diff --git a/0065-fix-stopp-removes-cont-error-remove-inspect-error-lo.patch b/0065-fix-stopp-removes-cont-error-remove-inspect-error-lo.patch new file mode 100644 index 0000000..ba38cc7 --- /dev/null +++ b/0065-fix-stopp-removes-cont-error-remove-inspect-error-lo.patch @@ -0,0 +1,76 @@ +From 3d8c6127161acbe35bf03fe495ac43e2b9242cbf Mon Sep 17 00:00:00 2001 +From: jikai +Date: Tue, 19 Dec 2023 18:31:30 +0800 +Subject: [PATCH 65/71] fix stopp removes cont error & remove inspect error log + +Signed-off-by: jikai +--- + .../cri_pod_sandbox_manager_service.cc | 36 ++++++++----------- + .../container_cb/execution_information.c | 2 +- + 2 files changed, 15 insertions(+), 23 deletions(-) + +diff --git a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc +index bc40cb06..4d1d19eb 100644 +--- a/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc ++++ b/src/daemon/entry/cri/v1alpha/cri_pod_sandbox_manager_service.cc +@@ -703,30 +703,22 @@ auto PodSandboxManagerService::GetRealSandboxIDToStop(const std::string &podSand + std::map &stdAnnos, Errors &error) + -> int + { +- Errors statusErr; ++ auto status = PodSandboxStatus(podSandboxID, error); ++ if (error.NotEmpty()) { ++ return -1; ++ } + +- auto status = PodSandboxStatus(podSandboxID, statusErr); +- if (statusErr.Empty()) { +- if (status->linux().namespaces().has_options()) { +- hostNetwork = (status->linux().namespaces().options().network() == runtime::v1alpha2::NamespaceMode::NODE); +- } +- // if metadata is invalid, don't return -1 and continue stopping pod +- if (status->has_metadata()) { +- name = status->metadata().name(); +- ns = status->metadata().namespace_(); +- } +- realSandboxID = status->id(); +- CRIHelpers::ProtobufAnnoMapToStd(status->annotations(), stdAnnos); +- } else { +- if (CRIHelpers::IsContainerNotFoundError(statusErr.GetMessage())) { +- WARN("Both sandbox container and checkpoint for id %s could not be found. " +- "Proceed without further sandbox information.", +- podSandboxID.c_str()); +- } else { +- error.Errorf("failed to get sandbox status: %s", statusErr.GetCMessage()); +- return -1; +- } ++ if (status->linux().namespaces().has_options()) { ++ hostNetwork = (status->linux().namespaces().options().network() == runtime::v1alpha2::NamespaceMode::NODE); + } ++ // if metadata is invalid, don't return -1 and continue stopping pod ++ if (status->has_metadata()) { ++ name = status->metadata().name(); ++ ns = status->metadata().namespace_(); ++ } ++ realSandboxID = status->id(); ++ CRIHelpers::ProtobufAnnoMapToStd(status->annotations(), stdAnnos); ++ + if (realSandboxID.empty()) { + realSandboxID = podSandboxID; + } +diff --git a/src/daemon/executor/container_cb/execution_information.c b/src/daemon/executor/container_cb/execution_information.c +index 420f08df..03fce848 100644 +--- a/src/daemon/executor/container_cb/execution_information.c ++++ b/src/daemon/executor/container_cb/execution_information.c +@@ -914,7 +914,7 @@ static int inspect_container_helper(const char *id, int timeout, char **containe + + inspect = inspect_container(id, timeout, true); + if (inspect == NULL) { +- ERROR("Failed to inspect container:%s", id); ++ DEBUG("Failed to inspect container:%s", id); + ret = -1; + goto out; + } +-- +2.25.1 + diff --git