Upgrade containerd #2369

NicolasT · 2020-04-06T11:25:51Z

Upgrade containerd to 1.2.13, among others to include a fix for containerd/containerd#3125. Also, enable seccomp support to handle #2259.

This implies we no longer ship the containerd package as found in EPEL, but instead build one as part of the MetalK8s build and ship it in the metalk8s-scality repository.

bert-e · 2020-04-06T11:25:53Z

Hello nicolast,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Status report is not available.

bert-e · 2020-04-06T11:25:58Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

Retrieved from EPEL. See: https://download-ib01.fedoraproject.org/pub/epel/7/SRPMS/Packages/c/containerd-1.2.4-1.el7.src.rpm

NicolasT · 2020-04-06T13:59:44Z

For reviewers, the most important changes are

Bumping the containerd version to 1.2.13, based on the RPM spec of 1.2.4 as we currently ship from EPEL (imported separately) at f586940#diff-bddba0a782eb642c0a25329157bdf322
Enabling seccomp support in containerd at 05ea261#diff-bddba0a782eb642c0a25329157bdf322

Fixes: #2259 See: #2259

NicolasT · 2020-04-06T15:48:32Z

@bert-e approve

bert-e · 2020-04-06T15:48:38Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
one peer

Peer approvals must include at least 1 approval from the following list:

The following options are set: approve

NicolasT · 2020-04-06T19:43:28Z

Moved into 2.6.0. Needs field testing, too big a change for a .1.

…t/upgrade-containerd * origin/development/2.6: images: enrich `metalk8s-utils` image deps: Pin pytest version deps: Bump PyYAML to 5.3.1 in buildchain deps: Regenerate compiled requirements eve: Add `text` in JUnit containing artifact Url eve: Add `text` support for JUnit generation eve: Add `message` support for JUnit generation Conflicts: CHANGELOG.md

gdemonet

LGTM for the most part! Some suggested changes on tests, maybe we want to move them in a debt ticket, as you wish.

gdemonet · 2020-04-08T10:42:57Z

tests/post/steps/conftest.py

+def given_check_pod_status(request, host, k8s_client, label, expected_status):
    ssh_config = request.config.getoption('--ssh-config')


I know it's not related to your changes, but there's a ssh_config fixture to simplify this a bit:

Suggested change

def given_check_pod_status(request, host, k8s_client, label, expected_status):

ssh_config = request.config.getoption('--ssh-config')

def given_check_pod_status(ssh_config, host, k8s_client, label, expected_status):

gdemonet · 2020-04-08T10:53:25Z

tests/post/steps/test_seccomp.py

+
+
+@pytest.fixture
+def utils_pod(k8s_client, utils_image):


You don't need to create another fixture, @when already makes the create_utils_pod a fixture. This would allow us to make use of a BDD parser:

_UTILS_POD_PARSER = parsers.parse( "we create a utils Pod with labels {labels:JSON} " "and annotations {annotations:JSON}", extra_types=dict(JSON=json.loads), ) @when(_UTILS_POD_PARSER) def utils_pod(k8s_client, utils_image, labels, annotations): # create the Pod with right labels and annotations, which are # passed in as Python dicts already try: yield pod_name finally: # clean-up of the Pod @then("I can run '{command}' in the utils Pod") def run_in_utils_pod(utils_pod, command): # If we had such a helper, we could do: kubectl_exec(pod_name=utils_pod, command=command)

Well, that's what I tried at first (how could one perform resource cleanup otherwise?). However, when executing the test using that implementation, nothing happened. My when thing, which is then a generator, would not be nexted, so no code executed, no Pod created,... (to my surprise). Skimming the docs back then, there's no reference of whens being permitted to be a generator.

I'll try again with a super-simple test...

As discussed on Slack, one can't use a generator in a @when implementation.

Indeed, but it seems we can in a @given (and in your context, creating a utils Pod could make sense as a "Given" step).

