From 2e999fff02650b07f0e4ffb9c4563548c669b9c3 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Tue, 9 Jan 2024 10:42:20 +0900 Subject: [PATCH] Fix compiling e2e.test on macOS Fix issue 122650 (regression in PR 122552) ``` $ make WHAT=test/e2e/e2e.test +++ [0109 10:06:53] Building go targets for darwin/amd64 k8s.io/kubernetes/test/e2e/e2e.test (test) package k8s.io/kubernetes/test/e2e imports k8s.io/kubernetes/test/e2e/common imports k8s.io/kubernetes/test/e2e/common/node imports k8s.io/kubernetes/pkg/kubelet imports github.com/opencontainers/runc/libcontainer/userns: C source files not allowed when not using cgo or SWIG: userns_maps.c !!! [0109 10:06:54] Call tree: !!! [0109 10:06:54] 1: /Users/suda/gopath/src/k8s.io/kubernetes/hack/lib/golang.sh:948 kube::golang::build_binaries_for_platform(...) !!! [0109 10:06:54] 2: hack/make-rules/build.sh:27 kube::golang::build_binaries(...) !!! [0109 10:06:54] Call tree: !!! [0109 10:06:54] 1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...) !!! [0109 10:06:54] Call tree: !!! [0109 10:06:54] 1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...) make: *** [all] Error 1 ``` Signed-off-by: Akihiro Suda --- pkg/kubelet/cm/container_manager_linux.go | 4 +-- pkg/kubelet/kubelet.go | 4 +-- pkg/kubelet/userns/inuserns/inuserns_linux.go | 24 ++++++++++++++++++ .../userns/inuserns/inuserns_others.go | 25 +++++++++++++++++++ 4 files changed, 53 insertions(+), 4 deletions(-) create mode 100644 pkg/kubelet/userns/inuserns/inuserns_linux.go create mode 100644 pkg/kubelet/userns/inuserns/inuserns_others.go diff --git a/pkg/kubelet/cm/container_manager_linux.go b/pkg/kubelet/cm/container_manager_linux.go index 7dbfd4cc664..4b3d9ffe9dc 100644 --- a/pkg/kubelet/cm/container_manager_linux.go +++ b/pkg/kubelet/cm/container_manager_linux.go @@ -36,7 +36,6 @@ import ( "k8s.io/mount-utils" utilpath "k8s.io/utils/path" - libcontaineruserns "github.com/opencontainers/runc/libcontainer/userns" v1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/resource" "k8s.io/apimachinery/pkg/types" @@ -64,6 +63,7 @@ import ( "k8s.io/kubernetes/pkg/kubelet/pluginmanager/cache" "k8s.io/kubernetes/pkg/kubelet/stats/pidlimit" "k8s.io/kubernetes/pkg/kubelet/status" + "k8s.io/kubernetes/pkg/kubelet/userns/inuserns" schedulerframework "k8s.io/kubernetes/pkg/scheduler/framework" "k8s.io/kubernetes/pkg/util/oom" ) @@ -431,7 +431,7 @@ func setupKernelTunables(option KernelTunableBehavior) error { klog.V(2).InfoS("Updating kernel flag", "flag", flag, "expectedValue", expectedValue, "actualValue", val) err = sysctl.SetSysctl(flag, expectedValue) if err != nil { - if libcontaineruserns.RunningInUserNS() { + if inuserns.RunningInUserNS() { if utilfeature.DefaultFeatureGate.Enabled(kubefeatures.KubeletInUserNamespace) { klog.V(2).InfoS("Updating kernel flag failed (running in UserNS, ignoring)", "flag", flag, "err", err) continue diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go index bef8a2209b5..1d412181500 100644 --- a/pkg/kubelet/kubelet.go +++ b/pkg/kubelet/kubelet.go @@ -33,7 +33,6 @@ import ( cadvisorapi "github.com/google/cadvisor/info/v1" "github.com/google/go-cmp/cmp" - libcontaineruserns "github.com/opencontainers/runc/libcontainer/userns" "github.com/opencontainers/selinux/go-selinux" "go.opentelemetry.io/otel/attribute" semconv "go.opentelemetry.io/otel/semconv/v1.12.0" @@ -110,6 +109,7 @@ import ( "k8s.io/kubernetes/pkg/kubelet/token" kubetypes "k8s.io/kubernetes/pkg/kubelet/types" "k8s.io/kubernetes/pkg/kubelet/userns" + "k8s.io/kubernetes/pkg/kubelet/userns/inuserns" "k8s.io/kubernetes/pkg/kubelet/util" "k8s.io/kubernetes/pkg/kubelet/util/manager" "k8s.io/kubernetes/pkg/kubelet/util/queue" @@ -471,7 +471,7 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, oomWatcher, err := oomwatcher.NewWatcher(kubeDeps.Recorder) if err != nil { - if libcontaineruserns.RunningInUserNS() { + if inuserns.RunningInUserNS() { if utilfeature.DefaultFeatureGate.Enabled(features.KubeletInUserNamespace) { // oomwatcher.NewWatcher returns "open /dev/kmsg: operation not permitted" error, // when running in a user namespace with sysctl value `kernel.dmesg_restrict=1`. diff --git a/pkg/kubelet/userns/inuserns/inuserns_linux.go b/pkg/kubelet/userns/inuserns/inuserns_linux.go new file mode 100644 index 00000000000..656fcd64a22 --- /dev/null +++ b/pkg/kubelet/userns/inuserns/inuserns_linux.go @@ -0,0 +1,24 @@ +/* +Copyright 2024 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package inuserns + +import libcontaineruserns "github.com/opencontainers/runc/libcontainer/userns" + +// RunningInUserNS detects whether the current process is running in a user namespace. +func RunningInUserNS() bool { + return libcontaineruserns.RunningInUserNS() +} diff --git a/pkg/kubelet/userns/inuserns/inuserns_others.go b/pkg/kubelet/userns/inuserns/inuserns_others.go new file mode 100644 index 00000000000..b2693ca30a2 --- /dev/null +++ b/pkg/kubelet/userns/inuserns/inuserns_others.go @@ -0,0 +1,25 @@ +//go:build !linux +// +build !linux + +/* +Copyright 2024 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package inuserns + +// RunningInUserNS detects whether the current process is running in a user namespace. +func RunningInUserNS() bool { + return false +}