sandbox: send pod UID to CNI plugins as K8S_POD_UID#5640
Merged
fuweid merged 1 commit intocontainerd:mainfrom Jun 23, 2021
Merged
sandbox: send pod UID to CNI plugins as K8S_POD_UID#5640fuweid merged 1 commit intocontainerd:mainfrom
fuweid merged 1 commit intocontainerd:mainfrom
Conversation
CNI plugins that need to wait for network state to converge may want to cancel waiting when a short lived pod is deleted. However, there is a race between when kubelet asks the runtime to create the sandbox for the pod, and when the plugin is able request the pod object from the apiserver. It may be the case that the plugin receives the new pod, rather than the pod the sandbox request was initiated for. Passing the pod UID to the plugin allows the plugin to check whether the pod it gets from the apiserver is actually the pod its sandbox request was started for. Signed-off-by: Dan Williams <[email protected]>
|
Hi @dcbw. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Build succeeded.
|
Member
|
/ok-to-test |
fuweid
approved these changes
Jun 23, 2021
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CNI plugins that need to wait for network state to converge
may want to cancel waiting when a short lived pod is deleted.
However, there is a race between when kubelet asks the runtime
to create the sandbox for the pod, and when the plugin is able
request the pod object from the apiserver. It may be the case
that the plugin receives the new pod, rather than the pod
the sandbox request was initiated for.
Passing the pod UID to the plugin allows the plugin to check
whether the pod it gets from the apiserver is actually the
pod its sandbox request was started for.
(corresponding crio PR is cri-o/cri-o#5026, FWIW)
@estesp @fuweid