|
| 1 | +/* |
| 2 | + Copyright The containerd Authors. |
| 3 | +
|
| 4 | + Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + you may not use this file except in compliance with the License. |
| 6 | + You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | + Unless required by applicable law or agreed to in writing, software |
| 11 | + distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + See the License for the specific language governing permissions and |
| 14 | + limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package podsandbox |
| 18 | + |
| 19 | +import ( |
| 20 | + "context" |
| 21 | + "fmt" |
| 22 | + goruntime "runtime" |
| 23 | + "time" |
| 24 | + |
| 25 | + "github.com/containerd/containerd/pkg/netns" |
| 26 | + "github.com/containerd/typeurl/v2" |
| 27 | + runtime "k8s.io/cri-api/pkg/apis/runtime/v1" |
| 28 | + |
| 29 | + "github.com/containerd/containerd" |
| 30 | + "github.com/containerd/containerd/errdefs" |
| 31 | + "github.com/containerd/containerd/log" |
| 32 | + sandboxstore "github.com/containerd/containerd/pkg/cri/store/sandbox" |
| 33 | + ctrdutil "github.com/containerd/containerd/pkg/cri/util" |
| 34 | +) |
| 35 | + |
| 36 | +// loadContainerTimeout is the default timeout for loading a container/sandbox. |
| 37 | +// One container/sandbox hangs (e.g. containerd#2438) should not affect other |
| 38 | +// containers/sandboxes. |
| 39 | +// Most CRI container/sandbox related operations are per container, the ones |
| 40 | +// which handle multiple containers at a time are: |
| 41 | +// * ListPodSandboxes: Don't talk with containerd services. |
| 42 | +// * ListContainers: Don't talk with containerd services. |
| 43 | +// * ListContainerStats: Not in critical code path, a default timeout will |
| 44 | +// be applied at CRI level. |
| 45 | +// * Recovery logic: We should set a time for each container/sandbox recovery. |
| 46 | +// * Event monitor: We should set a timeout for each container/sandbox event handling. |
| 47 | +const loadContainerTimeout = 10 * time.Second |
| 48 | + |
| 49 | +func (c *Controller) RecoverContainer(ctx context.Context, cntr containerd.Container) (sandboxstore.Sandbox, error) { |
| 50 | + ctx, cancel := context.WithTimeout(ctx, loadContainerTimeout) |
| 51 | + defer cancel() |
| 52 | + var sandbox sandboxstore.Sandbox |
| 53 | + // Load sandbox metadata. |
| 54 | + exts, err := cntr.Extensions(ctx) |
| 55 | + if err != nil { |
| 56 | + return sandbox, fmt.Errorf("failed to get sandbox container extensions: %w", err) |
| 57 | + } |
| 58 | + ext, ok := exts[sandboxMetadataExtension] |
| 59 | + if !ok { |
| 60 | + return sandbox, fmt.Errorf("metadata extension %q not found", sandboxMetadataExtension) |
| 61 | + } |
| 62 | + data, err := typeurl.UnmarshalAny(ext) |
| 63 | + if err != nil { |
| 64 | + return sandbox, fmt.Errorf("failed to unmarshal metadata extension %q: %w", ext, err) |
| 65 | + } |
| 66 | + meta := data.(*sandboxstore.Metadata) |
| 67 | + |
| 68 | + s, err := func() (sandboxstore.Status, error) { |
| 69 | + status := sandboxstore.Status{ |
| 70 | + State: sandboxstore.StateUnknown, |
| 71 | + } |
| 72 | + // Load sandbox created timestamp. |
| 73 | + info, err := cntr.Info(ctx) |
| 74 | + if err != nil { |
| 75 | + return status, fmt.Errorf("failed to get sandbox container info: %w", err) |
| 76 | + } |
| 77 | + status.CreatedAt = info.CreatedAt |
| 78 | + |
| 79 | + // Load sandbox state. |
| 80 | + t, err := cntr.Task(ctx, nil) |
| 81 | + if err != nil && !errdefs.IsNotFound(err) { |
| 82 | + return status, fmt.Errorf("failed to load task: %w", err) |
| 83 | + } |
| 84 | + var taskStatus containerd.Status |
| 85 | + var notFound bool |
| 86 | + if errdefs.IsNotFound(err) { |
| 87 | + // Task is not found. |
| 88 | + notFound = true |
| 89 | + } else { |
| 90 | + // Task is found. Get task status. |
| 91 | + taskStatus, err = t.Status(ctx) |
| 92 | + if err != nil { |
| 93 | + // It's still possible that task is deleted during this window. |
| 94 | + if !errdefs.IsNotFound(err) { |
| 95 | + return status, fmt.Errorf("failed to get task status: %w", err) |
| 96 | + } |
| 97 | + notFound = true |
| 98 | + } |
| 99 | + } |
| 100 | + if notFound { |
| 101 | + // Task does not exist, set sandbox state as NOTREADY. |
| 102 | + status.State = sandboxstore.StateNotReady |
| 103 | + } else { |
| 104 | + if taskStatus.Status == containerd.Running { |
| 105 | + // Wait for the task for sandbox monitor. |
| 106 | + // wait is a long running background request, no timeout needed. |
| 107 | + exitCh, err := t.Wait(ctrdutil.NamespacedContext()) |
| 108 | + if err != nil { |
| 109 | + if !errdefs.IsNotFound(err) { |
| 110 | + return status, fmt.Errorf("failed to wait for task: %w", err) |
| 111 | + } |
| 112 | + status.State = sandboxstore.StateNotReady |
| 113 | + } else { |
| 114 | + // Task is running, set sandbox state as READY. |
| 115 | + status.State = sandboxstore.StateReady |
| 116 | + status.Pid = t.Pid() |
| 117 | + |
| 118 | + go func() { |
| 119 | + c.waitSandboxExit(context.Background(), meta.ID, exitCh) |
| 120 | + }() |
| 121 | + } |
| 122 | + } else { |
| 123 | + // Task is not running. Delete the task and set sandbox state as NOTREADY. |
| 124 | + if _, err := t.Delete(ctx, containerd.WithProcessKill); err != nil && !errdefs.IsNotFound(err) { |
| 125 | + return status, fmt.Errorf("failed to delete task: %w", err) |
| 126 | + } |
| 127 | + status.State = sandboxstore.StateNotReady |
| 128 | + } |
| 129 | + } |
| 130 | + return status, nil |
| 131 | + }() |
| 132 | + if err != nil { |
| 133 | + log.G(ctx).WithError(err).Errorf("Failed to load sandbox status for %q", cntr.ID()) |
| 134 | + } |
| 135 | + |
| 136 | + sandbox = sandboxstore.NewSandbox(*meta, s) |
| 137 | + sandbox.Container = cntr |
| 138 | + |
| 139 | + // Load network namespace. |
| 140 | + sandbox.NetNS = getNetNS(meta) |
| 141 | + |
| 142 | + // It doesn't matter whether task is running or not. If it is running, sandbox |
| 143 | + // status will be `READY`; if it is not running, sandbox status will be `NOT_READY`, |
| 144 | + // kubelet will stop the sandbox which will properly cleanup everything. |
| 145 | + return sandbox, nil |
| 146 | +} |
| 147 | + |
| 148 | +func getNetNS(meta *sandboxstore.Metadata) *netns.NetNS { |
| 149 | + // Don't need to load netns for host network sandbox. |
| 150 | + if hostNetwork(meta.Config) { |
| 151 | + return nil |
| 152 | + } |
| 153 | + return netns.LoadNetNS(meta.NetNSPath) |
| 154 | +} |
| 155 | + |
| 156 | +// hostNetwork handles checking if host networking was requested. |
| 157 | +// TODO: Copy pasted from sbserver to handle container sandbox events in podsandbox/ package, needs refactoring. |
| 158 | +func hostNetwork(config *runtime.PodSandboxConfig) bool { |
| 159 | + var hostNet bool |
| 160 | + switch goruntime.GOOS { |
| 161 | + case "windows": |
| 162 | + // Windows HostProcess pods can only run on the host network |
| 163 | + hostNet = config.GetWindows().GetSecurityContext().GetHostProcess() |
| 164 | + case "darwin": |
| 165 | + // No CNI on Darwin yet. |
| 166 | + hostNet = true |
| 167 | + default: |
| 168 | + // Even on other platforms, the logic containerd uses is to check if NamespaceMode == NODE. |
| 169 | + // So this handles Linux, as well as any other platforms not governed by the cases above |
| 170 | + // that have special quirks. |
| 171 | + hostNet = config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetNetwork() == runtime.NamespaceMode_NODE |
| 172 | + } |
| 173 | + return hostNet |
| 174 | +} |
0 commit comments