Skip to content

Commit 1b6019b

Browse files
dmcgowandmcgowan
authored
Merge pull request containerd#9681 from dmcgowan/cri-runtime-plugin
Add CRI Service plugin type
2 parents 30a6485 + 64b4778 commit 1b6019b

36 files changed

+659
-522
lines changed

‎cmd/containerd/builtins/cri.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
package builtins
2020

2121
import (
22-
_ "github.com/containerd/containerd/v2/pkg/cri"
22+
_ "github.com/containerd/containerd/v2/plugins/cri"
2323
_ "github.com/containerd/containerd/v2/plugins/cri/images"
24+
_ "github.com/containerd/containerd/v2/plugins/cri/runtime"
2425
)

‎contrib/fuzz/builtins.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ package fuzz
1919
import (
2020
// base containerd imports
2121
_ "github.com/containerd/containerd/v2/core/runtime/v2"
22-
_ "github.com/containerd/containerd/v2/pkg/cri"
2322
_ "github.com/containerd/containerd/v2/pkg/events/plugin"
2423
_ "github.com/containerd/containerd/v2/pkg/nri/plugin"
24+
_ "github.com/containerd/containerd/v2/plugins/cri"
2525
_ "github.com/containerd/containerd/v2/plugins/cri/images"
26+
_ "github.com/containerd/containerd/v2/plugins/cri/runtime"
2627
_ "github.com/containerd/containerd/v2/plugins/diff/walking/plugin"
2728
_ "github.com/containerd/containerd/v2/plugins/gc"
2829
_ "github.com/containerd/containerd/v2/plugins/imageverifier"

‎contrib/fuzz/cri_server_fuzzer.go

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
"github.com/containerd/containerd/v2/pkg/cri/server"
3030
"github.com/containerd/containerd/v2/pkg/cri/server/images"
3131
"github.com/containerd/containerd/v2/pkg/oci"
32+
"github.com/containerd/errdefs"
3233
)
3334

3435
func FuzzCRIServer(data []byte) int {
@@ -42,7 +43,6 @@ func FuzzCRIServer(data []byte) int {
4243
}
4344
defer client.Close()
4445

45-
config := criconfig.Config{}
4646
imageConfig := criconfig.ImageConfig{}
4747

4848
imageService, err := images.NewService(imageConfig, &images.CRIImageServiceOptions{
@@ -52,10 +52,10 @@ func FuzzCRIServer(data []byte) int {
5252
panic(err)
5353
}
5454

55-
c, rs, err := server.NewCRIService(config, &server.CRIServiceOptions{
56-
ImageService: imageService,
57-
Client: client,
58-
BaseOCISpecs: map[string]*oci.Spec{},
55+
c, rs, err := server.NewCRIService(&server.CRIServiceOptions{
56+
RuntimeService: &fakeRuntimeService{},
57+
ImageService: imageService,
58+
Client: client,
5959
})
6060
if err != nil {
6161
panic(err)
@@ -68,6 +68,16 @@ func FuzzCRIServer(data []byte) int {
6868
})
6969
}
7070

71+
type fakeRuntimeService struct{}
72+
73+
func (fakeRuntimeService) Config() criconfig.Config {
74+
return criconfig.Config{}
75+
}
76+
77+
func (fakeRuntimeService) LoadOCISpec(string) (*oci.Spec, error) {
78+
return nil, errdefs.ErrNotFound
79+
}
80+
7181
type service struct {
7282
server.CRIService
7383
runtime.RuntimeServiceServer

‎integration/build_local_containerd_helper_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
_ "github.com/containerd/containerd/v2/core/runtime/v2/runc/options"
3939
_ "github.com/containerd/containerd/v2/pkg/events/plugin"
4040
_ "github.com/containerd/containerd/v2/plugins/cri/images"
41+
_ "github.com/containerd/containerd/v2/plugins/cri/runtime"
4142
_ "github.com/containerd/containerd/v2/plugins/diff/walking/plugin"
4243
_ "github.com/containerd/containerd/v2/plugins/gc"
4344
_ "github.com/containerd/containerd/v2/plugins/leases"

‎integration/main_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ import (
5151
dialer "github.com/containerd/containerd/v2/integration/remote/util"
5252
criconfig "github.com/containerd/containerd/v2/pkg/cri/config"
5353
"github.com/containerd/containerd/v2/pkg/cri/constants"
54-
"github.com/containerd/containerd/v2/pkg/cri/server/base"
54+
"github.com/containerd/containerd/v2/pkg/cri/types"
5555
"github.com/containerd/containerd/v2/pkg/cri/util"
5656
)
5757

