Skip to content

Commit f48bbef

Browse files
AkihiroSudaAkihiroSuda
authored
Merge pull request #8994 from mxpv/cri
Use sandboxed CRI by default
2 parents 8e7a258 + c92f4a1 commit f48bbef

10 files changed

Lines changed: 27 additions & 27 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ jobs:
244244
fail-fast: false
245245
matrix:
246246
os: [windows-2019, windows-2022]
247-
enable_cri_sandboxes: ["", "sandboxed"]
247+
disable_cri_sandboxes: ["", "legacyCRI"]
248248

249249
defaults:
250250
run:
@@ -335,7 +335,7 @@ jobs:
335335
- name: Integration 1
336336
env:
337337
CGO_ENABLED: 1
338-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
338+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
339339
GOTESTSUM_JUNITFILE: ${{github.workspace}}/test-integration-serial-junit.xml
340340
GOTESTSUM_JSONFILE: ${{github.workspace}}/test-integration-serial-gotest.json
341341
EXTRA_TESTFLAGS: "-timeout=20m"
@@ -353,7 +353,7 @@ jobs:
353353
TESTFLAGS_PARALLEL: 1
354354
EXTRA_TESTFLAGS: "-short"
355355
CGO_ENABLED: 1
356-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
356+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
357357
GOTESTSUM_JUNITFILE: ${{github.workspace}}/test-integration-parallel-junit.xml
358358
GOTESTSUM_JSONFILE: ${{github.workspace}}/test-integration-parallel-gotest.json
359359
run: mingw32-make.exe integration
@@ -366,14 +366,14 @@ jobs:
366366

367367
- name: CRI Integration Test
368368
env:
369-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
369+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
370370
TEST_IMAGE_LIST: ${{github.workspace}}/repolist.toml
371371
run: |
372372
make cri-integration
373373
374374
- name: cri-tools critest
375375
env:
376-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
376+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
377377
CRI_TEST_IMAGES: ${{github.workspace}}/cri-test-images.yaml
378378
shell: powershell
379379
run: |
@@ -409,7 +409,7 @@ jobs:
409409
runtime:
410410
- io.containerd.runc.v2
411411
runc: [runc, crun]
412-
enable_cri_sandboxes: ["", "sandboxed"]
412+
DISABLE_CRI_SANDBOXES: ["", "legacyCRI"]
413413

414414
env:
415415
GOTEST: gotestsum --
@@ -464,7 +464,7 @@ jobs:
464464
env:
465465
TEST_RUNTIME: ${{ matrix.runtime }}
466466
RUNC_FLAVOR: ${{ matrix.runc }}
467-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
467+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
468468
GOTESTSUM_JUNITFILE: ${{github.workspace}}/test-integration-serial-junit.xml
469469
GOTESTSUM_JSONFILE: ${{github.workspace}}/test-integration-serial-gotest.json
470470
run: |
@@ -483,7 +483,7 @@ jobs:
483483
env:
484484
TEST_RUNTIME: ${{ matrix.runtime }}
485485
RUNC_FLAVOR: ${{ matrix.runc }}
486-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
486+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
487487
GOTESTSUM_JUNITFILE: ${{github.workspace}}/test-integration-parallel-junit.xml
488488
GOTESTSUM_JSONFILE: ${{github.workspace}}/test-integration-parallel-gotest.json
489489
run: |
@@ -500,14 +500,14 @@ jobs:
500500
- name: CRI Integration Test
501501
env:
502502
TEST_RUNTIME: ${{ matrix.runtime }}
503-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
503+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
504504
run: |
505505
CONTAINERD_RUNTIME=$TEST_RUNTIME make cri-integration
506506
507507
- name: cri-tools critest
508508
env:
509509
TEST_RUNTIME: ${{ matrix.runtime }}
510-
ENABLE_CRI_SANDBOXES: ${{ matrix.enable_cri_sandboxes }}
510+
DISABLE_CRI_SANDBOXES: ${{ matrix.disable_cri_sandboxes }}
511511
run: |
512512
sudo -E PATH=$PATH ./script/critest.sh "${{github.workspace}}/report"
513513

‎RELEASES.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,8 @@ The deprecated features are shown in the following table:
386386
| `cri-containerd-*.tar.gz` release bundles | containerd v1.6 | containerd v2.0 | Use `containerd-*.tar.gz` bundles |
387387
| Pulling Schema 1 images (`application/vnd.docker.distribution.manifest.v1+json`) | containerd v1.7 | containerd v2.0 | Use Schema 2 or OCI images |
388388
| CRI `v1alpha2` | containerd v1.7 | containerd v2.0 ✅ | Use CRI `v1` |
389+
| Legacy CRI implementation of podsandbox support | containerd v2.0 | containerd v2.1 | Disabled by default in 2.0 in favor of core sandboxed CRI plugin (use `DISABLE_CRI_SANDBOXES=1` to fallback to prior CRI podsandbox implementation) |
390+
389391

390392
### Deprecated config properties
391393
The deprecated properties in [`config.toml`](./docs/cri/config.md) are shown in the following table:

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ EOF
272272
'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
273273
'GOTESTSUM_JSONFILE': ENV['GOTESTSUM_JSONFILE'],
274274
'GITHUB_WORKSPACE': '',
275-
'ENABLE_CRI_SANDBOXES': ENV['ENABLE_CRI_SANDBOXES'],
275+
'DISABLE_CRI_SANDBOXES': ENV['DISABLE_CRI_SANDBOXES'],
276276
}
277277
sh.inline = <<~SHELL
278278
#!/usr/bin/env bash

‎containerd.service‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ Documentation=https://containerd.io
1818
After=network.target local-fs.target
1919

