Skip to content

Commit 28e8e24

Browse files
fuweidfuweid
authored
Merge pull request #7892 from AkihiroSuda/cri-integration-cgroup2
Cirrus CI (Fedora 37, Rocky 8): enable cri-integration
2 parents b7b0ee0 + 419b5ab commit 28e8e24

7 files changed

Lines changed: 76 additions & 14 deletions

File tree

‎.cirrus.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@ task:
4040
integration_script: |
4141
vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-integration
4242
43+
cri_integration_script: |
44+
vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri-integration
45+
4346
cri_test_script: |
4447
vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri
4548

‎Vagrantfile‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,19 @@ EOF
207207
SHELL
208208
end
209209

210+
config.vm.provision "install-failpoint-binaries", type: "shell", run: "once" do |sh|
211+
sh.upload_path = "/tmp/vagrant-install-failpoint-binaries"
212+
sh.inline = <<~SHELL
213+
#!/usr/bin/env bash
214+
source /etc/environment
215+
source /etc/profile.d/sh.local
216+
set -eux -o pipefail
217+
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-failpoint-binaries
218+
chcon -v -t container_runtime_exec_t $(type -ap containerd-shim-runc-fp-v1)
219+
containerd-shim-runc-fp-v1 -v
220+
SHELL
221+
end
222+
210223
# SELinux is Enforcing by default.
211224
# To set SELinux as Disabled on a VM that has already been provisioned:
212225
# SELINUX=Disabled vagrant up --provision-with=selinux
@@ -246,6 +259,36 @@ EOF
246259
SHELL
247260
end
248261

262+
# SELinux is Enforcing by default (via provisioning) in this VM. To re-run with SELinux disabled:
263+
# SELINUX=Disabled vagrant up --provision-with=selinux,test-cri-integration
264+
#
265+
config.vm.provision "test-cri-integration", type: "shell", run: "never" do |sh|
266+
sh.upload_path = "/tmp/test-cri-integration"
267+
sh.env = {
268+
'GOTEST': ENV['GOTEST'] || "go test",
269+
'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
270+
'GOTESTSUM_JSONFILE': ENV['GOTESTSUM_JSONFILE'],
271+
'GITHUB_WORKSPACE': '',
272+
'ENABLE_CRI_SANDBOXES': ENV['ENABLE_CRI_SANDBOXES'],
273+
}
274+
sh.inline = <<~SHELL
275+
#!/usr/bin/env bash
276+
source /etc/environment
277+
source /etc/profile.d/sh.local
278+
set -eux -o pipefail
279+
cleanup() {
280+
rm -rf /var/lib/containerd* /run/containerd* /tmp/containerd* /tmp/test* /tmp/failpoint* /tmp/nri*
281+
}
282+
cleanup
283+
cd ${GOPATH}/src/github.com/containerd/containerd
284+
# cri-integration.sh executes containerd from ./bin, not from $PATH .
285+
make BUILDTAGS="seccomp selinux no_aufs no_btrfs no_devmapper no_zfs" binaries bin/cri-integration.test
286+
chcon -v -t container_runtime_exec_t ./bin/{containerd,containerd-shim*}
287+
CONTAINERD_RUNTIME=io.containerd.runc.v2 ./script/test/cri-integration.sh
288+
cleanup
289+
SHELL
290+
end
291+
249292
# SELinux is Enforcing by default (via provisioning) in this VM. To re-run with SELinux disabled:
250293
# SELINUX=Disabled vagrant up --provision-with=selinux,test-cri
251294
#

‎integration/container_stats_test.go‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func TestContainerStats(t *testing.T) {
6161
if err != nil {
6262
return false, err
6363
}
64-
if s.GetWritableLayer().GetUsedBytes().GetValue() != 0 {
64+
if s.GetWritableLayer().GetTimestamp() != 0 {
6565
return true, nil
6666
}
6767
return false, nil
@@ -103,7 +103,7 @@ func TestContainerConsumedStats(t *testing.T) {
103103
if err != nil {
104104
return false, err
105105
}
106-
if s.GetMemory().GetWorkingSetBytes().GetValue() > 0 {
106+
if s.GetWritableLayer().GetTimestamp() > 0 {
107107
return true, nil
108108
}
109109
return false, nil
@@ -179,7 +179,7 @@ func TestContainerListStats(t *testing.T) {
179179
return false, err
180180
}
181181
for _, s := range stats {
182-
if s.GetWritableLayer().GetUsedBytes().GetValue() == 0 {
182+
if s.GetWritableLayer().GetTimestamp() == 0 {
183183
return false, nil
184184
}
185185
}
@@ -238,7 +238,7 @@ func TestContainerListStatsWithIdFilter(t *testing.T) {
238238
if len(stats) != 1 {
239239
return false, errors.New("unexpected stats length")
240240
}
241-
if stats[0].GetWritableLayer().GetUsedBytes().GetValue() != 0 {
241+
if stats[0].GetWritableLayer().GetTimestamp() != 0 {
242242
return true, nil
243243
}
244244
return false, nil
@@ -300,7 +300,7 @@ func TestContainerListStatsWithSandboxIdFilter(t *testing.T) {
300300

