Move CRI from pkg/ to internal/
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
This commit is contained in:
Maksym Pavlenko
782
internal/cri/server/container_create_test.go
Normal file
782
internal/cri/server/container_create_test.go
Normal file
@@ -0,0 +1,782 @@
|
||||
/*
|
||||
Copyright The containerd Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package server
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
goruntime "runtime"
|
||||
"testing"
|
||||
|
||||
ostesting "github.com/containerd/containerd/v2/pkg/os/testing"
|
||||
"github.com/containerd/platforms"
|
||||
|
||||
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
|
||||
|
||||
"github.com/containerd/containerd/v2/internal/cri/config"
|
||||
"github.com/containerd/containerd/v2/internal/cri/constants"
|
||||
"github.com/containerd/containerd/v2/internal/cri/opts"
|
||||
"github.com/containerd/containerd/v2/pkg/oci"
|
||||
)
|
||||
|
||||
var currentPlatform = platforms.DefaultSpec()
|
||||
|
||||
func checkMount(t *testing.T, mounts []runtimespec.Mount, src, dest, typ string,
|
||||
contains, notcontains []string) {
|
||||
found := false
|
||||
for _, m := range mounts {
|
||||
if m.Source == src && m.Destination == dest {
|
||||
assert.Equal(t, m.Type, typ)
|
||||
for _, c := range contains {
|
||||
assert.Contains(t, m.Options, c)
|
||||
}
|
||||
for _, n := range notcontains {
|
||||
assert.NotContains(t, m.Options, n)
|
||||
}
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
assert.True(t, found, "mount from %q to %q not found", src, dest)
|
||||
}
|
||||
|
||||
const testImageName = "container-image-name"
|
||||
|
||||
func TestGeneralContainerSpec(t *testing.T) {
|
||||
testID := "test-id"
|
||||
testPid := uint32(1234)
|
||||
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
|
||||
ociRuntime := config.Runtime{}
|
||||
c := newTestCRIService()
|
||||
testSandboxID := "sandbox-id"
|
||||
testContainerName := "container-name"
|
||||
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
|
||||
require.NoError(t, err)
|
||||
specCheck(t, testID, testSandboxID, testPid, spec)
|
||||
}
|
||||
|
||||
func TestPodAnnotationPassthroughContainerSpec(t *testing.T) {
|
||||
switch goruntime.GOOS {
|
||||
case "darwin":
|
||||
t.Skip("not implemented on Darwin")
|
||||
case "freebsd":
|
||||
t.Skip("not implemented on FreeBSD")
|
||||
}
|
||||
|
||||
testID := "test-id"
|
||||
testSandboxID := "sandbox-id"
|
||||
testContainerName := "container-name"
|
||||
testPid := uint32(1234)
|
||||
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
podAnnotations []string
|
||||
configChange func(*runtime.PodSandboxConfig)
|
||||
specCheck func(*testing.T, *runtimespec.Spec)
|
||||
}{
|
||||
{
|
||||
desc: "a passthrough annotation should be passed as an OCI annotation",
|
||||
podAnnotations: []string{"c"},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
assert.Equal(t, spec.Annotations["c"], "d")
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "a non-passthrough annotation should not be passed as an OCI annotation",
|
||||
configChange: func(c *runtime.PodSandboxConfig) {
|
||||
c.Annotations["d"] = "e"
|
||||
},
|
||||
podAnnotations: []string{"c"},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
assert.Equal(t, spec.Annotations["c"], "d")
|
||||
_, ok := spec.Annotations["d"]
|
||||
assert.False(t, ok)
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "passthrough annotations should support wildcard match",
|
||||
configChange: func(c *runtime.PodSandboxConfig) {
|
||||
c.Annotations["t.f"] = "j"
|
||||
c.Annotations["z.g"] = "o"
|
||||
c.Annotations["z"] = "o"
|
||||
c.Annotations["y.ca"] = "b"
|
||||
c.Annotations["y"] = "b"
|
||||
},
|
||||
