitorAddr = "http://localhost:8090"
|
||||
defaultRuntimeNamespace = "k8s.io"
|
||||
)
|
||||
|
||||
var (
|
||||
@ -55,12 +58,12 @@ var kataExecCLICommand = cli.Command{
|
||||
Usage: "Enter into guest by debug console",
|
||||
Flags: []cli.Flag{
|
||||
cli.StringFlag{
|
||||
Name: paramKataMonitorAddr,
|
||||
Usage: "Kata monitor listen address.",
|
||||
Name: paramRuntimeNamespace,
|
||||
Usage: "Namespace that containerd or CRI-O are using for containers. (Default: k8s.io, only works for containerd)",
|
||||
},
|
||||
cli.Uint64Flag{
|
||||
Name: paramDebugConsolePort,
|
||||
Usage: "Port that debug console is listening on.",
|
||||
Usage: "Port that debug console is listening on. (Default: 1026)",
|
||||
},
|
||||
},
|
||||
Action: func(context *cli.Context) error {
|
||||
@ -71,11 +74,11 @@ var kataExecCLICommand = cli.Command{
|
||||
span, _ := katautils.Trace(ctx, subCommandName)
|
||||
defer span.End()
|
||||
|
||||
endPoint := context.String(paramKataMonitorAddr)
|
||||
if endPoint == "" {
|
||||
endPoint = defaultParamKataMonitorAddr
|
||||
namespace := context.String(paramRuntimeNamespace)
|
||||
if namespace == "" {
|
||||
namespace = defaultRuntimeNamespace
|
||||
}
|
||||
span.SetAttributes(label.Key("endPoint").String(endPoint))
|
||||
span.SetAttributes(label.Key("namespace").String(namespace))
|
||||
|
||||
port := context.Uint64(paramDebugConsolePort)
|
||||
if port == 0 {
|
||||
@ -89,7 +92,7 @@ var kataExecCLICommand = cli.Command{
|
||||
}
|
||||
span.SetAttributes(label.Key("sandbox").String(sandboxID))
|
||||
|
||||
conn, err := getConn(endPoint, sandboxID, port)
|
||||
conn, err := getConn(namespace, sandboxID, port)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@ -172,15 +175,20 @@ func (s *iostream) Read(data []byte) (n int, err error) {
|
||||
return s.conn.Read(data)
|
||||
}
|
||||
|
||||
func getConn(endPoint, sandboxID string, port uint64) (net.Conn, error) {
|
||||
shimURL := fmt.Sprintf("%s/agent-url?sandbox=%s", endPoint, sandboxID)
|
||||
resp, err := http.Get(shimURL)
|
||||
func getConn(namespace, sandboxID string, port uint64) (net.Conn, error) {
|
||||
socketAddr := filepath.Join(string(filepath.Separator), "containerd-shim", namespace, sandboxID, "shim-monitor.sock")
|
||||
client, err := kataMonitor.BuildUnixSocketClient(socketAddr, defaultTimeout)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resp, err := client.Get("http://shim/agent-url")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("Failed to get %s: %d", shimURL, resp.StatusCode)
|
||||
return nil, fmt.Errorf("Failed to get %s: %d", socketAddr, resp.StatusCode)
|
||||
}
|
||||
|
||||
defer resp.Body.Close()
|
||||
|
@ -1,4 +1,4 @@
|
||||
// Copyright (c) 2020 Ant Financial
|
||||
// Copyright (c) 2020-2021 Ant Group
|
||||
//
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
//
|
||||
@ -34,15 +34,19 @@ func getSandboxIdFromReq(r *http.Request) (string, error) {
|
||||
}
|
||||
|
||||
func (km *KataMonitor) buildShimClient(sandboxID, namespace string, timeout time.Duration) (*http.Client, error) {
|
||||
socket, err := km.getMonitorAddress(sandboxID, namespace)
|
||||
socketAddr, err := km.getMonitorAddress(sandboxID, namespace)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return BuildUnixSocketClient(socketAddr, timeout)
|
||||
}
|
||||
|
||||
// BuildUnixSocketClient build http client for Unix socket
|
||||
func BuildUnixSocketClient(socketAddr string, timeout time.Duration) (*http.Client, error) {
|
||||
transport := &http.Transport{
|
||||
DisableKeepAlives: true,
|
||||
Dial: func(proto, addr string) (conn net.Conn, err error) {
|
||||
return net.Dial("unix", "\x00"+socket)
|
||||
return net.Dial("unix", "\x00"+socketAddr)
|
||||
},
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user