Hi @afbjorklund. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

/assign @mikebrow

I don't follow the issue we are trying to fix, why would kubeadm provide a warning if the version number in the config or container runtime const default is not the same as for kubeadm?

It was a part of moving the sandbox configuration from the kubelet, to the container runtime:

• Configurable sandbox (pause) image kubernetes/kubeadm#2020

Some users miss the fine print on the installation page, and "forget" to configure their runtime:

https://kubernetes.io/docs/setup/production-environment/container-runtimes/

see comments.. does the crio team not have a list of pinned images?

The pause image is pinned automatically:

s.StorageImageServer().UpdatePinnedImagesList(append(s.config.PinnedImages, s.config.PauseImage))

The "config" in crictl info is only for information:

{
  "status": {
    "conditions": [
      {
        "type": "RuntimeReady",
        "status": true,
        "reason": "",
        "message": ""
      },
      {
        "type": "NetworkReady",
        "status": true,
        "reason": "",
        "message": ""
      }
    ]
  },
  "runtimeHandlers": [
    {
      "name": "runc",
      "features": {}
    },
    {
      "name": "crun",
      "features": {
        "user_namespaces": true
      }
    },
    {
      "features": {
        "user_namespaces": true
      }
    }
  ],
  "config": {
    "sandboxImage": "registry.k8s.io/pause:3.9"
  }
}

Can you add a test case with the config entry in pinned set to nil, and a variation with the config set to something different than the default sandbox image.. Do you want "" in info or the actual that will be used when it's not set?

So far I only validated it manually, using crictl info (verbose)

It should return the value that is actually being used, for pause.

There is a separate issue of updating the Kubernetes documentation, to cover both v2 and v3 containerd configuration.

Configuration migrated from version 2, use `containerd config migrate` to avoid migration

But it it still being upgraded with 2.0, the only problem is when the user tries v1 (...by overwriting the default contents)

error="strict mode: fields in the document are missing in the target struct" key=sandbox_image plugin=io.containerd.grpc.v1.cri

• Containerd configuration needs to show new format version kubernetes/website#48976

The lima template uses: sandbox_image = "$(kubeadm config images list | grep pause | sort -r | head -n1)"

But there is no information in the Kubernetes documentation, on how you find out what image to actually use?

For now, it has been updated to the latest version (3.10) - so it won't be outdated until pause 3.11 is out...

This PR is stale because it has been open 90 days with no activity. This PR will be closed in 7 days unless new comments are made or the stale label is removed.

This is still failing with kubeadm 1.34.1 and containerd 2.1.3, just that it does so much more silently now:

failed to detect the sandbox image for local container runtime, no 'sandboxImage' field in CRI info config

Kubernetes is using registry.k8s.io/pause:3.10.1, while containerd defaults to registry.k8s.io/pause:3.10 sandbox.

So the users are still required to read, and update their configuration according to the documentation.

Note: the documentation has not been updated.

[plugins."io.containerd.grpc.v1.cri"]
  sandbox_image = "registry.k8s.io/pause:3.10"

Need to check with kubeadm config images list

app/constants/constants.go:     // PauseVersion indicates the default pause image version for kubeadm
app/constants/constants.go:     PauseVersion = "3.10.1"

As before, this doesn't really impact anything because all the changes made to pause are Windows-only (for now)...

# 3.10.1

* Updating base image for Windows pause container

# 3.10

* Add support for the -v flag on Windows. It prints the version similarly to Linux.

# 3.9

* Unsupported Windows Semi-Annual Channel container images removed

# 3.8

* Updating base image for Windows container images 

# 3.7

* Unsupported Windows Semi-Annual Channel container images removed