Merge pull request #603 from Random-Liu/support-shared-pid

Support shared pid

README.md

@@ -7,7 +7,7 @@
 [![Build Status](https://api.travis-ci.org/containerd/cri-containerd.svg?style=flat-square)](https://travis-ci.org/containerd/cri-containerd)
 [![Go Report Card](https://goreportcard.com/badge/github.com/containerd/cri-containerd?style=flat-square)](https://goreportcard.com/report/github.com/containerd/cri-containerd)
 
-`cri-containerd` is a [containerd](https://containerd.io/) based implementation of Kubernetes [container runtime interface (CRI)](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto).
+`cri-containerd` is a [containerd](https://containerd.io/) based implementation of Kubernetes [container runtime interface (CRI)](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto).
 
 With it, you could run Kubernetes using containerd as the container runtime.
 ![cri-containerd](./docs/cri-containerd.png)

docs/architecture.md

@@ -1,7 +1,7 @@
 # Architecture of CRI-Containerd
 This document describes the architecture of `cri-containerd`.
 
-Cri-containerd is a containerd based implementation of Kubernetes [container runtime interface (CRI)](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/v1alpha1/runtime/api.proto). It operates on the same node as the [Kubelet](https://kubernetes.io/docs/reference/generated/kubelet/) and [containerd](https://github.com/containerd/containerd). Layered between Kubernetes and containerd, cri-containerd handles all CRI service requests from the Kubelet and uses containerd to manage containers and container images.
+Cri-containerd is a containerd based implementation of Kubernetes [container runtime interface (CRI)](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/runtime/v1alpha2/api.proto). It operates on the same node as the [Kubelet](https://kubernetes.io/docs/reference/generated/kubelet/) and [containerd](https://github.com/containerd/containerd). Layered between Kubernetes and containerd, cri-containerd handles all CRI service requests from the Kubelet and uses containerd to manage containers and container images.
 
 Cri-containerd uses containerd to manage the full container lifecycle and all container images. As also shown below, cri-containerd manages pod networking via [CNI](https://github.com/containernetworking/cni) (another CNCF project).
 

