-
Notifications
You must be signed in to change notification settings - Fork 60
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #228 from AkihiroSuda/dev
Update k/k patches to follow the latest KEP
- Loading branch information
Showing
8 changed files
with
137 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
src/patches/kubernetes/0001-New-feature-gate-KubeletInUserNamespace.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| From c23b75f05c9959d48e0bf6579c35065018348547 Mon Sep 17 00:00:00 2001 | ||
| From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> | ||
| Date: Mon, 24 May 2021 23:18:02 +0900 | ||
| Subject: [PATCH 1/5] New feature gate: KubeletInUserNamespace | ||
|
|
||
| Enables support for running kubelet in a user namespace. | ||
| The user namespace has to be created before running kubelet. | ||
| All the node components such as CRI need to be running in the same user namespace. | ||
|
|
||
| See kubernetes/enhancements PR 1371 (merged) and issue 2033. | ||
|
|
||
| Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> | ||
| --- | ||
| pkg/features/kube_features.go | 9 +++++++++ | ||
| 1 file changed, 9 insertions(+) | ||
|
|
||
| diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go | ||
| index 589cb97c52b..eebd4d28de4 100644 | ||
| --- a/pkg/features/kube_features.go | ||
| +++ b/pkg/features/kube_features.go | ||
| @@ -733,6 +733,14 @@ const ( | ||
| // | ||
| // Enables support for 'HostProcess' containers on Windows nodes. | ||
| WindowsHostProcessContainers featuregate.Feature = "WindowsHostProcessContainers" | ||
| + | ||
| + // owner: @AkihiroSuda | ||
| + // alpha: v1.22 | ||
| + // | ||
| + // Enables support for running kubelet in a user namespace. | ||
| + // The user namespace has to be created before running kubelet. | ||
| + // All the node components such as CRI need to be running in the same user namespace. | ||
| + KubeletInUserNamespace featuregate.Feature = "KubeletInUserNamespace" | ||
| ) | ||
|
|
||
| func init() { | ||
| @@ -844,6 +852,7 @@ var defaultKubernetesFeatureGates = map[featuregate.Feature]featuregate.FeatureS | ||
| CSIVolumeHealth: {Default: false, PreRelease: featuregate.Alpha}, | ||
| WindowsHostProcessContainers: {Default: false, PreRelease: featuregate.Alpha}, | ||
| DisableCloudProviders: {Default: false, PreRelease: featuregate.Alpha}, | ||
| + KubeletInUserNamespace: {Default: false, PreRelease: featuregate.Alpha}, | ||
|
|
||
| // inherited features from generic apiserver, relisted here to get a conflict if it is changed | ||
| // unintentionally on either side: | ||
| -- | ||
| 2.30.2 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
63 changes: 63 additions & 0 deletions
63
src/patches/kubernetes/0004-kubelet-ignore-dev-kmsg-error-when-runnin-in-userns.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| From 926907649559db5d85c813cc123318c035e61c2e Mon Sep 17 00:00:00 2001 | ||
| From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> | ||
| Date: Mon, 24 May 2021 23:35:22 +0900 | ||
| Subject: [PATCH 4/5] kubelet: ignore /dev/kmsg error when runnin in userns | ||
|
|
||
| oomwatcher.NewWatcher returns "open /dev/kmsg: operation not permitted" error, | ||
| when running with sysctl value `kernel.dmesg_restrict=1`. | ||
|
|
||
| The error is negligible for KubeletInUserNamespace. | ||
|
|
||
| Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp> | ||
| --- | ||
| pkg/kubelet/kubelet.go | 20 +++++++++++++++++--- | ||
| 1 file changed, 17 insertions(+), 3 deletions(-) | ||
|
|
||
| diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go | ||
| index 7f390290496..dfce93e34c9 100644 | ||
| --- a/pkg/kubelet/kubelet.go | ||
| +++ b/pkg/kubelet/kubelet.go | ||
| @@ -37,6 +37,7 @@ import ( | ||
| "k8s.io/mount-utils" | ||
| "k8s.io/utils/integer" | ||
|
|
||
| + libcontainersystem "github.com/opencontainers/runc/libcontainer/system" | ||
| v1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "k8s.io/apimachinery/pkg/fields" | ||
| @@ -479,7 +480,18 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, | ||
|
|
||
| oomWatcher, err := oomwatcher.NewWatcher(kubeDeps.Recorder) | ||
| if err != nil { | ||
| - return nil, err | ||
| + if !libcontainersystem.RunningInUserNS() { | ||
| + return nil, err | ||
| + } | ||
| + // oomwatcher.NewWatcher returns "open /dev/kmsg: operation not permitted" error, | ||
| + // when running with sysctl value `kernel.dmesg_restrict=1`. | ||
| + if !utilfeature.DefaultFeatureGate.Enabled(features.KubeletInUserNamespace) { | ||
| + klog.Errorf("Failed to create an oomWatcher: %v (running in UserNS, Hint: enable KubeletInUserNamespace feature flag to ignore the error)", | ||
| + err) | ||
| + return nil, err | ||
| + } | ||
| + klog.Warningf("Failed to create an oomWatcher: %v (running in UserNS, ignoring)", err) | ||
| + oomWatcher = nil | ||
| } | ||
|
|
||
| clusterDNS := make([]net.IP, 0, len(kubeCfg.ClusterDNS)) | ||
| @@ -1356,8 +1368,10 @@ func (kl *Kubelet) initializeModules() error { | ||
| } | ||
|
|
||
| // Start out of memory watcher. | ||
| - if err := kl.oomWatcher.Start(kl.nodeRef); err != nil { | ||
| - return fmt.Errorf("failed to start OOM watcher %v", err) | ||
| + if kl.oomWatcher != nil { | ||
| + if err := kl.oomWatcher.Start(kl.nodeRef); err != nil { | ||
| + return fmt.Errorf("failed to start OOM watcher %v", err) | ||
| + } | ||
| } | ||
|
|
||
| // Start resource analyzer | ||
| -- | ||
| 2.30.2 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters