Repository: containerd/containerd
File: pkg/cri/nri/nri_api_linux.go (Go)

Code before:
			if className == "" {
				return nil, nil
			}
			return &runtimespec.LinuxIntelRdt{
				ClosID: className,
			}, nil
		},
	)

	blkioResolveOpt := nrigen.WithBlockIOResolver(
		func(className string) (*runtimespec.LinuxBlockIO, error) {
			if className == "" {
				return nil, nil
			}
			blockIO, err := blockio.ClassNameToLinuxOCI(className)
			if err != nil {
				return nil, err
			}
			return blockIO, nil
		},
	)

	cdiInjectOpt := nrigen.WithCDIDeviceInjector(
		func(s *runtimespec.Spec, devices []string) error {
			if !a.cri.Config().EnableCDI {
				return fmt.Errorf("CDI device injection is disabled by configuration")
			}

			devs := make([]*cri.CDIDevice, 0, len(devices))
			for _, name := range devices {
				devs = append(devs, &cri.CDIDevice{Name: name})
			}

			// This is iffy at best, but as long as we pass in nil
			// annotations, then ID is the only member accessed in
			// the option WithCDI returns, and it is only used for
			// log messages.
			//
			// The alternative would be to do a CDI cache refresh
			// followed by CDI injection of devices, which is what
			// the option returned by WithCDI essentially does.
			fakeCtr := &containers.Container{
				ID: "NRI CDI device adjustment",
			}
			return criopts.WithCDI(nil, devs)(context.TODO(), nil, fakeCtr, s)
		},
	)

	return func(ctx context.Context, _ *containerd.Client, c *containers.Container) error {
		spec := &specs.Spec{}
		if err := json.Unmarshal(c.Spec.GetValue(), spec); err != nil {

Review comment (bug):
```suggestion
				return fmt.Errorf("CDI device injection, from NRI plugin adjustment, is disabled by containerd enable_cdi configuration")
```
Maybe also add the devices to the error message.. to aid in debugging.

Code after:
		func(className string) (*runtimespec.LinuxIntelRdt, error) {
			if className == "" {
				return nil, nil
			}
			return &runtimespec.LinuxIntelRdt{
				ClosID: className,
			}, nil
		},
	)

	blkioResolveOpt := nrigen.WithBlockIOResolver(
		func(className string) (*runtimespec.LinuxBlockIO, error) {
			if className == "" {
				return nil, nil
			}
			blockIO, err := blockio.ClassNameToLinuxOCI(className)
			if err != nil {
				return nil, err
			}
			return blockIO, nil
		},
	)

	cdiInjectOpt := nrigen.WithCDIDeviceInjector(
		func(s *runtimespec.Spec, devices []string) error {
			if len(devices) == 0 {
				return nil
			}

			if !a.cri.Config().EnableCDI {
				return fmt.Errorf("can't inject CDI devices (%s): CDI is disabled by configuration", strings.Join(devices, ", "))
			}

			devs := make([]*cri.CDIDevice, 0, len(devices))
			for _, name := range devices {
				devs = append(devs, &cri.CDIDevice{Name: name})
			}

			// This is iffy at best, but as long as we pass in nil
			// annotations, then ID is the only member accessed in
			// the option WithCDI returns, and it is only used for
			// log messages.
			//
			// The alternative would be to do a CDI cache refresh
			// followed by CDI injection of devices, which is what
			// the option returned by WithCDI essentially does.
			fakeCtr := &containers.Container{
				ID: "NRI CDI device adjustment",
			}
			return criopts.WithCDI(nil, devs)(context.TODO(), nil, fakeCtr, s)
		},