podAnnotations: []string{"t*", "z.*", "y.c*"},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
t.Logf("%+v", spec.Annotations)
|
||||
assert.Equal(t, spec.Annotations["t.f"], "j")
|
||||
assert.Equal(t, spec.Annotations["z.g"], "o")
|
||||
assert.Equal(t, spec.Annotations["y.ca"], "b")
|
||||
_, ok := spec.Annotations["y"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["z"]
|
||||
assert.False(t, ok)
|
||||
},
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
c := newTestCRIService()
|
||||
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
|
||||
if test.configChange != nil {
|
||||
test.configChange(sandboxConfig)
|
||||
}
|
||||
|
||||
ociRuntime := config.Runtime{
|
||||
PodAnnotations: test.podAnnotations,
|
||||
}
|
||||
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName,
|
||||
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
|
||||
assert.NoError(t, err)
|
||||
assert.NotNil(t, spec)
|
||||
specCheck(t, testID, testSandboxID, testPid, spec)
|
||||
if test.specCheck != nil {
|
||||
test.specCheck(t, spec)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestContainerSpecCommand(t *testing.T) {
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
criEntrypoint []string
|
||||
criArgs []string
|
||||
imageEntrypoint []string
|
||||
imageArgs []string
|
||||
expected []string
|
||||
expectErr bool
|
||||
}{
|
||||
{
|
||||
desc: "should use cri entrypoint if it's specified",
|
||||
criEntrypoint: []string{"a", "b"},
|
||||
imageEntrypoint: []string{"c", "d"},
|
||||
imageArgs: []string{"e", "f"},
|
||||
expected: []string{"a", "b"},
|
||||
},
|
||||
{
|
||||
desc: "should use cri entrypoint if it's specified even if it's empty",
|
||||
criEntrypoint: []string{},
|
||||
criArgs: []string{"a", "b"},
|
||||
imageEntrypoint: []string{"c", "d"},
|
||||
imageArgs: []string{"e", "f"},
|
||||
expected: []string{"a", "b"},
|
||||
},
|
||||
{
|
||||
desc: "should use cri entrypoint and args if they are specified",
|
||||
criEntrypoint: []string{"a", "b"},
|
||||
criArgs: []string{"c", "d"},
|
||||
imageEntrypoint: []string{"e", "f"},
|
||||
imageArgs: []string{"g", "h"},
|
||||
expected: []string{"a", "b", "c", "d"},
|
||||
},
|
||||
{
|
||||
desc: "should use image entrypoint if cri entrypoint is not specified",
|
||||
criArgs: []string{"a", "b"},
|
||||
imageEntrypoint: []string{"c", "d"},
|
||||
imageArgs: []string{"e", "f"},
|
||||
expected: []string{"c", "d", "a", "b"},
|
||||
},
|
||||
{
|
||||
desc: "should use image args if both cri entrypoint and args are not specified",
|
||||
imageEntrypoint: []string{"c", "d"},
|
||||
imageArgs: []string{"e", "f"},
|
||||
expected: []string{"c", "d", "e", "f"},
|
||||
},
|
||||
{
|
||||
desc: "should return error if both entrypoint and args are empty",
|
||||
expectErr: true,
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
config, _, imageConfig, _ := getCreateContainerTestData()
|
||||
config.Command = test.criEntrypoint
|
||||
config.Args = test.criArgs
|
||||
imageConfig.Entrypoint = test.imageEntrypoint
|
||||
imageConfig.Cmd = test.imageArgs
|
||||
|
||||
var spec runtimespec.Spec
|
||||
err := opts.WithProcessArgs(config, imageConfig)(context.Background(), nil, nil, &spec)
|
||||
if test.expectErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
assert.NoError(t, err)
|
||||
assert.Equal(t, test.expected, spec.Process.Args, test.desc)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestVolumeMounts(t *testing.T) {
|
||||
testContainerRootDir := "test-container-root"
|
||||
idmap := []*runtime.IDMapping{
|
||||
{
|
||||
ContainerId: 0,
|
||||
HostId: 100,
|
||||
Length: 1,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
platform platforms.Platform
|
||||
criMounts []*runtime.Mount
|
||||
usernsEnabled bool
|
||||
imageVolumes map[string]struct{}
|
||||
expectedMountDest []string
|
||||
expectedMappings []*runtime.IDMapping
|
||||
}{
|
||||
{
|
||||
desc: "should setup rw mount for image volumes",
|
||||
imageVolumes: map[string]struct{}{
|
||||
"/test-volume-1": {},
|
||||
"/test-volume-2": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-1",
|
||||
"/test-volume-2",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should skip image volumes if already mounted by CRI",
|
||||
criMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/test-volume-1",
|
||||
HostPath: "/test-hostpath-1",
|
||||
},
|
||||
},
|
||||
imageVolumes: map[string]struct{}{
|
||||
"/test-volume-1": {},
|
||||
"/test-volume-2": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-2",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should compare and return cleanpath",
|
||||
criMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/test-volume-1",
|
||||
HostPath: "/test-hostpath-1",
|
||||
},
|
||||
},
|
||||
imageVolumes: map[string]struct{}{
|
||||
"/test-volume-1/": {},
|
||||
"/test-volume-2/": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-2/",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should make relative paths absolute on Linux",
|
||||
platform: platforms.Platform{OS: "linux"},
|
||||
imageVolumes: map[string]struct{}{
|
||||
"./test-volume-1": {},
|
||||
"C:/test-volume-2": {},
|
||||
"../../test-volume-3": {},
|
||||
"/abs/test-volume-4": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-1",
|
||||
"/C:/test-volume-2",
|
||||
"/test-volume-3",
|
||||
"/abs/test-volume-4",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should include mappings for image volumes on Linux",
|
||||
platform: platforms.Platform{OS: "linux"},
|
||||
usernsEnabled: true,
|
||||
imageVolumes: map[string]struct{}{
|
||||
"/test-volume-1/": {},
|
||||
"/test-volume-2/": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-2/",
|
||||
"/test-volume-2/",
|
||||
},
|
||||
expectedMappings: idmap,
|
||||
},
|
||||
{
|
||||
desc: "should NOT include mappings for image volumes on Linux if !userns",
|
||||
platform: platforms.Platform{OS: "linux"},
|
||||
usernsEnabled: false,
|
||||
imageVolumes: map[string]struct{}{
|
||||
"/test-volume-1/": {},
|
||||
"/test-volume-2/": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-2/",
|
||||
"/test-volume-2/",
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should convert rel imageVolume paths to abs paths and add userns mappings",
|
||||
platform: platforms.Platform{OS: "linux"},
|
||||
usernsEnabled: true,
|
||||
imageVolumes: map[string]struct{}{
|
||||
"test-volume-1/": {},
|
||||
"C:/test-volume-2/": {},
|
||||
"../../test-volume-3/": {},
|
||||
},
|
||||
expectedMountDest: []string{
|
||||
"/test-volume-1",
|
||||
"/C:/test-volume-2",
|
||||
"/test-volume-3",
|
||||
},
|
||||
expectedMappings: idmap,
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
config := &imagespec.ImageConfig{
|
||||
Volumes: test.imageVolumes,
|
||||
}
|
||||
containerConfig := &runtime.ContainerConfig{Mounts: test.criMounts}
|
||||
if test.usernsEnabled {
|
||||
containerConfig.Linux = &runtime.LinuxContainerConfig{
|
||||
SecurityContext: &runtime.LinuxContainerSecurityContext{
|
||||
NamespaceOptions: &runtime.NamespaceOption{
|
||||
UsernsOptions: &runtime.UserNamespace{
|
||||
Mode: runtime.NamespaceMode_POD,
|
||||
Uids: idmap,
|
||||
Gids: idmap,
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
c := newTestCRIService()
|
||||
got := c.volumeMounts(test.platform, testContainerRootDir, containerConfig, config)
|
||||
assert.Len(t, got, len(test.expectedMountDest))
|
||||
