ed47d6ba76
The rpc only reports one field, i.e. the cgroup driver, to kubelet. Containerd determines the effective cgroup driver by looking at all runtime handlers, starting from the default runtime handler (the rest in alphabetical order), and returning the cgroup driver setting of the first runtime handler that supports one. If no runtime handler supports cgroup driver (i.e. has a config option for it) containerd falls back to auto-detection, returning systemd if systemd is running and cgroupfs otherwise. This patch implements the CRI server side of Kubernetes KEP-4033: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4033-group-driver-detection-over-cri Signed-off-by: Markus Lehtonen <markus.lehtonen@intel.com>
69 lines
2.0 KiB
Go
69 lines
2.0 KiB
Go
package configs
|
|
|
|
import "errors"
|
|
|
|
var (
|
|
errNoUIDMap = errors.New("User namespaces enabled, but no uid mappings found.")
|
|
errNoUserMap = errors.New("User namespaces enabled, but no user mapping found.")
|
|
errNoGIDMap = errors.New("User namespaces enabled, but no gid mappings found.")
|
|
errNoGroupMap = errors.New("User namespaces enabled, but no group mapping found.")
|
|
)
|
|
|
|
// HostUID gets the translated uid for the process on host which could be
|
|
// different when user namespaces are enabled.
|
|
func (c Config) HostUID(containerId int) (int, error) {
|
|
if c.Namespaces.Contains(NEWUSER) {
|
|
if c.UidMappings == nil {
|
|
return -1, errNoUIDMap
|
|
}
|
|
id, found := c.hostIDFromMapping(containerId, c.UidMappings)
|
|
if !found {
|
|
return -1, errNoUserMap
|
|
}
|
|
return id, nil
|
|
}
|
|
// Return unchanged id.
|
|
return containerId, nil
|
|
}
|
|
|
|
// HostRootUID gets the root uid for the process on host which could be non-zero
|
|
// when user namespaces are enabled.
|
|
func (c Config) HostRootUID() (int, error) {
|
|
return c.HostUID(0)
|
|
}
|
|
|
|
// HostGID gets the translated gid for the process on host which could be
|
|
// different when user namespaces are enabled.
|
|
func (c Config) HostGID(containerId int) (int, error) {
|
|
if c.Namespaces.Contains(NEWUSER) {
|
|
if c.GidMappings == nil {
|
|
return -1, errNoGIDMap
|
|
}
|
|
id, found := c.hostIDFromMapping(containerId, c.GidMappings)
|
|
if !found {
|
|
return -1, errNoGroupMap
|
|
}
|
|
return id, nil
|
|
}
|
|
// Return unchanged id.
|
|
return containerId, nil
|
|
}
|
|
|
|
// HostRootGID gets the root gid for the process on host which could be non-zero
|
|
// when user namespaces are enabled.
|
|
func (c Config) HostRootGID() (int, error) {
|
|
return c.HostGID(0)
|
|
}
|
|
|
|
// Utility function that gets a host ID for a container ID from user namespace map
|
|
// if that ID is present in the map.
|
|
func (c Config) hostIDFromMapping(containerID int, uMap []IDMap) (int, bool) {
|
|
for _, m := range uMap {
|
|
if (containerID >= m.ContainerID) && (containerID <= (m.ContainerID + m.Size - 1)) {
|
|
hostID := m.HostID + (containerID - m.ContainerID)
|
|
return hostID, true
|
|
}
|
|
}
|
|
return -1, false
|
|
}
|