Skip to content

K
k3s
Unverified Commit ef38fa6b authored by Jacob Blain Christen's avatar Jacob Blain Christen Committed by GitHub
Browse files
Options

containerd: v1.3.10-k3s1 (#3082)

Addresses k3s-io/k3s#3070 and CVE-2021-21334 Signed-off-by: 's avatarJacob Blain Christen <jacob@rancher.com>
parent e8c94840
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 140 additions and 101 deletions
go.mod
View file @ ef38fa6b
...@@ -7,9 +7,9 @@ replace ( ...@@ -7,9 +7,9 @@ replace (
github.com/containerd/btrfs => github.com/containerd/btrfs v0.0.0-20181101203652-af5082808c83 github.com/containerd/btrfs => github.com/containerd/btrfs v0.0.0-20181101203652-af5082808c83
github.com/containerd/cgroups => github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601 github.com/containerd/cgroups => github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601
github.com/containerd/console => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50 github.com/containerd/console => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
github.com/containerd/containerd => github.com/k3s-io/containerd v1.3.9-k3s1 github.com/containerd/containerd => github.com/k3s-io/containerd v1.3.10-k3s1
github.com/containerd/continuity => github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02 github.com/containerd/continuity => github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02
github.com/containerd/cri => github.com/k3s-io/cri v1.3.0-k3s.9 // k3s-release/1.3 github.com/containerd/cri => github.com/k3s-io/cri v1.3.0-k3s.10 // k3s-release/1.3
github.com/containerd/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c github.com/containerd/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c
github.com/containerd/go-runc => github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda github.com/containerd/go-runc => github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda
github.com/containerd/typeurl => github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd github.com/containerd/typeurl => github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd
......
go.sum
View file @ ef38fa6b
...@@ -517,10 +517,10 @@ github.com/juju/loggo v0.0.0-20180524022052-584905176618/go.mod h1:vgyd7OREkbtVE ...@@ -517,10 +517,10 @@ github.com/juju/loggo v0.0.0-20180524022052-584905176618/go.mod h1:vgyd7OREkbtVE
github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U= github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
github.com/juju/testing v0.0.0-20180920084828-472a3e8b2073/go.mod h1:63prj8cnj0tU0S9OHjGJn+b1h0ZghCndfnbQolrYTwA= github.com/juju/testing v0.0.0-20180920084828-472a3e8b2073/go.mod h1:63prj8cnj0tU0S9OHjGJn+b1h0ZghCndfnbQolrYTwA=
github.com/juju/testing v0.0.0-20190613124551-e81189438503/go.mod h1:63prj8cnj0tU0S9OHjGJn+b1h0ZghCndfnbQolrYTwA= github.com/juju/testing v0.0.0-20190613124551-e81189438503/go.mod h1:63prj8cnj0tU0S9OHjGJn+b1h0ZghCndfnbQolrYTwA=
github.com/k3s-io/containerd v1.3.9-k3s1 h1:VeMMmcojFZDJlLkgtIr7GAmDUgtGS7ME3KvLo9g/6+s= github.com/k3s-io/containerd v1.3.10-k3s1 h1:udmDeUJVbz4zFdN+fCih+GSY35iFpb7Yk0K+ph2oc9c=
github.com/k3s-io/containerd v1.3.9-k3s1/go.mod h1:eMCLnqhZCzg+cZuvfMLStYPsrx5cWGpdZL6krPhK8RI= github.com/k3s-io/containerd v1.3.10-k3s1/go.mod h1:eMCLnqhZCzg+cZuvfMLStYPsrx5cWGpdZL6krPhK8RI=
github.com/k3s-io/cri v1.3.0-k3s.9 h1:1PUJysV7YQElM5JEjnHdOQ2kgwtTiSJ5fpx1j4/WjzU= github.com/k3s-io/cri v1.3.0-k3s.10 h1:K4pIza6Fnv9ucC2DigmTDHeW/v7nBT8cF2M3a1N6uHQ=
github.com/k3s-io/cri v1.3.0-k3s.9/go.mod h1:fGPUUHMKQik/vIegSe05DtX/m4miovdtvVLqRUFAkK0= github.com/k3s-io/cri v1.3.0-k3s.10/go.mod h1:fGPUUHMKQik/vIegSe05DtX/m4miovdtvVLqRUFAkK0=
github.com/k3s-io/kubernetes v1.17.17-k3s1 h1:z8OnWFDurLPRqhlTf4EdmWm06IYsZLuhVQmofrL7Reo= github.com/k3s-io/kubernetes v1.17.17-k3s1 h1:z8OnWFDurLPRqhlTf4EdmWm06IYsZLuhVQmofrL7Reo=
github.com/k3s-io/kubernetes v1.17.17-k3s1/go.mod h1:J8bqjhrOYZ/dDhaQU8sEfM+aH81x3Urfw1uODZc7ZfU= github.com/k3s-io/kubernetes v1.17.17-k3s1/go.mod h1:J8bqjhrOYZ/dDhaQU8sEfM+aH81x3Urfw1uODZc7ZfU=
github.com/k3s-io/kubernetes/staging/src/k8s.io/api v1.17.17-k3s1 h1:u73fKSBMXqZ7sMYcKwySceqrQMMTYhMnkCfLiCfusGo= github.com/k3s-io/kubernetes/staging/src/k8s.io/api v1.17.17-k3s1 h1:u73fKSBMXqZ7sMYcKwySceqrQMMTYhMnkCfLiCfusGo=
......
