From b7998ec82d579bd0550e23f880decdcee61264f5 Mon Sep 17 00:00:00 2001
From: Chris Akritidis <43294513+cakrit@users.noreply.github.com>
Date: Wed, 13 Mar 2019 12:47:20 +0100
Subject: When running from within a k8s pod, use the k8s API to get the cgroup
 name  (#5576)

* When running from within a k8s pod, use the k8s API to get the pod name

* Check the last part of an underscore-delimited or slash-delimited container id

* Add a docker image builder that adds a single image to a user-specified registry, for use in k8s

* When running in k8s, disable cgroups that the pod API does not return

* Use longer name for k8s containers

* Add reference to build-test.sh to packaging/docker/README.md

* Anonymous statistics should not break when /proc/1/sched is not available
---
 collectors/cgroups.plugin/cgroup-name.sh.in | 43 ++++++++++++++++++++---------
 collectors/cgroups.plugin/sys_fs_cgroup.c   | 10 +++++--
 2 files changed, 37 insertions(+), 16 deletions(-)

(limited to 'collectors/cgroups.plugin')

diff --git a/collectors/cgroups.plugin/cgroup-name.sh.in b/collectors/cgroups.plugin/cgroup-name.sh.in
index c470870b53..97e030852e 100755
--- a/collectors/cgroups.plugin/cgroup-name.sh.in
+++ b/collectors/cgroups.plugin/cgroup-name.sh.in
@@ -64,6 +64,28 @@ function docker_get_name_api() {
 	return 0
 }
 
+function k8s_get_name() {
+	# Take the last part of the delimited path identifier (expecting either _ or / as a delimiter).
+	local id="${1##*_}"
+	if [ "${id}" == "${1}" ]; then
+		id="${1##*/}"
+	fi
+	KUBE_TOKEN="$(</var/run/secrets/kubernetes.io/serviceaccount/token)"
+	NAME="$(
+curl -sSk -H "Authorization: Bearer $KUBE_TOKEN"  "https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_PORT_443_TCP_PORT/api/v1/pods" |
+jq -r '.items[] | "k8s_\(.metadata.namespace)_\(.metadata.name)_\(.metadata.uid)_\(.status.containerStatuses[0].name) \(.status.containerStatuses[0].containerID)"' |
+grep "$id" |
+cut -d' ' -f1
+)"
+	if [ -z "${NAME}" ]; then
+		warning "cannot find the name of k8s pod with containerID '${id}'. Setting name to ${id} and disabling it"
+		NAME="${id}"
+		NAME_NOT_FOUND=3
+	else
+		info "k8s containerID '${id}' has chart name (namespace_podname_poduid_containername) '${NAME}'"
+	fi
+}
+
 function docker_get_name() {
 	local id="${1}"
 	if hash docker 2>/dev/null; then
@@ -73,7 +95,7 @@ function docker_get_name() {
 	fi
 	if [ -z "${NAME}" ]; then
 		warning "cannot find the name of docker container '${id}'"
-		NAME_NOT_FOUND=1
+		NAME_NOT_FOUND=2
 		NAME="${id:0:12}"
 	else
 		info "docker container '${id}' is named '${NAME}'"
@@ -89,6 +111,7 @@ function docker_validate_id() {
 	fi
 }
 
+
 # -----------------------------------------------------------------------------
 
 [ -z "${NETDATA_USER_CONFIG_DIR}" ] && NETDATA_USER_CONFIG_DIR="@configdir_POST@"
@@ -118,25 +141,22 @@ for CONFIG in "${NETDATA_USER_CONFIG_DIR}/cgroups-names.conf" "${NETDATA_STOCK_C
 	fi
 done
 
