80dd779deb
Close connection if no more data. It's to fix false alert filed by image
pull progress.
```
dst = OpenWriter (--> Content Store)
src = Fetch
Open (--> Registry)
Mark it as active request
Copy(dst, src) (--> Keep updating total received bytes)
^
| (Active Request > 0, but total received bytes won't be updated)
v
defer src.Close()
content.Commit(dst)
```
Before migrating to transfer service, CRI plugin doesn't limit global
concurrent downloads for ImagePulls. Each ImagePull requests have 3 concurrent
goroutines to download blob and 1 goroutine to unpack blob. Like ext4
filesystem [1][1], the fsync from content.Commit may sync unrelated dirty pages
into disk. The host is running under IO pressure, and then the content.Commit
will take long time and block other goroutines. If httpreadseeker
doesn't close the connection after io.EOF, this connection will be
considered as active. The pull progress reporter reports there is no
bytes transfered and cancels the ImagePull.
The original 1-minute timeout[2][2] is from kubelet settting. Since CRI-plugin
can't limit the total concurrent downloads, this patch is to update 1-minute
to 5-minutes to prevent from unexpected cancel.
[1]: https://lwn.net/Articles/842385/
[2]: https://github.com/kubernetes/kubernetes/blob/release-1.23/pkg/kubelet/config/flags.go#L45-L48
Signed-off-by: Wei Fu <fuweid89@gmail.com>
90 lines
3.2 KiB
Go
90 lines
3.2 KiB
Go
/*
|
|
Copyright The containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
|
|
containerd "github.com/containerd/containerd/v2/client"
|
|
"k8s.io/kubelet/pkg/cri/streaming"
|
|
)
|
|
|
|
// DefaultConfig returns default configurations of cri plugin.
|
|
func DefaultConfig() PluginConfig {
|
|
return PluginConfig{
|
|
CniConfig: CniConfig{
|
|
NetworkPluginBinDir: filepath.Join(os.Getenv("ProgramFiles"), "containerd", "cni", "bin"),
|
|
NetworkPluginConfDir: filepath.Join(os.Getenv("ProgramFiles"), "containerd", "cni", "conf"),
|
|
NetworkPluginMaxConfNum: 1,
|
|
NetworkPluginSetupSerially: false,
|
|
NetworkPluginConfTemplate: "",
|
|
},
|
|
ContainerdConfig: ContainerdConfig{
|
|
Snapshotter: containerd.DefaultSnapshotter,
|
|
DefaultRuntimeName: "runhcs-wcow-process",
|
|
Runtimes: map[string]Runtime{
|
|
"runhcs-wcow-process": {
|
|
Type: "io.containerd.runhcs.v1",
|
|
ContainerAnnotations: []string{"io.microsoft.container.*"},
|
|
},
|
|
"runhcs-wcow-hypervisor": {
|
|
Type: "io.containerd.runhcs.v1",
|
|
PodAnnotations: []string{"io.microsoft.virtualmachine.*"},
|
|
ContainerAnnotations: []string{"io.microsoft.container.*"},
|
|
// Full set of Windows shim options:
|
|
// https://pkg.go.dev/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options#Options
|
|
Options: map[string]interface{}{
|
|
// SandboxIsolation specifies the isolation level of the sandbox.
|
|
// PROCESS (0) and HYPERVISOR (1) are the valid options.
|
|
"SandboxIsolation": 1,
|
|
// ScaleCpuLimitsToSandbox indicates that the containers CPU
|
|
// maximum value (specifies the portion of processor cycles that
|
|
// a container can use as a percentage times 100) should be adjusted
|
|
// to account for the difference in the number of cores between the
|
|
// host and UVM.
|
|
//
|
|
// This should only be turned on if SandboxIsolation is 1.
|
|
"ScaleCpuLimitsToSandbox": true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
DisableTCPService: true,
|
|
StreamServerAddress: "127.0.0.1",
|
|
StreamServerPort: "0",
|
|
StreamIdleTimeout: streaming.DefaultConfig.StreamIdleTimeout.String(), // 4 hour
|
|
EnableTLSStreaming: false,
|
|
X509KeyPairStreaming: X509KeyPairStreaming{
|
|
TLSKeyFile: "",
|
|
TLSCertFile: "",
|
|
},
|
|
SandboxImage: "registry.k8s.io/pause:3.9",
|
|
StatsCollectPeriod: 10,
|
|
MaxContainerLogLineSize: 16 * 1024,
|
|
MaxConcurrentDownloads: 3,
|
|
IgnoreImageDefinedVolumes: false,
|
|
// TODO(windows): Add platform specific config, so that most common defaults can be shared.
|
|
|
|
ImageDecryption: ImageDecryption{
|
|
KeyModel: KeyModelNode,
|
|
},
|
|
ImagePullProgressTimeout: defaultImagePullProgressTimeoutDuration.String(),
|
|
DrainExecSyncIOTimeout: "0s",
|
|
}
|
|
}
|