summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Fix CPU usage limitation in play kube for non integer valuesMikhail Khachayants2022-09-10
| | | | | | | | | | This logic has been broken by commit 9c6c981928c3e020ff6eef9454c7ee86aa8c83d1 (kube: fix conversion from milliCPU to period/quota). [NO NEW TESTS NEEDED] Fixes: #15726 Signed-off-by: Mikhail Khachayants <tyler92@inbox.ru>
* Merge pull request #15687 from vrothberg/RUN-1639OpenShift Merge Robot2022-09-09
|\ | | | | health check: add on-failure actions
| * health check: add on-failure actionsValentin Rothberg2022-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For systems that have extreme robustness requirements (edge devices, particularly those in difficult to access environments), it is important that applications continue running in all circumstances. When the application fails, Podman must restart it automatically to provide this robustness. Otherwise, these devices may require customer IT to physically gain access to restart, which can be prohibitively difficult. Add a new `--on-failure` flag that supports four actions: - **none**: Take no action. - **kill**: Kill the container. - **restart**: Restart the container. Do not combine the `restart` action with the `--restart` flag. When running inside of a systemd unit, consider using the `kill` or `stop` action instead to make use of systemd's restart policy. - **stop**: Stop the container. To remain backwards compatible, **none** is the default action. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | Merge pull request #15692 from giuseppe/pod-spec-usernsOpenShift Merge Robot2022-09-09
|\ \ | | | | | | kube: plug HostUsers in the pod spec
| * | kube: plug HostUsers in the pod specGiuseppe Scrivano2022-09-08
| |/ | | | | | | | | | | | | | | | | | | | | | | map HostUsers=false to userns=auto. One difference with the current implementation in the Kubelet is that the podman default size is 1024 while the Kubelet uses 65536. This is done on purpose, because 65536 is a problem for rootless as the entire IDs space would be allocated to a single pod. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* | Merge pull request #15712 from sstosh/fix-swaggerOpenShift Merge Robot2022-09-09
|\ \ | | | | | | Fix swagger documentation
| * | Fix swagger documentationToshiki Sonoda2022-09-09
| |/ | | | | | | | | | | | | | | | | * ContainerKillLibpod "signal" query default is SIGKILL. * ContainerStopLibpod "all" query doesn't exist. [NO NEW TESTS NEEDED] Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | Merge pull request #15658 from rhatdan/configOpenShift Merge Robot2022-09-09
|\ \ | | | | | | Add --config for Docker compatibility
| * | Add --config for Docker compatibilityDaniel J Walsh2022-09-08
| | | | | | | | | | | | | | | | | | Fixes: https://github.com/containers/podman/issues/14767 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* | | Ignore cpu realtime options on cgroups V2 systemsToshiki Sonoda2022-09-09
| |/ |/| | | | | | | | | | | | | | | | | | | | | `--cpu-rt-period` and `--cpu-rt-runtime` options are only supported on cgroups V1 rootful systems. Therefore, podman prints an warning message and ignores these options when we use cgroups V2 systems. Related to: #15666 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | Merge pull request #15675 from Luap99/pod-inspectOpenShift Merge Robot2022-09-08
|\ \ | |/ |/| fix podman pod inspect to support multiple pods
| * fix podman pod inspect to support multiple podsPaul Holzinger2022-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Just like the other inspect commands `podman pod inspect p1 p2` should return the json for both. To correctly implement this we follow the container inspect logic, this allows use to reuse the global inspect command. Note: To not break the existing single pod output format for podman pod inspect I added a pod-legacy inspect type. This is only used to make sure we will print the pod as single json and not an array like for the other commands. We cannot use the pod type since podman inspect --type pod did return an array and we should not break that as well. Fixes #15674 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* | Merge pull request #15667 from dfr/freebsd-specgenOpenShift Merge Robot2022-09-08
|\ \ | | | | | | specgen/generate: Factor out setting resource limits from CompleteSpec
| * | specgen/generate: Factor out setting resource limits from CompleteSpecDoug Rabson2022-09-08
| |/ | | | | | | | | | | | | | | | | | | This avoids setting values in the spec which are not supported on FreeBSD - including these values causes warning messages for the unsupported features. [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
* | Merge pull request #15665 from thediveo/data-raceOpenShift Merge Robot2022-09-08