for _, dest := range test.expectedMountDest {
|
||||
found := false
|
||||
for _, m := range got {
|
||||
if m.ContainerPath != dest {
|
||||
continue
|
||||
}
|
||||
found = true
|
||||
assert.Equal(t,
|
||||
filepath.Dir(m.HostPath),
|
||||
filepath.Join(testContainerRootDir, "volumes"))
|
||||
if test.expectedMappings != nil {
|
||||
assert.Equal(t, test.expectedMappings, m.UidMappings)
|
||||
assert.Equal(t, test.expectedMappings, m.GidMappings)
|
||||
}
|
||||
break
|
||||
}
|
||||
assert.True(t, found)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestContainerAnnotationPassthroughContainerSpec(t *testing.T) {
|
||||
switch goruntime.GOOS {
|
||||
case "darwin":
|
||||
t.Skip("not implemented on Darwin")
|
||||
case "freebsd":
|
||||
t.Skip("not implemented on FreeBSD")
|
||||
}
|
||||
|
||||
testID := "test-id"
|
||||
testSandboxID := "sandbox-id"
|
||||
testContainerName := "container-name"
|
||||
testPid := uint32(1234)
|
||||
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
podAnnotations []string
|
||||
containerAnnotations []string
|
||||
podConfigChange func(*runtime.PodSandboxConfig)
|
||||
configChange func(*runtime.ContainerConfig)
|
||||
specCheck func(*testing.T, *runtimespec.Spec)
|
||||
}{
|
||||
{
|
||||
desc: "passthrough annotations from pod and container should be passed as an OCI annotation",
|
||||
podConfigChange: func(p *runtime.PodSandboxConfig) {
|
||||
p.Annotations["pod.annotation.1"] = "1"
|
||||
p.Annotations["pod.annotation.2"] = "2"
|
||||
p.Annotations["pod.annotation.3"] = "3"
|
||||
},
|
||||
configChange: func(c *runtime.ContainerConfig) {
|
||||
c.Annotations["container.annotation.1"] = "1"
|
||||
c.Annotations["container.annotation.2"] = "2"
|
||||
c.Annotations["container.annotation.3"] = "3"
|
||||
},
|
||||
podAnnotations: []string{"pod.annotation.1"},
|
||||
containerAnnotations: []string{"container.annotation.1"},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
assert.Equal(t, "1", spec.Annotations["container.annotation.1"])
|
||||
_, ok := spec.Annotations["container.annotation.2"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["container.annotation.3"]
|
||||
assert.False(t, ok)
|
||||
assert.Equal(t, "1", spec.Annotations["pod.annotation.1"])
|
||||
_, ok = spec.Annotations["pod.annotation.2"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["pod.annotation.3"]
|
||||
assert.False(t, ok)
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "passthrough annotations from pod and container should support wildcard",
|
||||
podConfigChange: func(p *runtime.PodSandboxConfig) {
|
||||
p.Annotations["pod.annotation.1"] = "1"
|
||||
p.Annotations["pod.annotation.2"] = "2"
|
||||
p.Annotations["pod.annotation.3"] = "3"
|
||||
},
|
||||
configChange: func(c *runtime.ContainerConfig) {
|
||||
c.Annotations["container.annotation.1"] = "1"
|
||||
c.Annotations["container.annotation.2"] = "2"
|
||||
c.Annotations["container.annotation.3"] = "3"
|
||||
},
|
||||
podAnnotations: []string{"pod.annotation.*"},
|
||||
containerAnnotations: []string{"container.annotation.*"},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
assert.Equal(t, "1", spec.Annotations["container.annotation.1"])
|
||||
assert.Equal(t, "2", spec.Annotations["container.annotation.2"])
|
||||
assert.Equal(t, "3", spec.Annotations["container.annotation.3"])
|
||||
assert.Equal(t, "1", spec.Annotations["pod.annotation.1"])
|
||||
assert.Equal(t, "2", spec.Annotations["pod.annotation.2"])
|
||||
assert.Equal(t, "3", spec.Annotations["pod.annotation.3"])
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "annotations should not pass through if no passthrough annotations are configured",
|
||||
podConfigChange: func(p *runtime.PodSandboxConfig) {
|
||||
p.Annotations["pod.annotation.1"] = "1"
|
||||
p.Annotations["pod.annotation.2"] = "2"
|
||||
p.Annotations["pod.annotation.3"] = "3"
|
||||
},
|
||||
configChange: func(c *runtime.ContainerConfig) {
|
||||
c.Annotations["container.annotation.1"] = "1"
|
||||
c.Annotations["container.annotation.2"] = "2"
|
||||
c.Annotations["container.annotation.3"] = "3"
|
||||
},
|
||||
podAnnotations: []string{},
|
||||
containerAnnotations: []string{},
|
||||
specCheck: func(t *testing.T, spec *runtimespec.Spec) {
|
||||
_, ok := spec.Annotations["container.annotation.1"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["container.annotation.2"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["container.annotation.3"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["pod.annotation.1"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["pod.annotation.2"]
|
||||
assert.False(t, ok)
|
||||
_, ok = spec.Annotations["pod.annotation.3"]
|
||||
assert.False(t, ok)
|
||||
},
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
c := newTestCRIService()
|
||||
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
|
||||
if test.configChange != nil {
|
||||
test.configChange(containerConfig)
|
||||
}
|
||||
if test.podConfigChange != nil {
|
||||
test.podConfigChange(sandboxConfig)
|
||||
}
|
||||
ociRuntime := config.Runtime{
|
||||
PodAnnotations: test.podAnnotations,
|
||||
ContainerAnnotations: test.containerAnnotations,
|
||||
}
|
||||
spec, err := c.buildContainerSpec(currentPlatform, testID, testSandboxID, testPid, "", testContainerName, testImageName,
|
||||
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
|
||||
assert.NoError(t, err)
|
||||
assert.NotNil(t, spec)
|
||||
specCheck(t, testID, testSandboxID, testPid, spec)
|
||||
if test.specCheck != nil {
|
||||
test.specCheck(t, spec)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBaseRuntimeSpec(t *testing.T) {
|
||||
c := newTestCRIService(withRuntimeService(&fakeRuntimeService{
|
||||
ocispecs: map[string]*oci.Spec{
|
||||
"/etc/containerd/cri-base.json": {
|
||||
Version: "1.0.2",
|
||||
Hostname: "old",
|
||||
},
|
||||
},
|
||||
}))
|
||||
|
||||
out, err := c.runtimeSpec(
|
||||
"id1",
|
||||
platforms.DefaultSpec(),
|
||||
"/etc/containerd/cri-base.json",
|
||||
oci.WithHostname("new-host"),
|
||||
oci.WithDomainname("new-domain"),
|
||||
)
|
||||
assert.NoError(t, err)
|
||||
|
||||
assert.Equal(t, "1.0.2", out.Version)
|
||||
assert.Equal(t, "new-host", out.Hostname)
|
||||
assert.Equal(t, "new-domain", out.Domainname)
|
||||
|
||||
// Make sure original base spec not changed
|
||||
spec, err := c.LoadOCISpec("/etc/containerd/cri-base.json")
|
||||
assert.NoError(t, err)
|
||||
assert.NotEqual(t, out, spec)
|
||||
assert.Equal(t, spec.Hostname, "old")
|
||||
|
||||
assert.Equal(t, filepath.Join("/", constants.K8sContainerdNamespace, "id1"), out.Linux.CgroupsPath)
|
||||
}
|
||||
|
||||
func TestLinuxContainerMounts(t *testing.T) {
|
||||
const testSandboxID = "test-id"
|
||||
idmap := []*runtime.IDMapping{
|
||||
{
|
||||
ContainerId: 0,
|
||||
HostId: 100,
|
||||
Length: 1,
|
||||
},
|
||||
}
|
||||
|
||||
for _, test := range []struct {
|
||||
desc string
|
||||
statFn func(string) (os.FileInfo, error)
|
||||
criMounts []*runtime.Mount
|
||||
securityContext *runtime.LinuxContainerSecurityContext
|
||||
expectedMounts []*runtime.Mount
|
||||
}{
|
||||
{
|
||||
desc: "should setup ro mount when rootfs is read-only",
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{
|
||||
ReadonlyRootfs: true,
|
||||
},
|
||||
expectedMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hostname",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
|
||||
