10aec359a0
A nil CRIImplementation field can cause a nil pointer dereference and panic during startup recovery. Prior to this change, the nri.API struct would have a nil cri (CRIImplementation) field after nri.NewAPI until nri.Register was called. Register is called mid-way through initialization of the CRI plugin, but recovery for containers occurs prior to that. Container recovery includes establishing new exit monitors for existing containers that were discovered. When a container exits, NRI plugins are given the opportunity to be notified about the lifecycle event, and this is done by accessing that CRIImplementation field inside the nri.API. If a container exits prior to nri.Register being called, access to the CRIImplementation field can cause a panic. Here's the call-path: * The CRI plugin starts running [here](ae71819c4f/pkg/cri/server/service.go (L222)) * It then [calls into](ae71819c4f/pkg/cri/server/service.go (L227)) `recover()` to recover state from previous runs of containerd * `recover()` then attempts to recover all containers through [`loadContainer()`](ae7d74b9e2/internal/cri/server/restart.go (L175)) * When `loadContainer()` finds a container that is still running, it waits for the task (internal containerd object) to exit and sets up [exit monitoring](ae7d74b9e2/internal/cri/server/restart.go (L391)) * Any exit that then happens must be [handled](ae7d74b9e2/internal/cri/server/events.go (L145)) * Handling an exit includes [deleting the Task](ae7d74b9e2/internal/cri/server/events.go (L188)) and specifying [`nri.WithContainerExit`](ae7d74b9e2/internal/cri/nri/nri_api_linux.go (L348)) to [notify](ae7d74b9e2/internal/cri/nri/nri_api_linux.go (L356)) any subscribed NRI plugins * NRI plugins need to know information about the pod (not just the sandbox), so before a plugin is notified the NRI API package [queries the Sandbox Store](ae7d74b9e2/internal/cri/nri/nri_api_linux.go (L232)) through the CRI implementation * The `cri` implementation member field in the `nri.API` struct is set as part of the [`Register()`](ae7d74b9e2/internal/cri/nri/nri_api_linux.go (L66)) method * The `nri.Register()` method is only called [much further down in the CRI `Run()` method](ae71819c4f/pkg/cri/server/service.go (L279)) Signed-off-by: Samuel Karp <samuelkarp@google.com>
146 lines
3.4 KiB
Go
146 lines
3.4 KiB
Go
//go:build !linux
|
|
|
|
/*
|
|
Copyright The containerd Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package nri
|
|
|
|
import (
|
|
"context"
|
|
|
|
containerd "github.com/containerd/containerd/v2/client"
|
|
"github.com/containerd/containerd/v2/core/containers"
|
|
cstore "github.com/containerd/containerd/v2/internal/cri/store/container"
|
|
sstore "github.com/containerd/containerd/v2/internal/cri/store/sandbox"
|
|
"github.com/opencontainers/runtime-spec/specs-go"
|
|
cri "k8s.io/cri-api/pkg/apis/runtime/v1"
|
|
|
|
"github.com/containerd/containerd/v2/internal/cri/constants"
|
|
"github.com/containerd/containerd/v2/internal/nri"
|
|
|
|
"github.com/containerd/nri/pkg/api"
|
|
)
|
|
|
|
type API struct {
|
|
}
|
|
|
|
func NewAPI(nri.API, CRIImplementation) *API {
|
|
return nil
|
|
}
|
|
|
|
func (a *API) Register() error {
|
|
return nil
|
|
}
|
|
|
|
func (a *API) IsEnabled() bool {
|
|
return false
|
|
}
|
|
|
|
//
|
|
// CRI-NRI lifecycle hook no-op interface
|
|
//
|
|
|
|
func (*API) RunPodSandbox(context.Context, *sstore.Sandbox) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) StopPodSandbox(context.Context, *sstore.Sandbox) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) RemovePodSandbox(context.Context, *sstore.Sandbox) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) PostCreateContainer(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) StartContainer(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) PostStartContainer(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) UpdateContainerResources(context.Context, *sstore.Sandbox, *cstore.Container, *cri.LinuxContainerResources) (*cri.LinuxContainerResources, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
func (*API) PostUpdateContainerResources(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) StopContainer(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) RemoveContainer(context.Context, *sstore.Sandbox, *cstore.Container) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) UndoCreateContainer(context.Context, *sstore.Sandbox, string, *specs.Spec) {
|
|
}
|
|
|
|
func (*API) WithContainerAdjustment() containerd.NewContainerOpts {
|
|
return func(ctx context.Context, _ *containerd.Client, c *containers.Container) error {
|
|
return nil
|
|
}
|
|
}
|
|
|
|
func (*API) WithContainerExit(*cstore.Container) containerd.ProcessDeleteOpts {
|
|
return func(_ context.Context, _ containerd.Process) error {
|
|
return nil
|
|
}
|
|
}
|
|
|
|
//
|
|
// NRI-CRI no-op 'domain' interface
|
|
//
|
|
|
|
const (
|
|
nriDomain = constants.K8sContainerdNamespace
|
|
)
|
|
|
|
func (*API) GetName() string {
|
|
return nriDomain
|
|
}
|
|
|
|
func (*API) ListPodSandboxes() []nri.PodSandbox {
|
|
return nil
|
|
}
|
|
|
|
func (*API) ListContainers() []nri.Container {
|
|
return nil
|
|
}
|
|
|
|
func (*API) GetPodSandbox(string) (nri.PodSandbox, bool) {
|
|
return nil, false
|
|
}
|
|
|
|
func (*API) GetContainer(string) (nri.Container, bool) {
|
|
return nil, false
|
|
}
|
|
|
|
func (*API) UpdateContainer(context.Context, *api.ContainerUpdate) error {
|
|
return nil
|
|
}
|
|
|
|
func (*API) EvictContainer(context.Context, *api.ContainerEviction) error {
|
|
return nil
|
|
}
|