New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert to using isolated PID namespaces in Docker #51634

Merged
merged 2 commits into from Sep 6, 2017

Conversation

@verb
Contributor

verb commented Aug 30, 2017

What this PR does / why we need it: Reverts to the previous docker default of using isolated PID namespaces for containers in a pod. There exist container images that expect always to be PID 1 which we want to support unmodified in 1.8.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #48937

Special notes for your reviewer:

Release note:

Sharing a PID namespace between containers in a pod is disabled by default in 1.8. To enable for a node, use the --docker-disable-shared-pid=false kubelet flag. Note that PID namespace sharing requires docker >= 1.13.1.
@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Aug 30, 2017

Contributor

looks like maybe the e2e node test doesn't set the flag. Will look into it tomorrow.

Contributor

verb commented Aug 30, 2017

looks like maybe the e2e node test doesn't set the flag. Will look into it tomorrow.

@derekwaynecarr

This comment has been minimized.

Show comment
Hide comment
@derekwaynecarr

derekwaynecarr Aug 31, 2017

Member

poke when tests pass, thanks for making the update.

Member

derekwaynecarr commented Aug 31, 2017

poke when tests pass, thanks for making the update.

@dims

This comment has been minimized.

Show comment
Hide comment
@dims

dims Aug 31, 2017

Member

@verb do we want to specify the docker versions needed for the shared pid flag to work in the release note?

Member

dims commented Aug 31, 2017

@verb do we want to specify the docker versions needed for the shared pid flag to work in the release note?

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Aug 31, 2017

Contributor

@dims oh yes, great catch. Updated the release note.

Contributor

verb commented Aug 31, 2017

@dims oh yes, great catch. Updated the release note.

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Aug 31, 2017

Contributor

@yguo0905 can you offer any advice about how to best to update the node e2e test for this? It looks like the kubelet is only run one time for the test, so I can't test with both the flag enabled and disabled.

Should I test the default behavior or test the feature even though it's disabled by default?

I assume the former but I want to make sure I'm not missing something.

Contributor

verb commented Aug 31, 2017

@yguo0905 can you offer any advice about how to best to update the node e2e test for this? It looks like the kubelet is only run one time for the test, so I can't test with both the flag enabled and disabled.

Should I test the default behavior or test the feature even though it's disabled by default?

I assume the former but I want to make sure I'm not missing something.

@yguo0905

This comment has been minimized.

Show comment
Hide comment
@yguo0905

yguo0905 Aug 31, 2017

Contributor

I think we want to test this behavior because user can enable it if they want. We can set the flag at

KUBELET_ARGS='--cgroups-per-qos=true --cgroup-root=/'

Contributor

yguo0905 commented Aug 31, 2017

I think we want to test this behavior because user can enable it if they want. We can set the flag at

KUBELET_ARGS='--cgroups-per-qos=true --cgroup-root=/'

@k8s-ci-robot k8s-ci-robot added size/S and removed size/XS labels Sep 1, 2017

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 1, 2017

Contributor

/retest

Contributor

verb commented Sep 1, 2017

/retest

1 similar comment
@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 1, 2017

Contributor

/retest

Contributor

verb commented Sep 1, 2017

/retest

@@ -155,6 +155,7 @@ func (e *E2EServices) startKubelet() (*server, error) {
"--serialize-image-pulls", "false",
"--pod-manifest-path", manifestPath,
"--file-check-frequency", "10s", // Check file frequently so tests won't wait too long
"--docker-disable-shared-pid=false",

This comment has been minimized.

@yguo0905

yguo0905 Sep 1, 2017

Contributor

If we set it here we don't need the change in test/e2e_node/jenkins/jenkins-pull.properties?

Actually, if we don't set it here there are other properties files in test/e2e_node/jenkins/ need to be changed.

@yguo0905

yguo0905 Sep 1, 2017

Contributor

If we set it here we don't need the change in test/e2e_node/jenkins/jenkins-pull.properties?

Actually, if we don't set it here there are other properties files in test/e2e_node/jenkins/ need to be changed.

This comment has been minimized.

@verb

verb Sep 4, 2017

Contributor

Ok, thanks. Based on this advice (and because it made the e2e node test pass) I've removed the jenkins config and set the flag here.

@verb

verb Sep 4, 2017

Contributor

Ok, thanks. Based on this advice (and because it made the e2e node test pass) I've removed the jenkins config and set the flag here.

verb added some commits Aug 30, 2017

Revert to using isolated PID namespaces in Docker
A shared PID namespace were enabled by default in the 1.7 when running
with a supported Docker runtime, but a Docker version that supports
a shared namespace was not qualified for use.

Release 1.8 will qualify a docker version supporting shared PID, but we
don't want to cause disruption for container images which expect always
to have PID 1.
Explicitly enable docker shared-pid for e2e_node
This also renames isSharedPIDNamespaceEnabled() to
isSharedPIDNamespaceSupported() to be more accurate.
@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 2, 2017

Contributor
Contributor

verb commented Sep 2, 2017

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 2, 2017

Contributor

/retest

Contributor

verb commented Sep 2, 2017

/retest

1 similar comment
@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 4, 2017

Contributor

/retest

Contributor

verb commented Sep 4, 2017

/retest

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 5, 2017

Contributor

This PR is ready for review. According to sig-testing, pull-kubernetes-e2e-kops-aws is broken and has been disabled for the merge queue.

