[Dockershim removal] Document the change for pod-infra-container-image

[SergeyKanzhelev]

/kind feature
/sig node

1. Update docs for the flag pod-infra-container-image as dockershim is removed (also tracked here: Clean up dockershim flags in the kubelet kubernetes#106893)

2. Document how to transition from using this flag to Contained setting when migrating off dockershim

Also see kubernetes/kubernetes#106903 (comment)

[mehabhalodiya]

/sig docs

[mehabhalodiya]

/triage accepted

[chris-short]

I'm not quite sure what needs to happen with this issue specifically. Is the umbrella issue going to cover this?

What needs to change in relation to this issue?

[mehabhalodiya]

What needs to change in relation to this issue?

@SergeyKanzhelev Can you please describe more?

[SergeyKanzhelev]

similar to this: kubernetes/kubernetes#108144

The flag pod-infra-container-image is deprecated. On migration - users needs to stop using this flag and instead configure the container runtime with the proper configuration setting. For containerd it is a sandbox_image

[mehabhalodiya]

/milestone 1.24

[hakman]

@SergeyKanzhelev Users should stop using the flag only when using a container runtime that supports image pinning. At the moment there's work being done on the containerd side.
containerd/containerd#6456

Other CRIs only have issues created for implementing image pining:
cri-o/cri-o#5652
Mirantis/cri-dockerd#39

[afbjorklund]

The current situation is that you end up with two (or more) versions of pod-infra-container:

IMAGE                                     TAG                 IMAGE ID            SIZE
k8s.gcr.io/pause                          3.1                 da86e6ba6ca19       742kB
k8s.gcr.io/pause                          3.6                 6270bb605e12e       683kB

Depending on the actual versions of kubernetes and the container runtime being involved.

cmd/kubelet/app/options/container_runtime.go:   defaultPodSandboxImageName    = "k8s.gcr.io/pause"
cmd/kubelet/app/options/container_runtime.go-   defaultPodSandboxImageVersion = "3.6"

src/cmd/cri/options/options.go: defaultPodSandboxImageName    = "k8s.gcr.io/pause"
src/cmd/cri/options/options.go- defaultPodSandboxImageVersion = "3.1"

[chrisnegus]

The pod-infra-container-image flag is only mentioned in two files currently. The one in reference docs will go away when reference docs are rebuilt for 1.24. The mention in https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/ will be removed in PR to be named later. If there are new feature to replace image pining for other runtimes, please create a new issue.

[chrisnegus]

PR #31899 removes the --pod-infra-container-image option. So we should close this issue once that PR merges.

[nate-double-u]

The dockershim work is ongoing, but as 1.24 is releasing today, i'm clearing the milestone.

/milestone clear

[chrisnegus]

The final instance of --pod-infra-container-image was removed with PR # 33582.
/close

[k8s-ci-robot]

@chrisnegus: Closing this issue.

In response to this:

The final instance of --pod-infra-container-image was removed with PR # 33582.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[SergeyKanzhelev]

/reopen

this bug was suggesting to add a note to dockershim migration document to suggest customers what to replace this flag with on migration off dockershim. See comment #30842 (comment)

This document will benefit from this instruction: https://kubernetes.io/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd/#configure-the-kubelet-to-use-containerd-as-its-container-runtime

This is one of the flags, other flags not documented in the migration document and causing confusion (see report: https://twitter.com/krisnova/status/1528735755794894850?t=RWDf1J4FsWgZdNmGk4Cf4A&s=03):

Upon closer investigation these flags were removed for the notorious “dockershim deprecation”.

[k8s-ci-robot]

@SergeyKanzhelev: Reopened this issue.

In response to this:

/reopen

this bug was suggesting to add a note to dockershim migration document to suggest customers what to replace this flag with on migration off dockershim. See comment #30842 (comment)

This document will benefit from this instruction: https://kubernetes.io/docs/tasks/administer-cluster/migrating-from-dockershim/change-runtime-containerd/#configure-the-kubelet-to-use-containerd-as-its-container-runtime

This is one of the flags, other flags not documented in the migration document and causing confusion (see report: https://twitter.com/krisnova/status/1528735755794894850?t=RWDf1J4FsWgZdNmGk4Cf4A&s=03):

Upon closer investigation these flags were removed for the notorious “dockershim deprecation”.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afbjorklund]

The flag pod-infra-container-image is deprecated. On migration - users needs to stop using this flag and instead configure the container runtime with the proper configuration setting. For containerd it is a sandbox_image

For cri-dockerd, it is called --pod-infra-container-image :-) Eventually it will also be possible to set using configuration files:

• Provide hooks to configure cri-dockerd via a configuration file Mirantis/cri-dockerd#102

But I believe the current status (editing flags in systemd unit) is documented properly, on the container runtime page.

https://kubernetes.io/docs/setup/production-environment/container-runtimes/#override-pause-image-cri-dockerd

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[divya-mohan0209]

/remove-lifecycle rotten

[divya-mohan0209]

@SergeyKanzhelev Would it be appropriate to link this right before this section starts?
We could add a line asking our audience to refer to the linked guide to understand how to get Kubelet working with containerd.
If that doesn't work, where else would you recommend placing it?