Skip to content

Seam C: the bound pod becomes a process — kubelet to CRI to CNI, ending on a clone/setns you once made by hand

Artifact — the sub-path config/apiserver.go → pod_workers.go → kuberuntime_manager.computePodActions → CRI → CNI cited file:line at a stated sha, ending with the veth/netns the CNI ADD produced and the P0 syscall it reduces to. Two areas — Area 7 (P6) and Area 5 (P7) — and the point where the loop closes: the container this trace produces is the namespaces and cgroups you created by hand in week one, now created for you.

Rests on — Seam B, which set the node; the CRI calls one pod makes, read in P6; the CNI plugin you built in P7, which is these primitives automated; and the P0 syscalls the whole trace terminates on.

Topology — pair, continued.

Read — the module framing. The CRI RuntimeService split and the CNI ADD were read in P6 and P7; this exercise cites the decision point and follows it across the two gRPC/exec boundaries to the kernel. P6's capstone could only watch this far end; here you cite it.

Question to answer from the source: computePodActions decides what to do; cite the line where it decides a container must be created, follow it to the CRI call, then name the CNI ADD result — the veth and netns — and point at the P0 syscall (clone/setns/unshare) it corresponds to. The trace ends on a syscall you once made yourself.

Build — create a pod on the worker, then read the seam from the node side: the kubelet's CRI calls to the runtime and the CNI ADD that wired the netns, ending at the namespaces the container now holds.

kubectl run seamc --image=nginx --restart=Never
WK=10.10.10.131
# the CRI calls the kubelet made for this pod:
ssh zain@$WK 'sudo crictl ps --name seamc; sudo crictl inspect $(sudo crictl ps -q --name seamc) | grep -i -A2 "namespaces\|pid"'
# the netns the CNI ADD produced — the veth end and the namespace itself:
ssh zain@$WK 'sudo ip netns list; sudo lsns -t net | grep -i nginx || true'

Verify from outside — a reader opens computePodActions at your sha, finds the create decision, follows the cited line to the CRI call, and matches your named CNI result (a veth pair, a netns) to a P0 syscall. "The kubelet starts it" fails; computePodActions:NNN → CRI CreateContainer → CNI ADD → clone(CLONE_NEWNET) passes.

Expect — the pod's namespaces present on the worker and traceable to a clone/setns — the same primitives P0 made by hand, now made by the machine. Exercise 6 breaks the CNI to strand the pod at this seam's last frame.

Write down — the config/apiserver.go → pod_workers.go → computePodActions → CRI → CNI sub-path cited to source, ending with the P0 syscall the running container reduces to. The final third; the three sub-paths joined are the capstone.

Footprint note — pair at 5.0GB, unchanged.

Teardown — kubectl delete pod seamc; the topology stays — exercise 6 breaks Seams B and C on this same cluster, then the joined trace assembles all three.