fix pinned the preloaded pause image

[Iceber]

Fix pause image already exists but is not pinned.

The code that needs to be fixed is in two places:

1. use image reference/name to get image cri labels
2. when updating the image, not just determine the io.cri-containerd.image label

related pr: #8866 (comment)

[adisky]

@Iceber how the images are preloaded in the containerd? as i know the image tars are loaded in the content store and then imported using ctr.

how other containerd cri specific labels are get added to it? like this one io.cri-containerd.image=managed? I think the pinned label should get added in the same way

edit: after going through the changes you are doing the same, I was wondering if the image leak problem could be solved the same way? UpdateImage is also gets called when containerd service is restarted, if the user has updated the sandbox image they definitely need to restart the containerd service and during that we can cleanup the pinned image label

containerd/pkg/cri/server/restart.go

Line 426 in 935b22d

func (c *criService) loadImages(ctx context.Context, cImages []containerd.Image) {

[Iceber]

how the images are preloaded in the containerd? as i know the image tars are loaded in the content store and then imported using ctr.

yes, sometimes the pause image exists before containerd restarts, and containerd may restart for various reasons, such as a manual restart or an upgrade restart.

Regardless of whether pre-existing (preloaded) pause image have the io.cri-containerd.image=managed label or not, they will not be pinned due to a bug. This pr is to ensure that paused images are correctly labelled as pinned after containerd reboot, or if they are loaded/pulled via ctr.

[Iceber]

if the user has updated the sandbox image they definitely need to restart the containerd service and during that we can cleanup the pinned image label

Does this mean clean up the pinned label of the old pause?

[adisky]

if the user has updated the sandbox image they definitely need to restart the containerd service and during that we can cleanup the pinned image label

Does this mean clean up the pinned label of the old pause?

yes, the current UpdateImage won't work, maybe a new function while containerd restarts to cleanup old pause image

[Iceber]

@adisky What are your thoughts on identifying the old pause image?
Regarding unpin's old pause, #8866 has something like

[adisky]

@Iceber I am ok with the approach but as the feedback from that PR it would be good if we can have a consistent approach so suggested if we can try this

edit: after going through the changes you are doing the same, I was wondering if the image leak problem could be solved the same way? UpdateImage is also gets called when containerd service is restarted, if the user has updated the sandbox image they definitely need to restart the containerd service and during that we can cleanup the pinned image label

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.