update pause image to 3.10

contrib/ansible/cri-containerd.yaml

@@ -61,6 +61,6 @@
     # TODO This needs to be removed once we have consistent concurrent pull results
     - name: "Pre-pull pause container image"
       shell: |
-        /usr/local/bin/ctr pull registry.k8s.io/pause:3.9
+        /usr/local/bin/ctr pull registry.k8s.io/pause:3.10
         /usr/local/bin/crictl --runtime-endpoint unix:///run/containerd/containerd.sock \
-        pull registry.k8s.io/pause:3.9
+        pull registry.k8s.io/pause:3.10

docs/cri/config.md

@@ -153,7 +153,7 @@ version = 2
   selinux_category_range = 1024
 
   # sandbox_image is the image used by sandbox container.
-  sandbox_image = "registry.k8s.io/pause:3.9"
+  sandbox_image = "registry.k8s.io/pause:3.10"
 
   # stats_collect_period is the period (in seconds) of snapshots stats collection.
   stats_collect_period = 10

docs/cri/crictl.md

@@ -59,29 +59,29 @@ command. With the load command you inject a container image into the container
 runtime from a file. First you need to create a container image tarball. For
 example to create an image tarball for a pause container using Docker:
 ```console
-$ docker pull registry.k8s.io/pause:3.9
-  3.9: Pulling from pause
+$ docker pull registry.k8s.io/pause:3.10
+  3.10: Pulling from pause
   7582c2cc65ef: Pull complete
-  Digest: sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097
-  Status: Downloaded newer image for registry.k8s.io/pause:3.9
-  registry.k8s.io/pause:3.9
-$ docker save registry.k8s.io/pause:3.9 -o pause.tar
+  Digest: sha256:ee6521f290b2168b6e0935a181d4cff9be1ac3f505666ef0e3c98fae8199917a
+  Status: Downloaded newer image for registry.k8s.io/pause:3.10
+  registry.k8s.io/pause:3.10
+$ docker save registry.k8s.io/pause:3.10 -o pause.tar
 ```
 Then use `ctr` to load the container image into the container runtime:
 ```console
 # The cri plugin uses the "k8s.io" containerd namespace.
 $ sudo ctr -n=k8s.io images import pause.tar
-  Loaded image: registry.k8s.io/pause:3.9
+  Loaded image: registry.k8s.io/pause:3.10
 ```
 List images and inspect the pause image:
 ```console
 $ sudo crictl images
 IMAGE                       TAG                 IMAGE ID            SIZE
 docker.io/library/busybox   latest              f6e427c148a76       728kB
-registry.k8s.io/pause            3.9                 e6f181688397       311kB
-$ sudo crictl inspecti e6f181688397
+registry.k8s.io/pause            3.10                 873ed75102791       311kB
+$ sudo crictl inspecti 873ed75102791
   ... displays information about the pause image.
-$ sudo crictl inspecti registry.k8s.io/pause:3.9
+$ sudo crictl inspecti registry.k8s.io/pause:3.10
   ... displays information about the pause image.
 ```
 
@@ -290,7 +290,7 @@ $ crictl info
     "streamIdleTimeout": "4h0m0s",
     "enableSelinux": false,
     "selinuxCategoryRange": 1024,
-    "sandboxImage": "registry.k8s.io/pause:3.9",
+    "sandboxImage": "registry.k8s.io/pause:3.10",
     "statsCollectPeriod": 10,
     "systemdCgroup": false,
     "enableTLSStreaming": false,

integration/client/testdata/default-1.6.toml

@@ -62,8 +62,7 @@ version = 2
     netns_mounts_under_state_dir = false
     restrict_oom_score_adj = false
     # Default image update in latest
-    #sandbox_image = "registry.k8s.io/pause:3.6"
-    sandbox_image = "registry.k8s.io/pause:3.9"
+    sandbox_image = "registry.k8s.io/pause:3.10"
     selinux_category_range = 1024
     stats_collect_period = 10
     stream_idle_timeout = "4h0m0s"