2020
[Service]
21-
#uncomment to enable the experimental sbservice (sandboxed) version of containerd/cri integration
22-
#Environment="ENABLE_CRI_SANDBOXES=sandboxed"
21+
#uncomment to fallback to legacy CRI plugin implementation with podsandbox support.
22+
#Environment="DISABLE_CRI_SANDBOXES=1"
2323
ExecStartPre=-/sbin/modprobe overlay
2424
ExecStart=/usr/local/bin/containerd
2525

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ RUN make BUILDTAGS="no_btrfs no_devmapper" bin/cri-integration.test
9494
RUN ./script/setup/install-failpoint-binaries
9595
# The test scripts need these env vars to be explicitly set
9696
ENV GITHUB_WORKSPACE=""
97-
ENV ENABLE_CRI_SANDBOXES=""
97+
ENV DISABLE_CRI_SANDBOXES=""
9898
ENV CONTAINERD_RUNTIME="io.containerd.runc.v2"
9999
CMD ["make", "cri-integration"]
100100

‎integration/sandbox_run_rollback_test.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -293,8 +293,7 @@ func TestRunPodSandboxAndTeardownCNISlow(t *testing.T) {
293293
assert.Equal(t, sb.Metadata.Uid, sbConfig.Metadata.Uid)
294294
assert.Equal(t, sb.Metadata.Attempt, sbConfig.Metadata.Attempt)
295295

296-
switch os.Getenv("ENABLE_CRI_SANDBOXES") {
297-
case "":
296+
if os.Getenv("DISABLE_CRI_SANDBOXES") != "" {
298297
// non-sbserver
299298
t.Log("Get sandbox info (non-sbserver)")
300299
_, info, err := SandboxInfo(sb.Id)
@@ -319,7 +318,7 @@ func TestRunPodSandboxAndTeardownCNISlow(t *testing.T) {
319318
metadata, ok := i.(*sandbox.Metadata)
320319
require.True(t, ok)
321320
assert.Equal(t, netNS, metadata.NetNSPath, "network namespace path should be the same in runtime spec and sandbox metadata")
322-
default:
321+
} else {
323322
// sbserver
324323
t.Log("Get sandbox info (sbserver)")
325324
_, info, err := sbserverSandboxInfo(sb.Id)
@@ -328,7 +327,6 @@ func TestRunPodSandboxAndTeardownCNISlow(t *testing.T) {
328327

329328
assert.NotEmpty(t, info.Metadata.NetNSPath, "network namespace should be set")
330329
}
331-
332330
}
333331

334332
// sbserverSandboxInfo gets sandbox info.

‎pkg/cri/config/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ type Runtime struct {
7878
// See https://github.com/containerd/containerd/issues/6657 for details.
7979
Snapshotter string `toml:"snapshotter" json:"snapshotter"`
8080
// SandboxMode defines which sandbox runtime to use when scheduling pods
81-
// This features requires experimental CRI server to be enabled (use ENABLE_CRI_SANDBOXES=1)
81+
// This features requires the new CRI server implementation (enabled by default in 2.0)
8282
// shim - means use whatever Controller implementation provided by shim (e.g. use RemoteController).
8383
// podsandbox - means use Controller implementation from sbserver podsandbox package.
8484
SandboxMode string `toml:"sandbox_mode" json:"sandboxMode"`

‎pkg/cri/cri.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@ func initCRIService(ic *plugin.InitContext) (interface{}, error) {
8888
}
8989

9090
var s server.CRIService
91-
if os.Getenv("ENABLE_CRI_SANDBOXES") != "" {
92-
log.G(ctx).Info("using experimental CRI Sandbox server - unset ENABLE_CRI_SANDBOXES to disable")
91+
if os.Getenv("DISABLE_CRI_SANDBOXES") == "" {
92+
log.G(ctx).Info("using CRI Sandbox server - use DISABLE_CRI_SANDBOXES=1 to fallback to legacy CRI")
9393
s, err = sbserver.NewCRIService(c, client, getNRIAPI(ic))
9494
} else {
9595
log.G(ctx).Info("using legacy CRI server")

‎script/test/cri-integration.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ test_setup "${REPORT_DIR}"
4444
CMD=""
4545
if [ -n "${sudo}" ]; then
4646
CMD+="${sudo} "
47-
# sudo strips environment variables, so add ENABLE_CRI_SANDBOXES back if present
48-
if [ -n "${ENABLE_CRI_SANDBOXES}" ]; then
49-
CMD+="ENABLE_CRI_SANDBOXES='${ENABLE_CRI_SANDBOXES}' "
47+
# sudo strips environment variables, so add DISABLE_CRI_SANDBOXES back if present
48+
if [ -n "${DISABLE_CRI_SANDBOXES}" ]; then
49+
CMD+="DISABLE_CRI_SANDBOXES='${DISABLE_CRI_SANDBOXES}' "
5050
fi
5151
fi
5252
CMD+="${PWD}/bin/cri-integration.test"

‎script/test/utils.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -215,9 +215,9 @@ run_containerd() {
215215
CMD=""
216216
if [ -n "${sudo}" ]; then
217217
CMD+="${sudo} "
218-
# sudo strips environment variables, so add ENABLE_CRI_SANDBOXES back if present
219-
if [ -n "${ENABLE_CRI_SANDBOXES}" ]; then
220-
CMD+="ENABLE_CRI_SANDBOXES='${ENABLE_CRI_SANDBOXES}' "
218+
# sudo strips environment variables, so add DISABLE_CRI_SANDBOXES back if present
219+
if [ -n "${DISABLE_CRI_SANDBOXES}" ]; then
220+
CMD+="DISABLE_CRI_SANDBOXES='${DISABLE_CRI_SANDBOXES}' "
221221
fi
222222
fi
223223
CMD+="${PWD}/bin/containerd"

0 commit comments

Comments
 (0)