github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-09 22:24:51 +00:00
Code Issues Projects Releases Wiki Activity

tests: retry pod removal before forcing in TestKilledVmmCleanup

Browse Source 
TestKilledVmmCleanup SIGKILLs the VMM and then removes the pod.  After a
hard VMM kill the shim exits promptly (which the test asserts), so the
container's TaskExit event may not have reached containerd before the
shim was gone, leaving CRI's view of the container as "running" and
making a plain `crictl rmp` fail with "container is still running, to
stop first".

Retry the normal removal a few times to give the event time to arrive,
and only fall back to `crictl rmp -f` if it keeps failing -- which is how
a crashed sandbox is recovered in practice (kubelet GC / manual force
removal).  The essential guarantee, that no shim process is leaked after
the VMM is killed, is unchanged.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
This commit is contained in:
Fabiano Fidêncio
2026-07-07 12:19:50 +02:00
parent d3291b8778
commit 7053d70acf
1 changed files with 41 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
tests/integration/cri-containerd/integration-tests.sh
View File

@@ -339,12 +339,47 @@ EOF
}
function testContainerStop() {
# When the caller passes "force", remove the pod with `crictl rmp -f`.
# This is needed for the killed-VMM case: after the hypervisor is
# SIGKILL'd the shim exits promptly (as the test itself asserts), so the
# container's TaskExit event may not have reached containerd before the
# shim was gone, leaving CRI's view of the container as "running". A
# crashed VMM is recovered with a force removal (what kubelet's GC and
# manual `crictl rmp -f` do); the essential guarantee -- that no shim is
# leaked -- is already checked by the caller.
local -r force="${1:-}"
info "show pod ${podid}"
sudo crictl --timeout=20s pods --id "${podid}"
info "stop pod ${podid}"
sudo crictl --timeout=20s stopp "${podid}"
info "remove pod ${podid}"
sudo crictl --timeout=20s rmp "${podid}"
if [[ "${force}" != "force" ]]; then
sudo crictl --timeout=20s rmp "${podid}"
restore_cri_integration_containerd_host_config
return 0
fi
# Force path (killed-VMM): after a hard VMM kill the container's TaskExit
# may not have reached containerd yet, leaving CRI's view as "running".
# Retry the normal removal a few times to give the event time to arrive,
# and only fall back to a force removal (how a crashed sandbox is cleaned
# up in practice) if it keeps failing.
local removed="false"
local i
for i in 1 2 3; do
if sudo crictl --timeout=20s rmp "${podid}"; then
removed="true"
break
fi
info "rmp attempt ${i} failed, retrying"
sleep 1
done
if [[ "${removed}" != "true" ]]; then
info "falling back to force removal of pod ${podid}"
sudo crictl --timeout=20s rmp -f "${podid}"
fi
restore_cri_integration_containerd_host_config
}
@@ -367,7 +402,11 @@ function TestKilledVmmCleanup() {
remained=$(pgrep -f shimv2 || true)
[[ -z "${remained}" ]] || die "found remaining shimv2 process ${remained}"
testContainerStop
# The VMM was hard-killed, so the container's exit may not have reached
# containerd before the shim exited. Retry the normal removal a few times
# and fall back to a force removal, mirroring how a crashed sandbox is
# cleaned up in practice.
testContainerStop "force"
info "stop containerd"
}