a/0066-2313-use-lxc-5.X-in-CI-testcase.patch b/0066-2313-use-lxc-5.X-in-CI-testcase.patch new file mode 100644 index 0000000..a730c39 --- /dev/null +++ b/0066-2313-use-lxc-5.X-in-CI-testcase.patch @@ -0,0 +1,41 @@ +From 1c28f9259463433a7aac10733be09f8d47ec17a5 Mon Sep 17 00:00:00 2001 +From: zhangxiaoyu +Date: Thu, 21 Dec 2023 12:36:52 +0000 +Subject: [PATCH 66/71] !2313 use lxc 5.X in CI testcase * use lxc 5.X in CI + testcase + +--- + CI/install_depends.sh | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/CI/install_depends.sh b/CI/install_depends.sh +index 5a4d71fa..ebeb79db 100755 +--- a/CI/install_depends.sh ++++ b/CI/install_depends.sh +@@ -105,18 +105,12 @@ cd ~ + git clone https://gitee.com/src-openeuler/lxc.git + git config --global --add safe.directory ~/lxc/lxc-5.0.2 + cd lxc +-git checkout origin/openEuler-22.03-LTS-SP1 +-tar xf lxc-4.0.3.tar.gz +-cd lxc-4.0.3 +-mv ../*.patch . +-for var in $(ls 0*.patch | sort -n) +-do +- patch -p1 < ${var} +-done ++./apply-patches ++cd lxc-5.0.2 ++mkdir -p build + sed -i 's/fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO/fd == 0 || fd == 1 || fd == 2 || fd >= 1000/g' ./src/lxc/start.c +-./autogen.sh +-./configure --prefix=${builddir} enable_werror=no +-make -j $(nproc) ++meson setup -Disulad=true -Dprefix=${builddir} build ++meson compile -C build + make install + ldconfig + +-- +2.25.1 + diff --git a/0067-2329-modify-mount-dev-directory-for-lxc-5.X.patch b/0067-2329-modify-mount-dev-directory-for-lxc-5.X.patch new file mode 100644 index 0000000..a67684f --- /dev/null +++ b/0067-2329-modify-mount-dev-directory-for-lxc-5.X.patch @@ -0,0 +1,27 @@ +From 4a3ec85d707db28f10d4cd5654abf227dfc515cc Mon Sep 17 00:00:00 2001 +From: zhangxiaoyu +Date: Mon, 25 Dec 2023 09:34:28 +0000 +Subject: [PATCH 67/71] !2329 modify mount /dev directory for lxc 5.X * modify + mount /dev directory for lxc 5.X + +--- + CI/test_cases/container_cases/bind_special_dir.sh | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/CI/test_cases/container_cases/bind_special_dir.sh b/CI/test_cases/container_cases/bind_special_dir.sh +index d030bb08..545d5099 100755 +--- a/CI/test_cases/container_cases/bind_special_dir.sh ++++ b/CI/test_cases/container_cases/bind_special_dir.sh +@@ -42,7 +42,8 @@ function test_bind_special_dir() + if [ $runtime == "runc" ]; then + c_id=`isula run -itd -v -itd --runtime=$runtime -v /sys/fs:/sys/fs:rw -v /proc:/proc -v /dev/pts:/dev/pts:rw busybox sh` + else +- c_id=`isula run --runtime=$runtime -itd -v -itd -v /sys/fs:/sys/fs:rw -v /proc:/proc -v /dev:/dev:ro -v /dev/pts:/dev/pts:rw busybox sh` ++ # lxc 5.X cannot support mount /dev directory ++ c_id=`isula run --runtime=$runtime -itd -v -itd -v /sys/fs:/sys/fs:rw -v /proc:/proc busybox sh` + fi + [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - failed to run container with image: ${image}" && ((ret++)) + +-- +2.25.1 + diff --git a/0068-add-cri-1.29-api-change-docs.patch b/0068-add-cri-1.29-api-change-docs.patch new file mode 100644 index 0000000..97aee02 --- /dev/null +++ b/0068-add-cri-1.29-api-change-docs.patch @@ -0,0 +1,139 @@ +From 6ffd8232929b3cd1873c899d6bf379013959fb28 Mon Sep 17 00:00:00 2001 +From: jikai +Date: Fri, 22 Dec 2023 15:26:48 +0800 +Subject: [PATCH 