Update gvisor-tap service by using nmcli and binary from container image #673
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Trying this patch right now with microshift bundle and so far so good tried 3 time /hold |
This patch do following - Create a tap device using nmcli with a hard coded mac address, this mac address is mapped in the crc daemon lease which provide `192.168.127.2` IP address to the VM. - copy the `vm` binary from container image and put it to /usr/local/bin - modify gvisor-tap-vsock service to use the `vm` binary instead running the container using podman
praveenkumar
force-pushed
the
gvisor_service
branch
from
87b7be3 to
45c5117
Compare
|
With the current change now it takes around 40-50 sec extra. I have to dig more. ( still hold) |
| podman create --name=gvisor-tap-vsock quay.io/crcont/gvisor-tap-vsock:latest | ||
| podman cp gvisor-tap-vsock:/vm /usr/local/bin/ | ||
| podman rm gvisor-tap-vsock | ||
| tee /etc/systemd/system/gvisor-tap-vsock.service <<ETE |
There was a problem hiding this comment.
Does ETE have any special meaning/is this typical to use this?
| [Unit] | ||
| Description=gvisor-tap-vsock traffic forwarder | ||
| Wants=network-online.target | ||
| After=network-online.target |
There was a problem hiding this comment.
When the network-online target is reached, it means the system has some kind of external network connectivity. In our bundles, with usermode networking, gvisor-tap-vsock is required before we have external network connectivity.
This unit file tells systemd to first wait for network-online.target, and then to start gvisor-tap-vsock.service, I don't think this is correct, the order should be the opposite.
|
containers/gvisor-tap-vsock#202 is exploring something similar. |
|
I've done some work on this in https://github.com/cfergeau/snc/tree/gvisor_service |
|
@praveenkumar: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
This patch do following
192.168.127.2IP address to the VM.vmbinary from container image and put it to /usr/local/binvmbinary instead running the container using podman