Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@adrianreber
Copy link
Member

@adrianreber adrianreber commented Aug 29, 2022

/kind feature

What this PR does / why we need it:

This adds the Podman support to export checkpoints to OCI images which can be pushed to registry to CRI-O.

With this change it is possible to do something like this:

# crictl checkpoint --export=localhost/checkpoint-image:tag1 CTR-ID
# podman push localhost/checkpoint-image:tag1 quay.io/adrianreber/checkpoint-image:tag1

The image quay.io/adrianreber/checkpoint-image:tag1 can then be used on the same or another system to restore the container using crictl create and crictl start.

The image quay.io/adrianreber/checkpoint-image:tag1 can also be used in Kubernetes to start a container from a checkpoint image without Kubernetes knowing that it is restore.

This PR is not targeting the 1.25.0 CRI-O release.

A side effect from this PR is that crictl inspecti will contain spec.annotations.

Which issue(s) this PR fixes:

None

Does this PR introduce a user-facing change?

This introduces the ability to store checkpoint archives as OCI images and push the checkpoint images to a remote registry. Important to remember is that the checkpoint image contains all memory pages of the checkpoint and therefore might contain sensitive information (password, encryption keys, ...).

@openshift-ci openshift-ci bot added dco-signoff: yes Indicates the PR's author has DCO signed all their commits. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Aug 29, 2022
@openshift-ci openshift-ci bot requested review from QiWang19 and klihub August 29, 2022 11:04
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Aug 29, 2022

Hi @adrianreber. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Aug 29, 2022
@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch from 9b8abcf to bc29615 Compare August 29, 2022 11:13
@saschagrunert
Copy link
Member

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 29, 2022
@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch 4 times, most recently from bdc3899 to 67f373c Compare August 30, 2022 07:34
@codecov
Copy link

codecov bot commented Aug 30, 2022

Codecov Report

Merging #6181 (39c0ff6) into main (bde6d38) will increase coverage by 0.18%.
The diff coverage is 53.93%.

❗ Current head 39c0ff6 differs from pull request most recent head 0244fee. Consider uploading reports for the commit 0244fee to get more accurate results

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6181      +/-   ##
==========================================
+ Coverage   43.68%   43.87%   +0.18%     
==========================================
  Files         122      122              
  Lines       13666    13730      +64     
==========================================
+ Hits         5970     6024      +54     
- Misses       7049     7051       +2     
- Partials      647      655       +8     

@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch 2 times, most recently from d0f1923 to e2de1b1 Compare August 30, 2022 13:38
@adrianreber
Copy link
Member Author

Ready for review. The three CI failures seem to happen everywhere right now and unrelated to this PR.

@adrianreber
Copy link
Member Author

Besides the three failing CI runs which seems to be expected right now, this is ready for review. PTAL.

@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch from 39c0ff6 to c7355a0 Compare September 19, 2022 16:43
@adrianreber
Copy link
Member Author

I personally would prefer to wait until we standardize in the KEP. WDYT @saschagrunert @mrunalp

Hmm. Okay. There is no immediate plan from my side to add this to a KEP as the image specification would be independent of Kubernetes from my point of view. If a standardization happens it would happen at https://github.com/opencontainers/image-spec , but that is a step we did not plan in the next couple of months.

Currently is is an image format used by Podman and specific to Podman and the goal was to bring this to CRI-O.

Not having it in CRI-O is not something we really planed for. Not really sure what to do now. Happy for any additional input.

@adrianreber
Copy link
Member Author

@haircommander What about just loading checkpoint images as created by Podman and not creating them by CRI-O? Just the changes in the restore code path?

@saschagrunert
Copy link
Member

saschagrunert commented Oct 5, 2022

I see both of your points @haircommander @adrianreber. The question is if we value the separation of concerns over usability. Since we just wrap a bunch of buildah APIs in an isolated fashion I'm leaning towards having the feature completely in CRI-O.

If there is no upstream KEP planned for the next couple of months to standardize it via the CRI, then this would be probably a good follow-up in the long term.

@haircommander
Copy link
Member

@haircommander What about just loading checkpoint images as created by Podman and not creating them by CRI-O? Just the changes in the restore code path?

I think this is a good compromise and works for me. How does that sound @saschagrunert ?

@saschagrunert
Copy link
Member

@haircommander What about just loading checkpoint images as created by Podman and not creating them by CRI-O? Just the changes in the restore code path?

I think this is a good compromise and works for me. How does that sound @saschagrunert ?

Sounds good to me!

@adrianreber
Copy link
Member Author

Okay, let me rework this PR and ping you again. Thanks.

@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch from c2e4d7b to e7f6487 Compare October 5, 2022 16:45
@adrianreber
Copy link
Member Author

Okay, let's see if CI like the changes.

@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch from e7f6487 to b0b07ee Compare October 5, 2022 19:12
Co-authored-by: Sascha Grunert <[email protected]>
Signed-off-by: Adrian Reber <[email protected]>
@adrianreber adrianreber force-pushed the checkpoint-restore-support-oci branch from b0b07ee to 0244fee Compare October 5, 2022 20:18
@adrianreber
Copy link
Member Author

/retest-required

@adrianreber
Copy link
Member Author

/test ci-rhel-e2e

@adrianreber
Copy link
Member Author

Most tests are happy. So it seems to work. I hope this is what we agreed on. I removed the OCI checkpoint image creation from CRI-O but I am able to test the restore path by creating an OCI checkpoint image with CLI buildah in checkpoint.bats.

@adrianreber
Copy link
Member Author

Is this good to go?

@haircommander
Copy link
Member

/approve

LGTM, thanks @adrianreber
@saschagrunert @mrunalp PTAL

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 7, 2022
Copy link
Member

@saschagrunert saschagrunert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/retest

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 10, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 10, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adrianreber, haircommander, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [haircommander,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@adrianreber
Copy link
Member Author

/retest-required

2 similar comments
@adrianreber
Copy link
Member Author

/retest-required

@adrianreber
Copy link
Member Author

/retest-required

@saschagrunert
Copy link
Member

/override ci/kata-jenkins

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 11, 2022

@saschagrunert: Overrode contexts on behalf of saschagrunert: ci/kata-jenkins

Details

In response to this:

/override ci/kata-jenkins

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants