Allow to adjust LinuxNamespaces

pkg/adaptation/adaptation_suite_test.go

@@ -488,6 +488,12 @@ var _ = Describe("Plugin container creation adjustments", func() {
 			}
 			a.AddDevice(dev)
 
+		case "namespace":
+			ns := &api.LinuxNamespace{
+				Type: "cgroup",
+			}
+			a.AddOrReplaceNamespace(ns)
+
 		case "rlimit":
 			a.AddRlimit("nofile", 456, 123)
 
@@ -653,6 +659,17 @@ var _ = Describe("Plugin container creation adjustments", func() {
 					},
 				},
 			),
+			Entry("adjust namespace", "namespace",
+				&api.ContainerAdjustment{
+					Linux: &api.LinuxContainerAdjustment{
+						Namespaces: []*api.LinuxNamespace{
+							{
+								Type: "cgroup",
+							},
+						},
+					},
+				},
+			),
 			Entry("adjust rlimits", "rlimit",
 				&api.ContainerAdjustment{
 					Rlimits: []*api.POSIXRlimit{{Type: "nofile", Soft: 123, Hard: 456}},
@@ -2008,8 +2025,9 @@ func stripLinuxAdjustment(a *api.ContainerAdjustment) {
 		return
 	}
 	stripLinuxDevices(a)
+	stripLinuxNamespace(a)
 	a.Linux.Resources = stripLinuxResources(a.Linux.Resources)
-	if a.Linux.Devices == nil && a.Linux.Resources == nil && a.Linux.CgroupsPath == "" {
+	if a.Linux.Devices == nil && a.Linux.Resources == nil && a.Linux.CgroupsPath == "" && a.Linux.OomScoreAdj == nil && a.Linux.Namespaces == nil {
 		a.Linux = nil
 	}
 }
@@ -2020,6 +2038,12 @@ func stripLinuxDevices(a *api.ContainerAdjustment) {
 	}
 }
 
+func stripLinuxNamespace(a *api.ContainerAdjustment) {
+	if len(a.Linux.Namespaces) == 0 {
+		a.Linux.Namespaces = nil
+	}
+}
+
 func stripCDIDevices(a *api.ContainerAdjustment) {
 	if len(a.CDIDevices) == 0 {
 		a.CDIDevices = nil

pkg/adaptation/result.go

@@ -79,6 +79,9 @@ func collectCreateContainerResult(request *CreateContainerRequest) *result {
 	if request.Container.Linux.Resources.Unified == nil {
 		request.Container.Linux.Resources.Unified = map[string]string{}
 	}
+	if request.Container.Linux.Namespaces == nil {
+		request.Container.Linux.Namespaces = []*LinuxNamespace{}
+	}
 
 	return &result{
 		request: resultRequest{
@@ -100,6 +103,7 @@ func collectCreateContainerResult(request *CreateContainerRequest) *result {
 						HugepageLimits: []*HugepageLimit{},
 						Unified:        map[string]string{},
 					},
+					Namespaces: []*LinuxNamespace{},
 				},
 			},
 		},
@@ -219,6 +223,9 @@ func (r *result) adjust(rpl *ContainerAdjustment, plugin string) error {
 		if err := r.adjustOomScoreAdj(rpl.Linux.OomScoreAdj, plugin); err != nil {
 			return err
 		}
+		if err := r.adjustNamespaces(rpl.Linux.Namespaces, plugin); err != nil {
+			return err
+		}
 	}
 	if err := r.adjustRlimits(rpl.Rlimits, plugin); err != nil {
 		return err
@@ -402,6 +409,44 @@ func (r *result) adjustDevices(devices []*LinuxDevice, plugin string) error {
 	return nil
 }
 
+func (r *result) adjustNamespaces(namespaces []*LinuxNamespace, plugin string) error {
+	if len(namespaces) == 0 {
+		return nil
+	}
+
+	create, id := r.request.create, r.request.create.Container.Id
+
+	creatensmap := map[string]*LinuxNamespace{}
+	for _, n := range create.Container.Linux.Namespaces {
+		creatensmap[n.Type] = n
+	}
+
+	for _, n := range namespaces {
+		if n == nil {
+			continue
+		}
+		key, marked := n.IsMarkedForRemoval()
+		if err := r.owners.claimNamespace(id, key, plugin); err != nil {
+			return err
+		}
+		if marked {
+			delete(creatensmap, key)
+		} else {
+			creatensmap[key] = n
+		}
+		r.reply.adjust.Linux.Namespaces = append(r.reply.adjust.Linux.Namespaces, n)
+	}
+
+	// maps.Values() requires go 1.23+
+	creatensarray := []*LinuxNamespace{}
+	for _, n := range creatensmap {
+		creatensarray = append(creatensarray, n)
+	}
+	create.Container.Linux.Namespaces = creatensarray
+
+	return nil
+}
+
 func (r *result) adjustCDIDevices(devices []*CDIDevice, plugin string) error {
 	if len(devices) == 0 {
 		return nil
@@ -952,6 +997,7 @@ type owners struct {
 	annotations         map[string]string
 	mounts              map[string]string
 	devices             map[string]string
+	namespaces          map[string]string
 	cdiDevices          map[string]string
 	env                 map[string]string
 	memLimit            string
@@ -1000,6 +1046,10 @@ func (ro resultOwners) claimDevice(id, path, plugin string) error {
 	return ro.ownersFor(id).claimDevice(path, plugin)
 }
 
+func (ro resultOwners) claimNamespace(id, typ, plugin string) error {
+	return ro.ownersFor(id).claimNamespace(typ, plugin)
+}
+
 func (ro resultOwners) claimCDIDevice(id, path, plugin string) error {
 	return ro.ownersFor(id).claimCDIDevice(path, plugin)
 }
@@ -1133,6 +1183,17 @@ func (o *owners) claimDevice(path, plugin string) error {
 	return nil
 }
 
+func (o *owners) claimNamespace(typ, plugin string) error {
+	if o.namespaces == nil {
+		o.namespaces = make(map[string]string)
+	}
+	if other, taken := o.namespaces[typ]; taken {
+		return conflict(plugin, other, "namespace", typ)
+	}
+	o.namespaces[typ] = plugin
+	return nil
+}
+
 func (o *owners) claimCDIDevice(name, plugin string) error {
 	if o.cdiDevices == nil {
 		o.cdiDevices = make(map[string]string)

pkg/api/adjustment.go

@@ -134,6 +134,20 @@ func (a *ContainerAdjustment) AddCDIDevice(d *CDIDevice) {
 	a.CDIDevices = append(a.CDIDevices, d) // TODO: should we dup d here ?
 }
 
+// AddOrReplaceNamespace records the addition or replacement of the given namespace to a container.
+func (a *ContainerAdjustment) AddOrReplaceNamespace(n *LinuxNamespace) {
+	a.initLinuxNamespaces()
+	a.Linux.Namespaces = append(a.Linux.Namespaces, n) // TODO: should we dup n here ?
+}
+
+// RemoveNamespace records the removal of the given namespace from a container.
+func (a *ContainerAdjustment) RemoveNamespace(n *LinuxNamespace) {
+	a.initLinuxNamespaces()
+	a.Linux.Namespaces = append(a.Linux.Namespaces, &LinuxNamespace{
+		Type: MarkForRemoval(n.Type),
+	})
+}
+
 // SetLinuxMemoryLimit records setting the memory limit for a container.
 func (a *ContainerAdjustment) SetLinuxMemoryLimit(value int64) {
 	a.initLinuxResourcesMemory()
@@ -298,6 +312,13 @@ func (a *ContainerAdjustment) initLinux() {
 	}
 }
 
+func (a *ContainerAdjustment) initLinuxNamespaces() {
+	a.initLinux()
+	if a.Linux.Namespaces == nil {
+		a.Linux.Namespaces = []*LinuxNamespace{}
+	}
+}
+
 func (a *ContainerAdjustment) initLinuxResources() {
 	a.initLinux()
 	if a.Linux.Resources == nil {