Readonly: true,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
|
||||
Readonly: true,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
|
||||
Readonly: true,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should setup rw mount when rootfs is read-write",
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{},
|
||||
expectedMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hostname",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should setup uidMappings/gidMappings when userns is used",
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{
|
||||
NamespaceOptions: &runtime.NamespaceOption{
|
||||
UsernsOptions: &runtime.UserNamespace{
|
||||
Mode: runtime.NamespaceMode_POD,
|
||||
Uids: idmap,
|
||||
Gids: idmap,
|
||||
},
|
||||
},
|
||||
},
|
||||
expectedMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hostname",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
UidMappings: idmap,
|
||||
GidMappings: idmap,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
UidMappings: idmap,
|
||||
GidMappings: idmap,
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
UidMappings: idmap,
|
||||
GidMappings: idmap,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should use host /dev/shm when host ipc is set",
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{
|
||||
NamespaceOptions: &runtime.NamespaceOption{Ipc: runtime.NamespaceMode_NODE},
|
||||
},
|
||||
expectedMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hostname",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: "/dev/shm",
|
||||
Readonly: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
desc: "should skip container mounts if already mounted by CRI",
|
||||
criMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hostname",
|
||||
HostPath: "/test-etc-hostname",
|
||||
},
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: "/test-etc-host",
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: "test-resolv-conf",
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: "test-dev-shm",
|
||||
},
|
||||
},
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{},
|
||||
expectedMounts: nil,
|
||||
},
|
||||
{
|
||||
desc: "should skip hostname mount if the old sandbox doesn't have hostname file",
|
||||
statFn: func(path string) (os.FileInfo, error) {
|
||||
assert.Equal(t, filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hostname"), path)
|
||||
return nil, errors.New("random error")
|
||||
},
|
||||
securityContext: &runtime.LinuxContainerSecurityContext{},
|
||||
expectedMounts: []*runtime.Mount{
|
||||
{
|
||||
ContainerPath: "/etc/hosts",
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "hosts"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: resolvConfPath,
|
||||
HostPath: filepath.Join(testRootDir, sandboxesDir, testSandboxID, "resolv.conf"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
{
|
||||
ContainerPath: "/dev/shm",
|
||||
HostPath: filepath.Join(testStateDir, sandboxesDir, testSandboxID, "shm"),
|
||||
Readonly: false,
|
||||
SelinuxRelabel: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
} {
|
||||
test := test
|
||||
t.Run(test.desc, func(t *testing.T) {
|
||||
config := &runtime.ContainerConfig{
|
||||
Metadata: &runtime.ContainerMetadata{
|
||||
Name: "test-name",
|
||||
Attempt: 1,
|
||||
},
|
||||
Mounts: test.criMounts,
|
||||
Linux: &runtime.LinuxContainerConfig{
|
||||
SecurityContext: test.securityContext,
|
||||
},
|
||||
}
|
||||
c := newTestCRIService()
|
||||
c.os.(*ostesting.FakeOS).StatFn = test.statFn
|
||||
mounts := c.linuxContainerMounts(testSandboxID, config)
|
||||
assert.Equal(t, test.expectedMounts, mounts, test.desc)
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user