diff --git a/Dockerfile b/Dockerfile index 541315e..af7977a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,24 +4,24 @@ ### Version definitions # use ./hack/show-latest-commits.sh to get the latest commits -# 2021-03-16T04:30:13Z -ARG ROOTLESSKIT_COMMIT=50e88d6e889c88501455579a0177b42822bc26f2 -# 2021-03-26T14:51:29Z -ARG CONTAINERD_COMMIT=1b05b605c860e3052dc2fb298fcf98987f9a811d -# 2021-03-26T16:56:49Z -ARG CRIO_COMMIT=3cf4a99706b13f05e679768cabfbdaf7e84c0dc6 -# 2021-03-27T01:26:43Z -ARG KUBE_NODE_COMMIT=770d3f181c5d7ed100d1ba43760a74093fc9d9ef +# 2021-04-15T05:58:47Z +ARG ROOTLESSKIT_COMMIT=2416b0b1799b3888c570c590da3cb27c13d2eb0f +# 2021-04-24T20:46:00Z +ARG CONTAINERD_COMMIT=56f1b3fef84d72f76ca65151854c9c9d1461e0f8 +# 2021-04-25T13:18:28Z +ARG CRIO_COMMIT=d3dbaec060e33870e5cb5c3f7ec4207837804b00 +# 2021-04-26T07:03:01Z +ARG KUBE_NODE_COMMIT=e640a01219736dd051dc3a9b8ac4630ec18b6b25 # Version definitions (cont.) ARG SLIRP4NETNS_RELEASE=v1.1.9 ARG CONMON_RELEASE=2.0.27 -ARG CRUN_RELEASE=0.18 +ARG CRUN_RELEASE=0.19.1 ARG FUSE_OVERLAYFS_RELEASE=v1.5.0 ARG CONTAINERD_FUSE_OVERLAYFS_RELEASE=1.0.2 -ARG KUBE_MASTER_RELEASE=v1.21.0-rc.0 +ARG KUBE_MASTER_RELEASE=v1.21.0 # Kube's build script requires KUBE_GIT_VERSION to be set to a semver string -ARG KUBE_GIT_VERSION=v1.21.0-usernetes +ARG KUBE_GIT_VERSION=v1.22.0-usernetes ARG CNI_PLUGINS_RELEASE=v0.9.1 ARG FLANNEL_RELEASE=v0.13.0 ARG ETCD_RELEASE=v3.5.0-alpha.0 @@ -93,11 +93,6 @@ RUN git clone -q https://github.com/cri-o/cri-o.git /go/src/github.com/cri-o/cri WORKDIR /go/src/github.com/cri-o/cri-o ARG CRIO_COMMIT RUN git pull && git checkout ${CRIO_COMMIT} -COPY ./src/patches/crio /patches -# `git am` requires user info to be set -RUN git config user.email "nobody@example.com" && \ - git config user.name "Usernetes Build Script" && \ - git am /patches/* && git show --summary RUN EXTRA_LDFLAGS='-linkmode external -extldflags "-static"' make binaries && \ mkdir /out && cp bin/crio bin/crio-status bin/pinns /out diff --git a/src/patches/crio/0001-rootless-enable-resource-limit-when-cgroup-v2-contro.patch b/src/patches/crio/0001-rootless-enable-resource-limit-when-cgroup-v2-contro.patch deleted file mode 100644 index eacf234..0000000 --- a/src/patches/crio/0001-rootless-enable-resource-limit-when-cgroup-v2-contro.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 1c408e08ec3854fa4478802c09f493cfdaad5691 Mon Sep 17 00:00:00 2001 -From: Akihiro Suda -Date: Mon, 1 Feb 2021 18:52:30 +0900 -Subject: [PATCH] rootless: enable resource limit when cgroup v2 controllers - are delegated - -Requires systemd-delegated cgroupfs driver. -See Usernetes PR 210 for the actual usage. - -Signed-off-by: Akihiro Suda ---- - server/rootless.go | 66 +++++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 65 insertions(+), 1 deletion(-) - -diff --git a/server/rootless.go b/server/rootless.go -index 39c65a90b..9fecebaf8 100644 ---- a/server/rootless.go -+++ b/server/rootless.go -@@ -1,10 +1,14 @@ - package server - - import ( -+ "io/ioutil" -+ "path/filepath" - "strings" - -+ "github.com/opencontainers/runc/libcontainer/cgroups" - rspec "github.com/opencontainers/runtime-spec/specs-go" - "github.com/opencontainers/runtime-tools/generate" -+ "github.com/sirupsen/logrus" - ) - - func hasNetworkNamespace(config *rspec.Spec) bool { -@@ -17,7 +21,43 @@ func hasNetworkNamespace(config *rspec.Spec) bool { - } - - func makeOCIConfigurationRootless(g *generate.Generator) { -- g.Config.Linux.Resources = nil -+ // Resource limitations requires cgroup v2 delegation (https://rootlesscontaine.rs/getting-started/common/cgroup2/). -+ if r := g.Config.Linux.Resources; r != nil { -+ // cannot control device eBPF with rootless -+ r.Devices = nil -+ if r.Memory != nil || r.CPU != nil || r.Pids != nil || r.BlockIO != nil || r.Rdma != nil || r.HugepageLimits != nil { -+ v2Controllers := getAvailableV2Controllers() -+ if _, ok := v2Controllers["memory"]; !ok && r.Memory != nil { -+ logrus.Warn("rootless: cgroup v2 memory controller is not delegated. Discarding memory limit.") -+ r.Memory = nil -+ } -+ if _, ok := v2Controllers["cpu"]; !ok && r.CPU != nil { -+ logrus.Warn("rootless: cgroup v2 cpu controller is not delegated. Discarding cpu limit.") -+ r.CPU = nil -+ } -+ if _, ok := v2Controllers["cpuset"]; !ok && r.CPU != nil { -+ logrus.Warn("rootless: cgroup v2 cpuset controller is not delegated. Discarding cpuset limit.") -+ r.CPU.Cpus = "" -+ r.CPU.Mems = "" -+ } -+ if _, ok := v2Controllers["pids"]; !ok && r.Pids != nil { -+ logrus.Warn("rootless: cgroup v2 pids controller is not delegated. Discarding pids limit.") -+ r.Pids = nil -+ } -+ if _, ok := v2Controllers["io"]; !ok && r.BlockIO != nil { -+ logrus.Warn("rootless: cgroup v2 io controller is not delegated. Discarding block I/O limit.") -+ r.BlockIO = nil -+ } -+ if _, ok := v2Controllers["rdma"]; !ok && r.Rdma != nil { -+ logrus.Warn("rootless: cgroup v2 rdma controller is not delegated. Discarding RDMA limit.") -+ r.Rdma = nil -+ } -+ if _, ok := v2Controllers["hugetlb"]; !ok && r.HugepageLimits != nil { -+ logrus.Warn("rootless: cgroup v2 hugetlb controller is not delegated. Discarding RDMA limit.") -+ r.HugepageLimits = nil -+ } -+ } -+ } - g.Config.Process.OOMScoreAdj = nil - g.Config.Process.ApparmorProfile = "" - -@@ -45,3 +85,27 @@ func makeOCIConfigurationRootless(g *generate.Generator) { - - g.SetLinuxCgroupsPath("") - } -+ -+// getAvailableV2Controllers returns the entries in /sys/fs/cgroup//cgroup.controllers -+func getAvailableV2Controllers() map[string]struct{} { -+ procSelfCgroup, err := cgroups.ParseCgroupFile("/proc/self/cgroup") -+ if err != nil { -+ logrus.Error(err) -+ return nil -+ } -+ v2Group := procSelfCgroup[""] -+ if v2Group == "" { -+ return nil -+ } -+ controllersPath := filepath.Join("/sys/fs/cgroup", v2Group, "cgroup.controllers") -+ controllersBytes, err := ioutil.ReadFile(controllersPath) -+ if err != nil { -+ logrus.Error(err) -+ return nil -+ } -+ result := make(map[string]struct{}) -+ for _, controller := range strings.Split(strings.TrimSpace(string(controllersBytes)), " ") { -+ result[controller] = struct{}{} -+ } -+ return result -+} --- -2.27.0 -