Fix propagation of annotations from sandbox to container #5078

frasertweedale · 2021-07-15T14:23:04Z

Commit 8cf3222 introduces some
extra processing of seccomp-related sandbox annotations. But it
introduced a regression where most sandbox annotations are no longer
propagated to the container annotations. Add an else clause to
ensure we propagate all the sandbox annotations to the container's
OCI configuration.

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes: #5077

Does this PR introduce a user-facing change?

None

openshift-ci · 2021-07-15T14:23:13Z

Hi @frasertweedale. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

haircommander · 2021-07-15T14:29:03Z

/ok-to-test

thanks @frasertweedale , since you also want it in 4.8
/cherry-pick release-1.21

openshift-cherrypick-robot · 2021-07-15T14:29:04Z

@haircommander: once the present PR merges, I will cherry-pick it on top of release-1.21 in a new PR and assign it to you.

Details

In response to this:

/ok-to-test

thanks @frasertweedale , since you also want it in 4.8
/cherry-pick release-1.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

frasertweedale · 2021-07-15T19:57:57Z

/retest

pkg/container/container.go

mrunalp · 2021-07-16T15:57:23Z

@saschagrunert @haircommander We need tests here to make sure we don't regress again in the future.

frasertweedale · 2021-07-19T07:22:15Z

@saschagrunert @haircommander We need tests here to make sure we don't regress again in the future.

I am unfamiliar with the test suite. If someone would identify a test that would make a good "template" for testing this behaviour, I'll be happy to have a go. Otherwise it might be better use of everyone's time overall for someone more familiar with cri-o test suite to contribute a test.

saschagrunert · 2021-07-19T07:32:50Z

@saschagrunert @haircommander We need tests here to make sure we don't regress again in the future.

Otherwise it might be better use of everyone's time overall for someone more familiar with cri-o test suite to contribute a test.

Sure thing, we can follow-up on that in a separate PR 👍

TomSweeneyRedHat

LGTM
assuming happy tests

frasertweedale · 2021-07-20T05:33:23Z

/retest

haircommander · 2021-07-20T13:48:36Z

/approve
@saschagrunert @mrunalp I'll give y'all the final lgtm

codecov · 2021-07-20T13:52:05Z

Codecov Report

Merging #5078 (17d73a2) into master (0fc6d47) will increase coverage by 0.00%.
The diff coverage is 0.00%.

❗ Current head 17d73a2 differs from pull request most recent head 34ddc81. Consider uploading reports for the commit 34ddc81 to get more accurate results

@@           Coverage Diff           @@
##           master    #5078   +/-   ##
=======================================
  Coverage   43.95%   43.96%           
=======================================
  Files         110      110           
  Lines       11440    11436    -4     
=======================================
- Hits         5029     5028    -1     
+ Misses       5934     5931    -3     
  Partials      477      477

haircommander · 2021-07-20T15:01:11Z

ah @frasertweedale I thinki you need to run gofmt -s -w pkg/container/container.go

frasertweedale · 2021-07-21T00:03:21Z

I fixed the lint nit and also added the regression test.

frasertweedale · 2021-07-21T06:26:00Z

/retest

frasertweedale · 2021-07-21T20:54:34Z

CI seems to be stalled somehow...

haircommander · 2021-07-22T13:46:01Z

yeah we're unfortunately dealing with a cert rotation issue right now, thanks for the patience

frasertweedale · 2021-07-23T04:38:36Z

/retest

Commit 8cf3222 introduces some extra processing of seccomp-related sandbox annotations. But it introduced a regression where most sandbox annotations are no longer propagated to the container annotations. Simplify the logic and add an `else` clause to ensure we propagate all the sandbox annotations to the container's OCI configuration. Fixes: cri-o#5077 Signed-off-by: Fraser Tweedale <[email protected]>

