Skip to content

Commit 98ebb3e

Browse files
mikebrowmikebrow
authored
Merge pull request containerd#9737 from everpeace/kep-3169-SupplementalGroupsPolicy
KEP-3619: Fine-grained SupplementalGroups control
2 parents c75f6d4 + 8bcffa9 commit 98ebb3e

18 files changed

+1762
-635
lines changed

‎go.mod

+7-7
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ require (
2929
github.com/containernetworking/cni v1.2.0
3030
github.com/containernetworking/plugins v1.4.1
3131
github.com/coreos/go-systemd/v22 v22.5.0
32-
github.com/davecgh/go-spew v1.1.1
32+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
3333
github.com/distribution/reference v0.6.0
3434
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
3535
github.com/docker/go-metrics v0.0.1
@@ -78,7 +78,7 @@ require (
7878
k8s.io/apimachinery v0.30.0
7979
k8s.io/client-go v0.30.0
8080
k8s.io/component-base v0.30.0
81-
k8s.io/cri-api v0.30.0
81+
k8s.io/cri-api v0.31.0-alpha.0.0.20240529224029-3a66d9d86654
8282
k8s.io/klog/v2 v2.120.1
8383
k8s.io/kubelet v0.30.0
8484
k8s.io/utils v0.0.0-20230726121419-3b25d923346b
@@ -116,7 +116,7 @@ require (
116116
github.com/modern-go/reflect2 v1.0.2 // indirect
117117
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
118118
github.com/pkg/errors v0.9.1 // indirect
119-
github.com/pmezard/go-difflib v1.0.0 // indirect
119+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
120120
github.com/prometheus/client_model v0.5.0 // indirect
121121
github.com/prometheus/common v0.48.0 // indirect
122122
github.com/prometheus/procfs v0.12.0 // indirect
@@ -129,12 +129,12 @@ require (
129129
go.opencensus.io v0.24.0 // indirect
130130
go.opentelemetry.io/otel/metric v1.26.0 // indirect
131131
go.opentelemetry.io/proto/otlp v1.2.0 // indirect
132-
golang.org/x/crypto v0.22.0 // indirect
132+
golang.org/x/crypto v0.23.0 // indirect
133133
golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 // indirect
134-
golang.org/x/net v0.24.0 // indirect
134+
golang.org/x/net v0.25.0 // indirect
135135
golang.org/x/oauth2 v0.17.0 // indirect
136-
golang.org/x/term v0.19.0 // indirect
137-
golang.org/x/text v0.14.0 // indirect
136+
golang.org/x/term v0.20.0 // indirect
137+
golang.org/x/text v0.15.0 // indirect
138138
golang.org/x/time v0.3.0 // indirect
139139
google.golang.org/appengine v1.6.8 // indirect
140140
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect

‎go.sum

+16-13
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,9 @@ github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
7878
github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
7979
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
8080
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
81-
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
8281
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
82+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
83+
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
8384
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
8485
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
8586
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
@@ -260,8 +261,9 @@ github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h
260261
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
261262
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
262263
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
263-
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
264264
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
265+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
266+
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
265267
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
266268
github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
267269
github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
@@ -281,8 +283,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT
281283
github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
282284
github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
283285
github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
284-
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
285-
github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
286+
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
287+
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
286288
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
287289
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
288290
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -366,8 +368,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
366368
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
367369
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
368370
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
369-
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
370-
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
371+
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
372+
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
371373
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
372374
golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 h1:qCEDpW1G+vcj3Y7Fy52pEM1AWm3abj8WimGYejI3SC4=
373375
golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
@@ -395,8 +397,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
395397
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
396398
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
397399
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
398-
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
399-
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
400+
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
401+
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
400402
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
401403
golang.org/x/oauth2 v0.17.0 h1:6m3ZPmLEFdVxKKWnKq4VqZ60gutO35zm+zrAHVmHyDQ=
402404
golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
@@ -438,16 +440,17 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
438440
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
439441
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
440442
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
441-
golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
442-
golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
443+
golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
444+
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
443445
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
444446
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
445447
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
446448
golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
447449
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
448450
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
449-
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
450451
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
452+
golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
453+
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
451454
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
452455
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
453456
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -525,8 +528,8 @@ k8s.io/client-go v0.30.0 h1:sB1AGGlhY/o7KCyCEQ0bPWzYDL0pwOZO4vAtTSh/gJQ=
525528
k8s.io/client-go v0.30.0/go.mod h1:g7li5O5256qe6TYdAMyX/otJqMhIiGgTapdLchhmOaY=
526529
k8s.io/component-base v0.30.0 h1:cj6bp38g0ainlfYtaOQuRELh5KSYjhKxM+io7AUIk4o=
527530
k8s.io/component-base v0.30.0/go.mod h1:V9x/0ePFNaKeKYA3bOvIbrNoluTSG+fSJKjLdjOoeXQ=
528-
k8s.io/cri-api v0.30.0 h1:hZqh3vH5JZdqeAyhD9nPXSbT6GDgrtPJkPiIzhWKVhk=
529-
k8s.io/cri-api v0.30.0/go.mod h1://4/umPJSW1ISNSNng4OwjpkvswJOQwU8rnkvO8P+xg=
531+
k8s.io/cri-api v0.31.0-alpha.0.0.20240529224029-3a66d9d86654 h1:REcqRW1lajhGkr+RMfO5mQ7JYp93Fe65js/hJ8R/wq0=
532+
k8s.io/cri-api v0.31.0-alpha.0.0.20240529224029-3a66d9d86654/go.mod h1:8SzLKTnltnWXG9FMIL4SHWcAnnPGssi5viN/SMMMf4k=
530533
k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
531534
k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
532535
k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=

‎internal/cri/server/container_create_linux.go

+17-2
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,23 @@ func (c *criService) containerSpecOpts(config *runtime.ContainerConfig, imageCon
6565
} else if imageConfig.User != "" {
6666
userstr, _, _ = strings.Cut(imageConfig.User, ":")
6767
}
68-
specOpts = append(specOpts, customopts.WithAdditionalGIDs(userstr),
69-
customopts.WithSupplementalGroups(securityContext.GetSupplementalGroups()))
68+
69+
switch securityContext.GetSupplementalGroupsPolicy() {
70+
case runtime.SupplementalGroupsPolicy_Merge:
71+
// merging group defined in /etc/passwd
72+
// and SupplementalGroups defined in security context
73+
specOpts = append(specOpts,
74+
customopts.WithAdditionalGIDs(userstr),
75+
customopts.WithSupplementalGroups(securityContext.GetSupplementalGroups()),
76+
)
77+
case runtime.SupplementalGroupsPolicy_Strict:
78+
// no merging group defined in /etc/passwd
79+
specOpts = append(specOpts,
80+
customopts.WithSupplementalGroups(securityContext.GetSupplementalGroups()),
81+
)
82+
default:
83+
return nil, fmt.Errorf("not implemented in this containerd release: SupplementalGroupsPolicy=%d", securityContext.GetSupplementalGroupsPolicy())
84+
}
7085

7186
asp := securityContext.GetApparmor()
7287
if asp == nil {

‎internal/cri/server/container_create_linux_test.go

+33-4
Original file line numberDiff line numberDiff line change
@@ -1468,7 +1468,7 @@ additional-group-for-root:x:22222:root
14681468
expected runtimespec.User
14691469
}{
14701470
{
1471-
desc: "Only SecurityContext was set, SecurityContext defines User",
1471+
desc: "[SupplementalGroupsPolicy=Merge(default)] Only SecurityContext was set, SecurityContext defines User",
14721472
securityContext: &runtime.LinuxContainerSecurityContext{
14731473
RunAsUser: &runtime.Int64Value{Value: 1000},
14741474
RunAsGroup: &runtime.Int64Value{Value: 2000},
@@ -1477,13 +1477,13 @@ additional-group-for-root:x:22222:root
14771477
expected: runtimespec.User{UID: 1000, GID: 2000, AdditionalGids: []uint32{2000, 3333, 11111}},
14781478
},
14791479
{
1480-
desc: "Only imageConfig.User was set, imageConfig.User defines User",
1480+
desc: "[SupplementalGroupsPolicy=Merge(default)] Only imageConfig.User was set, imageConfig.User defines User",
14811481
imageConfigUser: "1000",
14821482
securityContext: nil,
14831483
expected: runtimespec.User{UID: 1000, GID: 1000, AdditionalGids: []uint32{1000, 11111}},
14841484
},
14851485
{
1486-
desc: "Both SecurityContext and ImageConfig.User was set, SecurityContext defines User",
1486+
desc: "[SupplementalGroupsPolicy=Merge(default)] Both SecurityContext and ImageConfig.User were set, SecurityContext defines User",
14871487
imageConfigUser: "0",
14881488
securityContext: &runtime.LinuxContainerSecurityContext{
14891489
RunAsUser: &runtime.Int64Value{Value: 1000},
@@ -1493,9 +1493,38 @@ additional-group-for-root:x:22222:root
14931493
expected: runtimespec.User{UID: 1000, GID: 2000, AdditionalGids: []uint32{2000, 3333, 11111}},
14941494
},
14951495
{
1496-
desc: "No SecurityContext nor ImageConfig.User were set, runtime default defines User",
1496+
desc: "[SupplementalGroupsPolicy=Merge(default)] No SecurityContext nor ImageConfig.User were set, runtime default defines User",
14971497
expected: runtimespec.User{UID: 0, GID: 0, AdditionalGids: []uint32{0, 22222}},
14981498
},
1499+
{
1500+
desc: "[SupplementalGroupsPolicy=Strict] Only SecurityContext was set, SecurityContext defines User",
1501+
securityContext: &runtime.LinuxContainerSecurityContext{
1502+
RunAsUser: &runtime.Int64Value{Value: 1000},
1503+
RunAsGroup: &runtime.Int64Value{Value: 2000},
1504+
SupplementalGroups: []int64{3333},
1505+
SupplementalGroupsPolicy: runtime.SupplementalGroupsPolicy_Strict,
1506+
},
1507+
expected: runtimespec.User{UID: 1000, GID: 2000, AdditionalGids: []uint32{2000, 3333}},
1508+
},
1509+
{
1510+
desc: "[SupplementalGroupsPolicy=Strict] Only imageConfig.User was set, imageConfig.User defines User",
1511+
imageConfigUser: "1000",
1512+
securityContext: &runtime.LinuxContainerSecurityContext{
1513+
SupplementalGroupsPolicy: runtime.SupplementalGroupsPolicy_Strict,
1514+
},
1515+
expected: runtimespec.User{UID: 1000, GID: 1000, AdditionalGids: []uint32{1000}},
1516+
},
1517+
{
1518+
desc: "[SupplementalGroupsPolicy=Strict] Both SecurityContext and ImageConfig.User were set, SecurityContext defines User",
1519+
imageConfigUser: "0",
1520+
securityContext: &runtime.LinuxContainerSecurityContext{
1521+
RunAsUser: &runtime.Int64Value{Value: 1000},
1522+
RunAsGroup: &runtime.Int64Value{Value: 2000},
1523+
SupplementalGroups: []int64{3333},
1524+
SupplementalGroupsPolicy: runtime.SupplementalGroupsPolicy_Strict,
1525+
},
1526+
expected: runtimespec.User{UID: 1000, GID: 2000, AdditionalGids: []uint32{2000, 3333}},
1527+
},
14991528
} {
15001529
test := test
15011530
t.Run(test.desc, func(t *testing.T) {

‎internal/cri/server/container_status.go

+14-3
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
containerstore "github.com/containerd/containerd/v2/internal/cri/store/container"
2525
"github.com/containerd/containerd/v2/internal/cri/util"
2626
"github.com/containerd/errdefs"
27+
"github.com/containerd/log"
2728

2829
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
2930
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
@@ -60,7 +61,10 @@ func (c *criService) ContainerStatus(ctx context.Context, r *runtime.ContainerSt
6061
imageRef = repoDigests[0]
6162
}
6263
}
63-
status := toCRIContainerStatus(container, spec, imageRef)
64+
status, err := toCRIContainerStatus(ctx, container, spec, imageRef)
65+
if err != nil {
66+
return nil, fmt.Errorf("failed to get ContainerStatus: %w", err)
67+
}
6468
if status.GetCreatedAt() == 0 {
6569
// CRI doesn't allow CreatedAt == 0.
6670
info, err := container.Container.Info(ctx)
@@ -82,7 +86,7 @@ func (c *criService) ContainerStatus(ctx context.Context, r *runtime.ContainerSt
8286
}
8387

8488
// toCRIContainerStatus converts internal container object to CRI container status.
85-
func toCRIContainerStatus(container containerstore.Container, spec *runtime.ImageSpec, imageRef string) *runtime.ContainerStatus {
89+
func toCRIContainerStatus(ctx context.Context, container containerstore.Container, spec *runtime.ImageSpec, imageRef string) (*runtime.ContainerStatus, error) {
8690
meta := container.Metadata
8791
status := container.Status.Get()
8892
reason := status.Reason
@@ -104,6 +108,12 @@ func toCRIContainerStatus(container containerstore.Container, spec *runtime.Imag
104108
st, ft = status.StartedAt, status.FinishedAt
105109
}
106110

111+
runtimeUser, err := toCRIContainerUser(ctx, container)
112+
if err != nil {
113+
log.G(ctx).WithField("Id", meta.ID).WithError(err).Debug("failed to get ContainerUser. returning an empty ContainerUser")
114+
runtimeUser = &runtime.ContainerUser{}
115+
}
116+
107117
return &runtime.ContainerStatus{
108118
Id: meta.ID,
109119
Metadata: meta.Config.GetMetadata(),
@@ -121,7 +131,8 @@ func toCRIContainerStatus(container containerstore.Container, spec *runtime.Imag
121131
Mounts: meta.Config.GetMounts(),
122132
LogPath: meta.LogPath,
123133
Resources: status.Resources,
124-
}
134+
User: runtimeUser,
135+
}, nil
125136
}
126137

127138
// ContainerInfo is extra information for a container.

‎internal/cri/server/container_status_linux.go

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package server
18+
19+
import (
20+
"context"
21+
"errors"
22+
"fmt"
23+
24+
containerstore "github.com/containerd/containerd/v2/internal/cri/store/container"
25+
runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
26+
)
27+
28+
func toCRIContainerUser(ctx context.Context, container containerstore.Container) (*runtime.ContainerUser, error) {
29+
if container.Container == nil {
30+
return nil, errors.New("container must not be nil")
31+
}
32+
33+
runtimeSpec, err := container.Container.Spec(ctx)
34+
if err != nil {
35+
return nil, fmt.Errorf("failed to get container runtime spec: %w", err)
36+
}
37+
38+
if runtimeSpec.Process == nil {
39+
return &runtime.ContainerUser{}, nil
40+
}
41+
42+
user := runtimeSpec.Process.User
43+
var supplementalGroups []int64
44+
for _, gid := range user.AdditionalGids {
45+
supplementalGroups = append(supplementalGroups, int64(gid))
46+
}
47+
return &runtime.ContainerUser{
48+
Linux: &runtime.LinuxContainerUser{
49+
Uid: int64(user.UID),
50+
Gid: int64(user.GID),
51+
SupplementalGroups: supplementalGroups,
52+
},
53+
}, nil
54+
}

0 commit comments

Comments
 (0)