+if [ -z "${NAME}" ] && [ -n "${KUBERNETES_SERVICE_HOST}" ] && [ -n "${KUBERNETES_PORT_443_TCP_PORT}" ] && [[ ${CGROUP} =~ ^.*kubepods.* ]]; then
+	k8s_get_name "${CGROUP}"
+fi
+
 if [ -z "${NAME}" ]; then
 	if [[ ${CGROUP} =~ ^.*docker[-_/\.][a-fA-F0-9]+[-_\.]?.*$ ]]; then
 		# docker containers
 		#shellcheck disable=SC1117
 		DOCKERID="$(echo "${CGROUP}" | sed "s|^.*docker[-_/]\([a-fA-F0-9]\+\)[-_\.]\?.*$|\1|")"
 		docker_validate_id "${DOCKERID}"
-
 	elif [[ ${CGROUP} =~ ^.*ecs[-_/\.][a-fA-F0-9]+[-_\.]?.*$ ]]; then
 		# ECS
 		#shellcheck disable=SC1117
 		DOCKERID="$(echo "${CGROUP}" | sed "s|^.*ecs[-_/].*[-_/]\([a-fA-F0-9]\+\)[-_\.]\?.*$|\1|")"
 		docker_validate_id "${DOCKERID}"
 
-	elif [[ ${CGROUP} =~ ^.*kubepods[_/].*[_/]pod[a-fA-F0-9-]+[_/][a-fA-F0-9]+$ ]]; then
-		# kubernetes
-		#shellcheck disable=SC1117
-		DOCKERID="$(echo "${CGROUP}" | sed "s|^.*kubepods[_/].*[_/]pod[a-fA-F0-9-]\+[_/]\([a-fA-F0-9]\+\)$|\1|")"
-		docker_validate_id "${DOCKERID}"
-
 	elif [[ ${CGROUP} =~ machine.slice[_/].*\.service ]]; then
 		# systemd-nspawn
 		NAME="$(echo "${CGROUP}" | sed 's/.*machine.slice[_\/]\(.*\)\.service/\1/g')"
@@ -177,8 +197,5 @@ fi
 info "cgroup '${CGROUP}' is called '${NAME}'"
 echo "${NAME}"
 
-if [ "${NAME_NOT_FOUND}" -eq 1 ]; then
-	exit 2
-else
-	exit 0
-fi
+exit ${NAME_NOT_FOUND}
+
diff --git a/collectors/cgroups.plugin/sys_fs_cgroup.c b/collectors/cgroups.plugin/sys_fs_cgroup.c
index 41079a43b4..66dfc2d6aa 100644
--- a/collectors/cgroups.plugin/sys_fs_cgroup.c
+++ b/collectors/cgroups.plugin/sys_fs_cgroup.c
@@ -893,7 +893,7 @@ static inline void cgroup_get_chart_name(struct cgroup *cg) {
 
     snprintfz(command, CGROUP_CHARTID_LINE_MAX, "exec %s '%s'", cgroups_rename_script, cg->chart_id);
 
-    debug(D_CGROUP, "executing command \"%s\" for cgroup '%s'", command, cg->id);
+    debug(D_CGROUP, "executing command \"%s\" for cgroup '%s'", command, cg->chart_id);
     FILE *fp = mypopen(command, &cgroup_pid);
     if(fp) {
         // debug(D_CGROUP, "reading from command '%s' for cgroup '%s'", command, cg->id);
@@ -904,12 +904,16 @@ static inline void cgroup_get_chart_name(struct cgroup *cg) {
         // debug(D_CGROUP, "closed command for cgroup '%s'", cg->id);
 
         if(s && *s && *s != '\n') {
-            debug(D_CGROUP, "cgroup '%s' should be renamed to '%s'", cg->id, s);
+            debug(D_CGROUP, "cgroup '%s' should be renamed to '%s'", cg->chart_id, s);
 
             s = trim(s);
             if (s) {
-                if(likely(!name_error))
+                if(likely(name_error==0))
                     cg->pending_renames = 0;
+                else if (unlikely(name_error==3)) {
+                    debug(D_CGROUP, "cgroup '%s' disabled based due to rename command output", cg->chart_id);
+                    cg->enabled = 0;
+                }
 
                 if(likely(cg->pending_renames < 2)) {
                     freez(cg->chart_title);
-- 
cgit v1.2.3