Skip to content

Commit 99cb62f

Browse files
crosbymichaelcrosbymichael
committed
[cri] add image-name annotation
For some tools having the actual image name in the annotations is helpful for debugging and auditing the workload. Signed-off-by: Michael Crosby <[email protected]>
1 parent aa5e55a commit 99cb62f

8 files changed

Lines changed: 69 additions & 31 deletions

‎pkg/cri/annotations/annotations.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ const (
5353

5454
// ContainerName is the name of the container in the pod
5555
ContainerName = "io.kubernetes.cri.container-name"
56+
// ImageName is the name of the image used to create the container
57+
ImageName = "io.kubernetes.cri.image-name"
5658
)

‎pkg/cri/server/container_create.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
155155
}
156156
log.G(ctx).Debugf("Use OCI runtime %+v for sandbox %q and container %q", ociRuntime, sandboxID, id)
157157

158-
spec, err := c.containerSpec(id, sandboxID, sandboxPid, sandbox.NetNSPath, containerName, config, sandboxConfig,
158+
spec, err := c.containerSpec(id, sandboxID, sandboxPid, sandbox.NetNSPath, containerName, containerdImage.Name(), config, sandboxConfig,
159159
&image.ImageSpec.Config, append(mounts, volumeMounts...), ociRuntime)
160160
if err != nil {
161161
return nil, errors.Wrapf(err, "failed to generate container %q spec", id)

‎pkg/cri/server/container_create_linux.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,10 +108,19 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
108108
return mounts
109109
}
110110

111-
func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint32, netNSPath string, containerName string,
112-
config *runtime.ContainerConfig, sandboxConfig *runtime.PodSandboxConfig, imageConfig *imagespec.ImageConfig,
113-
extraMounts []*runtime.Mount, ociRuntime config.Runtime) (_ *runtimespec.Spec, retErr error) {
114-
111+
func (c *criService) containerSpec(
112+
id string,
113+
sandboxID string,
114+
sandboxPid uint32,
115+
netNSPath string,
116+
containerName string,
117+
imageName string,
118+
config *runtime.ContainerConfig,
119+
sandboxConfig *runtime.PodSandboxConfig,
120+
imageConfig *imagespec.ImageConfig,
121+
extraMounts []*runtime.Mount,
122+
ociRuntime config.Runtime,
123+
) (_ *runtimespec.Spec, retErr error) {
115124
specOpts := []oci.SpecOpts{
116125
customopts.WithoutRunMount,
117126
}
@@ -263,6 +272,7 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
263272
customopts.WithAnnotation(annotations.SandboxNamespace, sandboxConfig.GetMetadata().GetNamespace()),
264273
customopts.WithAnnotation(annotations.SandboxName, sandboxConfig.GetMetadata().GetName()),
265274
customopts.WithAnnotation(annotations.ContainerName, containerName),
275+
customopts.WithAnnotation(annotations.ImageName, imageName),
266276
)
267277
// cgroupns is used for hiding /sys/fs/cgroup from containers.
268278
// For compatibility, cgroupns is not used when running in cgroup v1 mode or in privileged.

‎pkg/cri/server/container_create_linux_test.go‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,9 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
180180

181181
assert.Contains(t, spec.Annotations, annotations.SandboxName)
182182
assert.EqualValues(t, spec.Annotations[annotations.SandboxName], "test-sandbox-name")
183+
184+
assert.Contains(t, spec.Annotations, annotations.ImageName)
185+
assert.EqualValues(t, spec.Annotations[annotations.ImageName], testImageName)
183186
}
184187
return config, sandboxConfig, imageConfig, specCheck
185188
}
@@ -237,7 +240,7 @@ func TestContainerCapabilities(t *testing.T) {
237240
c := newTestCRIService()
238241

239242
containerConfig.Linux.SecurityContext.Capabilities = test.capability
240-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
243+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
241244
require.NoError(t, err)
242245

