github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-17 20:00:07 +00:00
Code Issues Projects Releases Wiki Activity

Remove workaround for an old bug.

Browse Source 
Kubernetes no longer supports containerd 1.7, and the workaround is
not needed with containerd 2.x (or cri-o).
This commit is contained in:
Dan Winship
2025-09-15 13:38:30 -04:00
parent 9998041e0f
commit 905492223b
2 changed files with 1 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
cmd/kube-proxy/app/conntrack.go
View File

@@ -18,14 +18,12 @@ package app
import (
"context"
"errors"
"os"
"strconv"
"strings"
"k8s.io/component-helpers/node/util/sysctl"
"k8s.io/klog/v2"
"k8s.io/mount-utils"
)
// Conntracker is an interface to the global sysctl. Descriptions of the various
@@ -50,8 +48,6 @@ type Conntracker interface {
type realConntracker struct {
}
var errReadOnlySysFS = errors.New("readOnlySysFS")
func (rct realConntracker) SetMax(ctx context.Context, max int) error {
logger := klog.FromContext(ctx)
logger.Info("Setting nf_conntrack_max", "nfConntrackMax", max)
@@ -68,20 +64,6 @@ func (rct realConntracker) SetMax(ctx context.Context, max int) error {
return nil
}
// sysfs is expected to be mounted as 'rw'. However, it may be unexpectedly
// mounted as 'ro' by docker because of known bugs (https://issues.k8s.io/134108).
// In that case we return a special error errReadOnlySysFS here, which the caller
// should deal with specially.
//
// TODO: this workaround can go away once we no longer support containerd 1.7.
writable, err := rct.isSysFSWritable(ctx)
if err != nil {
return err
}
if !writable {
return errReadOnlySysFS
}
logger.Info("Setting conntrack hashsize", "conntrackHashsize", max/4)
return writeIntStringFile("/sys/module/nf_conntrack/parameters/hashsize", max/4)
}
@@ -120,33 +102,6 @@ func (rct realConntracker) setIntSysCtl(ctx context.Context, name string, value
return nil
}
// isSysFSWritable checks /proc/mounts to see whether sysfs is 'rw' or not.
func (rct realConntracker) isSysFSWritable(ctx context.Context) (bool, error) {
logger := klog.FromContext(ctx)
const permWritable = "rw"
const sysfsDevice = "sysfs"
m := mount.New("" /* default mount path */)
mountPoints, err := m.List()
if err != nil {
logger.Error(err, "Failed to list mount points")
return false, err
}
for _, mountPoint := range mountPoints {
if mountPoint.Type != sysfsDevice {
continue
}
// Check whether sysfs is 'rw'
if len(mountPoint.Opts) > 0 && mountPoint.Opts[0] == permWritable {
return true, nil
}
logger.Error(nil, "Sysfs is not writable", "mountPoint", mountPoint, "mountOptions", mountPoint.Opts)
return false, errReadOnlySysFS
}
return false, errors.New("no sysfs mounted")
}
func readIntStringFile(filename string) (int, error) {
b, err := os.ReadFile(filename)
if err != nil {

10
cmd/kube-proxy/app/server_linux.go
View File

@@ -304,15 +304,7 @@ func (s *ProxyServer) setupConntrack(ctx context.Context, ct Conntracker) error
if max > 0 {
err := ct.SetMax(ctx, max)
if err != nil {
if err != errReadOnlySysFS {
return err
}
// errReadOnlySysFS means we ran into a known container runtim bug
// (https://issues.k8s.io/134108). For historical reasons we ignore
// this problem and just alert the admin that it occurred.
const message = "CRI error: /sys is read-only: " +
"cannot modify conntrack limits, problems may arise later (If running Docker, see docker issue #24000)"
s.Recorder.Eventf(s.NodeRef, nil, v1.EventTypeWarning, err.Error(), "StartKubeProxy", message)
return err
}
}