oci: take opLock for UpdateContainer #6122
Conversation
UpdateContainer requests can come in at any time in a container's lifecycle, even when it's shutting down. In some cases, it can cause a container to get stuck: runc pauses the cgroup on v1 and systemd to prevent systemd from mucking around while the cgroup is being updated. In some cases, CRI-O calls `UpdateContainerStatus` during that time, and gets `paused` state. CRI-O does not expect a container to be paused, so it doesn't know how to handle it. Fix this by taking opLock when updating Signed-off-by: Peter Hunt <[email protected]>
|
LGTM |
Codecov Report
@@ Coverage Diff @@
## main #6122 +/- ##
==========================================
- Coverage 42.88% 42.87% -0.01%
==========================================
Files 117 117
Lines 12735 12737 +2
==========================================
Hits 5461 5461
- Misses 6722 6724 +2
Partials 552 552 |
|
@saschagrunert PTAL |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: haircommander, saschagrunert The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
13 similar comments
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
|
/cherry-pick release-1.24 |
|
@haircommander: new pull request created: #6129 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
UpdateContainer requests can come in at any time in a container's
lifecycle, even when it's shutting down.
In some cases, it can cause a container to get stuck: runc pauses the
cgroup on v1 and systemd to prevent systemd from mucking around while
the cgroup is being updated. In some cases, CRI-O calls
UpdateContainerStatusduring that time, and getspausedstate. CRI-Odoes not expect a container to be paused, so it doesn't know how to
handle it.
Fix this by taking opLock when updating
Signed-off-by: Peter Hunt [email protected]
What type of PR is this?
/kind bug
What this PR does / why we need it:
related to https://bugzilla.redhat.com/show_bug.cgi?id=2094865
Which issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?