Add support for OCI artifact seccomp profiles

[saschagrunert]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This feature allows pulling seccomp profiles using OCI artifacts directly within CRI-O.
The new annotation seccomp-profile.kubernetes.cri-o.io can be used to:

• Use a seccomp profile for a whole container image. This works if if it got build with the annotation, for example:

  podman build \
    --annotation seccomp-profile.kubernetes.cri-o.io/POD=quay.io/crio/seccomp:v1 \
    -t quay.io/crio/nginx-seccomp .

• Use a seccomp profile for every container within a pod:

  apiVersion: v1
  kind: Pod
  metadata:
    name: pod
    annotations:
      seccomp-profile.kubernetes.cri-o.io/POD: quay.io/crio/seccomp:v1
  spec: …

• Use a seccomp profile for a specific container within a pod:

  apiVersion: v1
  kind: Pod
  metadata:
    name: pod
    annotations:
      seccomp-profile.kubernetes.cri-o.io/container: quay.io/crio/seccomp:v1
  spec:
    containers:
    - name: container
      image: …

The profile itself can be pushed into a registry using the ORAS CLI, for example by running:

echo "{}" > config.json
tar cf seccomp.tar seccomp.json
oras push --config config.json:application/vnd.oci.image.config.v1+json quay.io/crio/seccomp:v1 seccomp.tar

The resulting image manifest looks like this:

skopeo inspect --raw docker://quay.io/crio/seccomp:v1 | jq .

{
  "schemaVersion": 2,
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
    "size": 3
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar",
      "digest": "sha256:c15f3eb1efd9abe0ae973e050c374988bba52c45a53f5c3cd80419a865013fa6",
      "size": 20480,
      "annotations": {
        "org.opencontainers.image.title": "seccomp.tar"
      }
    }
  ],
  "annotations": {
    "org.opencontainers.image.created": "2024-02-05T11:37:22Z"
  }
}

Authentication with registries during artifact pull is out of scope of this PR.

Which issue(s) this PR fixes:

Fixes #7580

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Add support for OCI artifact seccomp profiles using the `seccomp-profile.kubernetes.cri-o.io/<CONTAINER_NAME>` and `seccomp-profile.kubernetes.cri-o.io/POD` annotations on container images or Kubernetes workloads.

[saschagrunert]

/retest

[codecov]

Codecov Report

Merging #7719 (b20d06c) into main (e9febd3) will increase coverage by 0.09%.
Report is 5 commits behind head on main.
The diff coverage is 71.42%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7719      +/-   ##
==========================================
+ Coverage   47.95%   48.05%   +0.09%     
==========================================
  Files         146      148       +2     
  Lines       16274    16339      +65     
==========================================
+ Hits         7804     7851      +47     
- Misses       7517     7532      +15     
- Partials      953      956       +3     

[saschagrunert]

I'm going to blog about this, for now it's ready for review.

PTAL @cri-o/cri-o-maintainers

[saschagrunert]

/test ci-fedora-kata

[kwilczynski]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kwilczynski, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[saschagrunert]

/test ci-fedora-kata

[sftim]

Eesh. We're still lacking a mapping or documented convention about how the annotations get set on containers when they start out on a Kubernetes Pod (Kubernetes uses a different convention).

I commented on this in https://github.com/kubernetes/website/pull/45121/files#r1487723768