github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-10 07:05:51 +00:00
Code Issues Projects Releases Wiki Activity

kata-deploy: allow CRI sandbox sizing annotations.

Browse Source 
Forward and allow CRI sandbox CPU and memory annotations so static
sandbox sizing can consume Kubernetes-provided limits instead of
silently ignoring them in SNP/TDX workloads.

This should solve the breakage caused in the k8s-qos-pods.bats and
k8s-memory.bats seen in the nightly jobs for both TDX and SNP with
runtime-rs.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
This commit is contained in:
Fabiano Fidêncio
2026-06-09 12:58:10 +02:00
parent ac2221a6a5
commit fa672ffa0b
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/runtime-rs/Makefile
View File

@@ -176,8 +176,8 @@ DEFBRIDGES := 1
DEFNETQUEUES := 1
# Security note: do not enable "virtio_fs_extra_args" by default.
# Allowing pods to pass arbitrary virtiofsd arguments can be abused for malicious host-side behavior.
DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\"]
DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"cc_init_data\"]
DEFENABLEANNOTATIONS := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-memory\"]
DEFENABLEANNOTATIONS_COCO := [\"enable_iommu\", \"kernel_params\", \"kernel_verity_params\", \"default_vcpus\", \"default_memory\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-memory\", \"cc_init_data\"]
DEFDISABLEGUESTSECCOMP := true
DEFDISABLEGUESTEMPTYDIR := false
DEFEMPTYDIRMODE := shared-fs

8
tools/packaging/kata-deploy/binary/src/runtime/containerd.rs
View File

@@ -37,6 +37,8 @@ const CONTAINERD_LEGACY_CRI_PLUGIN_ID: &str = "cri";
const CONTAINERD_CRI_IMAGES_PLUGIN_ID: &str = "\"io.containerd.cri.v1.images\"";
/// Plugin table for CRI containerd in v2 (disable_snapshot_annotations lives here).
const CONTAINERD_CRI_CONTAINERD_TABLE_V2: &str = "\"io.containerd.grpc.v1.cri\".containerd";
/// Runtime-level pod annotations forwarded by containerd to kata-shim.
const KATA_POD_ANNOTATIONS: &str = "[\"io.katacontainers.*\", \"io.kubernetes.cri.sandbox-cpu-period\", \"io.kubernetes.cri.sandbox-cpu-quota\", \"io.kubernetes.cri.sandbox-cpu-shares\", \"io.kubernetes.cri.sandbox-memory\"]";
fn is_k3s_or_rke2(runtime: &str) -> bool {
matches!(runtime, "k3s" | "k3s-agent" | "rke2-agent" | "rke2-server")
@@ -320,7 +322,7 @@ pub async fn configure_containerd_runtime(
pluginid
);
let pod_annotations = "[\"io.katacontainers.*\"]";
let pod_annotations = KATA_POD_ANNOTATIONS;
let container_annotations = "[\"io.kubernetes.container.terminationMessage*\"]";
// Determine snapshotter if configured
@@ -400,7 +402,7 @@ pub async fn configure_custom_containerd_runtime(
pluginid
);
let pod_annotations = "[\"io.katacontainers.*\"]";
let pod_annotations = KATA_POD_ANNOTATIONS;
let container_annotations = "[\"io.kubernetes.container.terminationMessage*\"]";
// Determine snapshotter if specified
@@ -854,7 +856,7 @@ mod tests {
runtime_path: "\"/opt/kata/bin/kata-runtime\"".to_string(),
config_path: "\"/opt/kata/share/defaults/kata-containers/configuration-qemu.toml\""
.to_string(),
pod_annotations: "[\"io.katacontainers.*\"]",
pod_annotations: KATA_POD_ANNOTATIONS,
container_annotations: "[\"io.kubernetes.container.terminationMessage*\"]",
snapshotter: snapshotter.map(|s| s.to_string()),
}