vendor/github.com/containerd/containerd/runtime/v1/shim/client/client.go
View file @ ef38fa6b
...@@ -170,6 +170,7 @@ func eaddrinuse(err error) bool { ...@@ -170,6 +170,7 @@ func eaddrinuse(err error) bool {
// setupOOMScore gets containerd's oom score and adds +1 to it // setupOOMScore gets containerd's oom score and adds +1 to it
// to ensure a shim has a lower* score than the daemons // to ensure a shim has a lower* score than the daemons
// if not already at the maximum OOM Score
func setupOOMScore(shimPid int) error { func setupOOMScore(shimPid int) error {
pid := os.Getpid() pid := os.Getpid()
score, err := sys.GetOOMScoreAdj(pid) score, err := sys.GetOOMScoreAdj(pid)
...@@ -177,6 +178,9 @@ func setupOOMScore(shimPid int) error { ...@@ -177,6 +178,9 @@ func setupOOMScore(shimPid int) error {
return errors.Wrap(err, "get daemon OOM score") return errors.Wrap(err, "get daemon OOM score")
} }
shimScore := score + 1 shimScore := score + 1
if shimScore > sys.OOMScoreAdjMax {
shimScore = sys.OOMScoreAdjMax
}
if err := sys.SetOOMScore(shimPid, shimScore); err != nil { if err := sys.SetOOMScore(shimPid, shimScore); err != nil {
return errors.Wrap(err, "set shim OOM score") return errors.Wrap(err, "set shim OOM score")
} }
......
vendor/github.com/containerd/containerd/runtime/v2/binary.go
View file @ ef38fa6b
...@@ -26,6 +26,7 @@ import ( ...@@ -26,6 +26,7 @@ import (
"github.com/containerd/containerd/events/exchange" "github.com/containerd/containerd/events/exchange"
"github.com/containerd/containerd/log" "github.com/containerd/containerd/log"
"github.com/containerd/containerd/namespaces"
"github.com/containerd/containerd/runtime" "github.com/containerd/containerd/runtime"
client "github.com/containerd/containerd/runtime/v2/shim" client "github.com/containerd/containerd/runtime/v2/shim"
"github.com/containerd/containerd/runtime/v2/task" "github.com/containerd/containerd/runtime/v2/task"
...@@ -74,7 +75,15 @@ func (b *binary) Start(ctx context.Context, opts *types.Any, onClose func()) (_ ...@@ -74,7 +75,15 @@ func (b *binary) Start(ctx context.Context, opts *types.Any, onClose func()) (_
if err != nil { if err != nil {
return nil, err return nil, err
} }
f, err := openShimLog(ctx, b.bundle, client.AnonDialer) // Windows needs a namespace when openShimLog
ns, _ := namespaces.Namespace(ctx)
shimCtx, cancelShimLog := context.WithCancel(namespaces.WithNamespace(context.Background(), ns))
defer func() {
if err != nil {
cancelShimLog()
}
}()
f, err := openShimLog(shimCtx, b.bundle, client.AnonDialer)
if err != nil { if err != nil {
return nil, errors.Wrap(err, "open shim log pipe") return nil, errors.Wrap(err, "open shim log pipe")
} }
...@@ -103,7 +112,11 @@ func (b *binary) Start(ctx context.Context, opts *types.Any, onClose func()) (_ ...@@ -103,7 +112,11 @@ func (b *binary) Start(ctx context.Context, opts *types.Any, onClose func()) (_
if err != nil { if err != nil {
return nil, err return nil, err
} }
client := ttrpc.NewClient(conn, ttrpc.WithOnClose(onClose)) onCloseWithShimLog := func() {
onClose()
cancelShimLog()
}
client := ttrpc.NewClient(conn, ttrpc.WithOnClose(onCloseWithShimLog))
return &shim{ return &shim{
bundle: b.bundle, bundle: b.bundle,
client: client, client: client,
......
