The CRI v1 implementation of validateServiceConnection does not check for unavailable

[afbjorklund]

What happened?

It "connects" to dockershim

DEBU[0000] Connected successfully using endpoint: unix:///var/run/dockershim.sock 
DEBU[0000] VersionRequest: &VersionRequest{Version:v1,} 
E1213 20:22:57.677536   53350 remote_runtime.go:145] "Version from runtime service failed" err="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory\""
DEBU[0000] VersionResponse: nil                         

What did you expect to happen?

There is no dockershim.sock

ERRO[0000] validate service connection: CRI v1 runtime API is not available for endpoint "unix:///var/run/dockershim.sock": rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory" 

How can we reproduce it (as minimally and precisely as possible)?

Run crictl v1.26.0, without setting up /etc/crictl.yaml (or using -r)

• Default endpoint fallback doesn't work anymore kubernetes-sigs/cri-tools#1041

Anything else we need to know?

Worked in crictl v1.25.0, that still had CRI v1alpha2

This patch fixed the issue, to make the fallbacks work:

--- a/vendor/k8s.io/kubernetes/pkg/kubelet/cri/remote/remote_runtime.go
+++ b/vendor/k8s.io/kubernetes/pkg/kubelet/cri/remote/remote_runtime.go
@@ -122,6 +122,8 @@ func (r *remoteRuntimeService) validateServiceConnection(ctx context.Context, co
 
        } else if status.Code(err) == codes.Unimplemented {
                return fmt.Errorf("CRI v1 runtime API is not implemented for endpoint %q: %w", endpoint, err)
+       } else if status.Code(err) == codes.Unavailable {
+               return fmt.Errorf("CRI v1 runtime API is not available for endpoint %q: %w", endpoint, err)
        }
 
        return nil

Kubernetes version

v1.26.0

Cloud provider

Lima

OS version

PRETTY_NAME="Ubuntu 22.04.1 LTS"

Install tools

Container runtime (CRI) and version (if applicable)

v1.6.12

Related plugins (CNI, CSI, ...) and versions (if applicable)

[k8s-ci-robot]

@afbjorklund: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afbjorklund]

/sig node

[saschagrunert]

@afbjorklund I agree that we can check for unavailable connection because it will only be done on kubelet startup.