integration/client/testdata/default-1.7.toml

@@ -69,7 +69,7 @@ version = 2
     restrict_oom_score_adj = false
     # Updated in latest
     #sandbox_image = "registry.k8s.io/pause:3.8"
-    sandbox_image = "registry.k8s.io/pause:3.9"
+    sandbox_image = "registry.k8s.io/pause:3.10"
     selinux_category_range = 1024
     stats_collect_period = 10
     stream_idle_timeout = "4h0m0s"

integration/images/image_list.go

@@ -51,7 +51,7 @@ func initImages(imageListFile string) {
 	imageList = ImageList{
 		Alpine:           "ghcr.io/containerd/alpine:3.14.0",
 		BusyBox:          "ghcr.io/containerd/busybox:1.36",
-		Pause:            "registry.k8s.io/pause:3.9",
+		Pause:            "registry.k8s.io/pause:3.10",
 		ResourceConsumer: "registry.k8s.io/e2e-test-images/resource-consumer:1.10",
 		VolumeCopyUp:     "ghcr.io/containerd/volume-copy-up:2.2",
 		VolumeOwnership:  "ghcr.io/containerd/volume-ownership:2.1",

integration/images/image_list.sample.toml

@@ -1,6 +1,6 @@
 alpine = "docker.io/library/alpine:latest"
 busybox = "docker.io/library/busybox:latest"
-pause = "registry.k8s.io/pause:3.9"
+pause = "registry.k8s.io/pause:3.10"
 VolumeCopyUp = "ghcr.io/containerd/volume-copy-up:2.1"
 VolumeOwnership = "ghcr.io/containerd/volume-ownership:2.1"
 ArgsEscaped = "cplatpublic.azurecr.io/args-escaped-test-image-ns:1.0"

internal/cri/config/config.go

@@ -70,7 +70,7 @@ const (
 	ModeShim SandboxControllerMode = "shim"
 	// DefaultSandboxImage is the default image to use for sandboxes when empty or
 	// for default configurations.
-	DefaultSandboxImage = "registry.k8s.io/pause:3.9"
+	DefaultSandboxImage = "registry.k8s.io/pause:3.10"
 	// IOTypeFifo is container io implemented by creating named pipe
 	IOTypeFifo = "fifo"
 	// IOTypeStreaming is container io implemented by connecting the streaming api to sandbox endpoint
@@ -284,7 +284,7 @@ type ImageConfig struct {
 	// by other plugins to lookup the current image name.
 	// Image names should be full names including domain and tag
 	// Examples:
-	//   "sandbox": "k8s.gcr.io/pause:3.9"
+	//   "sandbox": "k8s.gcr.io/pause:3.10"
 	//   "base": "docker.io/library/ubuntu:latest"
 	// Migrated from:
 	// (PluginConfig).SandboxImage string `toml:"sandbox_image" json:"sandboxImage"`

internal/cri/server/images/image_pull_test.go

@@ -498,8 +498,8 @@ func TestImageGetLabels(t *testing.T) {
 		{
 			name:          "pinned image labels should get added on sandbox image",
 			expectedLabel: map[string]string{labels.ImageLabelKey: labels.ImageLabelValue, labels.PinnedImageLabelKey: labels.PinnedImageLabelValue},
-			pinnedImages:  map[string]string{"sandbox": "k8s.gcr.io/pause:3.9"},
-			pullImageName: "k8s.gcr.io/pause:3.9",
+			pinnedImages:  map[string]string{"sandbox": "k8s.gcr.io/pause:3.10"},
+			pullImageName: "k8s.gcr.io/pause:3.10",
 		},
 		{
 			name:          "pinned image labels should get added on sandbox image without tag",

plugins/cri/images/plugin_test.go

@@ -26,7 +26,7 @@ import (
 )
 
 func TestSandboxImageConfigMigration(t *testing.T) {
-	image := "rancher/mirrored-pause:3.9-amd64"
+	image := "rancher/mirrored-pause:3.10-amd64"
 	grpcCri := map[string]interface{}{
 		"sandbox_image": image,
 	}