68/71] add cri 1.29 api change docs + +Signed-off-by: jikai +--- + .../detailed/CRI/CRI_1.29_interface_change.md | 105 ++++++++++++++++++ + docs/images/cri_1.29_interface_change.svg | 5 + + 2 files changed, 110 insertions(+) + create mode 100644 docs/design/detailed/CRI/CRI_1.29_interface_change.md + create mode 100644 docs/images/cri_1.29_interface_change.svg + +diff --git a/docs/design/detailed/CRI/CRI_1.29_interface_change.md b/docs/design/detailed/CRI/CRI_1.29_interface_change.md +new file mode 100644 +index 00000000..f94d001b +--- /dev/null ++++ b/docs/design/detailed/CRI/CRI_1.29_interface_change.md +@@ -0,0 +1,105 @@ ++| Author | 吉凯 | ++| ------ | ------------------------ | ++| Date | 2023-12-22 | ++| Email | jikai11@huawei.com | ++ ++### 参考代码 ++ ++升级版本：1.29 ++参考地址： ++ ++### 变更依赖图 ++ ++![](../../../images/cri_1.29_interface_change.svg) ++ ++### 变更说明 ++ ++##### [CRI: Add Windows Podsandbox Stats](https://github.com/kubernetes/kubernetes/pull/110754) ++ ++不支持，无需变更 ++ ++- Added fields to the type `WindowsPodSandboxStats` expressing stats required to be collected from windows pods. ++ ++##### [Windows hostnetwork alpha](https://github.com/kubernetes/kubernetes/pull/112961) ++ ++不支持，无需变更 ++ ++- New type `WindowsNamespaceOption` introduced ++- The type `WindowsSandboxSecurityContext` has a new field `namespace_options` of type `WindowsNamespaceOption` ++ ++##### [Improve the API description of `PodSecurityContext.SupplementalGroups` to clarify its unfamiliar behavior](https://github.com/kubernetes/kubernetes/pull/113047) ++ ++描述修改，优化`PodSecurityContext.SupplementalGroups`的注释，明确容器镜像定义的主UID不在该列表下的行为 ++ ++- Clarified the expected behavior of `SupplementalGroups` field of `PodSecurityContext` ++ ++##### [Add Support for Evented PLEG](https://github.com/kubernetes/kubernetes/pull/111384) ++ ++新增字段，`GetContainerEvent`提供pod status和container status信息，`PodSandboxStatus`提供container status信息，[KEP-3386](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/3386-kubelet-evented-pleg/README.md) ++ ++- The type `ContainerEventResponse` updated: the field `pod_sandbox_metadata` removed and fields `pod_sandbox_status` and `containers_statuses` added. ++- The type `PodSandboxStatusResponse` has a new fields `containers_statuses` and `timestamp` ++ ++##### [CRI: Add CDI device info for containers](https://github.com/kubernetes/kubernetes/pull/115891/) ++ ++新增字段，CDI特性支持，CDI设备信息不再从annotation获取，直接从`ContainerConfig`获取，[KEP-3063](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/3063-dynamic-resource-allocation/README.md) ++ ++- New type `CDIDevice` was introduced and added to container config ++ ++##### [Add mappings for volumes](https://github.com/kubernetes/kubernetes/pull/116377) ++ ++新增字段，`Mount`中新增UID/GID映射信息，要求CRI创建挂载绑定时指定UID/GID映射信息，Kubelet不再负责映射， ++[KEP-127](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/127-user-namespaces) ++ ++- Added new fields to the type `Mount` expressing runtime UID/GID mappings for the mount. ++ ++##### [cri-api: fix comment lines about PROPAGATION_PRIVATE](https://github.com/kubernetes/kubernetes/pull/115704) ++ ++描述修改，修改对PROPAGATION_PRIVATE的不正确注释 ++ ++- Fixed comment lines about PROPAGATION_PRIVATE ++ ++##### [Add user specified image to CRI ContainerConfig](https://github.com/kubernetes/kubernetes/pull/118652) ++ ++新增字段，`ImageSpec`新增`user_specified_image`，确保创建容器时验证正确的镜像 ++ ++- Added the `user_specified_image` field to type `ImageSpec` ++ ++##### [kubelet: get cgroup driver config from CRI](https://github.com/kubernetes/kubernetes/pull/118770) ++ ++新增rpc，获取cgroup驱动配置，[KEP-4033](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4033-group-driver-detection-over-cri) ++ ++- Added rpc for querying runtime configuration ++- Added cavieats about cgroup driver field ++ ++##### [Add swap to stats to Summary API and Prometheus endpoints (/stats/summary and /metrics/resource)](https://github.com/kubernetes/kubernetes/pull/118865) ++ ++新增字段，`ContainerStats`中新增虚拟内存使用情况信息，[KEP-2400](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2400-node-swap/README.md#beta-1) ++ ++- Added `SwapUsage` type ++- Added `SwapUsage` field to `ContainerStats` type ++ ++##### [Expose commit memory used in WindowsMemoryUsage struct](https://github.com/kubernetes/kubernetes/pull/119238) ++ ++不支持，无需变更。 ++ ++- Added the `commit_memory_bytes` field to type `WindowsMemoryUsage` ++ ++##### [Add runtime handler field to ImageSpec struct](https://github.com/kubernetes/kubernetes/pull/121121) ++ ++新增字段，指定拉取镜像所采用的运行时处理，[KEP-4216](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4216-image-pull-per-runtime-class) ++ ++- Added `runtime_handler` field to type `ImageSpec` ++ ++##### [kubelet: add support for broadcasting metrics from CRI](https://github.com/kubernetes/kubernetes/pull/113609) ++ ++新增rpc，`ListMetricDescriptors`和`ListPodSandboxMetrics`获取metrics信息，[KEP-2371](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2371-cri-pod-container-stats/README.md) ++ ++- Added rpc for pulling the metrics from CRI and broadcasting them to prometheus ++- Added cavieats about metrics ++ ++##### [Kubelet disk api cri update](https://github.com/kubernetes/kubernetes/pull/120914) ++ ++新增字段，`ImageFsInfo`返回值添加容器文件系统信息，[KEP-4191](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/4191-split-image-filesystem/README.md) ++ ++- Added `container_filesystems` field to type `ImageFsInfoResponse` +diff --git a/docs/images/cri_1.29_interface_change.svg b/docs/images/cri_1.29_interface_change.svg +new file mode 100644 +index 00000000..06026d6f +--- /dev/null ++++ b/docs/images/cri_1.29_interface_change.svg +@@ -0,0 +1,5 @@ ++ ++ ++ ++ ++ ListPodSandboxStatsPodSandboxStatsPodSandboxStatsWindowsPodSandboxStatsWindowsSandboxSecurityContextWindowsNamespaceOptionWindowsPodSandboxConfigPodSandboxConfigPullImageCreateContainerL:nuxSandboxSecurityContextContainerConfigRunPodSandboxCDIDeviceMountMountPropogationIDMappingImageSpecRuntimeConfigLinuxRuntimeConfigurationCgroupDriverContainerStatsSwapUsageListContainerStatsContainerStatsLinuxPodSandboxStatsGetContainerEventsContainerEventResponseContainerStatusContainerStatusWindowsCpuUsageLinuxPodSandboxConfig无变更新增修改接口内部数据不支持WindowsMemoryUsageWindowsNetworkUsageListMetricDescriptorsListPodSandboxMetricsMetricDescriptorPodSandboxMetricsContainerMetricsMetricMetricTypeImageFsInfoImageFsInfoResponseWindowsContainerStatsWindowsProcessUsageWindowsNetworkInterfaceUsageWindowsFilesystemStatsPodSandboxStatusPodSandboxStatusResponse +\ No newline at end of file +-- +2.25.1 + diff --git a/0069-add-exec-workdir-support-for-oci-runtime.patch b/0069-add-exec-workdir-support-for-oci-runtime.patch new file mode 100644 index 0000000..e57cee6 --- /dev/null +++ b/0069-add-exec-workdir-support-for-oci-runtime.patch @@ -0,0 +1,57 @@ +From 921ee84f80adda64fb0a7125f9f709bff416945c Mon Sep 17 00:00:00 2001 +From: zhongtao +Date: Tue, 26 Dec 2023 10:17:19 +0800 +Subject: [PATCH 69/71] add exec workdir support for oci runtime + +Signed-off-by: zhongtao +--- + src/cmd/isula/stream/exec.h | 2 +- + src/cmd/isulad-shim/process.c | 4 ++++ + src/daemon/modules/runtime/isula/isula_rt_ops.c | 3 +++ + 3 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/src/cmd/isula/stream/exec.h b/src/cmd/isula/stream/exec.h +index 83a4af06..8d8e4347 100644 +--- a/src/cmd/isula/stream/exec.h ++++ b/src/cmd/isula/stream/exec.h +@@ -48,7 +48,7 @@ extern "C" { + "Username or UID (format: [:])", \ + NULL }, \ + { CMD_OPT_TYPE_STRING_DUP, false, "workdir", 0, &(cmdargs).custom_conf.workdir, \ +- "Working directory inside the container, supported only when runtime is lcr", NULL } ++ "Working directory inside the container", NULL } + + extern const char g_cmd_exec_desc[]; + extern const char g_cmd_exec_usage[]; +diff --git a/src/cmd/isulad-shim/process.c b/src/cmd/isulad-shim/process.c +index 97524f1a..06726a40 100644 +--- a/src/cmd/isulad-shim/process.c ++++ b/src/cmd/isulad-shim/process.c +@@ -1274,6 +1274,10 @@ static void get_runtime_cmd(process_t *p, const char *log_path, const char *pid_ + #endif + params[i++] = "--process"; + params[i++] = process_desc; ++ if (p->state->cwd != NULL) { ++ params[i++] = "--cwd"; ++ params[i++] = p->state->cwd; ++ } + } else { + params[i++] = "create"; + params[i++] = "--bundle"; +diff --git a/src/daemon/modules/runtime/isula/isula_rt_ops.c b/src/daemon/modules/runtime/isula/isula_rt_ops.c +index fbb779f7..c754fc54 100644 +--- a/src/daemon/modules/runtime/isula/isula_rt_ops.c ++++ b/src/daemon/modules/runtime/isula/isula_rt_ops.c +@@ -1345,6 +1345,9 @@ static int preparation_exec(const char *id, const char *runtime, const char *wor + p.runtime_args = (char **)runtime_args; + p.runtime_args_len = runtime_args_len; + copy_process(&p, process); ++ if (params->workdir != NULL) { ++ p.cwd = (char *)params->workdir; ++ } + + ret = create_process_json_file(workdir, &p); + if (ret != 0) { +-- +2.25.1 + diff --git a/0070-add-testcases-for-exec-workdir.patch b/0070-add-testcases-for-exec-workdir.patch new file mode 100644 index 0000000..38687aa --- /dev/null +++ b/0070-add-testcases-for-exec-workdir.patch @@ -0,0 +1,27 @@ +From cf7effbfaf81d1982d81bbc6ca1c5eafbc07d07b Mon Sep 17 00:00:00 2001 +From: zhongtao +Date: Tue, 26 Dec 2023 10:24:52 +0800 +Subject: [PATCH 70/71] add testcases for exec --workdir + +Signed-off-by: zhongtao +--- + CI/test_cases/container_cases/runc_exec.sh | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/CI/test_cases/container_cases/runc_exec.sh b/CI/test_cases/container_cases/runc_exec.sh +index f963724e..aa7020ee 100755 +--- a/CI/test_cases/container_cases/runc_exec.sh ++++ b/CI/test_cases/container_cases/runc_exec.sh +@@ -53,6 +53,9 @@ function exec_runc_test() + isula exec -tid $container_name /bin/sh -c 'exit 2' + [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - exit code should be 0" && ((ret++)) + ++ isula exec -ti --workdir /tmp $container_name pwd | grep "/tmp" ++ [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - workdir is not /workdir failed" && ((ret++)) ++ + ls /var/run/isulad/runc/${ID}/exec/ + ls /var/run/isulad/runc/${ID}/exec/ | wc -l | grep 0 + [[ $? -ne 0 ]] && msg_err "${FUNCNAME[0]}:${LINENO} - residual dir after success exec" && ((ret++)) +-- +2.25.1 + diff --git a/0071-iSulad-restart-isuald-when-upgrade-active-isulad.patch b/0071-iSulad-restart-isuald-when-upgrade-active-isulad.patch new file mode 100644 index 0000000..033dd14 --- /dev/null +++ b/0071-iSulad-restart-isuald-when-upgrade-active-isulad.patch @@ -0,0 +1,34 @@ +From cffeca42fa88c749f122b904ecc2e634d4911576 Mon Sep 17 00:00:00 2001 +From: yangjiaqi +Date: Thu, 28 Dec 2023 15:56:47 +0800 +Subject: [PATCH 71/71] iSulad: restart isuald when upgrade active isulad + +Signed-off-by: yangjiaqi +--- + iSulad.spec | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/iSulad.spec b/iSulad.spec +index 0efbf043..71b61c8b 100644 +--- a/iSulad.spec ++++ b/iSulad.spec +@@ -196,6 +196,16 @@ if [ -e %{_unitdir}/lcrd.service.rpmsave ]; then + mv %{_unitdir}/lcrd.service.rpmsave %{_unitdir}/isulad.service + sed -i 's/lcrd/isulad/g' %{_unitdir}/isulad.service + fi ++# During the isulad upgrade process, the isulad service may still be running, but the service may be unavailable ++# due to configuration updates and other reasons. ++# it may fail if the X package is upgraded synchronously with isulad and depends on the isulad command, ++# For example syscontianer-tools and lxcfs-tools. ++# Therefore, after upgrading isulad, if the original status of isulad is running, ++# we need to restart isulad to ensure that the service is available during the upgrade process. ++systemctl status isulad | grep 'Active:' | grep 'running' ++if [ $? -eq 0 ]; then ++ systemctl restart isulad ++fi + %else + /sbin/service isulad status | grep 'Active:' | grep 'running' + if [ $? -eq 0 ]; then +-- +2.25.1 + diff --git a/iSulad.spec b/iSulad.spec index 8a91d97..a05395c 100644 --- a/iSulad.spec +++ b/iSulad.spec @@ -1,5 +1,5 @@ %global _version 2.1.4 -%global _release 3 +%global _release 4 %global is_systemd 1 %global enable_criv1 1 %global enable_shimv2 1 @@ -79,6 +79,13 @@ Patch0061: 0061-2320-improve-CI-test.patch Patch0062: 0062-verify-name-and-digest-consistency.patch Patch0063: 0063-code-improve-for-oci_rmi.patch Patch0064: 0064-bugfix-for-resort_image_names.patch +Patch0065: 0065-fix-stopp-removes-cont-error-remove-inspect-error-lo.patch +Patch0066: 0066-2313-use-lxc-5.X-in-CI-testcase.patch +Patch0067: 0067-2329-modify-mount-dev-directory-for-lxc-5.X.patch +Patch0068: 0068-add-cri-1.29-api-change-docs.patch +Patch0069: 0069-add-exec-workdir-support-for-oci-runtime.patch +Patch0070: 0070-add-testcases-for-exec-workdir.patch +Patch0071: 0071-iSulad-restart-isuald-when-upgrade-active-isulad.patch %ifarch x86_64 aarch64 Provides: libhttpclient.so()(64bit) @@ -330,6 +337,12 @@ fi %endif %changelog +* Thu Dec 28 2023 leizhongkai - 2.1.4-4 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: upgrade from upstream + * Wed Dec 20 2023 zhongtao - 2.1.4-3 - Type: bugfix - ID: NA