cri-o · openshift-merge-bot · Aug 15, 2024 · Jul 9, 2024 · Jul 10, 2024 · Jul 10, 2024
@@ -364,6 +364,10 @@ The "crio.runtime.runtimes" table defines a list of OCI compatible runtimes.  Th
 **platform_runtime_paths**={}
   A mapping of platforms to the corresponding runtime executable paths for the runtime handler.
 
+**no_sync_log**=false
+  If set to true, the runtime will not sync the log file on rotate or container exit. This option is only valid for the 'oci'
+  runtime type. Setting this option to true can cause data loss, e.g. when a machine crash happens.
+
 ### CRIO.RUNTIME.WORKLOADS TABLE
 The "crio.runtime.workloads" table defines a list of workloads - a way to customize the behavior of a pod and container.
 A workload is chosen for a pod based on whether the workload's **activation_annotation** is an annotation on the pod.

@@ -145,6 +145,9 @@ func (r *runtimeOCI) CreateContainer(ctx context.Context, c *Container, cgroupPa
 	if r.config.LogSizeMax >= 0 {
 		args = append(args, "--log-size-max", strconv.FormatInt(r.config.LogSizeMax, 10))
 	}
+	if r.handler.NoSyncLog {
+		args = append(args, "--no-sync-log")
+	}
 	if r.config.LogToJournald {
 		args = append(args, "--log-path", "journald:")
 	}

@@ -248,6 +248,10 @@ type RuntimeHandler struct {
 	// ContainerMinMemory is the minimum memory that must be set for a container.
 	ContainerMinMemory string `toml:"container_min_memory,omitempty"`
 
+	// NoSyncLog if enabled will disable fsync on log rotation and container exit.
+	// This can improve performance but may result in data loss on hard system crashes.
+	NoSyncLog bool `toml:"no_sync_log"`
+
 	// Output of the "features" subcommand.
 	// This is populated dynamically and not read from config.
 	features runtimeHandlerFeatures
@@ -1567,6 +1571,9 @@ func (r *RuntimeHandler) Validate(name string) error {
 	if err := r.ValidateRuntimeAllowedAnnotations(); err != nil {
 		return err
 	}
+	if err := r.ValidateNoSyncLog(); err != nil {
+		return err
+	}
 	return r.ValidateRuntimeType(name)
 }
 
@@ -1647,6 +1654,20 @@ func (r *RuntimeHandler) ValidateRuntimeAllowedAnnotations() error {
 	return nil
 }
 
+// ValidateNoSyncLog checks if the `NoSyncLog` is used with the correct `RuntimeType` ('oci').
+func (r *RuntimeHandler) ValidateNoSyncLog() error {
+	if !r.NoSyncLog {
+		return nil
+	}
+	// no_sync_log can only be used with the 'oci' runtime type.
+	// This means that the runtime type must be set to 'oci' or left empty
+	if r.RuntimeType == DefaultRuntimeType || r.RuntimeType == "" {
+		logrus.Warn("NoSyncLog is enabled. This can lead to lost log data")
+		return nil
+	}
+	return fmt.Errorf("no_sync_log is only allowed with runtime type 'oci', runtime type is '%s'", r.RuntimeType)
+}
+
 // SetContainerMinMemory sets the minimum container memory for a given runtime.
 // assigns defaultContainerMinMemory if no container_min_memory provided.
 func (r *RuntimeHandler) SetContainerMinMemory() (int64, error) {

@@ -680,6 +680,43 @@ var _ = t.Describe("Config", func() {
 			Expect(sut.Runtimes["runc"].AllowedAnnotations).To(ContainElement(crioann.DevicesAnnotation))
 			Expect(sut.Runtimes["runc"].DisallowedAnnotations).NotTo(ContainElement(crioann.DevicesAnnotation))
 		})
+
+		It("should allow no_sync_log for implicit default runtime", func() {
+			sut.Runtimes["runc"] = &config.RuntimeHandler{
+				RuntimePath: validFilePath,
+			}
+			sut.Runtimes["runc"].NoSyncLog = true
+
+			err := sut.Runtimes["runc"].Validate("runc")
+
+			Expect(err).ToNot(HaveOccurred())
+			Expect(sut.Runtimes["runc"].NoSyncLog).To(BeTrue())
+		})
+
+		It("should allow no_sync_log for the 'oci' runtime", func() {
+			sut.Runtimes["runc"] = &config.RuntimeHandler{
+				RuntimePath: validFilePath,
+				RuntimeType: "oci",
+			}
+			sut.Runtimes["runc"].NoSyncLog = true
+
+			err := sut.Runtimes["runc"].Validate("runc")
+
+			Expect(err).ToNot(HaveOccurred())
+			Expect(sut.Runtimes["runc"].NoSyncLog).To(BeTrue())
+		})
+
+		It("should disallow no_sync_log for the 'vm' runtime", func() {
+			sut.Runtimes["kata"] = &config.RuntimeHandler{
+				RuntimePath: "containerd-shim-kata-qemu-v2", RuntimeType: config.RuntimeTypeVM,
+			}
+			sut.Runtimes["kata"].NoSyncLog = true
+
+			err := sut.Runtimes["kata"].ValidateNoSyncLog()
+
+			Expect(err).To(HaveOccurred())
+			Expect(err).To(MatchError("no_sync_log is only allowed with runtime type 'oci', runtime type is 'vm'"))
+		})
 	})
 
 	t.Describe("ValidateConmonPath", func() {

@@ -1238,6 +1238,7 @@ const templateStringCrioRuntimeRuntimesRuntimeHandler = `# The "crio.runtime.run
 # privileged_without_host_devices = false
 # allowed_annotations = []
 # platform_runtime_paths = { "os/arch" = "/path/to/binary" }
+# no_sync_log = false
 # Where:
 # - runtime-handler: Name used to identify the runtime.
 # - runtime_path (optional, string): Absolute path to the runtime executable in
@@ -1284,6 +1285,9 @@ const templateStringCrioRuntimeRuntimesRuntimeHandler = `# The "crio.runtime.run
 # - container_min_memory (optional, string): The minimum memory that must be set for a container.
 #   This value can be used to override the currently set global value for a specific runtime. If not set,
 #   a global default value of "12 MiB" will be used.
+# - no_sync_log (optional, bool): If set to true, the runtime will not sync the log file on rotate or container exit.
+#   This option is only valid for the 'oci' runtime type. Setting this option to true can cause data loss, e.g.
+#   when a machine crash happens.
 #
 # Using the seccomp notifier feature:
 #