vendor/github.com/containerd/containerd/runtime/v2/manager.go
View file @ ef38fa6b
...@@ -29,6 +29,7 @@ import ( ...@@ -29,6 +29,7 @@ import (
"github.com/containerd/containerd/metadata" "github.com/containerd/containerd/metadata"
"github.com/containerd/containerd/mount" "github.com/containerd/containerd/mount"
"github.com/containerd/containerd/namespaces" "github.com/containerd/containerd/namespaces"
"github.com/containerd/containerd/pkg/timeout"
"github.com/containerd/containerd/platforms" "github.com/containerd/containerd/platforms"
"github.com/containerd/containerd/plugin" "github.com/containerd/containerd/plugin"
"github.com/containerd/containerd/runtime" "github.com/containerd/containerd/runtime"
...@@ -154,8 +155,13 @@ func (m *TaskManager) Create(ctx context.Context, id string, opts runtime.Create ...@@ -154,8 +155,13 @@ func (m *TaskManager) Create(ctx context.Context, id string, opts runtime.Create
} }
defer func() { defer func() {
if err != nil { if err != nil {
shim.Shutdown(ctx) dctx, cancel := timeout.WithContext(context.Background(), cleanupTimeout)
shim.Close() defer cancel()
_, errShim := shim.Delete(dctx)
if errShim != nil {
shim.Shutdown(dctx)
shim.Close()
}
} }
}() }()
t, err := shim.Create(ctx, opts) t, err := shim.Create(ctx, opts)
......
vendor/github.com/containerd/containerd/runtime/v2/runc/v2/service.go
View file @ ef38fa6b
...@@ -620,9 +620,10 @@ func (s *service) Connect(ctx context.Context, r *taskAPI.ConnectRequest) (*task ...@@ -620,9 +620,10 @@ func (s *service) Connect(ctx context.Context, r *taskAPI.ConnectRequest) (*task
func (s *service) Shutdown(ctx context.Context, r *taskAPI.ShutdownRequest) (*ptypes.Empty, error) { func (s *service) Shutdown(ctx context.Context, r *taskAPI.ShutdownRequest) (*ptypes.Empty, error) {
s.mu.Lock() s.mu.Lock()
defer s.mu.Unlock()
// return out if the shim is still servicing containers // return out if the shim is still servicing containers
if len(s.containers) > 0 { if len(s.containers) > 0 {
s.mu.Unlock()
return empty, nil return empty, nil
} }
s.cancel() s.cancel()
......
vendor/github.com/containerd/containerd/runtime/v2/shim.go
View file @ ef38fa6b
...@@ -235,11 +235,11 @@ func (s *shim) Delete(ctx context.Context) (*runtime.Exit, error) { ...@@ -235,11 +235,11 @@ func (s *shim) Delete(ctx context.Context) (*runtime.Exit, error) {
// this seems dirty but it cleans up the API across runtimes, tasks, and the service // this seems dirty but it cleans up the API across runtimes, tasks, and the service
s.rtTasks.Delete(ctx, s.ID()) s.rtTasks.Delete(ctx, s.ID())
if err := s.waitShutdown(ctx); err != nil { if err := s.waitShutdown(ctx); err != nil {
log.G(ctx).WithError(err).Error("failed to shutdown shim") log.G(ctx).WithField("id", s.ID()).WithError(err).Error("failed to shutdown shim")
} }
s.Close() s.Close()
if err := s.bundle.Delete(); err != nil { if err := s.bundle.Delete(); err != nil {
log.G(ctx).WithError(err).Error("failed to delete bundle") log.G(ctx).WithField("id", s.ID()).WithError(err).Error("failed to delete bundle")
} }
if shimErr != nil { if shimErr != nil {
return nil, shimErr return nil, shimErr
......
