pids_test.go 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
  1. /*
  2. Copyright 2019 The Kubernetes Authors.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. */
  13. package e2e_node
  14. import (
  15. "fmt"
  16. "time"
  17. apiv1 "k8s.io/api/core/v1"
  18. "k8s.io/apimachinery/pkg/api/resource"
  19. metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
  20. "k8s.io/apimachinery/pkg/util/uuid"
  21. kubeletconfig "k8s.io/kubernetes/pkg/kubelet/apis/config"
  22. "k8s.io/kubernetes/pkg/kubelet/cm"
  23. "k8s.io/kubernetes/test/e2e/framework"
  24. e2elog "k8s.io/kubernetes/test/e2e/framework/log"
  25. imageutils "k8s.io/kubernetes/test/utils/image"
  26. . "github.com/onsi/ginkgo"
  27. . "github.com/onsi/gomega"
  28. )
  29. // makePodToVerifyPids returns a pod that verifies specified cgroup with pids
  30. func makePodToVerifyPids(baseName string, pidsLimit resource.Quantity) *apiv1.Pod {
  31. // convert the cgroup name to its literal form
  32. cgroupFsName := ""
  33. cgroupName := cm.NewCgroupName(cm.RootCgroupName, defaultNodeAllocatableCgroup, baseName)
  34. if framework.TestContext.KubeletConfig.CgroupDriver == "systemd" {
  35. cgroupFsName = cgroupName.ToSystemd()
  36. } else {
  37. cgroupFsName = cgroupName.ToCgroupfs()
  38. }
  39. // this command takes the expected value and compares it against the actual value for the pod cgroup pids.max
  40. command := fmt.Sprintf("expected=%v; actual=$(cat /tmp/pids/%v/pids.max); if [ \"$expected\" -ne \"$actual\" ]; then exit 1; fi; ", pidsLimit.Value(), cgroupFsName)
  41. e2elog.Logf("Pod to run command: %v", command)
  42. pod := &apiv1.Pod{
  43. ObjectMeta: metav1.ObjectMeta{
  44. Name: "pod" + string(uuid.NewUUID()),
  45. },
  46. Spec: apiv1.PodSpec{
  47. RestartPolicy: apiv1.RestartPolicyNever,
  48. Containers: []apiv1.Container{
  49. {
  50. Image: busyboxImage,
  51. Name: "container" + string(uuid.NewUUID()),
  52. Command: []string{"sh", "-c", command},
  53. VolumeMounts: []apiv1.VolumeMount{
  54. {
  55. Name: "sysfscgroup",
  56. MountPath: "/tmp",
  57. },
  58. },
  59. },
  60. },
  61. Volumes: []apiv1.Volume{
  62. {
  63. Name: "sysfscgroup",
  64. VolumeSource: apiv1.VolumeSource{
  65. HostPath: &apiv1.HostPathVolumeSource{Path: "/sys/fs/cgroup"},
  66. },
  67. },
  68. },
  69. },
  70. }
  71. return pod
  72. }
  73. // enablePodPidsLimitInKubelet enables pod pid limit feature for kubelet with a sensible default test limit
  74. func enablePodPidsLimitInKubelet(f *framework.Framework) *kubeletconfig.KubeletConfiguration {
  75. oldCfg, err := getCurrentKubeletConfig()
  76. framework.ExpectNoError(err)
  77. newCfg := oldCfg.DeepCopy()
  78. if newCfg.FeatureGates == nil {
  79. newCfg.FeatureGates = make(map[string]bool)
  80. newCfg.FeatureGates["SupportPodPidsLimit"] = true
  81. }
  82. newCfg.PodPidsLimit = int64(1024)
  83. // Update the Kubelet configuration.
  84. framework.ExpectNoError(setKubeletConfiguration(f, newCfg))
  85. // Wait for the Kubelet to be ready.
  86. Eventually(func() bool {
  87. nodeList := framework.GetReadySchedulableNodesOrDie(f.ClientSet)
  88. return len(nodeList.Items) == 1
  89. }, time.Minute, time.Second).Should(BeTrue())
  90. return oldCfg
  91. }
  92. func runPodPidsLimitTests(f *framework.Framework) {
  93. It("should set pids.max for Pod", func() {
  94. By("by creating a G pod")
  95. pod := f.PodClient().Create(&apiv1.Pod{
  96. ObjectMeta: metav1.ObjectMeta{
  97. Name: "pod" + string(uuid.NewUUID()),
  98. Namespace: f.Namespace.Name,
  99. },
  100. Spec: apiv1.PodSpec{
  101. Containers: []apiv1.Container{
  102. {
  103. Image: imageutils.GetPauseImageName(),
  104. Name: "container" + string(uuid.NewUUID()),
  105. Resources: apiv1.ResourceRequirements{
  106. Limits: apiv1.ResourceList{
  107. apiv1.ResourceName("cpu"): resource.MustParse("10m"),
  108. apiv1.ResourceName("memory"): resource.MustParse("100Mi"),
  109. },
  110. },
  111. },
  112. },
  113. },
  114. })
  115. podUID := string(pod.UID)
  116. By("checking if the expected pids settings were applied")
  117. verifyPod := makePodToVerifyPids("pod"+podUID, resource.MustParse("1024"))
  118. f.PodClient().Create(verifyPod)
  119. err := framework.WaitForPodSuccessInNamespace(f.ClientSet, verifyPod.Name, f.Namespace.Name)
  120. Expect(err).NotTo(HaveOccurred())
  121. })
  122. }
  123. // Serial because the test updates kubelet configuration.
  124. var _ = SIGDescribe("PodPidsLimit [Serial] [Feature:SupportPodPidsLimit][NodeFeature:SupportPodPidsLimit]", func() {
  125. f := framework.NewDefaultFramework("pids-limit-test")
  126. Context("With config updated with pids feature enabled", func() {
  127. tempSetCurrentKubeletConfig(f, func(initialConfig *kubeletconfig.KubeletConfiguration) {
  128. if initialConfig.FeatureGates == nil {
  129. initialConfig.FeatureGates = make(map[string]bool)
  130. }
  131. initialConfig.FeatureGates["SupportPodPidsLimit"] = true
  132. initialConfig.PodPidsLimit = int64(1024)
  133. })
  134. runPodPidsLimitTests(f)
  135. })
  136. })