Commit Graph

8706 Commits

Author SHA1 Message Date
Phil Estes
9b4967bd6b
Merge pull request #4048 from fuweid/me-use-new-ctx-to-cleanup
bugfix: cleanup dangling shim by brand new context
2020-02-24 16:52:15 -05:00
Phil Estes
3b9f2e8540
Merge pull request #4051 from rancher/selinux
Use spec's mountLabel when mounting the rootfs
2020-02-24 16:51:21 -05:00
Brandon Lum
7a24da0375 Updated docs and encryption.md -> decryption.md
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
c5209cd679 Updated doc based on changes requested
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
ffcef9dc32 Addressed nits
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
8df431fc31 Defer multitenant key model to image auth discussion
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
c43a7588f6 Refactor encrypted opts and added unit test
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
ac8ec18813 bump imgcrypt commit version
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Brandon Lum
f0579c7b4d Implmented node key model for image encryption
Signed-off-by: Brandon Lum <lumjjb@gmail.com>
2020-02-24 20:45:57 +00:00
Darren Shepherd
c134a9befa Use spec's mountLabel when mounting the rootfs
In NewContainer if a SnapshotKey is used and the spec has
a mountLabel specified, that mountLabel should be used to mount
the rootfs.

Signed-off-by: Darren Shepherd <darren@rancher.com>
2020-02-24 10:04:05 -07:00
Phil Estes
2c5279e820
Merge pull request #4049 from fuweid/me-fix-flaky-testcase
cleanup the image synchronously for Usage case
2020-02-21 12:04:55 -05:00
Wei Fu
1d888ad6a6 cleanup the image synchronously for Usage case
TestImageIsUnpacked will unpacked docker.io/library/busybox:latest with
linux/amd64 platform. If the TestImageUsage doesn't wait for cleanup
finish (snapshotter is cleanup by gc asynchronously) and fetch image,
the Usage(ctx) will get 10767844 bytes(manifestUsage + snapshotUsage).

However, the manifestUsage is 9466142 bytes. That is why we got the
error:

```
Expected actual usage to equal manifest reported usage of 9466142:
got 10767844
```

This commit is to make sure that the image has been cleanup fully.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
2020-02-22 00:02:33 +08:00
Wei Fu
18e581dd91 bugfix: cleanup dangling shim by brand new context
When there is timeout or cancel for create container, killShim will fail
because of canceled context. The shim will be dangling and unmanageable.

Need to use new context to do cleanup.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
2020-02-21 16:49:58 +08:00
Justin Terry (SF)
fed8890e93 Enable CRI plugin for Windows builds as well
The builtins_cri_linux.go file only being included for _linux builds which
means that the builds for Windows do not contain the CRI plugin. This can
be disabled for either platform with the no_cri tag.

Signed-off-by: Justin Terry (SF) <juterry@microsoft.com>
2020-02-20 22:00:49 -08:00
Phil Estes
0e08405433
Merge pull request #4046 from darfux/cancel_shim_log_ctx_by_onclose
v2: Cancel shim log ctx when ttrpc is closed
2020-02-20 17:14:14 -05:00
Mike Brown
f4b3cdb892
Merge pull request #1399 from mikebrow/pause-image-update
move to v3.2 for the pause image
2020-02-20 10:45:16 -06:00
Li Yuxuan
84464b801f v2: Cancel shim log ctx when ttrpc is closed
The background context aovids shim blocking when the ctx is cancelled
unexpectedly during shim start. But if the shim exits unexpectedly
before opening the pipe, the fd will never be closed.
`onCloseWithShimLog` makes sure that the shim log fd is closed properly
once the shim disconnects.

Signed-off-by: Li Yuxuan <liyuxuan04@baidu.com>
2020-02-20 23:20:10 +08:00
Akihiro Suda
c23ed3befc
Merge pull request #1402 from thaJeztah/bump_crypto
vendor: golang.org/x/crypto 1d94cc7ab1c630336ab82ccb9c9cda72a875c382
2020-02-20 16:43:27 +09:00
Maksym Pavlenko
986d06785c
Merge pull request #4042 from thaJeztah/bump_crypto
vendor: golang.org/x/crypto 1d94cc7ab1c630336ab82ccb9c9cda72a875c382
2020-02-19 14:21:24 -08:00
Phil Estes
7f0bccf1a0
Merge pull request #4041 from elboulangero/remove-executable-bit-on-api-txt-files
Remove the executable bit for api/*.txt files
2020-02-19 10:04:41 -05:00
Sebastiaan van Stijn
f3652d0682
vendor: golang.org/x/crypto 1d94cc7ab1c630336ab82ccb9c9cda72a875c382
full diff: 69ecbb4d6d...1d94cc7ab1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-19 12:47:59 +01:00
Sebastiaan van Stijn
98ce6c022e
vendor: golang.org/x/crypto 1d94cc7ab1c630336ab82ccb9c9cda72a875c382
full diff: 60c769a6c5...1d94cc7ab1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-19 12:44:01 +01:00
Arnaud Rebillout
773adf7ab6 Remove the executable bit for api/*.txt files
These are text files so there's no reason these files are executable,
unless I'm missing something? Maybe it's something that doesn't show on
a Windows filesystem, only on Linux or macOS, hence nobody noticed?

Signed-off-by: Arnaud Rebillout <arnaud.rebillout@collabora.com>
2020-02-19 16:32:52 +07:00
Derek McGowan
986f294187
Merge pull request #3942 from hs0210/work
Add unit test for func in filter.go
2020-02-18 12:05:22 -08:00
Derek McGowan
724d0eb859
Merge pull request #4039 from AkihiroSuda/no-zfs
support building with BUILDTAGS="no_zfs no_aufs"
2020-02-18 11:39:38 -08:00
Akihiro Suda
8e685f78cf support building with BUILDTAGS="no_zfs no_aufs"
These plugins do not always need to be built-in.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-02-19 01:52:03 +09:00
Phil Estes
3fe22817ab
Merge pull request #4037 from thaJeztah/update_mailmap
Update mailmap
2020-02-18 09:38:56 -05:00
Sebastiaan van Stijn
61596169bb
Update .mailmap
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-18 10:24:08 +01:00
Sebastiaan van Stijn
f44d360992
Update .mailmap with changes from release-branches
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-18 09:33:42 +01:00
Akihiro Suda
04cda9b400
Merge pull request #4032 from thaJeztah/bump_golang_1.13.8
Update Golang 1.13.8
2020-02-18 02:43:22 +09:00
Sebastiaan van Stijn
499ab8a99a
Update Golang 1.13.8
full diff: https://github.com/golang/go/compare/go1.13.7...go1.13.8

go1.13.8 (released 2020/02/12) includes fixes to the runtime, the crypto/x509,
and net/http packages. See the Go 1.13.8 milestone on the issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.13.8+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-17 17:18:25 +01:00
Phil Estes
48d998f52c
Merge pull request #4034 from fuweid/me-use-current-git-for-critools
script: use github.com/kubernetes-sigs/cri-tools directly
2020-02-17 10:12:37 -05:00
Wei Fu
246a560edb script: use github.com/kubernetes-sigs/cri-tools directly
When we call `go get -d -v
github.com/kubernetes-incubator/cri-tools/...` which repos has been
moved to `github.com/kubernetes-sigs/cri-tools`, `go get` will create
package `github.com/kubernetes-sigs/cri-tools`.

```
go get -d -v github.com/kubernetes-incubator/cri-tools/...
github.com/kubernetes-incubator/cri-tools (download)
github.com/kubernetes-sigs/cri-tools (download)
```

According to old version of `github.com/kubernetes-incubator/cri-tools`
Makefile, if there is no `github.com/kubernetes-sigs/cri-tools` package,
it will create softlink self to `github.com/kubernetes-sigs/cri-tools`.
But `go get` will create `github.com/kubernetes-sigs/cri-tools` and
there is no softlink. Therefore, the critools are always latest one, not
specific version.

So, use `github.com/kubernetes-sigs/cri-tools` will be better and save
traffic from `go get`.

