mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-25 20:53:33 +00:00
Merge pull request #60181 from verb/pid-enable
Automatic merge from submit-queue (batch tested with PRs 59463, 59719, 60181, 58283, 59966). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Set shared PID namespace mode based on PodSpec **What this PR does / why we need it**: This PR enables pod process namespace sharing as an alpha feature, as described in [Shared PID Namespace Proposal](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node/pod-pid-namespace.md). **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: WIP #1615 **Special notes for your reviewer**: /assign @dchen1107 **Release note**: ```release-note When the `PodShareProcessNamespace` alpha feature is enabled, setting `pod.Spec.ShareProcessNamespace` to `true` will cause a single process namespace to be shared between all containers in a pod. ```
This commit is contained in:
commit
fe0e80e8da
@ -25,7 +25,9 @@ import (
|
|||||||
"github.com/golang/glog"
|
"github.com/golang/glog"
|
||||||
"k8s.io/api/core/v1"
|
"k8s.io/api/core/v1"
|
||||||
"k8s.io/apimachinery/pkg/types"
|
"k8s.io/apimachinery/pkg/types"
|
||||||
|
utilfeature "k8s.io/apiserver/pkg/util/feature"
|
||||||
v1helper "k8s.io/kubernetes/pkg/apis/core/v1/helper"
|
v1helper "k8s.io/kubernetes/pkg/apis/core/v1/helper"
|
||||||
|
"k8s.io/kubernetes/pkg/features"
|
||||||
runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
|
runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
|
||||||
kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
|
kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
|
||||||
)
|
)
|
||||||
@ -303,7 +305,9 @@ func pidNamespaceForPod(pod *v1.Pod) runtimeapi.NamespaceMode {
|
|||||||
if pod.Spec.HostPID {
|
if pod.Spec.HostPID {
|
||||||
return runtimeapi.NamespaceMode_NODE
|
return runtimeapi.NamespaceMode_NODE
|
||||||
}
|
}
|
||||||
// TODO(verb): set NamespaceMode_POD based on ShareProcessNamespace after #58716 is merged
|
if utilfeature.DefaultFeatureGate.Enabled(features.PodShareProcessNamespace) && pod.Spec.ShareProcessNamespace != nil && *pod.Spec.ShareProcessNamespace {
|
||||||
|
return runtimeapi.NamespaceMode_POD
|
||||||
|
}
|
||||||
}
|
}
|
||||||
// Note that PID does not default to the zero value for v1.Pod
|
// Note that PID does not default to the zero value for v1.Pod
|
||||||
return runtimeapi.NamespaceMode_CONTAINER
|
return runtimeapi.NamespaceMode_CONTAINER
|
||||||
|
@ -346,7 +346,75 @@ func TestNamespacesForPod(t *testing.T) {
|
|||||||
Pid: runtimeapi.NamespaceMode_NODE,
|
Pid: runtimeapi.NamespaceMode_NODE,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
// TODO(verb): add test cases for ShareProcessNamespace true (after #58716 is merged)
|
"Shared Process Namespace (feature enabled)": {
|
||||||
|
&v1.Pod{
|
||||||
|
Spec: v1.PodSpec{
|
||||||
|
ShareProcessNamespace: &[]bool{true}[0],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&runtimeapi.NamespaceOption{
|
||||||
|
Ipc: runtimeapi.NamespaceMode_POD,
|
||||||
|
Network: runtimeapi.NamespaceMode_POD,
|
||||||
|
Pid: runtimeapi.NamespaceMode_POD,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Shared Process Namespace, redundant flag (feature enabled)": {
|
||||||
|
&v1.Pod{
|
||||||
|
Spec: v1.PodSpec{
|
||||||
|
ShareProcessNamespace: &[]bool{false}[0],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&runtimeapi.NamespaceOption{
|
||||||
|
Ipc: runtimeapi.NamespaceMode_POD,
|
||||||
|
Network: runtimeapi.NamespaceMode_POD,
|
||||||
|
Pid: runtimeapi.NamespaceMode_CONTAINER,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
} {
|
||||||
|
t.Logf("TestCase: %s", desc)
|
||||||
|
actual := namespacesForPod(test.input)
|
||||||
|
assert.Equal(t, test.expected, actual)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Test ShareProcessNamespace feature disabled, feature gate restored by previous defer
|
||||||
|
utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.PodShareProcessNamespace, false)
|
||||||
|
|
||||||
|
for desc, test := range map[string]struct {
|
||||||
|
input *v1.Pod
|
||||||
|
expected *runtimeapi.NamespaceOption
|
||||||
|
}{
|
||||||
|
"v1.Pod default namespaces": {
|
||||||
|
&v1.Pod{},
|
||||||
|
&runtimeapi.NamespaceOption{
|
||||||
|
Ipc: runtimeapi.NamespaceMode_POD,
|
||||||
|
Network: runtimeapi.NamespaceMode_POD,
|
||||||
|
Pid: runtimeapi.NamespaceMode_CONTAINER,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Shared Process Namespace (feature disabled)": {
|
||||||
|
&v1.Pod{
|
||||||
|
Spec: v1.PodSpec{
|
||||||
|
ShareProcessNamespace: &[]bool{true}[0],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&runtimeapi.NamespaceOption{
|
||||||
|
Ipc: runtimeapi.NamespaceMode_POD,
|
||||||
|
Network: runtimeapi.NamespaceMode_POD,
|
||||||
|
Pid: runtimeapi.NamespaceMode_CONTAINER,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"Shared Process Namespace, redundant flag (feature disabled)": {
|
||||||
|
&v1.Pod{
|
||||||
|
Spec: v1.PodSpec{
|
||||||
|
ShareProcessNamespace: &[]bool{false}[0],
|
||||||
|
},
|
||||||
|
},
|
||||||
|
&runtimeapi.NamespaceOption{
|
||||||
|
Ipc: runtimeapi.NamespaceMode_POD,
|
||||||
|
Network: runtimeapi.NamespaceMode_POD,
|
||||||
|
Pid: runtimeapi.NamespaceMode_CONTAINER,
|
||||||
|
},
|
||||||
|
},
|
||||||
} {
|
} {
|
||||||
t.Logf("TestCase: %s", desc)
|
t.Logf("TestCase: %s", desc)
|
||||||
actual := namespacesForPod(test.input)
|
actual := namespacesForPod(test.input)
|
||||||
|
Loading…
Reference in New Issue
Block a user