From 817f95ebaa3c165301b22c4b547ee7adccdb7ebb Mon Sep 17 00:00:00 2001 From: Paul Holzinger Date: Wed, 16 Jun 2021 18:01:07 +0200 Subject: [PATCH] Add option to disable the use of inotify Add a new InitCNINoInotify function to allow the use of OCICNI without the use of inotify. For some workloads it is not required to watch the cni config directory. With podman v3.2 we started using OCICNI for rootless users as well. However the use of inotify is restricted by sysctl values (fs.inotify.max_user_instances and fs.inotify.max_user_watches). By default only 128 processes can use inotify. Since this limit is easy to reach and inotify is not required for our use case it would be great to have this option to disable it. see containers/podman#10686 Signed-off-by: Paul Holzinger --- pkg/ocicni/ocicni.go | 33 +++++++++++++++++++++------------ pkg/ocicni/ocicni_test.go | 18 +++++++++--------- 2 files changed, 30 insertions(+), 21 deletions(-) diff --git a/pkg/ocicni/ocicni.go b/pkg/ocicni/ocicni.go index c10c4452..90d5b6c5 100644 --- a/pkg/ocicni/ocicni.go +++ b/pkg/ocicni/ocicni.go @@ -195,16 +195,21 @@ func (plugin *cniNetworkPlugin) monitorConfDir(start *sync.WaitGroup) { // If defaultNetName is empty, CNI config files should be reloaded real-time and // defaultNetName should be changeable and determined by file sorting. func InitCNI(defaultNetName string, confDir string, binDirs ...string) (CNIPlugin, error) { - return initCNI(nil, "", defaultNetName, confDir, binDirs...) + return initCNI(nil, "", defaultNetName, confDir, true, binDirs...) } // InitCNIWithCache works like InitCNI except that it takes the cni cache directory as third param. func InitCNIWithCache(defaultNetName, confDir, cacheDir string, binDirs ...string) (CNIPlugin, error) { - return initCNI(nil, cacheDir, defaultNetName, confDir, binDirs...) + return initCNI(nil, cacheDir, defaultNetName, confDir, true, binDirs...) +} + +// InitCNINoInotify works like InitCNI except that it does not use inotify to watch for changes in the CNI config dir. +func InitCNINoInotify(defaultNetName, confDir, cacheDir string, binDirs ...string) (CNIPlugin, error) { + return initCNI(nil, cacheDir, defaultNetName, confDir, false, binDirs...) } // Internal function to allow faking out exec functions for testing -func initCNI(exec cniinvoke.Exec, cacheDir, defaultNetName string, confDir string, binDirs ...string) (CNIPlugin, error) { +func initCNI(exec cniinvoke.Exec, cacheDir, defaultNetName string, confDir string, useInotify bool, binDirs ...string) (CNIPlugin, error) { if confDir == "" { confDir = DefaultConfDir } @@ -245,22 +250,26 @@ func initCNI(exec cniinvoke.Exec, cacheDir, defaultNetName string, confDir strin plugin.syncNetworkConfig() - plugin.watcher, err = newWatcher(plugin.confDir) - if err != nil { - return nil, err - } + if useInotify { + plugin.watcher, err = newWatcher(plugin.confDir) + if err != nil { + return nil, err + } - startWg := sync.WaitGroup{} - startWg.Add(1) - go plugin.monitorConfDir(&startWg) - startWg.Wait() + startWg := sync.WaitGroup{} + startWg.Add(1) + go plugin.monitorConfDir(&startWg) + startWg.Wait() + } return plugin, nil } func (plugin *cniNetworkPlugin) Shutdown() error { close(plugin.shutdownChan) - plugin.watcher.Close() + if plugin.watcher != nil { + plugin.watcher.Close() + } plugin.done.Wait() return nil } diff --git a/pkg/ocicni/ocicni_test.go b/pkg/ocicni/ocicni_test.go index dce63e6d..92a336cd 100644 --- a/pkg/ocicni/ocicni_test.go +++ b/pkg/ocicni/ocicni_test.go @@ -211,7 +211,7 @@ var _ = Describe("ocicni operations", func() { _, _, err = writeConfig(tmpDir, "10-test.conf", "test", "myplugin", "0.3.1") Expect(err).NotTo(HaveOccurred()) - ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, false, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) Expect(ocicni.Status()).NotTo(HaveOccurred()) @@ -226,7 +226,7 @@ var _ = Describe("ocicni operations", func() { }) It("finds an asynchronously written default network configuration", func() { - ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) // Writing a config that doesn't match the default network @@ -248,7 +248,7 @@ var _ = Describe("ocicni operations", func() { }) It("finds and refinds an asynchronously written default network configuration", func() { - ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(&fakeExec{}, "", "test", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) // Write the default network config @@ -278,7 +278,7 @@ var _ = Describe("ocicni operations", func() { }) It("finds an ASCIIbetically first network configuration as default real-time if given no default network name", func() { - ocicni, err := initCNI(&fakeExec{}, "", "", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(&fakeExec{}, "", "", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) _, _, err = writeConfig(tmpDir, "15-test.conf", "test", "myplugin", "0.3.1") @@ -492,7 +492,7 @@ var _ = Describe("ocicni operations", func() { } fake.addPlugin(nil, conf, expectedResult, nil) - ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) podNet := PodNetwork{ @@ -573,7 +573,7 @@ var _ = Describe("ocicni operations", func() { } fake.addPlugin(nil, conf2, expectedResult2, nil) - ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) podNet := PodNetwork{ @@ -650,7 +650,7 @@ var _ = Describe("ocicni operations", func() { } fake.addPlugin(nil, conf2, expectedResult2, nil) - ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(fake, cacheDir, "network2", tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) podNet := PodNetwork{ @@ -725,7 +725,7 @@ var _ = Describe("ocicni operations", func() { fake.addPlugin([]string{fmt.Sprintf("CNI_IFNAME=%s", ifname1)}, conf1, nil, nil) fake.addPlugin([]string{fmt.Sprintf("CNI_IFNAME=%s", ifname2)}, conf2, nil, nil) - ocicni, err = initCNI(fake, cacheDir, defaultNetName, tmpDir, "/opt/cni/bin") + ocicni, err = initCNI(fake, cacheDir, defaultNetName, tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) podNet = PodNetwork{ @@ -790,7 +790,7 @@ var _ = Describe("ocicni operations", func() { fake.addPlugin(nil, conf1, nil, nil) fake.addPlugin(nil, conf2, nil, nil) - ocicni, err := initCNI(fake, cacheDir, defaultNetName, tmpDir, "/opt/cni/bin") + ocicni, err := initCNI(fake, cacheDir, defaultNetName, tmpDir, true, "/opt/cni/bin") Expect(err).NotTo(HaveOccurred()) defer ocicni.Shutdown()