243246
if selinux.GetEnabled() {
@@ -272,7 +275,7 @@ func TestContainerSpecTty(t *testing.T) {
272275
c := newTestCRIService()
273276
for _, tty := range []bool{true, false} {
274277
containerConfig.Tty = tty
275-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
278+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
276279
require.NoError(t, err)
277280
specCheck(t, testID, testSandboxID, testPid, spec)
278281
assert.Equal(t, tty, spec.Process.Terminal)
@@ -299,7 +302,7 @@ func TestContainerSpecDefaultPath(t *testing.T) {
299302
imageConfig.Env = append(imageConfig.Env, pathenv)
300303
expected = pathenv
301304
}
302-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
305+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
303306
require.NoError(t, err)
304307
specCheck(t, testID, testSandboxID, testPid, spec)
305308
assert.Contains(t, spec.Process.Env, expected)
@@ -316,7 +319,7 @@ func TestContainerSpecReadonlyRootfs(t *testing.T) {
316319
c := newTestCRIService()
317320
for _, readonly := range []bool{true, false} {
318321
containerConfig.Linux.SecurityContext.ReadonlyRootfs = readonly
319-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
322+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
320323
require.NoError(t, err)
321324
specCheck(t, testID, testSandboxID, testPid, spec)
322325
assert.Equal(t, readonly, spec.Root.Readonly)
@@ -355,7 +358,7 @@ func TestContainerSpecWithExtraMounts(t *testing.T) {
355358
Readonly: false,
356359
},
357360
}
358-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, extraMounts, ociRuntime)
361+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, extraMounts, ociRuntime)
359362
require.NoError(t, err)
360363
specCheck(t, testID, testSandboxID, testPid, spec)
361364
var mounts, sysMounts, devMounts []runtimespec.Mount
@@ -423,7 +426,7 @@ func TestContainerAndSandboxPrivileged(t *testing.T) {
423426
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
424427
Privileged: test.sandboxPrivileged,
425428
}
426-
_, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
429+
_, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
427430
if test.expectError {
428431
assert.Error(t, err)
429432
} else {
@@ -614,7 +617,7 @@ func TestPrivilegedBindMount(t *testing.T) {
614617
containerConfig.Linux.SecurityContext.Privileged = test.privileged
615618
sandboxConfig.Linux.SecurityContext.Privileged = test.privileged
616619

617-
spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
620+
spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
618621

619622
assert.NoError(t, err)
620623
if test.expectedSysFSRO {
@@ -771,7 +774,7 @@ func TestPidNamespace(t *testing.T) {
771774
} {
772775
t.Logf("TestCase %q", desc)
773776
containerConfig.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS}
774-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
777+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
775778
require.NoError(t, err)
776779
assert.Contains(t, spec.Linux.Namespaces, test.expected)
777780
}
@@ -786,7 +789,7 @@ func TestNoDefaultRunMount(t *testing.T) {
786789
ociRuntime := config.Runtime{}
787790
c := newTestCRIService()
788791

789-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
792+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
790793
assert.NoError(t, err)
791794
for _, mount := range spec.Mounts {
792795
assert.NotEqual(t, "/run", mount.Destination)
@@ -1159,7 +1162,7 @@ func TestMaskedAndReadonlyPaths(t *testing.T) {
11591162
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
11601163
Privileged: test.privileged,
11611164
}
1162-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1165+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
11631166
require.NoError(t, err)
11641167
if !test.privileged { // specCheck presumes an unprivileged container
11651168
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -1206,7 +1209,7 @@ func TestHostname(t *testing.T) {
12061209
sandboxConfig.Linux.SecurityContext = &runtime.LinuxSandboxSecurityContext{
12071210
NamespaceOptions: &runtime.NamespaceOption{Network: test.networkNs},
12081211
}
1209-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1212+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
12101213
require.NoError(t, err)
12111214
specCheck(t, testID, testSandboxID, testPid, spec)
12121215
assert.Contains(t, spec.Process.Env, test.expectedEnv)
@@ -1218,7 +1221,7 @@ func TestDisableCgroup(t *testing.T) {
12181221
ociRuntime := config.Runtime{}
12191222
c := newTestCRIService()
12201223
c.config.DisableCgroup = true
1221-
spec, err := c.containerSpec("test-id", "sandbox-id", 1234, "", "container-name", containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1224+
spec, err := c.containerSpec("test-id", "sandbox-id", 1234, "", "container-name", testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
12221225
require.NoError(t, err)
12231226

12241227
t.Log("resource limit should not be set")
@@ -1341,7 +1344,7 @@ func TestPrivilegedDevices(t *testing.T) {
13411344
ociRuntime := config.Runtime{
13421345
PrivilegedWithoutHostDevices: test.privilegedWithoutHostDevices,
13431346
}
1344-
spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1347+
spec, err := c.containerSpec(t.Name(), testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
13451348
assert.NoError(t, err)
13461349

13471350
hostDevicesRaw, err := devices.HostDevices()
@@ -1390,7 +1393,7 @@ func TestBaseOCISpec(t *testing.T) {
13901393
testPid := uint32(1234)
13911394
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
13921395

1393-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
1396+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
13941397
assert.NoError(t, err)
13951398

13961399
specCheck(t, testID, testSandboxID, testPid, spec)

‎pkg/cri/server/container_create_other.go‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,19 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
3333
return []*runtime.Mount{}
3434
}
3535

36-
func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint32, netNSPath string, containerName string,
37-
config *runtime.ContainerConfig, sandboxConfig *runtime.PodSandboxConfig, imageConfig *imagespec.ImageConfig,
38-
extraMounts []*runtime.Mount, ociRuntime config.Runtime) (_ *runtimespec.Spec, retErr error) {
36+
func (c *criService) containerSpec(
37+
id string,
38+
sandboxID string,
39+
sandboxPid uint32,
40+
netNSPath string,
41+
containerName string,
42+
imageName string,
43+
config *runtime.ContainerConfig,
44+
sandboxConfig *runtime.PodSandboxConfig,
45+
imageConfig *imagespec.ImageConfig,
46+
extraMounts []*runtime.Mount,
47+
ociRuntime config.Runtime,
48+
) (_ *runtimespec.Spec, retErr error) {
3949
return c.runtimeSpec(id, ociRuntime.BaseRuntimeSpec)
4050
}
4151