This PR should be added to the 1.8 milestone to resolve critical-urgent issue #48937.

Contributor

verb commented Sep 5, 2017

This PR is ready for review. According to sig-testing, pull-kubernetes-e2e-kops-aws is broken and has been disabled for the merge queue.

This PR should be added to the 1.8 milestone to resolve critical-urgent issue #48937.

@dims

This comment has been minimized.

Show comment
Hide comment
@dims

dims Sep 5, 2017

Member

@kubernetes/sig-release-members Can you please apply milestone v1.8?

Member

dims commented Sep 5, 2017

@kubernetes/sig-release-members Can you please apply milestone v1.8?

@ericchiang ericchiang added this to the v1.8 milestone Sep 5, 2017

@derekwaynecarr

This comment has been minimized.

Show comment
Hide comment
@derekwaynecarr

derekwaynecarr Sep 5, 2017

Member

/lgtm
/approve

Member

derekwaynecarr commented Sep 5, 2017

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm label Sep 5, 2017

@k8s-merge-robot

This comment has been minimized.

Show comment
Hide comment
@k8s-merge-robot

k8s-merge-robot Sep 5, 2017

Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, verb

Associated issue: 48937

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

Contributor

k8s-merge-robot commented Sep 5, 2017

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, verb

Associated issue: 48937

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 5, 2017

Contributor

/retest

Contributor

verb commented Sep 5, 2017

/retest

@fejta-bot

This comment has been minimized.

Show comment
Hide comment
@fejta-bot

fejta-bot Sep 5, 2017

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

fejta-bot commented Sep 5, 2017

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

@k8s-ci-robot

This comment has been minimized.

Show comment
Hide comment
@k8s-ci-robot

k8s-ci-robot Sep 5, 2017

Contributor

@verb: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-kops-aws 765374c link /test pull-kubernetes-e2e-kops-aws

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Contributor

k8s-ci-robot commented Sep 5, 2017

@verb: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
pull-kubernetes-e2e-kops-aws 765374c link /test pull-kubernetes-e2e-kops-aws

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@k8s-merge-robot

This comment has been minimized.

Show comment
Hide comment
@k8s-merge-robot

k8s-merge-robot Sep 6, 2017

Contributor

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

Contributor

k8s-merge-robot commented Sep 6, 2017

Automatic merge from submit-queue (batch tested with PRs 51984, 51351, 51873, 51795, 51634)

@k8s-merge-robot k8s-merge-robot merged commit eb86cc5 into kubernetes:master Sep 6, 2017

12 of 13 checks passed

pull-kubernetes-e2e-kops-aws Jenkins job failed.
Details
Submit Queue Queued to run github e2e tests a second time.
Details
cla/linuxfoundation verb authorized
Details
pull-kubernetes-bazel-build Job succeeded.
Details
pull-kubernetes-bazel-test Job succeeded.
Details
pull-kubernetes-e2e-gce-bazel Job succeeded.
Details
pull-kubernetes-e2e-gce-etcd3 Jenkins job succeeded.
Details
pull-kubernetes-e2e-gce-gpu Jenkins job succeeded.
Details
pull-kubernetes-federation-e2e-gce Jenkins job succeeded.
Details
pull-kubernetes-kubemark-e2e-gce Jenkins job succeeded.
Details
pull-kubernetes-node-e2e Jenkins job succeeded.
Details
pull-kubernetes-unit Jenkins job succeeded.
Details
pull-kubernetes-verify Jenkins job succeeded.
Details
@jdumars

This comment has been minimized.

Show comment
Hide comment
@jdumars

jdumars Sep 6, 2017

Member

@verb could you please assign a SIG to this?

Member

jdumars commented Sep 6, 2017

@verb could you please assign a SIG to this?

@verb

This comment has been minimized.

Show comment
Hide comment
@verb

verb Sep 7, 2017

Contributor

/sig node

Contributor

verb commented Sep 7, 2017

/sig node

chaitanyaenr added a commit to chaitanyaenr/svt that referenced this pull request Nov 28, 2017

Modify template to work with kubernetes 1.7
In 1.7 release the shared namespace is enabled by default. This is
causing a problem when running pbench container which runs systemd.

Related issue in upstream kubernetes:
kubernetes/kubernetes#48937

According to my understanding this will be fixed from 1.8 with the
following patch:
kubernetes/kubernetes#51634

chaitanyaenr added a commit to chaitanyaenr/svt that referenced this pull request Nov 28, 2017

Modify template to work with kubernetes 1.7
In 1.7 release the shared PID namespaces is enabled by default. This is
causing a problem when running pbench container which runs systemd.

Related issue in upstream kubernetes:
kubernetes/kubernetes#48937

According to my understanding this will be fixed from 1.8 with the
following patch:
kubernetes/kubernetes#51634

mffiedler added a commit to openshift/svt that referenced this pull request Nov 29, 2017

Modify template to work with kubernetes 1.7 (#345)
In 1.7 release the shared PID namespaces is enabled by default. This is
causing a problem when running pbench container which runs systemd.

Related issue in upstream kubernetes:
kubernetes/kubernetes#48937

According to my understanding this will be fixed from 1.8 with the
following patch:
kubernetes/kubernetes#51634
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment