fix(build): version-match the containerd pause image to kubeadm (C4)#21
Merged
Conversation
containerd/config.toml hardcoded registry.k8s.io/pause:3.10 for every build, but kubeadm expects a per-minor pause: 3.10.1 (1.34/1.35) and 3.10.2 (1.36). The registry was already correct (not the dead k8s.gcr.io), but the stale tag means containerd pulls a different pause than kubeadm pre-pulled -- a duplicate image and version drift (pitfall C4). Resolve the pause image from the bundled kubeadm at build time (kubeadm config images list) and rewrite sandbox_image, so it always matches the target Kubernetes minor instead of a hardcoded tag. The config.toml value is now a placeholder the build overwrites. A CI step asserts the shipped sandbox_image equals kubeadm pause per minor, so it cannot silently regress. Verified locally: kubeadm 1.34.0 -> pause:3.10.1, 1.36.0 -> pause:3.10.2; the sed rewrite + assert pass against the real config.toml. Closes kairos-io/kairos#4200. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: William Rizzo <william.rizzo@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fix pitfall C4: the containerd pod-sandbox (pause) image was hardcoded to
registry.k8s.io/pause:3.10for every build, but kubeadm expects a per-minor pause:3.10.13.10.2The registry was already correct (not the dead
k8s.gcr.io), but the stale tag means containerd uses a different pause than kubeadm pre-pulls — a duplicate image + version drift.Fix
kubeadm config images list) and rewritessandbox_image, so it always matches the target minor.containerd/config.tomlkeeps a placeholder the build overwrites.sandbox_imageequals kubeadm pause per minor, so a stale tag cannot silently regress.Verification
Validated locally: kubeadm
1.34.0 -> pause:3.10.1,1.36.0 -> pause:3.10.2; the sed rewrite + assert pass against the realconfig.toml.actionlintclean; Go gates unaffected (no Go change). The full per-minor build + the new assertion run in CI.Closes kairos-io/kairos#4200.
🤖 Generated with Claude Code