mirrors/talos
1
0
Fork 0
mirror of https://github.com/siderolabs/talos.git synced 2025-12-04 17:11:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: use a separate cgroup for each extension service

Browse Source 
Fixes #8229

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
This commit is contained in:
Andrey Smirnov 2024-02-02 20:28:03 +04:00
parent 6ccdd2c09c
commit ddbabc7e58
No known key found for this signature in database
GPG Key ID: FE042E3D4085A811
3 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
internal/app/machined/pkg/controllers/runtime/extension_service.go
View File

@ -113,19 +113,19 @@ func (ctrl *ExtensionServiceController) Run(ctx context.Context, r controller.Ru
return nil return nil
} }
func (ctrl *ExtensionServiceController) loadSpec(path string) (*extservices.Spec, error) { func (ctrl *ExtensionServiceController) loadSpec(path string) (extservices.Spec, error) {
var spec extservices.Spec var spec extservices.Spec
f, err := os.Open(path) f, err := os.Open(path)
if err != nil { if err != nil {
return nil, err return spec, err
} }
defer f.Close() //nolint:errcheck defer f.Close() //nolint:errcheck
if err = yaml.NewDecoder(f).Decode(&spec); err != nil { if err = yaml.NewDecoder(f).Decode(&spec); err != nil {
return nil, fmt.Errorf("error unmarshalling extension service config: %w", err) return spec, fmt.Errorf("error unmarshalling extension service config: %w", err)
} }
return &spec, nil return spec, nil
} }

4
internal/app/machined/pkg/system/services/extension.go
View File

@ -33,7 +33,7 @@ import (
// Extension service is a generic wrapper around extension services spec. // Extension service is a generic wrapper around extension services spec.
type Extension struct { type Extension struct {
Spec *extservices.Spec Spec extservices.Spec
overlay *mount.Point overlay *mount.Point
} }
@ -107,7 +107,7 @@ func (svc *Extension) getOCIOptions(envVars []string) []oci.SpecOpts {
ociOpts := []oci.SpecOpts{ ociOpts := []oci.SpecOpts{
oci.WithRootFSPath(filepath.Join(constants.ExtensionServicesRootfsPath, svc.Spec.Name)), oci.WithRootFSPath(filepath.Join(constants.ExtensionServicesRootfsPath, svc.Spec.Name)),
containerd.WithRootfsPropagation(svc.Spec.Container.Security.RootfsPropagation), containerd.WithRootfsPropagation(svc.Spec.Container.Security.RootfsPropagation),
oci.WithCgroup(constants.CgroupExtensions), oci.WithCgroup(filepath.Join(constants.CgroupExtensions, svc.Spec.Name)),
oci.WithMounts(svc.Spec.Container.Mounts), oci.WithMounts(svc.Spec.Container.Mounts),
oci.WithHostNamespace(specs.NetworkNamespace), oci.WithHostNamespace(specs.NetworkNamespace),
oci.WithSelinuxLabel(""), oci.WithSelinuxLabel(""),

12
internal/app/machined/pkg/system/services/extension_test.go
View File

@ -47,7 +47,7 @@ func TestGetOCIOptions(t *testing.T) {
t.Run("default configurations are cleared away if user passes empty arrays for MaskedPaths and ReadonlyPaths", func(t *testing.T) { t.Run("default configurations are cleared away if user passes empty arrays for MaskedPaths and ReadonlyPaths", func(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
Security: extservices.Security{ Security: extservices.Security{
MaskedPaths: []string{}, MaskedPaths: []string{},
@ -69,7 +69,7 @@ func TestGetOCIOptions(t *testing.T) {
t.Run("default configuration applies if user passes nil for MaskedPaths and ReadonlyPaths", func(t *testing.T) { t.Run("default configuration applies if user passes nil for MaskedPaths and ReadonlyPaths", func(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
Security: extservices.Security{ Security: extservices.Security{
MaskedPaths: nil, MaskedPaths: nil,
@ -109,7 +109,7 @@ func TestGetOCIOptions(t *testing.T) {
t.Run("root fs is readonly unless explicitly enabled", func(t *testing.T) { t.Run("root fs is readonly unless explicitly enabled", func(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
Security: extservices.Security{ Security: extservices.Security{
WriteableRootfs: true, WriteableRootfs: true,
@ -129,7 +129,7 @@ func TestGetOCIOptions(t *testing.T) {
t.Run("root fs is readonly by default", func(t *testing.T) { t.Run("root fs is readonly by default", func(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
Security: extservices.Security{}, Security: extservices.Security{},
}, },
@ -147,7 +147,7 @@ func TestGetOCIOptions(t *testing.T) {
t.Run("allows setting extra env vars", func(t *testing.T) { t.Run("allows setting extra env vars", func(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
Environment: []string{ Environment: []string{
"FOO=BAR", "FOO=BAR",
@ -172,7 +172,7 @@ func TestGetOCIOptions(t *testing.T) {
// given // given
svc := &services.Extension{ svc := &services.Extension{
Spec: &extservices.Spec{ Spec: extservices.Spec{
Container: extservices.Container{ Container: extservices.Container{
EnvironmentFile: envFile, EnvironmentFile: envFile,
}, },