Signed-off-by: Fraser Tweedale <[email protected]>

frasertweedale · 2021-07-24T00:46:12Z

/retest

openshift-ci · 2021-07-24T01:29:54Z

@frasertweedale: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/e2e_crun_cgroupv2	`34ddc81`	link	`/test e2e_cgroupv2`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

saschagrunert

/lgtm

openshift-ci · 2021-07-26T06:46:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: frasertweedale, haircommander, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-cherrypick-robot · 2021-07-26T06:48:11Z

@haircommander: new pull request created: #5124

Details

In response to this:

/ok-to-test

thanks @frasertweedale , since you also want it in 4.8
/cherry-pick release-1.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

frasertweedale requested review from mrunalp and runcom as code owners July 15, 2021 14:23

openshift-ci bot added kind/bug Categorizes issue or PR as related to a bug. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Jul 15, 2021

openshift-ci bot requested a review from nalind July 15, 2021 14:23

openshift-ci bot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 15, 2021

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from c4db2fe to 5a64d0d Compare July 15, 2021 14:23

saschagrunert reviewed Jul 16, 2021

View reviewed changes

pkg/container/container.go Show resolved Hide resolved

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from 5a64d0d to 0bbbe4a Compare July 19, 2021 07:18

TomSweeneyRedHat reviewed Jul 19, 2021

View reviewed changes

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from 0bbbe4a to 92202e0 Compare July 20, 2021 00:57

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 20, 2021

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from 92202e0 to 82dd8c3 Compare July 20, 2021 22:25

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch 2 times, most recently from f5e7eaf to 3cd9a17 Compare July 23, 2021 04:56

frasertweedale changed the title ~~Fix propgation of annotations from sandbox to container~~ Fix propagation of annotations from sandbox to container Jul 23, 2021

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from 3cd9a17 to 17d73a2 Compare July 23, 2021 08:48

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from 17d73a2 to a458874 Compare July 23, 2021 20:55

Add regression test for sandbox annotation passthrough

34ddc81

Signed-off-by: Fraser Tweedale <[email protected]>

frasertweedale force-pushed the fix/5077-propagate-sandbox-annotations branch from a458874 to 34ddc81 Compare July 23, 2021 21:00

saschagrunert approved these changes Jul 26, 2021

View reviewed changes

openshift-ci bot assigned saschagrunert Jul 26, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 26, 2021

openshift-merge-robot merged commit 49a8247 into cri-o:master Jul 26, 2021

openshift-cherrypick-robot mentioned this pull request Jul 26, 2021

[release-1.21] Fix propagation of annotations from sandbox to container #5124

Merged

frasertweedale deleted the fix/5077-propagate-sandbox-annotations branch July 26, 2021 07:38

Fix propagation of annotations from sandbox to container #5078

Fix propagation of annotations from sandbox to container #5078

Uh oh!

Conversation

frasertweedale commented Jul 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Jul 15, 2021

Uh oh!

haircommander commented Jul 15, 2021

Uh oh!

openshift-cherrypick-robot commented Jul 15, 2021

Uh oh!

frasertweedale commented Jul 15, 2021

Uh oh!

Uh oh!

mrunalp commented Jul 16, 2021

Uh oh!

frasertweedale commented Jul 19, 2021

Uh oh!

saschagrunert commented Jul 19, 2021

Uh oh!

TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

Uh oh!

frasertweedale commented Jul 20, 2021

Uh oh!

haircommander commented Jul 20, 2021

Uh oh!

codecov bot commented Jul 20, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

haircommander commented Jul 20, 2021

Uh oh!

frasertweedale commented Jul 21, 2021

Uh oh!

frasertweedale commented Jul 21, 2021

Uh oh!

frasertweedale commented Jul 21, 2021

Uh oh!

haircommander commented Jul 22, 2021

Uh oh!

frasertweedale commented Jul 23, 2021

Uh oh!

frasertweedale commented Jul 24, 2021

Uh oh!

openshift-ci bot commented Jul 24, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jul 26, 2021

Uh oh!

openshift-cherrypick-robot commented Jul 26, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

frasertweedale commented Jul 15, 2021 •

edited

Loading

codecov bot commented Jul 20, 2021 •

edited

Loading

openshift-ci bot commented Jul 24, 2021 •

edited

Loading