Merge pull request #3743 from weaveworks/more-pause

kubernetes: detect more 'pause' containers
weaveworks · Jan 23, 2020 · 53297eb · 53297eb
2 parents a375a54 + 880daa7
commit 53297eb
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 3 deletions.
diff --git a/probe/kubernetes/reporter.go b/probe/kubernetes/reporter.go
@@ -248,6 +248,10 @@ func (r *Reporter) podEvent(e Event, pod Pod) {
 }
 
 func isPauseContainer(n report.Node, rpt report.Report) bool {
+	k8sContainerType, _ := n.Latest.Lookup(report.DockerLabelPrefix + "io.kubernetes.docker.type")
+	if k8sContainerType == "podsandbox" { // this label is added by dockershim
+		return true
+	}
 	containerImageIDs, ok := n.Parents.Lookup(report.ContainerImage)
 	if !ok {
 		return false

diff --git a/probe/kubernetes/reporter_test.go b/probe/kubernetes/reporter_test.go
@@ -347,19 +347,48 @@ func BenchmarkReporter(b *testing.B) {
 
 func TestTagger(t *testing.T) {
 	rpt := report.MakeReport()
+	rpt.ContainerImage.AddNode(report.MakeNodeWith("image1", map[string]string{
+		docker.ImageName: "weaveworks/some_interesting_image",
+	}))
+	rpt.ContainerImage.AddNode(report.MakeNodeWith("pause_image", map[string]string{
+		docker.ImageName: "google_containers/pause",
+	}))
 	rpt.Container.AddNode(report.MakeNodeWith("container1", map[string]string{
 		docker.LabelPrefix + "io.kubernetes.pod.uid": "123456",
+	}).WithParent(report.ContainerImage, "image1"))
+	// This is the first way that Scope identified a pause container - via image name
+	rpt.Container.AddNode(report.MakeNodeWith("container2", map[string]string{
+		docker.LabelPrefix + "io.kubernetes.pod.uid": "123456",
+	}).WithParent(report.ContainerImage, "pause_image"))
+	// Second way that Scope identifies a pause container - via docker.type label
+	rpt.Container.AddNode(report.MakeNodeWith("container3", map[string]string{
+		docker.LabelPrefix + "io.kubernetes.pod.uid":     "123456",
+		docker.LabelPrefix + "io.kubernetes.docker.type": "podsandbox",
 	}))
 
 	rpt, err := (&kubernetes.Tagger{}).Tag(rpt)
 	if err != nil {
 		t.Errorf("Unexpected error: %v", err)
 	}
 
-	have, ok := rpt.Container.Nodes["container1"].Parents.Lookup(report.Pod)
+	podParents, ok := rpt.Container.Nodes["container1"].Parents.Lookup(report.Pod)
 	want := report.MakeStringSet(report.MakePodNodeID("123456"))
-	if !ok || !reflect.DeepEqual(have, want) {
-		t.Errorf("Expected container to have pod parent %v %v", have, want)
+	if !ok || !reflect.DeepEqual(podParents, want) {
+		t.Errorf("Expected container1 to have pod parent %v %v", podParents, want)
+	}
+	_, ok = rpt.Container.Nodes["container1"].Latest.Lookup(report.DoesNotMakeConnections)
+	if ok {
+		t.Errorf("Expected container1 not to have DoesNotMakeConnections flag")
+	}
+
+	_, ok = rpt.Container.Nodes["container2"].Latest.Lookup(report.DoesNotMakeConnections)
+	if !ok {
+		t.Errorf("Expected pause container to have DoesNotMakeConnections flag")
+	}
+
+	_, ok = rpt.Container.Nodes["container3"].Latest.Lookup(report.DoesNotMakeConnections)
+	if !ok {
+		t.Errorf("Expected pause container to have DoesNotMakeConnections flag")
 	}
 }
 

diff --git a/render/filters.go b/render/filters.go
@@ -245,6 +245,10 @@ func IsApplication(n report.Node) bool {
 	if _, ok := systemImagePrefixes[imagePrefix]; ok || report.IsPauseImageName(imagePrefix) {
 		return false
 	}
+	k8sContainerType, _ := n.Latest.Lookup(report.DockerLabelPrefix + "io.kubernetes.docker.type")
+	if k8sContainerType == "podsandbox" { // another way to detect "pause container"
+		return false
+	}
 	roleLabel, _ := n.Latest.Lookup(report.DockerLabelPrefix + "works.weave.role")
 	if roleLabel == "system" {
 		return false