Well, no :) I am not actually using the utils Pod, its merely a canary (hence, not executing any commands in it). What this test wants to validate is that any Pod with some specific set of annotations will be fully functional at some point (i.e., our CRI supports the seccomp profile annotations). The Pod is not an input to the test, its creation and validation is the test.

bert-e · 2020-04-08T14:19:49Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/2.6

The following branches will NOT be impacted:

development/1.0
development/1.1
development/1.2
development/1.3
development/2.0
development/2.1
development/2.2
development/2.3
development/2.4
development/2.5

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

bert-e · 2020-04-08T20:19:04Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/2.6

The following branches have NOT changed:

development/1.0
development/1.1
development/1.2
development/1.3
development/2.0
development/2.1
development/2.2
development/2.3
development/2.4
development/2.5

Please check the status of the associated issue None.

Goodbye nicolast.

NicolasT added 3 commits April 6, 2020 15:54

packages: import SRPM files of containerd-1.2.4-1.el7

516191b

Retrieved from EPEL. See: https://download-ib01.fedoraproject.org/pub/epel/7/SRPMS/Packages/c/containerd-1.2.4-1.el7.src.rpm

build: build 'our' containerd RPM

9ae95c1

packages: bump containerd to 1.2.13

f586940

NicolasT force-pushed the improvement/upgrade-containerd branch from 8fa2264 to 05ea261 Compare April 6, 2020 13:57

NicolasT marked this pull request as ready for review April 6, 2020 13:59

NicolasT requested a review from a team as a code owner April 6, 2020 13:59

packages: enable seccomp in containerd

f1df9b5

Fixes: #2259 See: #2259

NicolasT force-pushed the improvement/upgrade-containerd branch from 05ea261 to f1df9b5 Compare April 6, 2020 14:55

NicolasT added this to the MetalK8s 2.6.0 milestone Apr 6, 2020

gdemonet reviewed Apr 8, 2020

View reviewed changes

NicolasT mentioned this pull request Apr 8, 2020

Tests: use the ssh_config fixture where applicable #2387

Open

gdemonet approved these changes Apr 8, 2020

View reviewed changes

bert-e merged commit 187089b into development/2.6 Apr 8, 2020

bert-e deleted the improvement/upgrade-containerd branch April 8, 2020 20:19

gdemonet mentioned this pull request Oct 16, 2020

Bump containerd to 1.2.14 #2874

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade containerd #2369

Upgrade containerd #2369

NicolasT commented Apr 6, 2020

bert-e commented Apr 6, 2020

bert-e commented Apr 6, 2020

NicolasT commented Apr 6, 2020

NicolasT commented Apr 6, 2020

bert-e commented Apr 6, 2020

NicolasT commented Apr 6, 2020

gdemonet left a comment

gdemonet Apr 8, 2020

NicolasT Apr 8, 2020

gdemonet Apr 8, 2020

NicolasT Apr 8, 2020

NicolasT Apr 8, 2020

gdemonet Apr 8, 2020

NicolasT Apr 8, 2020

bert-e commented Apr 8, 2020

bert-e commented Apr 8, 2020

		def given_check_pod_status(request, host, k8s_client, label, expected_status):
		ssh_config = request.config.getoption('--ssh-config')

	def given_check_pod_status(request, host, k8s_client, label, expected_status):
	ssh_config = request.config.getoption('--ssh-config')
	def given_check_pod_status(ssh_config, host, k8s_client, label, expected_status):

Upgrade containerd #2369

Upgrade containerd #2369

Conversation

NicolasT commented Apr 6, 2020

bert-e commented Apr 6, 2020

Hello nicolast,

bert-e commented Apr 6, 2020

Waiting for approval

NicolasT commented Apr 6, 2020

NicolasT commented Apr 6, 2020

bert-e commented Apr 6, 2020

Waiting for approval

NicolasT commented Apr 6, 2020

gdemonet left a comment

Choose a reason for hiding this comment

gdemonet Apr 8, 2020

Choose a reason for hiding this comment

NicolasT Apr 8, 2020

Choose a reason for hiding this comment

gdemonet Apr 8, 2020

Choose a reason for hiding this comment

NicolasT Apr 8, 2020

Choose a reason for hiding this comment

NicolasT Apr 8, 2020

Choose a reason for hiding this comment

gdemonet Apr 8, 2020

Choose a reason for hiding this comment

NicolasT Apr 8, 2020

Choose a reason for hiding this comment

bert-e commented Apr 8, 2020

In the queue

bert-e commented Apr 8, 2020