301301
for _, containerStats := range stats {
302302
// Wait for stats on all containers, not just the first one in the list.
303-
if containerStats.GetWritableLayer().GetUsedBytes().GetValue() == 0 {
303+
if containerStats.GetWritableLayer().GetTimestamp() == 0 {
304304
return false, nil
305305
}
306306
}
@@ -358,7 +358,7 @@ func TestContainerListStatsWithIdSandboxIdFilter(t *testing.T) {
358358
if len(stats) != 1 {
359359
return false, errors.New("unexpected stats length")
360360
}
361-
if stats[0].GetWritableLayer().GetUsedBytes().GetValue() != 0 {
361+
if stats[0].GetWritableLayer().GetTimestamp() != 0 {
362362
return true, nil
363363
}
364364
return false, nil
@@ -380,7 +380,7 @@ func TestContainerListStatsWithIdSandboxIdFilter(t *testing.T) {
380380
if len(stats) != 1 {
381381
return false, fmt.Errorf("expected only one stat, but got %v", stats)
382382
}
383-
if stats[0].GetWritableLayer().GetUsedBytes().GetValue() != 0 {
383+
if stats[0].GetWritableLayer().GetTimestamp() != 0 {
384384
return true, nil
385385
}
386386
return false, nil
@@ -410,7 +410,12 @@ func testStats(t *testing.T,
410410
require.NotEmpty(t, s.GetMemory().GetWorkingSetBytes().GetValue())
411411
require.NotEmpty(t, s.GetWritableLayer().GetTimestamp())
412412
require.NotEmpty(t, s.GetWritableLayer().GetFsId().GetMountpoint())
413-
require.NotEmpty(t, s.GetWritableLayer().GetUsedBytes().GetValue())
413+
414+
// UsedBytes of a fresh container can be zero on Linux, depending on the backing filesystem.
415+
// https://github.com/containerd/containerd/issues/7909
416+
if goruntime.GOOS == "windows" {
417+
require.NotEmpty(t, s.GetWritableLayer().GetUsedBytes().GetValue())
418+
}
414419

415420
// Windows does not collect inodes stats.
416421
if goruntime.GOOS != "windows" {

‎integration/main_test.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ import (
4343
"github.com/containerd/containerd/pkg/cri/constants"
4444
"github.com/containerd/containerd/pkg/cri/server"
4545
"github.com/containerd/containerd/pkg/cri/util"
46+
"github.com/opencontainers/selinux/go-selinux"
4647
"github.com/sirupsen/logrus"
4748
"github.com/stretchr/testify/assert"
4849
"github.com/stretchr/testify/require"
@@ -289,7 +290,11 @@ func WithVolumeMount(hostPath, containerPath string) ContainerOpts {
289290
return func(c *runtime.ContainerConfig) {
290291
hostPath, _ = filepath.Abs(hostPath)
291292
containerPath, _ = filepath.Abs(containerPath)
292-
mount := &runtime.Mount{HostPath: hostPath, ContainerPath: containerPath}
293+
mount := &runtime.Mount{
294+
HostPath: hostPath,
295+
ContainerPath: containerPath,
296+
SelinuxRelabel: selinux.GetEnabled(),
297+
}
293298
c.Mounts = append(c.Mounts, mount)
294299
}
295300
}

‎integration/nri_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
cri "github.com/containerd/containerd/integration/cri-api/pkg/apis"
3333
"github.com/containerd/nri/pkg/api"
3434
"github.com/containerd/nri/pkg/stub"
35+
"github.com/opencontainers/selinux/go-selinux"
3536
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
3637

3738
"github.com/containerd/containerd/integration/images"
@@ -57,6 +58,11 @@ func skipNriTestIfNecessary(t *testing.T, extraSkipChecks ...map[string]bool) {
5758
if goruntime.GOOS != "linux" {
5859
t.Skip("Not running on linux")
5960
}
61+
62+
if selinux.GetEnabled() {
63+
// https://github.com/containerd/containerd/pull/7892#issuecomment-1369825603
64+
t.Skip("SELinux relabeling is not supported for NRI yet")
65+
}
6066
_, err := os.Stat(nriTestSocket)
6167
if err != nil {
6268
t.Skip("Containerd test instance does not have NRI enabled")

‎integration/volume_copy_up_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,17 +118,17 @@ func TestVolumeOwnership(t *testing.T) {
118118
require.NoError(t, runtimeService.StartContainer(cn))
119119

120120
// ghcr.io/containerd/volume-ownership:2.1 contains a test_dir
121-
// volume, which is owned by nobody:nogroup.
121+
// volume, which is owned by 65534:65534 (nobody:nogroup, or nobody:nobody).
122122
// On Windows, the folder is situated in C:\volumes\test_dir and is owned
123123
// by ContainerUser (SID: S-1-5-93-2-2). A helper tool get_owner.exe should
124124
// exist inside the container that returns the owner in the form of USERNAME:SID.
125125
t.Logf("Check ownership of test directory inside container")
126126

127127
cmd := []string{
128-
"stat", "-c", "%U:%G", "/test_dir",
128+
"stat", "-c", "%u:%g", "/test_dir",
129129
}
130-
expectedContainerOutput := "nobody:nogroup\n"
131-
expectedHostOutput := "nobody:nogroup\n"
130+
expectedContainerOutput := "65534:65534\n"
131+
expectedHostOutput := "65534:65534\n"
132132
if goruntime.GOOS == "windows" {
133133
cmd = []string{
134134
"C:\\bin\\get_owner.exe",

‎integration/volume_copy_up_unix_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ import (
2525
)
2626

2727
func getOwnership(path string) (string, error) {
28-
hostCmd := fmt.Sprintf("stat -c %%U:%%G '%s'", path)
28+
hostCmd := fmt.Sprintf("stat -c %%u:%%g '%s'", path)
2929
output, err := exec.Command("sh", "-c", hostCmd).CombinedOutput()
3030
if err != nil {
3131
return "", err

0 commit comments

Comments
 (0)