resmgr: inject mount before container state update.

Inject our 'downward API' mount into containers before updating their state to 'created'. Otherwise, if a policy doesn't make any changes to a container during its creation, we incorrectly consider the container as already created and fail to insert the mount. Signed-off-by: Krisztian Litkey <[email protected]>
containers · Jan 10, 2024 · 2071609 · 2071609
1 parent 398fdf5
commit 2071609
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/pkg/resmgr/nri.go b/pkg/resmgr/nri.go
@@ -333,7 +333,6 @@ func (p *nriPlugin) CreateContainer(ctx context.Context, podSandbox *api.PodSand
 		c.UpdateState(cache.ContainerStateStale)
 		return nil, nil, fmt.Errorf("failed to allocate resources: %w", err)
 	}
-	c.UpdateState(cache.ContainerStateCreated)
 
 	c.InsertMount(&cache.Mount{
 		Destination: "/.nri-resource-policy",
@@ -342,6 +341,8 @@ func (p *nriPlugin) CreateContainer(ctx context.Context, podSandbox *api.PodSand
 		Options:     []string{"bind", "ro", "rslave"},
 	})
 
+	c.UpdateState(cache.ContainerStateCreated)
+
 	if err := p.runPostAllocateHooks(event, c); err != nil {
 		m.Error("%s: failed to run post-allocate hooks for %s: %v",
 			event, container.GetName(), err)