Skip to content

Commit 28e4fb2

Browse files
albanalban
committed
cri: add annotations for pod name and namespace
cri-o has annotations for pod name, namespace and container name: https://github.com/containers/podman/blob/master/pkg/annotations/annotations.go But so far containerd had only the container name. This patch will be useful for seccomp agents to have a different behaviour depending on the pod (see runtime-spec PR 1074 and runc PR 2682). This should simplify the code in: https://github.com/kinvolk/seccompagent/blob/b2d423695d6dfc976d2456769acb19765a9d7524/pkg/kuberesolver/kuberesolver.go#L16-L27 Signed-off-by: Alban Crequy <[email protected]>
1 parent 2034660 commit 28e4fb2

9 files changed

Lines changed: 39 additions & 1 deletion

‎pkg/cri/annotations/annotations.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,12 @@ const (
4545
// workload can only run on dedicated runtime for untrusted workload.
4646
UntrustedWorkload = "io.kubernetes.cri.untrusted-workload"
4747

48-
// containerName is the name of the container in the pod
48+
// SandboxNamespace is the name of the namespace of the sandbox (pod)
49+
SandboxNamespace = "io.kubernetes.cri.sandbox-namespace"
50+
51+
// SandboxName is the name of the sandbox (pod)
52+
SandboxName = "io.kubernetes.cri.sandbox-name"
53+
54+
// ContainerName is the name of the container in the pod
4955
ContainerName = "io.kubernetes.cri.container-name"
5056
)

‎pkg/cri/server/container_create_linux.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,8 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
260260
customopts.WithSupplementalGroups(supplementalGroups),
261261
customopts.WithAnnotation(annotations.ContainerType, annotations.ContainerTypeContainer),
262262
customopts.WithAnnotation(annotations.SandboxID, sandboxID),
263+
customopts.WithAnnotation(annotations.SandboxNamespace, sandboxConfig.GetMetadata().GetNamespace()),
264+
customopts.WithAnnotation(annotations.SandboxName, sandboxConfig.GetMetadata().GetName()),
263265
customopts.WithAnnotation(annotations.ContainerName, containerName),
264266
)
265267
// cgroupns is used for hiding /sys/fs/cgroup from containers.

‎pkg/cri/server/container_create_linux_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,12 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
174174

175175
assert.Contains(t, spec.Annotations, annotations.ContainerType)
176176
assert.EqualValues(t, spec.Annotations[annotations.ContainerType], annotations.ContainerTypeContainer)
177+
178+
assert.Contains(t, spec.Annotations, annotations.SandboxNamespace)
179+
assert.EqualValues(t, spec.Annotations[annotations.SandboxNamespace], "test-sandbox-ns")
180+
181+
assert.Contains(t, spec.Annotations, annotations.SandboxName)
182+
assert.EqualValues(t, spec.Annotations[annotations.SandboxName], "test-sandbox-name")
177183
}
178184
return config, sandboxConfig, imageConfig, specCheck
179185
}

‎pkg/cri/server/container_create_windows.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
106106
specOpts = append(specOpts,
107107
customopts.WithAnnotation(annotations.ContainerType, annotations.ContainerTypeContainer),
108108
customopts.WithAnnotation(annotations.SandboxID, sandboxID),
109+
customopts.WithAnnotation(annotations.SandboxNamespace, sandboxConfig.GetMetadata().GetNamespace()),
110+
customopts.WithAnnotation(annotations.SandboxName, sandboxConfig.GetMetadata().GetName()),
109111
customopts.WithAnnotation(annotations.ContainerName, containerName),
110112
)
111113
return c.runtimeSpec(id, ociRuntime.BaseRuntimeSpec, specOpts...)

‎pkg/cri/server/container_create_windows_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,12 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
126126

127127
assert.Contains(t, spec.Annotations, annotations.ContainerType)
128128
assert.EqualValues(t, spec.Annotations[annotations.ContainerType], annotations.ContainerTypeContainer)
129+
130+
assert.Contains(t, spec.Annotations, annotations.SandboxNamespace)
131+
assert.EqualValues(t, spec.Annotations[annotations.SandboxNamespace], "test-sandbox-ns")
132+
133+
assert.Contains(t, spec.Annotations, annotations.SandboxName)
134+
assert.EqualValues(t, spec.Annotations[annotations.SandboxName], "test-sandbox-name")
129135
}
130136
return config, sandboxConfig, imageConfig, specCheck
131137
}

‎pkg/cri/server/sandbox_run_linux.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxC
151151
specOpts = append(specOpts,
152152
customopts.WithAnnotation(annotations.ContainerType, annotations.ContainerTypeSandbox),
153153
customopts.WithAnnotation(annotations.SandboxID, id),
154+
customopts.WithAnnotation(annotations.SandboxNamespace, config.GetMetadata().GetNamespace()),
155+
customopts.WithAnnotation(annotations.SandboxName, config.GetMetadata().GetName()),
154156
customopts.WithAnnotation(annotations.SandboxLogDir, config.GetLogDirectory()),
155157
)
156158

‎pkg/cri/server/sandbox_run_linux_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,12 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf
7373
assert.Contains(t, spec.Annotations, annotations.ContainerType)
7474
assert.EqualValues(t, spec.Annotations[annotations.ContainerType], annotations.ContainerTypeSandbox)
7575

76+
assert.Contains(t, spec.Annotations, annotations.SandboxNamespace)
77+
assert.EqualValues(t, spec.Annotations[annotations.SandboxNamespace], "test-ns")
78+
79+
assert.Contains(t, spec.Annotations, annotations.SandboxName)
80+
assert.EqualValues(t, spec.Annotations[annotations.SandboxName], "test-name")
81+
7682
assert.Contains(t, spec.Annotations, annotations.SandboxLogDir)
7783
assert.EqualValues(t, spec.Annotations[annotations.SandboxLogDir], "test-log-directory")
7884

‎pkg/cri/server/sandbox_run_windows.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ func (c *criService) sandboxContainerSpec(id string, config *runtime.PodSandboxC
6464
specOpts = append(specOpts,
6565
customopts.WithAnnotation(annotations.ContainerType, annotations.ContainerTypeSandbox),
6666
customopts.WithAnnotation(annotations.SandboxID, id),
67+
customopts.WithAnnotation(annotations.SandboxNamespace, config.GetMetadata().GetNamespace()),
68+
customopts.WithAnnotation(annotations.SandboxName, config.GetMetadata().GetName()),
6769
customopts.WithAnnotation(annotations.SandboxLogDir, config.GetLogDirectory()),
6870
)
6971

‎pkg/cri/server/sandbox_run_windows_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf
6464
assert.Contains(t, spec.Annotations, annotations.ContainerType)
6565
assert.EqualValues(t, spec.Annotations[annotations.ContainerType], annotations.ContainerTypeSandbox)
6666

67+
assert.Contains(t, spec.Annotations, annotations.SandboxNamespace)
68+
assert.EqualValues(t, spec.Annotations[annotations.SandboxNamespace], "test-ns")
69+
70+
assert.Contains(t, spec.Annotations, annotations.SandboxName)
71+
assert.EqualValues(t, spec.Annotations[annotations.SandboxName], "test-name")
72+
6773
assert.Contains(t, spec.Annotations, annotations.SandboxLogDir)
6874
assert.EqualValues(t, spec.Annotations[annotations.SandboxLogDir], "test-log-directory")
6975
}

0 commit comments

Comments
 (0)