Maksym Pavlenko 6a93e5d593 agent: Initial watchable-bind implementation ...

Add support for watchable-bind storage driver. When watchable-bind storage
is present, the agent will create a watchable path in a tmpfs, and poll the
watchable-bind source to keep this new mount-point up to date.

This poll will allow the agent to present the mount-point to the
container, allowing for inotify usage by the container workload.

If a mount becomes too large, either in file count or in overall size,
we want to stop treating it as watchable, and instead just treat as a
bindmount. This'll help avoid DoS by growing tmpfs too large, as well
as limiting time spent scanning files. If a watchable-bind grows beyond
8 files (arbitrary sane number for certs/secrets) or 1MB (limit on ConfigMap size),
we treat it as a normal bind.

Fixes: #1879

Signed-off-by: Eric Ernst <eric_ernst@apple.com>
Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>
Signed-off-by: Samuel Ortiz <samuel.e.ortiz@protonmail.com>

agent: watcher: SandboxStorages check loop cleanup

2021-06-24 10:07:06 -07:00

..

agent-ctl

agent: Initial watchable-bind implementation

2021-06-24 10:07:06 -07:00

osbuilder

osbuilder: Update QAT driver version

2021-06-23 23:49:19 +00:00

packaging

Merge pull request #2107 from Jakob-Naucke/protvirt-kernel

2021-06-24 15:29:15 +02:00