Skip to content

Commit 2fc62db

Browse files
Random-LiuRandom-Liu
authored
Merge pull request #1125 from Random-Liu/add-default-runtime-name
Add default runtime name
2 parents a5c5d55 + db90808 commit 2fc62db

7 files changed

Lines changed: 150 additions & 125 deletions

File tree

‎cluster/gce/configure.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -176,9 +176,11 @@ disabled_plugins = ["restart"]
176176
conf_template = "${cni_template_path}"
177177
[plugins.cri.registry.mirrors."docker.io"]
178178
endpoint = ["https://mirror.gcr.io","https://registry-1.docker.io"]
179-
[plugins.cri.containerd.default_runtime]
179+
[plugins.cri.containerd]
180+
default_runtime_name = "${CONTAINERD_DEFAULT_RUNTIME:-"runc"}"
181+
[plugins.cri.containerd.runtimes.runc]
180182
runtime_type = "io.containerd.runc.v1"
181-
[plugins.cri.containerd.default_runtime.options]
183+
[plugins.cri.containerd.runtimes.runc.options]
182184
BinaryName = "${CONTAINERD_HOME}/usr/local/sbin/runc"
183185
EOF
184186
chmod 644 "${config_path}"

‎cri.go‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package cri
1818

1919
import (
20+
"context"
2021
"flag"
2122
"path/filepath"
2223
"time"
@@ -73,7 +74,7 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
7374
}
7475
log.G(ctx).Infof("Start cri plugin with config %+v", c)
7576

76-
if err := validateConfig(&c); err != nil {
77+
if err := validateConfig(ctx, &c); err != nil {
7778
return nil, errors.Wrap(err, "invalid config")
7879
}
7980

@@ -111,14 +112,36 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
111112
}
112113

113114
// validateConfig validates the given configuration.
114-
func validateConfig(c *criconfig.Config) error {
115-
// It is an error to provide both an UntrustedWorkloadRuntime & define an 'untrusted' runtime.
116-
if _, ok := c.ContainerdConfig.Runtimes[criconfig.RuntimeUntrusted]; ok {
117-
if c.ContainerdConfig.UntrustedWorkloadRuntime.Type != "" {
118-
return errors.New("conflicting definitions: configuration includes untrusted_workload_runtime and runtimes['untrusted']")
115+
func validateConfig(ctx context.Context, c *criconfig.Config) error {
116+
if c.ContainerdConfig.Runtimes == nil {
117+
c.ContainerdConfig.Runtimes = make(map[string]criconfig.Runtime)
118+
}
119+
120+
// Validation for deprecated untrusted_workload_runtime.
121+
if c.ContainerdConfig.UntrustedWorkloadRuntime.Type != "" {
122+
log.G(ctx).Warning("`untrusted_workload_runtime` is deprecated, please use `untrusted` runtime in `runtimes` instead")
123+
if _, ok := c.ContainerdConfig.Runtimes[criconfig.RuntimeUntrusted]; ok {
124+
return errors.Errorf("conflicting definitions: configuration includes both `untrusted_workload_runtime` and `runtimes[%q]`", criconfig.RuntimeUntrusted)
119125
}
126+
c.ContainerdConfig.Runtimes[criconfig.RuntimeUntrusted] = c.ContainerdConfig.UntrustedWorkloadRuntime
127+
}
128+
129+
// Validation for deprecated default_runtime field.
130+
if c.ContainerdConfig.DefaultRuntime.Type != "" {
131+
log.G(ctx).Warning("`default_runtime` is deprecated, please use `default_runtime_name` to reference the default configuration you have defined in `runtimes`")
132+
c.ContainerdConfig.DefaultRuntimeName = criconfig.RuntimeDefault
133+
c.ContainerdConfig.Runtimes[criconfig.RuntimeDefault] = c.ContainerdConfig.DefaultRuntime
134+
}
135+
136+
// Validation for default_runtime_name
137+
if c.ContainerdConfig.DefaultRuntimeName == "" {
138+
return errors.New("`default_runtime_name` is empty")
139+
}
140+
if _, ok := c.ContainerdConfig.Runtimes[c.ContainerdConfig.DefaultRuntimeName]; !ok {
141+
return errors.New("no corresponding runtime configured in `runtimes` for `default_runtime_name`")
120142
}
121143