Signed-off-by: Wei Fu <fuweid89@gmail.com>
2020-02-17 21:52:39 +08:00
Maksym Pavlenko
27f25069c0
Merge pull request #4013 from estesp/support-32bit-arm64
Support 32-bit userspace on 64-bit ARM cores
2020-02-14 11:48:05 -08:00
Mike Brown
c9ed98462d move to v3.2 for the pause image
Signed-off-by: Mike Brown <brownwm@us.ibm.com>
2020-02-14 12:55:52 -06:00
Phil Estes
7811aa7552
Merge pull request #4022 from estesp/fix-script-comment
Fix incorrect comment from copy/paste of starting script
2020-02-13 14:22:59 -08:00
Phil Estes
75d0c5f2e7
Fix incorrect comment from copy/paste of starting script
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2020-02-13 11:48:12 -05:00
Wei Fu
e74962eaa6
Merge pull request #4018 from estesp/update-readme
Fix reference to LICENSE in README.md
2020-02-13 23:00:01 +08:00
Phil Estes
0dd6d24d2a
Fix reference to LICENSE in README.md
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2020-02-13 00:10:49 -05:00
Phil Estes
89de113de9
Support 32-bit userspace on 64-bit ARM cores
Don't rely on /proc/cpuinfo denoting a 64-bit ARMv8 processor if the
runtime detected GOARCH == arm. This allows aarch64 32-bit userspace
distros to run containers properly via a 32-bit runtime.

Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
2020-02-13 00:10:01 -05:00
Phil Estes
5abacb62da
Merge pull request #4017 from bloodorangeio/octet-stream-fix
Set octet-stream content-type on put request
2020-02-12 10:51:30 -08:00
Josh Dolitsky
d8a0d29c23 Set octet-stream content-type on put request
Signed-off-by: Josh Dolitsky <393494+jdolitsky@users.noreply.github.com>
2020-02-12 11:39:33 -06:00
Mike Brown
cf0e0a1e2c
Merge pull request #1332 from bg-chun/update_cri_for_hugepages
update cri-plugin to parse hugepages limit
2020-02-12 10:05:01 -06:00
Derek McGowan
cbf3ee0e22
Merge pull request #4010 from zhsj/fix-zsh-complete
Fix zsh autocomplete script
2020-02-11 10:39:04 -08:00
Shengjing Zhu
348e683ceb Fix zsh autocomplete script
Fix completion when argument startswith `-`
Merged in upstream https://github.com/urfave/cli/pull/1062

Signed-off-by: Shengjing Zhu <zhsj@debian.org>
2020-02-11 19:56:27 +08:00
Mike Brown
c955404ce7
Merge pull request #1384 from jterry75/fix_grpc_err
Fix store error serialization to gRPC status codes
2020-02-06 10:22:04 -06:00
Byonggon Chun
c02c24847f update cri-plugin to parse hugepages limit from CRI message
Signed-off-by: Byonggon Chun <bg.chun@samsung.com>
2020-02-06 15:28:24 +09:00
Justin Terry (VM)
a8cc66b37a Fix store error serialization to gRPC status codes
The pkg/store errors are duplicated errors of NotFound and AlreadyExist from
containerd's errdefs package and thus do not properly serialize when running
errdefs.ToGRPC on them. CRI runs this function on every return from a CRI
method so the conversion fails if there is a cache miss from the store caches
for containers or sandboxes. This change verifies that the errors are properly
converted to their gRPC values.

Signed-off-by: Justin Terry (VM) <juterry@microsoft.com>
2020-02-05 18:32:45 -08:00
Byonggon Chun
99c6e0dd51 Update Kubernetes dependencies for CRI update
update cri-api vendor to include hugepages changes
KEP: https://github.com/kubernetes/enhancements/pull/1199
CRI: https://github.com/kubernetes/kubernetes/pull/83614

Signed-off-by: Byonggon Chun <bg.chun@samsung.com>
2020-02-05 13:37:28 +09:00
Phil Estes
4f348c5b5b
Merge pull request #3999 from thaJeztah/bump_cri
vendor: bump cri, gopkg.in/yaml.v2 v2.2.8
2020-02-04 14:45:20 +01:00