docs/crictl.md

@@ -55,7 +55,7 @@ e1c83b0b8d481d4af8ba98d5f7812577fc175a37b10dc824335951f52addbb4e
 $ crictl pods
 PODSANDBOX ID       CREATED             STATE               NAME               NAMESPACE          ATTEMPT
 e1c83b0b8d481       2 hours ago         SANDBOX_READY       nginx-sandbox      default            1
-$ crictl inspects e1c8
+$ crictl inspectp e1c8
   ... displays information about the pod and the pod sandbox pause container.
 ```
 * Note: As shown above, you may use truncated IDs if they are unique.

hack/cri-reset.sh

@@ -31,13 +31,13 @@ crictl_rm_stopped_containers() {
 
 crictl_stop_pods() {
    for x in $($CRICTL_CLI pods | awk '{ print $1 }' | awk '{if(NR>1)print}') ;do
-       $CRICTL_CLI stops $x
+       $CRICTL_CLI stopp $x
    done
 }
 
 crictl_rm_pods() {
    for x in $($CRICTL_CLI pods | awk '{ print $1 }' | awk '{if(NR>1)print}') ;do
-       $CRICTL_CLI rms $x
+       $CRICTL_CLI rmp $x
    done
 }
 

hack/versions

@@ -2,5 +2,5 @@ RUNC_VERSION=9f9c96235cc97674e935002fc3d78361b696a69e
 CNI_VERSION=v0.6.0
 CONTAINERD_VERSION=f12ba2407e328c98f8be5eacbb9c510b073dd4c0
 CONTAINERD_REPO=
-CRITOOL_VERSION=ded07bb08aa23492fa0233bb3af8c4629875f286
-KUBERNETES_VERSION=v1.9.0
+CRITOOL_VERSION=240a840375cdabb5860c75c99e8b0d0a776006b4
+KUBERNETES_VERSION=0caa20c65f147e15f5545862510eb7e81c42b0a3

integration/container_stats_test.go

@@ -23,7 +23,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 // Test to verify for a container ID

integration/container_update_resources_test.go

@@ -24,7 +24,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 func checkMemoryLimit(t *testing.T, spec *runtimespec.Spec, memLimit int64) {

integration/image_load_test.go

@@ -25,7 +25,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	api "github.com/containerd/cri-containerd/pkg/api/v1"
 )

integration/imagefs_info_test.go

@@ -24,7 +24,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 func TestImageFSInfo(t *testing.T) {

integration/restart_test.go

@@ -27,7 +27,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 	"golang.org/x/sys/unix"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 // Restart test must run sequentially.

integration/sandbox_clean_remove_test.go

@@ -24,7 +24,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 func TestSandboxCleanRemove(t *testing.T) {

integration/test_utils.go

@@ -26,7 +26,7 @@ import (
 	"github.com/containerd/containerd"
 	"github.com/sirupsen/logrus"
 	"k8s.io/kubernetes/pkg/kubelet/apis/cri"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 	"k8s.io/kubernetes/pkg/kubelet/remote"
 
 	api "github.com/containerd/cri-containerd/pkg/api/v1"
@@ -104,7 +104,7 @@ func WithHostNetwork(p *runtime.PodSandboxConfig) {
 	}
 	if p.Linux.SecurityContext.NamespaceOptions == nil {
 		p.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{
-			HostNetwork: true,
+			Network: runtime.NamespaceMode_NODE,
 		}
 	}
 }

integration/truncindex_test.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtimeapi "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 func genTruncIndex(normalName string) string {

integration/volume_copy_up_test.go

@@ -24,7 +24,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 func TestVolumeCopyUp(t *testing.T) {

pkg/server/container_attach.go

@@ -24,7 +24,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/context"
 	"k8s.io/client-go/tools/remotecommand"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	cio "github.com/containerd/cri-containerd/pkg/server/io"
 )

pkg/server/container_create.go

@@ -43,7 +43,7 @@ import (
 	"github.com/syndtr/gocapability/capability"
 	"golang.org/x/net/context"
 	"golang.org/x/sys/unix"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	"github.com/containerd/cri-containerd/pkg/annotations"
 	customopts "github.com/containerd/cri-containerd/pkg/containerd/opts"
@@ -427,7 +427,7 @@ func (c *criContainerdService) generateContainerMounts(sandboxRootDir string, co
 
 	if !isInCRIMounts(devShm, config.GetMounts()) {
 		sandboxDevShm := getSandboxDevShm(sandboxRootDir)
-		if securityContext.GetNamespaceOptions().GetHostIpc() {
+		if securityContext.GetNamespaceOptions().GetIpc() == runtime.NamespaceMode_NODE {
 			sandboxDevShm = devShm
 		}
 		mounts = append(mounts, &runtime.Mount{
@@ -718,9 +718,9 @@ func setOCINamespaces(g *generate.Generator, namespaces *runtime.NamespaceOption
 	g.AddOrReplaceLinuxNamespace(string(runtimespec.NetworkNamespace), getNetworkNamespace(sandboxPid)) // nolint: errcheck
 	g.AddOrReplaceLinuxNamespace(string(runtimespec.IPCNamespace), getIPCNamespace(sandboxPid))         // nolint: errcheck
 	g.AddOrReplaceLinuxNamespace(string(runtimespec.UTSNamespace), getUTSNamespace(sandboxPid))         // nolint: errcheck
-	// Do not share pid namespace for now.
-	if namespaces.GetHostPid() {
-		g.RemoveLinuxNamespace(string(runtimespec.PIDNamespace)) // nolint: errcheck
+	// Do not share pid namespace if namespace mode is CONTAINER.
+	if namespaces.GetPid() != runtime.NamespaceMode_CONTAINER {
+		g.AddOrReplaceLinuxNamespace(string(runtimespec.PIDNamespace), getPIDNamespace(sandboxPid)) // nolint: errcheck
 	}
 }
 

pkg/server/container_create_test.go

@@ -30,7 +30,7 @@ import (
 	"github.com/opencontainers/runtime-tools/generate"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	"github.com/containerd/cri-containerd/pkg/annotations"
 	ostesting "github.com/containerd/cri-containerd/pkg/os/testing"
@@ -169,6 +169,10 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
 			Type: runtimespec.UTSNamespace,
 			Path: getUTSNamespace(sandboxPid),
 		})
+		assert.Contains(t, spec.Linux.Namespaces, runtimespec.LinuxNamespace{
+			Type: runtimespec.PIDNamespace,
+			Path: getPIDNamespace(sandboxPid),
+		})
 
 		t.Logf("Check PodSandbox annotations")