144+
// Validation for stream_idle_timeout
122145
if c.StreamIdleTimeout != "" {
123146
if _, err := time.ParseDuration(c.StreamIdleTimeout); err != nil {
124147
return errors.Wrap(err, "invalid stream idle timeout")

‎docs/config.md‎

Lines changed: 31 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -80,60 +80,22 @@ The explanation and default value of each configuration item are as follows:
8080
# For runtime "io.containerd.runc.v1", use the option `NoPivotRoot`.
8181
no_pivot = false
8282

83+
# default_runtime_name is the default runtime name to use.
84+
default_runtime_name = "runc"
85+
8386
# "plugins.cri.containerd.default_runtime" is the runtime to use in containerd.
87+
# DEPRECATED: use `default_runtime_name` and `plugins.cri.runtimes` instead.
88+
# Remove in containerd 1.4.
8489
[plugins.cri.containerd.default_runtime]
85-
# runtime_type is the runtime type to use in containerd e.g. io.containerd.runtime.v1.linux
86-
runtime_type = "io.containerd.runtime.v1.linux"
87-
88-
# runtime_engine is the name of the runtime engine used by containerd.
89-
# This only works for runtime type "io.containerd.runtime.v1.linux".
90-
# DEPRECATED: use Runtime.Options for runtime specific config for shim v2 runtimes.
91-
# For runtime "io.containerd.runc.v1", use the option `BinaryName`.
92-
runtime_engine = ""
93-
94-
# runtime_root is the directory used by containerd for runtime state.
95-
# This only works for runtime type "io.containerd.runtime.v1.linux".
96-
# DEPRECATED: use Runtime.Options for runtime specific config for shim v2 runtimes.
97-
# For runtime "io.containerd.runc.v1", use the option `Root`.
98-
runtime_root = ""
99-
100-
# "plugins.cri.containerd.default_runtime.options" is options specific to
101-
# the default runtime. The options type for "io.containerd.runtime.v1.linux" is:
102-
# https://github.com/containerd/containerd/blob/v1.2.0-rc.1/runtime/linux/runctypes/runc.pb.go#L40
103-
# NOTE: when `options` is specified, all related deprecated options will
104-
# be ignored, including `systemd_cgroup`, `no_pivot`, `runtime_engine`
105-
# and `runtime_root`.
106-
[plugins.cri.containerd.default_runtime.options]
107-
# Runtime is the binary name of the runtime.
108-
Runtime = ""
109-
110-
# RuntimeRoot is the root directory of the runtime.
111-
RuntimeRoot = ""
112-
113-
# CriuPath is the criu binary path.
114-
CriuPath = ""
115-
116-
# SystemdCgroup enables systemd cgroups.
117-
SystemdCgroup = false
11890

11991
# "plugins.cri.containerd.untrusted_workload_runtime" is a runtime to run untrusted workloads on it.
120-
# DEPRECATED: use plugins.cri.runtimes instead. If provided, this runtime is mapped to the
121-
# runtime handler named 'untrusted'. It is a configuration error to provide both the (now
122-
# deprecated) UntrustedWorkloadRuntime and a handler in the Runtimes handler map (below) for
123-
# 'untrusted' workloads at the same time. Please provide one or the other.
92+
# DEPRECATED: use `untrusted` runtime in `plugins.cri.runtimes` instead.
93+
# Remove in containerd 1.4.
12494
[plugins.cri.containerd.untrusted_workload_runtime]
125-
# runtime_type is the runtime type to use in containerd e.g. io.containerd.runtime.v1.linux
126-
runtime_type = ""
127-
128-
# runtime_engine is the name of the runtime engine used by containerd.
129-
runtime_engine = ""
130-
131-
# runtime_root is the directory used by containerd for runtime state.
132-
runtime_root = ""
13395

13496
# plugins.cri.containerd.runtimes is a map from CRI RuntimeHandler strings, which specify types
135-
# of runtime configurations, to the matching configurations. In this example,
136-
# 'runc' is the RuntimeHandler string to match.
97+
# of runtime configurations, to the matching configurations.
98+
# In this example, 'runc' is the RuntimeHandler string to match.
13799
[plugins.cri.containerd.runtimes.runc]
138100
# runtime_type is the runtime type to use in containerd e.g. io.containerd.runtime.v1.linux
139101
runtime_type = "io.containerd.runc.v1"
@@ -205,3 +167,25 @@ The explanation and default value of each configuration item are as follows:
205167
[plugins.cri.registry.mirrors."docker.io"]
206168
endpoint = ["https://registry-1.docker.io", ]
207169
```
170+
171+
## Untrusted Workload
172+
173+
The recommended way to run untrusted workload is to use
174+
[`RuntimeClass`](https://kubernetes.io/docs/concepts/containers/runtime-class/) api
175+
introduced in Kubernetes 1.12 to select RuntimeHandlers configured to run
176+
untrusted workload in `plugins.cri.containerd.runtimes`.
177+
178+
However, if you are using the legacy `io.kubernetes.cri.untrusted-workload`pod annotation
179+
to request a pod be run using a runtime for untrusted workloads, the RuntimeHandler
180+
`plugins.cri.containerd.runtimes.untrusted` must be defined first. When the annotation
181+
`io.kubernetes.cri.untrusted-workload` is set to `true` the `untrusted` runtime will be
182+
used. For example, see
183+
[Create an untrusted pod using Kata Containers](https://github.com/kata-containers/documentation/blob/master/how-to/how-to-use-k8s-with-cri-containerd-and-kata.md#create-an-untrusted-pod-using-kata-containers).
184+
185+
## Deprecation
186+
The config options of the CRI plugin follow the [Kubernetes deprecation
187+
policy of "admin-facing CLI components"](https://kubernetes.io/docs/reference/using-api/deprecation-policy/#deprecating-a-flag-or-cli).
188+
189+
In summary, when a config option is announced to be deprecated:
190+
* It is kept functional for 6 months or 1 release (whichever is longer);
191+
* A warning is emitted when it is used.

‎pkg/config/config.go‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,14 @@ type Runtime struct {
4747
type ContainerdConfig struct {
4848
// Snapshotter is the snapshotter used by containerd.
4949
Snapshotter string `toml:"snapshotter" json:"snapshotter"`
50+
// DefaultRuntimeName is the default runtime name to use from the runtimes table.
51+
DefaultRuntimeName string `toml:"default_runtime_name" json:"defaultRuntimeName"`
5052
// DefaultRuntime is the default runtime to use in containerd.
5153
// This runtime is used when no runtime handler (or the empty string) is provided.
54+
// DEPRECATED: use DefaultRuntimeName instead. Remove in containerd 1.4.
5255
DefaultRuntime Runtime `toml:"default_runtime" json:"defaultRuntime"`
5356
// UntrustedWorkloadRuntime is a runtime to run untrusted workloads on it.
54-
// DEPRECATED: use Runtimes instead. If provided, this runtime is mapped to the runtime handler
55-
// named 'untrusted'. It is a configuration error to provide both the (now deprecated)
56-
// UntrustedWorkloadRuntime and a handler in the Runtimes handler map (below) for 'untrusted'
57-
// workloads at the same time. Please provide one or the other.
57+
// DEPRECATED: use `untrusted` runtime in Runtimes instead. Remove in containerd 1.4.
5858
UntrustedWorkloadRuntime Runtime `toml:"untrusted_workload_runtime" json:"untrustedWorkloadRuntime"`
5959
// Runtimes is a map from CRI RuntimeHandler strings, which specify types of runtime
6060
// configurations, to the matching configurations.
@@ -195,13 +195,14 @@ func DefaultConfig() PluginConfig {
195195
NetworkPluginConfTemplate: "",
196196
},
197197
ContainerdConfig: ContainerdConfig{
198-
Snapshotter: containerd.DefaultSnapshotter,
