Merge release-20210510.0-45-gd96499d17 (automated)

4 files changed, 71 insertions, 25 deletions

diff --git a/pkg/shim/service.go b/pkg/shim/service.go
index 9d9fa8ef6..1f9adcb65 100644
--- a/pkg/shim/service.go
+++ b/pkg/shim/service.go
@@ -22,6 +22,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -44,6 +45,7 @@ import (
 	"github.com/containerd/containerd/sys/reaper"
 	"github.com/containerd/typeurl"
 	"github.com/gogo/protobuf/types"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/cleanup"
@@ -944,9 +946,19 @@ func newInit(path, workDir, namespace string, platform stdio.Platform, r *proc.C
 	if err != nil {
 		return nil, fmt.Errorf("read oci spec: %w", err)
 	}
-	if err := utils.UpdateVolumeAnnotations(r.Bundle, spec); err != nil {
+
+	updated, err := utils.UpdateVolumeAnnotations(spec)
+	if err != nil {
 		return nil, fmt.Errorf("update volume annotations: %w", err)
 	}
+	updated = updateCgroup(spec) || updated
+
+	if updated {
+		if err := utils.WriteSpec(r.Bundle, spec); err != nil {
+			return nil, err
+		}
+	}
+
 	runsc.FormatRunscLogPath(r.ID, options.RunscConfig)
 	runtime := proc.NewRunsc(options.Root, path, namespace, options.BinaryName, options.RunscConfig)
 	p := proc.New(r.ID, runtime, stdio.Stdio{
@@ -966,3 +978,39 @@ func newInit(path, workDir, namespace string, platform stdio.Platform, r *proc.C
 	p.Monitor = reaper.Default
 	return p, nil
 }
+
+// updateCgroup updates cgroup path for the sandbox to make the sandbox join the
+// pod cgroup and not the pause container cgroup. Returns true if the spec was
+// modified. Ex.:
+//   /kubepods/burstable/pod123/abc => kubepods/burstable/pod123
+//
+func updateCgroup(spec *specs.Spec) bool {
+	if !utils.IsSandbox(spec) {
+		return false
+	}
+	if spec.Linux == nil || len(spec.Linux.CgroupsPath) == 0 {
+		return false
+	}
+
+	// Search backwards for the pod cgroup path to make the sandbox use it,
+	// instead of the pause container's cgroup.
+	parts := strings.Split(spec.Linux.CgroupsPath, string(filepath.Separator))
+	for i := len(parts) - 1; i >= 0; i-- {
+		if strings.HasPrefix(parts[i], "pod") {
+			var path string
+			for j := 0; j <= i; j++ {
+				path = filepath.Join(path, parts[j])
+			}
+			// Add back the initial '/' that may have been lost above.
+			if filepath.IsAbs(spec.Linux.CgroupsPath) {
+				path = string(filepath.Separator) + path
+			}
+			if spec.Linux.CgroupsPath == path {
+				return false
+			}
+			spec.Linux.CgroupsPath = path
+			return true
+		}
+	}
+	return false
+}
diff --git a/pkg/shim/utils/annotations.go b/pkg/shim/utils/annotations.go
index 1e9d3f365..c744800bb 100644
--- a/pkg/shim/utils/annotations.go
+++ b/pkg/shim/utils/annotations.go
@@ -19,7 +19,9 @@ package utils
 // These are vendor due to import conflicts.
 const (
 	sandboxLogDirAnnotation = "io.kubernetes.cri.sandbox-log-directory"
-	containerTypeAnnotation = "io.kubernetes.cri.container-type"
+	// ContainerTypeAnnotation is they key that defines sandbox or container.
+	ContainerTypeAnnotation = "io.kubernetes.cri.container-type"
 	containerTypeSandbox    = "sandbox"
-	containerTypeContainer  = "container"
+	// ContainerTypeContainer is the value for container.
+	ContainerTypeContainer = "container"
 )
diff --git a/pkg/shim/utils/utils.go b/pkg/shim/utils/utils.go
index 7b1cd983e..f183b1bbc 100644
--- a/pkg/shim/utils/utils.go
+++ b/pkg/shim/utils/utils.go
@@ -18,19 +18,16 @@ package utils
 import (
 	"encoding/json"
 	"io/ioutil"
-	"os"
 	"path/filepath"
 
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 )
 
+const configFilename = "config.json"
+
 // ReadSpec reads OCI spec from the bundle directory.
 func ReadSpec(bundle string) (*specs.Spec, error) {
-	f, err := os.Open(filepath.Join(bundle, "config.json"))
-	if err != nil {
-		return nil, err
-	}
-	b, err := ioutil.ReadAll(f)
+	b, err := ioutil.ReadFile(filepath.Join(bundle, configFilename))
 	if err != nil {
 		return nil, err
 	}
@@ -41,9 +38,18 @@ func ReadSpec(bundle string) (*specs.Spec, error) {
 	return &spec, nil
 }
 
+// WriteSpec writes OCI spec to the bundle directory.
+func WriteSpec(bundle string, spec *specs.Spec) error {
+	b, err := json.Marshal(spec)
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(filepath.Join(bundle, configFilename), b, 0666)
+}
+
 // IsSandbox checks whether a container is a sandbox container.
 func IsSandbox(spec *specs.Spec) bool {
-	t, ok := spec.Annotations[containerTypeAnnotation]
+	t, ok := spec.Annotations[ContainerTypeAnnotation]
 	return !ok || t == containerTypeSandbox
 }
 
diff --git a/pkg/shim/utils/volumes.go b/pkg/shim/utils/volumes.go
index cdcb88229..6bc75139d 100644
--- a/pkg/shim/utils/volumes.go
+++ b/pkg/shim/utils/volumes.go
@@ -15,9 +15,7 @@
 package utils
 
 import (
-	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"path/filepath"
 	"strings"
 
@@ -89,8 +87,8 @@ func isVolumePath(volume, path string) (bool, error) {
 }
 
 // UpdateVolumeAnnotations add necessary OCI annotations for gvisor
-// volume optimization.
-func UpdateVolumeAnnotations(bundle string, s *specs.Spec) error {
+// volume optimization. Returns true if the spec was modified.
+func UpdateVolumeAnnotations(s *specs.Spec) (bool, error) {
 	var uid string
 	if IsSandbox(s) {
 		var err error
@@ -98,7 +96,7 @@ func UpdateVolumeAnnotations(bundle string, s *specs.Spec) error {
 		if err != nil {
 			// Skip if we can't get pod UID, because this doesn't work
 			// for containerd 1.1.
-			return nil
+			return false, nil
 		}
 	}
 	var updated bool
@@ -114,7 +112,7 @@ func UpdateVolumeAnnotations(bundle string, s *specs.Spec) error {
 			// This is a sandbox.
 			path, err := volumePath(volume, uid)
 			if err != nil {
-				return fmt.Errorf("get volume path for %q: %w", volume, err)
+				return false, fmt.Errorf("get volume path for %q: %w", volume, err)
 			}
 			s.Annotations[volumeSourceKey(volume)] = path
 			updated = true
@@ -138,15 +136,7 @@ func UpdateVolumeAnnotations(bundle string, s *specs.Spec) error {
 			}
 		}
 	}
-	if !updated {
-		return nil
-	}
-	// Update bundle.
-	b, err := json.Marshal(s)
-	if err != nil {
-		return err
-	}
-	return ioutil.WriteFile(filepath.Join(bundle, "config.json"), b, 0666)
+	return updated, nil
 }
 
 func changeMountType(m *specs.Mount, newType string) {