feat(cloudhypervisor): make watchdog policy configurable - #199
feat(cloudhypervisor): make watchdog policy configurable#199czmDeRepository wants to merge 4 commits into
Conversation
Change-Id: I370363cfe432cbdc7d996a1ab62284cf5ebc1732
dff28ac to
ad22695
Compare
Change-Id: I668e2f9642ae17a192cb92ba7ed77521015a5486
czmDeRepository
changed the title
Change-Id: Ifd73381c80fcdbec2451255e78cc1ee536ba5bac
CMGS
left a comment
CMGS
left a comment
There was a problem hiding this comment.
overall direction is right, keeping the watchdog on by default with an explicit opt out beats guessing by os type. the create side wiring is clean and adds zero cost on the boot path, and tests, lint and our layout gate all pass on the branch. the one real problem is the clone side: the override never reaches the restored device, details inline. once the clone flag is dropped this looks good.
Change-Id: I4c4e36316cad6cac0a15008390a18014961fd6be
CMGS
left a comment
CMGS
left a comment
There was a problem hiding this comment.
thanks, that's the shape i had in mind. two small leftovers inline, then this is good to go.
| if cmd.Flags().Changed("no-direct-io") { | ||
| noDirectIO, _ = cmd.Flags().GetBool("no-direct-io") | ||
| } | ||
| noWatchdog := snapCfg.NoWatchdog |
There was a problem hiding this comment.
this local only existed for the override branch. with that gone it's a plain pass through, inline it like the siblings: NoWatchdog: snapCfg.NoWatchdog in the literal below and drop this line.
| if err = vmCfg.Validate(); err != nil { | ||
| return cloneSetup{}, err | ||
| } | ||
| if err = validateBackendFlags(conf, vmCfg); err != nil { |
There was a problem hiding this comment.
with the clone flag gone this call is unreachable by construction: every knob the switch gates is inherited from the snapshot on clone, and an fc snapshot can't carry any of them because create already rejects them. the test that covered it got removed too, so this is now an untested guard for a state that can't happen. please drop these three lines and put the godoc back to 'create and debug'.
2 participants
Problem
Some guest or driver combinations can mishandle an armed virtio watchdog during reboot. Disabling the watchdog automatically by operating-system type is too broad: it would also remove hang recovery from healthy guests.
Fix
--no-watchdogcompatibility opt-out when creating a VMThis keeps automatic watchdog recovery as the safe default while allowing operators to opt out for a guest image with a demonstrated reboot incompatibility.
Validation
go test ./...make fmt-check vet lint