@@ -686,7 +686,7 @@ func CRIConfig() (*criconfig.Config, error) {
686686
}
687687

688688
// SandboxInfo gets sandbox info.
689-
func SandboxInfo(id string) (*runtime.PodSandboxStatus, *base.SandboxInfo, error) {
689+
func SandboxInfo(id string) (*runtime.PodSandboxStatus, *types.SandboxInfo, error) {
690690
client, err := RawRuntimeClient()
691691
if err != nil {
692692
return nil, nil, fmt.Errorf("failed to get raw runtime client: %w", err)
@@ -699,7 +699,7 @@ func SandboxInfo(id string) (*runtime.PodSandboxStatus, *base.SandboxInfo, error
699699
return nil, nil, fmt.Errorf("failed to get sandbox status: %w", err)
700700
}
701701
status := resp.GetStatus()
702-
var info base.SandboxInfo
702+
var info types.SandboxInfo
703703
if err := json.Unmarshal([]byte(resp.GetInfo()["info"]), &info); err != nil {
704704
return nil, nil, fmt.Errorf("failed to unmarshal sandbox info: %w", err)
705705
}

‎integration/sandbox_run_rollback_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ import (
3636
criapiv1 "k8s.io/cri-api/pkg/apis/runtime/v1"
3737

3838
"github.com/containerd/containerd/v2/internal/failpoint"
39-
"github.com/containerd/containerd/v2/pkg/cri/server/base"
39+
"github.com/containerd/containerd/v2/pkg/cri/types"
4040
)
4141

4242
const (
@@ -299,7 +299,7 @@ func TestRunPodSandboxAndTeardownCNISlow(t *testing.T) {
299299
}
300300

301301
// sbserverSandboxInfo gets sandbox info.
302-
func sbserverSandboxInfo(id string) (*criapiv1.PodSandboxStatus, *base.SandboxInfo, error) {
302+
func sbserverSandboxInfo(id string) (*criapiv1.PodSandboxStatus, *types.SandboxInfo, error) {
303303
client, err := RawRuntimeClient()
304304
if err != nil {
305305
return nil, nil, fmt.Errorf("failed to get raw runtime client: %w", err)
@@ -312,7 +312,7 @@ func sbserverSandboxInfo(id string) (*criapiv1.PodSandboxStatus, *base.SandboxIn
312312
return nil, nil, fmt.Errorf("failed to get sandbox status: %w", err)
313313
}
314314
status := resp.GetStatus()
315-
var info base.SandboxInfo
315+
var info types.SandboxInfo
316316
if err := json.Unmarshal([]byte(resp.GetInfo()["info"]), &info); err != nil {
317317
return nil, nil, fmt.Errorf("failed to unmarshal sandbox info: %w", err)
318318
}

‎pkg/cri/config/config.go

Lines changed: 53 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
"github.com/containerd/log"
2727
"github.com/pelletier/go-toml/v2"
2828
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
29+
"k8s.io/kubelet/pkg/cri/streaming"
2930

3031
runhcsoptions "github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options"
3132
runcoptions "github.com/containerd/containerd/v2/core/runtime/v2/runc/options"
@@ -312,33 +313,18 @@ type ImageConfig struct {
312313
StatsCollectPeriod int `toml:"stats_collect_period" json:"statsCollectPeriod"`
313314
}
314315

