add label flags to ctr import

[roman-kiselenko]

This PR introduces an option for assigning labels at the import step.

The current implementation provides a way to label images at the pull(fetch) step, and labeling images at the import step reduces additional steps.

related

• Node-image: tag the core bundled images that we want to preserve with a pinned label kubernetes-sigs/kind#3444
• leverage containerd image pinning kubernetes-sigs/kind#3441

Fixes #9505

[k8s-ci-robot]

Hi @roman-kiselenko. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[roman-kiselenko]

I've doubts about my implementation, and it's better to move that logic in the image.Store method 🤔

Also, I guess some integration tests are required.

[roman-kiselenko]

/kind feature

[roman-kiselenko]

/cc @ruiwen-zhao @samuelkarp

[adisky]

@roman-kiselenko Thanks for adding this, although adding the labels after import is doable using ctr images label still its a good addition to have consistency with the pull command. Going to try it out locally

[roman-kiselenko]

@adisky, @fuweid, @samuelkarp, thanks for your review. 🙏
To address your review
The current implementation of image importing doesn't inherit base image labels.

FROM busybox

RUN echo -e '#!/bin/sh\nwhile :; do date; sleep 1; done' > /entrypoint && \
    chmod 750 /entrypoint

RUN ["echo", "bar"]
ENTRYPOINT [ "/entrypoint" ]

# build image
docker build -t image-with-label --label some=label .
docker save -o with-label.tar docker.io/library/image-with-label
# in air-gapped environment
cat with-label.tar | ./bin/ctr images import -
unpacking docker.io/library/image-with-label:latest (sha256:ceccd3c9687d1e5d72432405278443a6d1c505dc0eb899b20414aec8d7759cf4)...done
./bin/ctr images ls
REF                                       TYPE                                                 DIGEST                                                                  SIZE    PLATFORMS   LABELS 
docker.io/library/image-with-label:latest application/vnd.docker.distribution.manifest.v2+json sha256:ceccd3c9687d1e5d72432405278443a6d1c505dc0eb899b20414aec8d7759cf4 4.1 MiB linux/arm64 -      

With --label options:

cat with-label.tar | ./bin/ctr images import --label=bar=bar -
./bin/ctr images ls
REF                                       TYPE                                                 DIGEST                                                                  SIZE    PLATFORMS   LABELS  
docker.io/library/image-with-label:latest application/vnd.docker.distribution.manifest.v2+json sha256:ceccd3c9687d1e5d72432405278443a6d1c505dc0eb899b20414aec8d7759cf4 4.1 MiB linux/arm64 bar=bar

Proposed changes complement the implementation of image pinning in air-gapped environments

• prevents garbage collection from removing pinned images kubernetes/kubernetes#103299
• CRI Pinned image support #7944

[fuweid]

LGTM

But please squash three commits into one. Thanks!

[adisky]

Thanks @roman-kiselenko LGTM

[ruiwen-zhao]

Thank you @roman-kiselenko !

[fuweid]

Hi @roman-kiselenko would you please rebase this one? We have two LGTMs. I can merge it when it's ready. Thanks

[roman-kiselenko]

Hi @roman-kiselenko would you please rebase this one? We have two LGTMs. I can merge it when it's ready. Thanks

@fuweid Thank you! Rebased 👍

[fuweid]

LGTM