 		assert.Contains(t, spec.Annotations, annotations.SandboxID)
@@ -543,7 +547,7 @@ func TestGenerateContainerMounts(t *testing.T) {
 		},
 		"should use host /dev/shm when host ipc is set": {
 			securityContext: &runtime.LinuxContainerSecurityContext{
-				NamespaceOptions: &runtime.NamespaceOption{HostIpc: true},
+				NamespaceOptions: &runtime.NamespaceOption{Ipc: runtime.NamespaceMode_NODE},
 			},
 			expectedMounts: []*runtime.Mount{
 				{
@@ -748,25 +752,39 @@ func TestPidNamespace(t *testing.T) {
 	testID := "test-id"
 	testPid := uint32(1234)
 	testSandboxID := "sandbox-id"
-	config, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
+	config, sandboxConfig, imageConfig, _ := getCreateContainerTestData()
 	c := newTestCRIContainerdService()
-	t.Logf("should not set pid namespace when host pid is true")
-	config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{HostPid: true}
-	spec, err := c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
-	require.NoError(t, err)
-	specCheck(t, testID, testSandboxID, testPid, spec)
-	for _, ns := range spec.Linux.Namespaces {
-		assert.NotEqual(t, ns.Type, runtimespec.PIDNamespace)
+	for desc, test := range map[string]struct {
+		pidNS    runtime.NamespaceMode
+		expected runtimespec.LinuxNamespace
+	}{
+		"node namespace mode": {
+			pidNS: runtime.NamespaceMode_NODE,
+			expected: runtimespec.LinuxNamespace{
+				Type: runtimespec.PIDNamespace,
+				Path: getPIDNamespace(testPid),
+			},
+		},
+		"container namespace mode": {
+			pidNS: runtime.NamespaceMode_CONTAINER,
+			expected: runtimespec.LinuxNamespace{
+				Type: runtimespec.PIDNamespace,
+			},
+		},
+		"pod namespace mode": {
+			pidNS: runtime.NamespaceMode_POD,
+			expected: runtimespec.LinuxNamespace{
+				Type: runtimespec.PIDNamespace,
+				Path: getPIDNamespace(testPid),
+			},
+		},
+	} {
+		t.Logf("TestCase %q", desc)
+		config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{Pid: test.pidNS}
+		spec, err := c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
+		require.NoError(t, err)
+		assert.Contains(t, spec.Linux.Namespaces, test.expected)
 	}
-
-	t.Logf("should set pid namespace when host pid is false")
-	config.Linux.SecurityContext.NamespaceOptions = &runtime.NamespaceOption{HostPid: false}
-	spec, err = c.generateContainerSpec(testID, testSandboxID, testPid, config, sandboxConfig, imageConfig, nil)
-	require.NoError(t, err)
-	specCheck(t, testID, testSandboxID, testPid, spec)
-	assert.Contains(t, spec.Linux.Namespaces, runtimespec.LinuxNamespace{
-		Type: runtimespec.PIDNamespace,
-	})
 }
 
 func TestDefaultRuntimeSpec(t *testing.T) {

pkg/server/container_exec.go

@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 // Exec prepares a streaming endpoint to execute a command in the container, and returns the address.

pkg/server/container_execsync.go

@@ -29,7 +29,7 @@ import (
 	"golang.org/x/net/context"
 	"golang.org/x/sys/unix"
 	"k8s.io/client-go/tools/remotecommand"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	cioutil "github.com/containerd/cri-containerd/pkg/ioutil"
 	cio "github.com/containerd/cri-containerd/pkg/server/io"

pkg/server/container_list.go

@@ -19,7 +19,7 @@ package server
 import (
 	"golang.org/x/net/context"
 
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 )

pkg/server/container_list_test.go

@@ -23,7 +23,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 	sandboxstore "github.com/containerd/cri-containerd/pkg/store/sandbox"

pkg/server/container_log_reopen.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2018 The Containerd Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package server
+
+import (
+	"errors"
+	"golang.org/x/net/context"
+
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
+)
+
+// ReopenContainerLog asks cri-containerd to reopen the stdout/stderr log file for the container.
+// This is often called after the log file has been rotated.
+// TODO(random-liu): Implement this for kubelet log rotation.
+func (c *criContainerdService) ReopenContainerLog(ctx context.Context, r *runtime.ReopenContainerLogRequest) (*runtime.ReopenContainerLogResponse, error) {
+	return nil, errors.New("not implemented")
+}

pkg/server/container_remove.go

@@ -24,7 +24,7 @@ import (
 	"github.com/docker/docker/pkg/system"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	"github.com/containerd/cri-containerd/pkg/log"
 	"github.com/containerd/cri-containerd/pkg/store"

pkg/server/container_start.go

@@ -26,7 +26,7 @@ import (
 	"github.com/containerd/containerd/errdefs"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	cio "github.com/containerd/cri-containerd/pkg/server/io"
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"

pkg/server/container_stats.go

@@ -21,7 +21,7 @@ import (
 
 	tasks "github.com/containerd/containerd/api/services/tasks/v1"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 )
 
 // ContainerStats returns stats of the container. If the container does not

pkg/server/container_stats_list.go

@@ -24,7 +24,7 @@ import (
 	"github.com/containerd/containerd/api/types"
 	"github.com/containerd/typeurl"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 )

pkg/server/container_status.go

@@ -23,7 +23,7 @@ import (
 	runtimespec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 )

pkg/server/container_status_test.go

@@ -22,7 +22,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 	imagestore "github.com/containerd/cri-containerd/pkg/store/image"

pkg/server/container_stop.go

@@ -26,7 +26,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"golang.org/x/net/context"
 	"golang.org/x/sys/unix"
-	"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
+	runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
 
 	containerstore "github.com/containerd/cri-containerd/pkg/store/container"
 )