vendor/github.com/containerd/containerd/runtime/v2/shim/util_unix.go
View file @ ef38fa6b
...@@ -52,6 +52,7 @@ func SetScore(pid int) error { ...@@ -52,6 +52,7 @@ func SetScore(pid int) error {
// AdjustOOMScore sets the OOM score for the process to the parents OOM score +1 // AdjustOOMScore sets the OOM score for the process to the parents OOM score +1
// to ensure that they parent has a lower* score than the shim // to ensure that they parent has a lower* score than the shim
// if not already at the maximum OOM Score
func AdjustOOMScore(pid int) error { func AdjustOOMScore(pid int) error {
parent := os.Getppid() parent := os.Getppid()
score, err := sys.GetOOMScoreAdj(parent) score, err := sys.GetOOMScoreAdj(parent)
...@@ -59,6 +60,9 @@ func AdjustOOMScore(pid int) error { ...@@ -59,6 +60,9 @@ func AdjustOOMScore(pid int) error {
return errors.Wrap(err, "get parent OOM score") return errors.Wrap(err, "get parent OOM score")
} }
shimScore := score + 1 shimScore := score + 1
if shimScore > sys.OOMScoreAdjMax {
shimScore = sys.OOMScoreAdjMax
}
if err := sys.SetOOMScore(pid, shimScore); err != nil { if err := sys.SetOOMScore(pid, shimScore); err != nil {
return errors.Wrap(err, "set shim OOM score") return errors.Wrap(err, "set shim OOM score")
} }
......
vendor/github.com/containerd/containerd/sys/oom_unix.go
View file @ ef38fa6b
...@@ -28,8 +28,12 @@ import ( ...@@ -28,8 +28,12 @@ import (
"github.com/opencontainers/runc/libcontainer/system" "github.com/opencontainers/runc/libcontainer/system"
) )
// OOMScoreMaxKillable is the maximum score keeping the process killable by the oom killer const (
const OOMScoreMaxKillable = -999 // OOMScoreMaxKillable is the maximum score keeping the process killable by the oom killer
OOMScoreMaxKillable = -999
// OOMScoreAdjMax is from OOM_SCORE_ADJ_MAX https://github.com/torvalds/linux/blob/master/include/uapi/linux/oom.h
OOMScoreAdjMax = 1000
)
// SetOOMScore sets the oom score for the provided pid // SetOOMScore sets the oom score for the provided pid
func SetOOMScore(pid, score int) error { func SetOOMScore(pid, score int) error {
......
vendor/github.com/containerd/containerd/sys/oom_windows.go
View file @ ef38fa6b
...@@ -16,6 +16,11 @@ ...@@ -16,6 +16,11 @@
package sys package sys
const (
// OOMScoreAdjMax is not implemented on Windows
OOMScoreAdjMax = 0
)
// SetOOMScore sets the oom score for the process // SetOOMScore sets the oom score for the process
// //
// Not implemented on Windows // Not implemented on Windows
......
vendor/github.com/containerd/containerd/vendor.conf
View file @ ef38fa6b
...@@ -3,7 +3,7 @@ github.com/BurntSushi/toml v0.3.1 ...@@ -3,7 +3,7 @@ github.com/BurntSushi/toml v0.3.1
github.com/containerd/btrfs af5082808c833de0e79c1e72eea9fea239364877 github.com/containerd/btrfs af5082808c833de0e79c1e72eea9fea239364877
github.com/containerd/cgroups 9f1c62dddf4bc7cc72822ebe353bae7006141b1b github.com/containerd/cgroups 9f1c62dddf4bc7cc72822ebe353bae7006141b1b
github.com/containerd/console v1.0.0 github.com/containerd/console v1.0.0
github.com/containerd/continuity f2a389ac0a02ce21c09edd7344677a601970f41c github.com/containerd/continuity 1d9893e5674b5260c3fc11316d0d5fc0d12ea9e2
github.com/containerd/fifo bda0ff6ed73c67bfb5e62bc9c697f146b7fd7f13 github.com/containerd/fifo bda0ff6ed73c67bfb5e62bc9c697f146b7fd7f13
github.com/containerd/go-runc e029b79d8cda8374981c64eba71f28ec38e5526f github.com/containerd/go-runc e029b79d8cda8374981c64eba71f28ec38e5526f
github.com/containerd/ttrpc v1.0.0 github.com/containerd/ttrpc v1.0.0
...@@ -52,7 +52,7 @@ google.golang.org/grpc v1.23.0 ...@@ -52,7 +52,7 @@ google.golang.org/grpc v1.23.0
gotest.tools v2.3.0 gotest.tools v2.3.0
# cri dependencies # cri dependencies
github.com/containerd/cri v1.3.0-k3s.9 https://github.com/rancher/cri.git github.com/containerd/cri v1.3.0-k3s.10 https://github.com/k3s-io/cri.git
github.com/davecgh/go-spew v1.1.1 github.com/davecgh/go-spew v1.1.1
github.com/docker/distribution 0d3efadf0154c2b8a4e7b6621fff9809655cc580 github.com/docker/distribution 0d3efadf0154c2b8a4e7b6621fff9809655cc580
github.com/docker/docker 86f080cff0914e9694068ed78d503701667c4c00 github.com/docker/docker 86f080cff0914e9694068ed78d503701667c4c00
......
vendor/github.com/containerd/containerd/version/version.go
View file @ ef38fa6b
...@@ -21,7 +21,7 @@ var ( ...@@ -21,7 +21,7 @@ var (
Package = "github.com/containerd/containerd" Package = "github.com/containerd/containerd"
// Version holds the complete version number. Filled in at linking time. // Version holds the complete version number. Filled in at linking time.
Version = "1.3.9+unknown" Version = "1.3.10+unknown"
// Revision is filled with the VCS (e.g. git) revision being used to build // Revision is filled with the VCS (e.g. git) revision being used to build
// the program at linking time. // the program at linking time.
......
vendor/github.com/containerd/cri/Makefile
View file @ ef38fa6b
...@@ -190,10 +190,10 @@ install.tools: .install.gitvalidation .install.golangci-lint .install.vndr ## in ...@@ -190,10 +190,10 @@ install.tools: .install.gitvalidation .install.golangci-lint .install.vndr ## in
.install.golangci-lint: .install.golangci-lint:
@echo "$(WHALE) $@" @echo "$(WHALE) $@"
$(GO) get -d github.com/golangci/golangci-lint/cmd/golangci-lint git clone https://github.com/golangci/golangci-lint.git $(GOPATH)/src/github.com/golangci/golangci-lint
@cd $(GOPATH)/src/github.com/golangci/golangci-lint/cmd/golangci-lint; \ @cd $(GOPATH)/src/github.com/golangci/golangci-lint/cmd/golangci-lint; \
git checkout v1.18.0; \ git checkout v1.18.0; \
go install GO111MODULE=off go install
.install.vndr: .install.vndr:
@echo "$(WHALE) $@" @echo "$(WHALE) $@"
......
vendor/github.com/containerd/cri/pkg/server/container_create.go
View file @ ef38fa6b
...@@ -373,7 +373,7 @@ func (c *criService) generateContainerSpec(id string, sandboxID string, sandboxP ...@@ -373,7 +373,7 @@ func (c *criService) generateContainerSpec(id string, sandboxID string, sandboxP
// Apply envs from image config first, so that envs from container config // Apply envs from image config first, so that envs from container config
// can override them. // can override them.
env := imageConfig.Env env := append([]string{}, imageConfig.Env...)
for _, e := range config.GetEnvs() { for _, e := range config.GetEnvs() {
env = append(env, e.GetKey()+"="+e.GetValue()) env = append(env, e.GetKey()+"="+e.GetValue())
} }
......
vendor/modules.txt
View file @ ef38fa6b
...@@ -157,7 +157,7 @@ github.com/container-storage-interface/spec/lib/go/csi ...@@ -157,7 +157,7 @@ github.com/container-storage-interface/spec/lib/go/csi
github.com/containerd/cgroups github.com/containerd/cgroups
# github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1 => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50 # github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1 => github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50
github.com/containerd/console github.com/containerd/console
# github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69 => github.com/k3s-io/containerd v1.3.9-k3s1 # github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69 => github.com/k3s-io/containerd v1.3.10-k3s1
github.com/containerd/containerd github.com/containerd/containerd
github.com/containerd/containerd/api/events github.com/containerd/containerd/api/events
github.com/containerd/containerd/api/services/containers/v1 github.com/containerd/containerd/api/services/containers/v1
...@@ -294,7 +294,7 @@ github.com/containerd/continuity/pathdriver ...@@ -294,7 +294,7 @@ github.com/containerd/continuity/pathdriver
github.com/containerd/continuity/proto github.com/containerd/continuity/proto
github.com/containerd/continuity/syscallx github.com/containerd/continuity/syscallx
github.com/containerd/continuity/sysx github.com/containerd/continuity/sysx
# github.com/containerd/cri v0.0.0-00010101000000-000000000000 => github.com/k3s-io/cri v1.3.0-k3s.9 # github.com/containerd/cri v0.0.0-00010101000000-000000000000 => github.com/k3s-io/cri v1.3.0-k3s.10
github.com/containerd/cri github.com/containerd/cri
github.com/containerd/cri/pkg/annotations github.com/containerd/cri/pkg/annotations
github.com/containerd/cri/pkg/api/runtimeoptions/v1 github.com/containerd/cri/pkg/api/runtimeoptions/v1
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment