From ddb50758428941b904da088ab820b5cde29665e3 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Thu, 21 Sep 2017 12:52:39 -0500 Subject: [PATCH] dockershim: fine-tune network-ready handling on sandbox teardown and removal If sandbox teardown results in an error, GC will periodically attempt to again remove the sandbox. Until the sandbox is removed, pod sandbox status calls will attempt to enter the pod's namespace and retrieve the pod IP, but the first teardown attempt may have already removed the network namespace, resulting in a pointless log error message that the network namespace doesn't exist, or that nsenter can't find eth0. The network-ready mechanism originally attempted to suppress those messages by ensuring that pod sandbox status skipped network checks when networking was already torn down, but unfortunately the ready value was cleared too early. Also, don't tear down the pod network multiple times if the first time we tore it down, it succeeded. --- pkg/kubelet/dockershim/docker_sandbox.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/pkg/kubelet/dockershim/docker_sandbox.go b/pkg/kubelet/dockershim/docker_sandbox.go index fb321d591388f..ba87342a083c4 100644 --- a/pkg/kubelet/dockershim/docker_sandbox.go +++ b/pkg/kubelet/dockershim/docker_sandbox.go @@ -227,7 +227,9 @@ func (ds *dockerService) StopPodSandbox(podSandboxID string) error { // since it is stopped. With empty network namespcae, CNI bridge plugin will conduct best // effort clean up and will not return error. errList := []error{} - if !hostNetwork { + ready, ok := ds.getNetworkReady(podSandboxID) + if !hostNetwork && (ready || !ok) { + // Only tear down the pod network if we haven't done so already cID := kubecontainer.BuildContainerID(runtimeName, podSandboxID) err := ds.network.TearDownPod(namespace, name, cID) if err == nil { @@ -270,12 +272,15 @@ func (ds *dockerService) RemovePodSandbox(podSandboxID string) error { } // Remove the sandbox container. - if err := ds.client.RemoveContainer(podSandboxID, dockertypes.ContainerRemoveOptions{RemoveVolumes: true, Force: true}); err != nil && !libdocker.IsContainerNotFoundError(err) { + err = ds.client.RemoveContainer(podSandboxID, dockertypes.ContainerRemoveOptions{RemoveVolumes: true, Force: true}) + if err == nil || libdocker.IsContainerNotFoundError(err) { + // Only clear network ready when the sandbox has actually been + // removed from docker or doesn't exist + ds.clearNetworkReady(podSandboxID) + } else { errs = append(errs, err) } - ds.clearNetworkReady(podSandboxID) - // Remove the checkpoint of the sandbox. if err := ds.checkpointHandler.RemoveCheckpoint(podSandboxID); err != nil { errs = append(errs, err)