199-
DefaultRuntime: Runtime{
200-
Type: "io.containerd.runtime.v1.linux",
201-
Engine: "",
202-
Root: "",
198+
Snapshotter: containerd.DefaultSnapshotter,
199+
DefaultRuntimeName: "runc",
200+
NoPivot: false,
201+
Runtimes: map[string]Runtime{
202+
"runc": {
203+
Type: "io.containerd.runc.v1",
204+
},
203205
},
204-
NoPivot: false,
205206
},
206207
StreamServerAddress: "127.0.0.1",
207208
StreamServerPort: "0",
@@ -229,4 +230,6 @@ func DefaultConfig() PluginConfig {
229230
const (
230231
// RuntimeUntrusted is the implicit runtime defined for ContainerdConfig.UntrustedWorkloadRuntime
231232
RuntimeUntrusted = "untrusted"
233+
// RuntimeDefault is the implicit runtime defined for ContainerdConfig.DefaultRuntime
234+
RuntimeDefault = "default"
232235
)

‎pkg/server/helpers_test.go‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,8 @@ func TestGenerateRuntimeOptions(t *testing.T) {
212212
systemd_cgroup = true
213213
[containerd]
214214
no_pivot = true
215-
[containerd.default_runtime]
215+
default_runtime_name = "default"
216+
[containerd.runtimes.legacy]
216217
runtime_type = "` + linuxRuntime + `"
217218
[containerd.runtimes.runc]
218219
runtime_type = "` + runcRuntimeV1 + `"
@@ -223,11 +224,12 @@ systemd_cgroup = true
223224
systemd_cgroup = true
224225
[containerd]
225226
no_pivot = true
226-
[containerd.default_runtime]
227+
default_runtime_name = "default"
228+
[containerd.runtimes.legacy]
227229
runtime_type = "` + linuxRuntime + `"
228-
[containerd.default_runtime.options]
229-
Runtime = "default"
230-
RuntimeRoot = "/default"
230+
[containerd.runtimes.legacy.options]
231+
Runtime = "legacy"
232+
RuntimeRoot = "/legacy"
231233
[containerd.runtimes.runc]
232234
runtime_type = "` + runcRuntimeV1 + `"
233235
[containerd.runtimes.runc.options]
@@ -246,8 +248,8 @@ systemd_cgroup = true
246248
require.NoError(t, err)
247249
_, err = toml.Decode(nonNilOpts, &nonNilOptsConfig)
248250
require.NoError(t, err)
249-
require.Len(t, nilOptsConfig.Runtimes, 2)
250-
require.Len(t, nonNilOptsConfig.Runtimes, 2)
251+
require.Len(t, nilOptsConfig.Runtimes, 3)
252+
require.Len(t, nonNilOptsConfig.Runtimes, 3)
251253

252254
for desc, test := range map[string]struct {
253255
r criconfig.Runtime
@@ -265,7 +267,7 @@ systemd_cgroup = true
265267
expectedOptions: nil,
266268
},
267269
"when options is nil, should use legacy fields for legacy runtime": {
268-
r: nilOptsConfig.DefaultRuntime,
270+
r: nilOptsConfig.Runtimes["legacy"],
269271
c: nilOptsConfig,
270272
expectedOptions: &runctypes.RuncOptions{
271273
SystemdCgroup: true,
@@ -290,11 +292,11 @@ systemd_cgroup = true
290292
},
291293
},
292294
"when options is not nil, should be able to decode for legacy runtime": {
293-
r: nonNilOptsConfig.DefaultRuntime,
295+
r: nonNilOptsConfig.Runtimes["legacy"],
294296
c: nonNilOptsConfig,
295297
expectedOptions: &runctypes.RuncOptions{
296-
Runtime: "default",
297-
RuntimeRoot: "/default",
298+
Runtime: "legacy",
299+
RuntimeRoot: "/legacy",
298300
},
299301
},
300302
} {

‎pkg/server/sandbox_run.go‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -628,16 +628,11 @@ func (c *criService) getSandboxRuntime(config *runtime.PodSandboxConfig, runtime
628628
return criconfig.Runtime{}, errors.New("untrusted workload with host access is not allowed")
629629
}
630630

631-
// Handle the deprecated UntrustedWorkloadRuntime.
632-
if c.config.ContainerdConfig.UntrustedWorkloadRuntime.Type != "" {
633-
return c.config.ContainerdConfig.UntrustedWorkloadRuntime, nil
634-
}
635-
636631
runtimeHandler = criconfig.RuntimeUntrusted
637632
}
638633

639634
if runtimeHandler == "" {
640-
return c.config.ContainerdConfig.DefaultRuntime, nil
635+
runtimeHandler = c.config.ContainerdConfig.DefaultRuntimeName
641636
}
642637

643638
handler, ok := c.config.ContainerdConfig.Runtimes[runtimeHandler]

0 commit comments

Comments
 (0)