‎pkg/cri/server/container_create_test.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ func checkMount(t *testing.T, mounts []runtimespec.Mount, src, dest, typ string,
5252
assert.True(t, found, "mount from %q to %q not found", src, dest)
5353
}
5454

55+
const testImageName = "container-image-name"
56+
5557
func TestGeneralContainerSpec(t *testing.T) {
5658
testID := "test-id"
5759
testPid := uint32(1234)
@@ -60,7 +62,7 @@ func TestGeneralContainerSpec(t *testing.T) {
6062
c := newTestCRIService()
6163
testSandboxID := "sandbox-id"
6264
testContainerName := "container-name"
63-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
65+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
6466
require.NoError(t, err)
6567
specCheck(t, testID, testSandboxID, testPid, spec)
6668
}
@@ -124,7 +126,7 @@ func TestPodAnnotationPassthroughContainerSpec(t *testing.T) {
124126
ociRuntime := config.Runtime{
125127
PodAnnotations: test.podAnnotations,
126128
}
127-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName,
129+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName,
128130
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
129131
assert.NoError(t, err)
130132
assert.NotNil(t, spec)
@@ -372,7 +374,7 @@ func TestContainerAnnotationPassthroughContainerSpec(t *testing.T) {
372374
PodAnnotations: test.podAnnotations,
373375
ContainerAnnotations: test.containerAnnotations,
374376
}
375-
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName,
377+
spec, err := c.containerSpec(testID, testSandboxID, testPid, "", testContainerName, testImageName,
376378
containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
377379
assert.NoError(t, err)
378380
assert.NotNil(t, spec)

‎pkg/cri/server/container_create_windows.go‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,19 @@ func (c *criService) containerMounts(sandboxID string, config *runtime.Container
3434
return nil
3535
}
3636

37-
func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint32, netNSPath string, containerName string,
38-
config *runtime.ContainerConfig, sandboxConfig *runtime.PodSandboxConfig, imageConfig *imagespec.ImageConfig,
39-
extraMounts []*runtime.Mount, ociRuntime config.Runtime) (*runtimespec.Spec, error) {
37+
func (c *criService) containerSpec(
38+
id string,
39+
sandboxID string,
40+
sandboxPid uint32,
41+
netNSPath string,
42+
containerName string,
43+
imageName string,
44+
config *runtime.ContainerConfig,
45+
sandboxConfig *runtime.PodSandboxConfig,
46+
imageConfig *imagespec.ImageConfig,
47+
extraMounts []*runtime.Mount,
48+
ociRuntime config.Runtime,
49+
) (*runtimespec.Spec, error) {
4050
specOpts := []oci.SpecOpts{
4151
customopts.WithProcessArgs(config, imageConfig),
4252
}
@@ -109,6 +119,7 @@ func (c *criService) containerSpec(id string, sandboxID string, sandboxPid uint3
109119
customopts.WithAnnotation(annotations.SandboxNamespace, sandboxConfig.GetMetadata().GetNamespace()),
110120
customopts.WithAnnotation(annotations.SandboxName, sandboxConfig.GetMetadata().GetName()),
111121
customopts.WithAnnotation(annotations.ContainerName, containerName),
122+
customopts.WithAnnotation(annotations.ImageName, imageName),
112123
)
113124
return c.runtimeSpec(id, ociRuntime.BaseRuntimeSpec, specOpts...)
114125
}

‎pkg/cri/server/container_create_windows_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ func TestContainerWindowsNetworkNamespace(t *testing.T) {
145145
c := newTestCRIService()
146146

147147
containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
148-
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
148+
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
149149
assert.NoError(t, err)
150150
assert.NotNil(t, spec)
151151
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -167,7 +167,7 @@ func TestMountCleanPath(t *testing.T) {
167167
ContainerPath: "c:/test/container-path",
168168
HostPath: "c:/test/host-path",
169169
})
170-
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
170+
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
171171
assert.NoError(t, err)
172172
assert.NotNil(t, spec)
173173
specCheck(t, testID, testSandboxID, testPid, spec)
@@ -187,7 +187,7 @@ func TestMountNamedPipe(t *testing.T) {
187187
ContainerPath: `\\.\pipe\foo`,
188188
HostPath: `\\.\pipe\foo`,
189189
})
190-
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
190+
spec, err := c.containerSpec(testID, testSandboxID, testPid, nsPath, testContainerName, testImageName, containerConfig, sandboxConfig, imageConfig, nil, config.Runtime{})
191191
assert.NoError(t, err)
192192
assert.NotNil(t, spec)
193193
specCheck(t, testID, testSandboxID, testPid, spec)

0 commit comments

Comments
 (0)