vendor: update github.com/opencontainers/runc by giuseppe · Pull Request #92862 · kubernetes/kubernetes

giuseppe · 2020-07-07T12:44:46Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:

/kind bug

What this PR does / why we need it:

when the systemd cgroup manager is used, controllers not handled by systemd are created manually afterwards.

libcontainer didn't correctly cleanup these cgroups that were leakedon cgroup v1.

Which issue(s) this PR fixes:

Fixes #92766

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

giuseppe · 2020-07-07T12:46:10Z

/sig-node

liggitt · 2020-07-07T14:54:42Z

vendor mechanics lgtm

cc @kubernetes/sig-node-pr-reviews for runc and ebpf changes

sjenning · 2020-07-07T15:28:40Z

/assign

sjenning · 2020-07-07T17:04:33Z

/lgtm

needs top level approver

sjenning · 2020-07-07T17:05:26Z

/assign @liggitt

liggitt · 2020-07-07T17:05:32Z

there's a gofmt error that needs fixing

sjenning · 2020-07-07T17:08:08Z

ah yes 52bf6e5#diff-20728a5825a9e01d8bf61ad43ab2b7e4R128

Verifying verify-gofmt.sh

+++ Running case: verify.gofmt 
+++ working dir: /home/prow/go/src/k8s.io/kubernetes
+++ command: bash "hack/make-rules/../../hack/verify-gofmt.sh"
diff -u ./pkg/kubelet/dockershim/cm/container_manager_linux.go.orig ./pkg/kubelet/dockershim/cm/container_manager_linux.go
--- ./pkg/kubelet/dockershim/cm/container_manager_linux.go.orig	2020-07-07 15:02:04.734181675 +0000
+++ ./pkg/kubelet/dockershim/cm/container_manager_linux.go	2020-07-07 15:02:04.734181675 +0000
@@ -123,8 +123,8 @@
 		Parent: "/",
 		Name:   name,
 		Resources: &configs.Resources{
-			Memory:     int64(memoryLimit),
-			MemorySwap: -1,
+			Memory:      int64(memoryLimit),
+			MemorySwap:  -1,
 			SkipDevices: true,
 			Devices: []*configs.DeviceRule{
 				{

Run ./hack/update-gofmt.sh
+++ exit code: 1
+++ error: 1
�[0;31mFAILED�[0m   verify-gofmt.sh	24s

mrunalp · 2020-07-07T19:09:50Z

/lgtm

liggitt · 2020-07-07T19:10:49Z

/approve
/retest

k8s-ci-robot · 2020-07-07T19:11:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kolyshkin

LGTM (not a maintainer)

haircommander · 2020-07-07T23:57:42Z

/retest

haircommander · 2020-07-08T19:14:34Z

hm is prow stalled or is 24 hours waiting for it to retest normal

when the systemd cgroup manager is used, controllers not handled by systemd are created manually afterwards. libcontainer didn't correctly cleanup these cgroups that were leaked on cgroup v1. Closes: kubernetes#92766 Signed-off-by: Giuseppe Scrivano <[email protected]>

use the new libcontainer feature of skipping setting the devices cgroup. This is necessary on cgroup v2 to avoid leaking a eBPF program every time the cgroup is re-configured. Signed-off-by: Giuseppe Scrivano <[email protected]>

giuseppe · 2020-07-09T07:38:36Z

had to rebase. Pushed a new version

liggitt · 2020-07-09T07:40:14Z

/lgtm

liggitt · 2020-07-09T12:35:09Z

/retest

haircommander · 2020-07-09T13:09:37Z

/retest

haircommander · 2020-07-09T14:38:46Z

/retest

k8s-ci-robot requested review from a team, dchen1107 and matthyx July 7, 2020 12:45

k8s-ci-robot added the area/dependency Issues or PRs related to dependency changes label Jul 7, 2020

k8s-ci-robot added area/kubelet sig/node Categorizes an issue or PR as relevant to SIG Node. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jul 7, 2020

giuseppe mentioned this pull request Jul 7, 2020

kubelet consistently timing out on attempting to Destroy cgroups #92766

Closed

giuseppe force-pushed the cgroup-fix-leaks branch from b6bb1b7 to 52bf6e5 Compare July 7, 2020 13:46

k8s-ci-robot assigned sjenning Jul 7, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 7, 2020

k8s-ci-robot assigned liggitt Jul 7, 2020

giuseppe force-pushed the cgroup-fix-leaks branch from 52bf6e5 to 1289531 Compare July 7, 2020 18:22

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 7, 2020

k8s-ci-robot assigned mrunalp Jul 7, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 7, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 7, 2020

kolyshkin approved these changes Jul 7, 2020

View reviewed changes

kolyshkin reviewed Jul 7, 2020

View reviewed changes

Comment thread pkg/kubelet/dockershim/cm/container_manager_linux.go Outdated

kolyshkin mentioned this pull request Jul 8, 2020

libct/cgroups: add SkipDevices to Resources opencontainers/runc#2490

Merged

liggitt added this to the v1.19 milestone Jul 8, 2020

liggitt added the priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. label Jul 8, 2020

k8s-ci-robot removed the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Jul 8, 2020

liggitt added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. labels Jul 8, 2020

giuseppe added 2 commits July 9, 2020 09:37

kubelet: skip setting the devices cgroup

0d2a493

use the new libcontainer feature of skipping setting the devices cgroup. This is necessary on cgroup v2 to avoid leaking a eBPF program every time the cgroup is re-configured. Signed-off-by: Giuseppe Scrivano <[email protected]>

giuseppe force-pushed the cgroup-fix-leaks branch from 1289531 to 0d2a493 Compare July 9, 2020 07:38

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 9, 2020

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 9, 2020

This was referenced Jul 10, 2020

test: use cgroupfs to fix tests temporarily cri-o/cri-o#3943

Merged

follow ups from 3943 cri-o/cri-o#3945

Closed

k8s-ci-robot merged commit 63926cf into kubernetes:master Jul 12, 2020

skeeey mentioned this pull request Aug 17, 2020

k8s v1.18 runc dependency question #94039

Closed

kolyshkin mentioned this pull request May 24, 2021

libct/cg/sd: fix SkipDevices for systemd opencontainers/runc#2958

Merged

Conversation

giuseppe commented Jul 7, 2020

Uh oh!

giuseppe commented Jul 7, 2020

Uh oh!

liggitt commented Jul 7, 2020

Uh oh!

sjenning commented Jul 7, 2020

Uh oh!

sjenning commented Jul 7, 2020

Uh oh!

sjenning commented Jul 7, 2020

Uh oh!

liggitt commented Jul 7, 2020

Uh oh!

sjenning commented Jul 7, 2020

Uh oh!

mrunalp commented Jul 7, 2020

Uh oh!

liggitt commented Jul 7, 2020

Uh oh!

k8s-ci-robot commented Jul 7, 2020

Uh oh!

kolyshkin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

haircommander commented Jul 7, 2020

Uh oh!

haircommander commented Jul 8, 2020

Uh oh!

giuseppe commented Jul 9, 2020

Uh oh!

liggitt commented Jul 9, 2020

Uh oh!

liggitt commented Jul 9, 2020

Uh oh!

haircommander commented Jul 9, 2020

Uh oh!

haircommander commented Jul 9, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants