github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-07 03:03:59 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #59643 from CaoShuFeng/docker_1.24

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 60346, 60135, 60289, 59643, 52640). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up sysctl code

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
This commit is contained in:
Kubernetes Submit Queue 2018-02-24 23:39:57 -08:00 committed by GitHub
commit 531f63c1ba
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
pkg/kubelet/sysctl/BUILD
View File

@ -20,7 +20,6 @@ go_library(
"//pkg/apis/extensions/validation:go_default_library", "//pkg/apis/extensions/validation:go_default_library",
"//pkg/kubelet/container:go_default_library", "//pkg/kubelet/container:go_default_library",
"//pkg/kubelet/lifecycle:go_default_library", "//pkg/kubelet/lifecycle:go_default_library",
"//vendor/k8s.io/api/core/v1:go_default_library",
], ],
) )

4
pkg/kubelet/sysctl/runtime.go
View File

@ -53,7 +53,7 @@ func NewRuntimeAdmitHandler(runtime container.Runtime) (*runtimeAdmitHandler, er
return nil, fmt.Errorf("failed to get runtime version: %v", err) return nil, fmt.Errorf("failed to get runtime version: %v", err)
} }
// only Docker >= 1.12 supports sysctls // only Docker API version >= 1.24 supports sysctls
c, err := v.Compare(dockerMinimumAPIVersion) c, err := v.Compare(dockerMinimumAPIVersion)
if err != nil { if err != nil {
return nil, fmt.Errorf("failed to compare Docker version for sysctl support: %v", err) return nil, fmt.Errorf("failed to compare Docker version for sysctl support: %v", err)
@ -69,7 +69,7 @@ func NewRuntimeAdmitHandler(runtime container.Runtime) (*runtimeAdmitHandler, er
result: lifecycle.PodAdmitResult{ result: lifecycle.PodAdmitResult{
Admit: false, Admit: false,
Reason: UnsupportedReason, Reason: UnsupportedReason,
Message: "Docker before 1.12 does not support sysctls", Message: "Docker API version before 1.24 does not support sysctls",
}, },
}, nil }, nil
case rktTypeName: case rktTypeName:

11
pkg/kubelet/sysctl/whitelist.go
View File

@ -20,7 +20,6 @@ import (
"fmt" "fmt"
"strings" "strings"
"k8s.io/api/core/v1"
v1helper "k8s.io/kubernetes/pkg/apis/core/v1/helper" v1helper "k8s.io/kubernetes/pkg/apis/core/v1/helper"
"k8s.io/kubernetes/pkg/apis/core/validation" "k8s.io/kubernetes/pkg/apis/core/validation"
extvalidation "k8s.io/kubernetes/pkg/apis/extensions/validation" extvalidation "k8s.io/kubernetes/pkg/apis/extensions/validation"
@ -45,14 +44,6 @@ func SafeSysctlWhitelist() []string {
} }
} }
// Whitelist provides a list of allowed sysctls and sysctl patterns (ending in *)
// and a function to check whether a given sysctl matches this list.
type Whitelist interface {
// Validate checks that all sysctls given in a v1.SysctlsPodAnnotationKey annotation
// are valid according to the whitelist.
Validate(pod *v1.Pod) error
}
// patternWhitelist takes a list of sysctls or sysctl patterns (ending in *) and // patternWhitelist takes a list of sysctls or sysctl patterns (ending in *) and
// checks validity via a sysctl and prefix map, rejecting those which are not known // checks validity via a sysctl and prefix map, rejecting those which are not known
// to be namespaced. // to be namespaced.
@ -130,7 +121,7 @@ func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool)
return fmt.Errorf("%q not whitelisted", sysctl) return fmt.Errorf("%q not whitelisted", sysctl)
} }
// Admit checks that all sysctls given in a v1.SysctlsPodAnnotationKey annotation // Admit checks that all sysctls given in annotations v1.SysctlsPodAnnotationKey and v1.UnsafeSysctlsPodAnnotationKey
// are valid according to the whitelist. // are valid according to the whitelist.
func (w *patternWhitelist) Admit(attrs *lifecycle.PodAdmitAttributes) lifecycle.PodAdmitResult { func (w *patternWhitelist) Admit(attrs *lifecycle.PodAdmitAttributes) lifecycle.PodAdmitResult {
pod := attrs.Pod pod := attrs.Pod