4d4edcb27b
https://github.com/kubernetes/kubernetes/pull/74737 introduced a new in-memory map for the dockershim, that could potentially (in pathological cases) cause memory leaks - for containers that use GMSA cred specs, get created successfully, but then never get started nor removed. This patch addresses this issue by making container removal fail altogether when platform-specific clean ups fail: this allows clean ups to be retried later, when the kubelet attempts to remove the container again. Resolves issue https://github.com/kubernetes/kubernetes/issues/74843. Signed-off-by: Jean Rouge <rougej+github@gmail.com>
48 lines
1.9 KiB
Go
48 lines
1.9 KiB
Go
// +build !windows
|
|
|
|
/*
|
|
Copyright 2019 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package dockershim
|
|
|
|
import (
|
|
dockertypes "github.com/docker/docker/api/types"
|
|
runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
|
|
)
|
|
|
|
type containerCleanupInfo struct{}
|
|
|
|
// applyPlatformSpecificDockerConfig applies platform-specific configurations to a dockertypes.ContainerCreateConfig struct.
|
|
// The containerCleanupInfo struct it returns will be passed as is to performPlatformSpecificContainerCleanup
|
|
// after either the container creation has failed or the container has been removed.
|
|
func (ds *dockerService) applyPlatformSpecificDockerConfig(*runtimeapi.CreateContainerRequest, *dockertypes.ContainerCreateConfig) (*containerCleanupInfo, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// performPlatformSpecificContainerCleanup is responsible for doing any platform-specific cleanup
|
|
// after either the container creation has failed or the container has been removed.
|
|
func (ds *dockerService) performPlatformSpecificContainerCleanup(cleanupInfo *containerCleanupInfo) (errors []error) {
|
|
return
|
|
}
|
|
|
|
// platformSpecificContainerInitCleanup is called when dockershim
|
|
// is starting, and is meant to clean up any cruft left by previous runs
|
|
// creating containers.
|
|
// Errors are simply logged, but don't prevent dockershim from starting.
|
|
func (ds *dockerService) platformSpecificContainerInitCleanup() (errors []error) {
|
|
return
|
|
}
|