github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Switch 'ContainerCheckpoint' from Alpha to Beta

Browse Source 
* Forensic Container Checkpointing as described in KEP 2008 moves from
   Alpha to Beta. This is corresponding code change.

 * Adapt e2e test to handle
   '(rpc error: code = Unimplemented desc = unknown method CheckpointContainer'
   and
   '(rpc error: code = Unimplemented desc = method CheckpointContainer not implemented)'
   and
   '(rpc error: code = Unknown desc = checkpoint/restore support not available)'
   One error message is if the CRI implementation does
   not implement the CRI RPC (too old) and the second is
   if the CRI implementation does explicitly not support the feature.
   The third error message can be seen if the container engine
   explicitly disabled the checkpoint/restore support,

 * As described in the corresponding KEP 2008 explicitly test for
   disabled functionality.

 * Extended test to look for the checkpoint kubelet metric.

 * Extended test to look for the CRI error metric.

 *  Add separate sub-resource permission to control permissions on
    the checkpoint kubelet API endpoint

Signed-off-by: Adrian Reber <areber@redhat.com>
This commit is contained in:
Adrian Reber
2024-02-09 11:02:25 +00:00
parent f99638d315
commit da8ffcd1dc
6 changed files with 135 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
pkg/kubelet/server/server_test.go
View File

@@ -858,18 +858,24 @@ func TestContainerLogsWithInvalidTail(t *testing.T) {
}
func TestCheckpointContainer(t *testing.T) {
// Enable features.ContainerCheckpoint during test
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ContainerCheckpoint, true)()
fw := newServerTest()
defer fw.testHTTPServer.Close()
podNamespace := "other"
podName := "foo"
expectedContainerName := "baz"
// GetPodByName() should always fail
fw.fakeKubelet.podByNameFunc = func(namespace, name string) (*v1.Pod, bool) {
return nil, false
setupTest := func(featureGate bool) *serverTestFramework {
// Enable features.ContainerCheckpoint during test
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ContainerCheckpoint, featureGate)()
fw := newServerTest()
// GetPodByName() should always fail
fw.fakeKubelet.podByNameFunc = func(namespace, name string) (*v1.Pod, bool) {
return nil, false
}
return fw
}
fw := setupTest(true)
defer fw.testHTTPServer.Close()
t.Run("wrong pod namespace", func(t *testing.T) {
resp, err := http.Post(fw.testHTTPServer.URL+"/checkpoint/"+podNamespace+"/"+podName+"/"+expectedContainerName, "", nil)
if err != nil {
@@ -927,6 +933,19 @@ func TestCheckpointContainer(t *testing.T) {
}
assert.Equal(t, resp.StatusCode, 200)
})
// Now test for 404 if checkpointing support is explicitly disabled.
fw.testHTTPServer.Close()
fw = setupTest(false)
defer fw.testHTTPServer.Close()
setPodByNameFunc(fw, podNamespace, podName, expectedContainerName)
t.Run("checkpointing fails because disabled", func(t *testing.T) {
resp, err := http.Post(fw.testHTTPServer.URL+"/checkpoint/"+podNamespace+"/"+podName+"/"+expectedContainerName, "", nil)
if err != nil {
t.Errorf("Got error POSTing: %v", err)
}
assert.Equal(t, 404, resp.StatusCode)
})
}
func makeReq(t *testing.T, method, url, clientProtocol string) *http.Request {