|\ \ | | | | | | fixes data race in system.Events and nil error logging
| * | fixes data race in system.Events and nil error loggingHarald Albrecht2022-09-07
| |/ | | | | | | Signed-off-by: Harald Albrecht <harald.albrecht@gmx.net>
* | Merge pull request #15610 from n1hility/release-workflowOpenShift Merge Robot2022-09-08
|\ \ | |/ |/| Introduce a new signed Windows installer with automated build process
| * Add new windows installer and buildJason T. Greene2022-09-06
| | | | | | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* | Merge pull request #15655 from n1hility/increase-pipe-waitOpenShift Merge Robot2022-09-07
|\ \ | | | | | | Fix intermittent issue with Compat API proxy startup on Windows
| * | Change pipe wait to 20 secondsJason T. Greene2022-09-06
| |/ | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* | Merge pull request #15547 from vrothberg/RUN-1606OpenShift Merge Robot2022-09-06
|\ \ | |/ |/| Support auto updates for Kubernetes workloads
| * kube play: support auto updates and rollbacksValentin Rothberg2022-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add auto-update support to `podman kube play`. Auto-update policies can be configured for: * the entire pod via the `io.containers.autoupdate` annotation * a specific container via the `io.containers.autoupdate/$name` annotation To make use of rollbacks, the `io.containers.sdnotify` policy should be set to `container` such that the workload running _inside_ the container can send the READY message via the NOTIFY_SOCKET once ready. For further details on auto updates and rollbacks, please refer to the specific article [1]. Since auto updates and rollbacks bases on Podman's systemd integration, the k8s YAML must be executed in the `podman-kube@` systemd template. For further details on how to run k8s YAML in systemd via Podman, please refer to the specific article [2]. An examplary k8s YAML may look as follows: ```YAML apiVersion: v1 kind: Pod metadata: annotations: io.containers.autoupdate: "local" io.containers.autoupdate/b: "registry" labels: app: test name: test_pod spec: containers: - command: - top image: alpine name: a - command: - top image: alpine name: b ``` [1] https://www.redhat.com/sysadmin/podman-auto-updates-rollbacks [2] https://www.redhat.com/sysadmin/kubernetes-workloads-podman-systemd Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
| * pkg/autoupdate: allow updating multiple tasks per unitValentin Rothberg2022-09-05
| | | | | | | | | | | | | | | | | | | | | | Refactor the auto-update backend to allow for updating multiple tasks/containers per unit. This commit is merely doing the plumbing. The actual integration comes in a following commit. [NO NEW TESTS NEEDED] as behavior should not change and existing tests are expected to continue to pass. Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* | Merge pull request #15584 from sstosh/generate-systemd-envOpenShift Merge Robot2022-09-06
|\ \ | | | | | | Add generate systemd -e/--env option
| * | Add generate systemd -e/--env optionToshiki Sonoda2022-09-06
| | | | | | | | | | | | | | | | | | | | | | | | -e/--env option sets environment variables to the systemd unit files. Fixes: #15523 Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | | Merge pull request #15638 from n1hility/stale-config-fixOpenShift Merge Robot2022-09-06
|\ \ \ | | | | | | | | (Windows) Drop stale config value resulting in asymmetric config
| * | | Drop stale config value resulting in asymmetric configJason T. Greene2022-09-06
| | |/ | |/| | | | | | | | | | | | | Fixes log follow operations since corresponding k8s-file backend was previously dropped Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* / | pkg/util: Add no-op implementation of AddPrivilegedDevices on FreeBSDDoug Rabson2022-09-05
|/ / | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
* | Merge pull request #15618 from mheon/add_group_to_addtlgroupsOpenShift Merge Robot2022-09-05
|\ \ | | | | | | Add container GID to additional groups
| * | Add container GID to additional groupsMatthew Heon2022-09-02
| | | | | | | | | | | | | | | | | | | | | Mitigates a potential permissions issue. Mirrors Buildah PR #4200 and CRI-O PR #6159. Signed-off-by: Matthew Heon <mheon@redhat.com>
* | | Merge pull request #15582 from dfr/freebsd-bindOpenShift Merge Robot2022-09-04
|\ \ \ | | | | | | | | Add support for FreeBSD volume mounts in specgen
| * | | specgen: Use platform-specific mount type for volume mountsDoug Rabson2022-08-30
| | | | | | | | | | | | | | | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
* | | | Merge pull request #15614 from sstosh/fix-swaggerOpenShift Merge Robot2022-09-02
|\ \ \ \ | | | | | | | | | | Fix swagger documentation
| * | | | Fix swagger documentationToshiki Sonoda2022-09-02
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * ContainerKillLibpod "signal" query default is SIGKILL. * ContainerListLibpod "namespace" query is failed to show. * SecretListLibpod parameters is duplicated. * SecretList parameters is duplicated. [NO NEW TESTS NEEDED] Signed-off-by: Toshiki Sonoda <sonoda.toshiki@fujitsu.com>
* | | | Merge pull request #15599 from umohnani8/gen-kubeOpenShift Merge Robot2022-09-02
|\ \ \ \ | |_|_|/ |/| | | Fix bind-mount-option annotation in gen/play kube
| * | | Fix bind-mount-option annotation in gen/play kubeUrvashi Mohnani2022-09-01
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | The format used for setting the bind-mount-options annotations in the kube yaml was incorrect and caused k8s to throw an error when trying to play the generated kube yaml. Fix the annotation format to match the rules of k8s. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* | | Merge pull request #15404 from arixmkii/win_compat2OpenShift Merge Robot2022-09-02
|\ \ \ | |_|/ |/| | Improved Windows compatibility for machine command
| * | Improved Windows compatibility for machine commandArthur Sengileyev2022-08-29
| | | | | | | | | | | | Signed-off-by: Arthur Sengileyev <arthur.sengileyev@gmail.com>
* | | implement podman updateCharlie Doern2022-09-01
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | podman update allows users to change the cgroup configuration of an existing container using the already defined resource limits flags from podman create/run. The supported flags in crun are: this command is also now supported in the libpod api via the /libpod/containers/<CID>/update endpoint where the resource limits are passed inthe request body and follow the OCI resource spec format –memory –cpus –cpuset-cpus –cpuset-mems –memory-swap –memory-reservation –cpu-shares –cpu-quota –cpu-period –blkio-weight –cpu-rt-period –cpu-rt-runtime -device-read-bps -device-write-bps -device-read-iops -device-write-iops -memory-swappiness -blkio-weight-device resolves #15067 Signed-off-by: Charlie Doern <cdoern@redhat.com>
* | Merge pull request #15360 from m0duspwnens/api_compat_containersOpenShift Merge Robot2022-09-01
|\ \ | | | | | | api: return imageID instead of imageName, for "Image" when Podman api is queried
| * \ Merge branch 'containers:main' into api_compat_containersJason Ertel2022-08-30
| |\ \
| * \ \ Merge remote-tracking branch 'upstream/main' into api_compat_containersJosh Patterson2022-08-29
| |\ \ \ | | | |/ | | |/|
| * | | api: return imageID instead of imageName, for "Image" when Podman API is queriedJosh Patterson2022-08-17
| | | | | | | | | | | | | | | | Signed-off-by: Josh Patterson <josh.patterson@securityonionsolutions.com>
* | | | Merge pull request #15560 from dfr/freebsd-specgenOpenShift Merge Robot2022-09-01
|\ \ \ \ | | | | | | | | | | Add FreeBSD support for pkg/specgen/generate
| * | | | specgen/generate: Add support for FreeBSDDoug Rabson2022-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
| * | | | specgen/generate: Move specConfigNamespaces to namespace_linux.go and add stubsDoug Rabson2022-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Everthing except for hostname management is linux-specific. [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
| * | | | specgen/generate: Move SpecGenToOCI, WeightDevices to oci_linux.go and add ↵Doug Rabson2022-08-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | stubs. Almost all of SpecGenToOCI deals with linux-specific aspects of the runtime spec. Rather than try to factor this out piecemeal, I think it is cleaner to move the whole function along with its implementation helper functions. This also meams we don't need non-linux stubs for functions called from oci_linux.go [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
| * | | | specgen/generate: Move security.go to security_linux.go and add stubsDoug Rabson2022-08-29
| | |_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The security features (selinux, apparmor, capabilities) are linux specific. [NO NEW TESTS NEEDED] Signed-off-by: Doug Rabson <dfr@rabson.org>
* | | | Merge pull request #15473 from umohnani8/empty-dirOpenShift Merge Robot2022-08-31
|\ \ \ \ | | | | | | | | | | Add emptyDir volume support to kube play
| * | | | Add emptyDir volume support to kube playUrvashi Mohnani2022-08-30
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a kube yaml has a volume set as empty dir, podman will create an anonymous volume with the empty dir name and attach it to the containers running in the pod. When the pod is removed, the empy dir volume created is also removed. Add tests and docs for this as well. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-08 20:02:04 +0000