Backports/v0.8: cgroups fixes and tests backport #629
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fix a bug that was only referencing the last entry of the loadedSensors on disable path. This patch ensures that we disable all sensors. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 930f9cb)
Add test to emulate k8s hierarchy in cgroupv2 under unified mode Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit eaa92b6)
Add test to emulate k8s hierarhcy in cgroupv2 under hybrid mode Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit b0a9f0a)
This test cgroupv1 subsys indexes from a custom file. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 41b54db)
Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 25c7466)
Export the CgroupController struct so we can use it by the cgroup sensors tests in next patch. We need this to assert cgroup events when we operate on cgroupv1 multiple hierarchies. This is explicitly a separate patch as it changes core package. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit c942c75)
Add test to emulate k8s hierarhcy in cgroupv1 under hybrid mode. The test will create multiple cgroup hierarchies, mount the related controllers, create cgroups and ensure that we only receive, store, and remove the cgroups of the desired hierarchy. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit e18f6f0)
Allow to select which controller to use when testing cgroupv1 hierarchies, this will ensure all those controllers can properly used as a fallback mechanism to guarantee proper operations. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 633db8f)
This will ensure that if we pass invalid or not supported controllers, current implementation will fallback to the proper working one. The selected controller and hierarchy will be used for tracking, receive events and hold cgroup data, where the not supported controllers will not receive any event. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 79f3741)
Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 7b57800)
The cgroup ID kube->cgrpid never worked, usually it will be zero
we didn't notice as it is not used. Fix this since we are improving
our cgroups management.
This patch contains:
- Add our bpf helper tg_get_current_cgroup_id() to get cgroup IDs,
upstream helper handles only unified cgroupv2.
For our cases we may have users that are still running in hybrid
mode (cgroupv1 and cgroupv2); so let's check the cgroupfs magic
that was passed from userspace during startup, and adapt to it.
Otherwise we fallback to operate on a cgroup of the desired css
that was also detected during startup, this will handle both
cgroupv1 and cgroupv2 at same time.
Note: if in unified pure cgroupv2 mode, then resources are managed
by systemd within cgroupv2 hierarchy, if in hybrid mode then
resources will be managed in cgroupv1 hierarchies while cgroupv2
will only be used for process tracking... this does not guarantee
the following setups:
- K8s could be using only cgroupv1 especially with its cgroup
driver:
kubernetes/kubernetes#108028
https://kubernetes.io/docs/concepts/architecture/cgroups/
- Nested k8s setups usually endup with a cgroupv1 filesystem even
if host is running in unified or hybrid modes, seems also related
to different k8s tools and versions.
This new helper covers all these cases.
- Fix how we declare cgroup bpf helpers as they are enums, add
bpf_core_enum_value_exists() from libbpf and check function ids
inside 'enum bpf_func_id' to see if the helper is available.
- Add EVENT_ERROR_CGROUP_ID flag to note that we failed to read the
cgroup ID of the process. This allows to easily trace errors from
user space.
Signed-off-by: Djalal Harouni <[email protected]>
(cherry picked from commit dc708e1)
The hierarchy ID is useful when running under multiple hierarchies to be able to debug or ensure that events belong to the corresponding hierarchy. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 958bd15)
Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 999aa7c)
…ver() Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit cb6c420)
The EventDocker* errors are in reality related to cgroups, so rename the flags to reflect that and improve their user space description too. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit acdfc94)
Set appropriate EVENT_ERROR_CGROUP_* flags when reading cgroup info from BPF side fails. It allows to easily identify from user space the offending bpf code. Signed-off-by: Djalal Harouni <[email protected]> (cherry picked from commit 82b216c)
tixxdz
force-pushed
the
backports/v0.8/tixxdz/cgroups-set-1
branch
from
6d6487e to
440ccf5
Compare
kkourt
approved these changes
Jan 18, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This backport is a follow up of cgroups fixes:
Goes on top of #627