315-
// PluginConfig contains toml config related to CRI plugin,
316+
// RuntimeConfig contains toml config related to CRI plugin,
316317
// it is a subset of Config.
317-
type PluginConfig struct {
318+
type RuntimeConfig struct {
318319
// ContainerdConfig contains config related to containerd
319320
ContainerdConfig `toml:"containerd" json:"containerd"`
320321
// CniConfig contains config related to cni
321322
CniConfig `toml:"cni" json:"cni"`
322-
// DisableTCPService disables serving CRI on the TCP server.
323-
DisableTCPService bool `toml:"disable_tcp_service" json:"disableTCPService"`
324-
// StreamServerAddress is the ip address streaming server is listening on.
325-
StreamServerAddress string `toml:"stream_server_address" json:"streamServerAddress"`
326-
// StreamServerPort is the port streaming server is listening on.
327-
StreamServerPort string `toml:"stream_server_port" json:"streamServerPort"`
328-
// StreamIdleTimeout is the maximum time a streaming connection
329-
// can be idle before the connection is automatically closed.
330-
// The string is in the golang duration format, see:
331-
// https://golang.org/pkg/time/#ParseDuration
332-
StreamIdleTimeout string `toml:"stream_idle_timeout" json:"streamIdleTimeout"`
333323
// EnableSelinux indicates to enable the selinux support.
334324
EnableSelinux bool `toml:"enable_selinux" json:"enableSelinux"`
335325
// SelinuxCategoryRange allows the upper bound on the category range to be set.
336326
// If not specified or set to 0, defaults to 1024 from the selinux package.
337327
SelinuxCategoryRange int `toml:"selinux_category_range" json:"selinuxCategoryRange"`
338-
// EnableTLSStreaming indicates to enable the TLS streaming support.
339-
EnableTLSStreaming bool `toml:"enable_tls_streaming" json:"enableTLSStreaming"`
340-
// X509KeyPairStreaming is a x509 key pair used for TLS streaming
341-
X509KeyPairStreaming `toml:"x509_key_pair_streaming" json:"x509KeyPairStreaming"`
342328
// MaxContainerLogLineSize is the maximum log line size in bytes for a container.
343329
// Log line longer than the limit will be split into multiple lines. Non-positive
344330
// value means no limit.
@@ -418,10 +404,10 @@ type X509KeyPairStreaming struct {
418404
TLSKeyFile string `toml:"tls_key_file" json:"tlsKeyFile"`
419405
}
420406

421-
// Config contains all configurations for cri server.
407+
// Config contains all configurations for CRI runtime plugin.
422408
type Config struct {
423-
// PluginConfig is the config for CRI plugin.
424-
PluginConfig
409+
// RuntimeConfig is the config for CRI runtime.
410+
RuntimeConfig
425411
// ContainerdRootDir is the root directory path for containerd.
426412
ContainerdRootDir string `json:"containerdRootDir"`
427413
// ContainerdEndpoint is the containerd endpoint path.
@@ -433,6 +419,25 @@ type Config struct {
433419
StateDir string `json:"stateDir"`
434420
}
435421

422+
// ServerConfig contains all the configuration for the CRI API server.
423+
type ServerConfig struct {
424+
// DisableTCPService disables serving CRI on the TCP server.
425+
DisableTCPService bool `toml:"disable_tcp_service" json:"disableTCPService"`
426+
// StreamServerAddress is the ip address streaming server is listening on.
427+
StreamServerAddress string `toml:"stream_server_address" json:"streamServerAddress"`
428+
// StreamServerPort is the port streaming server is listening on.
429+
StreamServerPort string `toml:"stream_server_port" json:"streamServerPort"`
430+
// StreamIdleTimeout is the maximum time a streaming connection
431+
// can be idle before the connection is automatically closed.
432+
// The string is in the golang duration format, see:
433+
// https://golang.org/pkg/time/#ParseDuration
434+
StreamIdleTimeout string `toml:"stream_idle_timeout" json:"streamIdleTimeout"`
435+
// EnableTLSStreaming indicates to enable the TLS streaming support.
436+
EnableTLSStreaming bool `toml:"enable_tls_streaming" json:"enableTLSStreaming"`
437+
// X509KeyPairStreaming is a x509 key pair used for TLS streaming
438+
X509KeyPairStreaming `toml:"x509_key_pair_streaming" json:"x509KeyPairStreaming"`
439+
}
440+
436441
const (
437442
// RuntimeUntrusted is the implicit runtime defined for ContainerdConfig.UntrustedWorkloadRuntime
438443
RuntimeUntrusted = "untrusted"
@@ -494,8 +499,8 @@ func ValidateImageConfig(ctx context.Context, c *ImageConfig) ([]deprecation.War
494499
return warnings, nil
495500
}
496501

497-
// ValidatePluginConfig validates the given plugin configuration.
498-
func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.Warning, error) {
502+
// ValidateRuntimeConfig validates the given runtime configuration.
503+
func ValidateRuntimeConfig(ctx context.Context, c *RuntimeConfig) ([]deprecation.Warning, error) {
499504
var warnings []deprecation.Warning
500505
if c.ContainerdConfig.Runtimes == nil {
501506
c.ContainerdConfig.Runtimes = make(map[string]Runtime)
@@ -520,13 +525,6 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W
520525
}
521526
}
522527

523-
// Validation for stream_idle_timeout
524-
if c.StreamIdleTimeout != "" {
525-
if _, err := time.ParseDuration(c.StreamIdleTimeout); err != nil {
526-
return warnings, fmt.Errorf("invalid stream idle timeout: %w", err)
527-
}
528-
}
529-
530528
// Validation for drain_exec_sync_io_timeout
531529
if c.DrainExecSyncIOTimeout != "" {
532530
if _, err := time.ParseDuration(c.DrainExecSyncIOTimeout); err != nil {
@@ -539,6 +537,18 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W
539537
return warnings, nil
540538
}
541539

540+
// ValidateServerConfig validates the given server configuration.
541+
func ValidateServerConfig(ctx context.Context, c *ServerConfig) ([]deprecation.Warning, error) {
542+
var warnings []deprecation.Warning
543+
// Validation for stream_idle_timeout
544+
if c.StreamIdleTimeout != "" {
545+
if _, err := time.ParseDuration(c.StreamIdleTimeout); err != nil {
546+
return warnings, fmt.Errorf("invalid stream idle timeout: %w", err)
547+
}
548+
}
549+
return warnings, nil
550+
}
551+
542552
func (config *Config) GetSandboxRuntime(podSandboxConfig *runtime.PodSandboxConfig, runtimeHandler string) (Runtime, error) {
543553
if untrustedWorkload(podSandboxConfig) {
544554
// If the untrusted annotation is provided, runtimeHandler MUST be empty.
@@ -627,3 +637,17 @@ func getRuntimeOptionsType(t string) interface{} {
627637
return &runtimeoptions.Options{}
628638
}
629639
}
640+
641+
func DefaultServerConfig() ServerConfig {
642+
return ServerConfig{
643+
DisableTCPService: true,
644+
StreamServerAddress: "127.0.0.1",
645+
StreamServerPort: "0",
646+
StreamIdleTimeout: streaming.DefaultConfig.StreamIdleTimeout.String(), // 4 hour
647+
EnableTLSStreaming: false,
648+
X509KeyPairStreaming: X509KeyPairStreaming{
649+
TLSKeyFile: "",
650+
TLSCertFile: "",
651+
},
652+
}
653+
}

‎pkg/cri/config/config_kernel_linux.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import (
2828

2929
var kernelGreaterEqualThan = kernel.GreaterEqualThan
3030

31-
func ValidateEnableUnprivileged(ctx context.Context, c *PluginConfig) error {
31+
func ValidateEnableUnprivileged(ctx context.Context, c *RuntimeConfig) error {
3232
if c.EnableUnprivilegedICMP || c.EnableUnprivilegedPorts {
3333
fourDotEleven := kernel.KernelVersion{Kernel: 4, Major: 11}
3434
ok, err := kernelGreaterEqualThan(fourDotEleven)

‎pkg/cri/config/config_kernel_linux_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ func TestValidateEnableUnprivileged(t *testing.T) {
3232

3333
tests := []struct {
3434
name string
35-
config *PluginConfig
35+
config *RuntimeConfig
3636
kernelGreater bool
3737
expectedErr string
3838
}{
3939
{
4040
name: "disable unprivileged_icmp and unprivileged_port",
41-
config: &PluginConfig{
41+
config: &RuntimeConfig{
4242
ContainerdConfig: ContainerdConfig{
4343
DefaultRuntimeName: RuntimeDefault,
4444
Runtimes: map[string]Runtime{
@@ -54,7 +54,7 @@ func TestValidateEnableUnprivileged(t *testing.T) {
5454
},
5555
{
5656
name: "enable unprivileged_icmp or unprivileged_port, but kernel version is smaller than 4.11",
57-
config: &PluginConfig{
57+
config: &RuntimeConfig{
5858
ContainerdConfig: ContainerdConfig{
5959
DefaultRuntimeName: RuntimeDefault,
6060
Runtimes: map[string]Runtime{
@@ -71,7 +71,7 @@ func TestValidateEnableUnprivileged(t *testing.T) {
7171
},
7272
{
7373
name: "enable unprivileged_icmp or unprivileged_port, but kernel version is greater than or equal 4.11",
74-
config: &PluginConfig{
74+
config: &RuntimeConfig{
7575
ContainerdConfig: ContainerdConfig{
7676
DefaultRuntimeName: RuntimeDefault,
7777
Runtimes: map[string]Runtime{

‎pkg/cri/config/config_kernel_other.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,6 @@ import (
2222
"context"
2323
)
2424

25-
func ValidateEnableUnprivileged(ctx context.Context, c *PluginConfig) error {
25+
func ValidateEnableUnprivileged(ctx context.Context, c *RuntimeConfig) error {
2626
return nil
2727
}

0 commit comments

Comments
 (0)