KEP-3857: Recursive Read-only (RRO) mounts

[AkihiroSuda]

Depends on:

• Revert "cri: make read-only mounts recursively read-only" containerd/containerd#9747
• KEP-3857: Recursive Read-only (RRO) mounts kubernetes/enhancements#3858
• cri-api: KEP-3857: Recursive Read-only (RRO) mounts [Split from #123180 for ease of review] kubernetes/kubernetes#123272

Depended by:

• KEP-3857: Recursive Read-only (RRO) mounts containerd/containerd#9787

---

What type of PR is this?

/kind feature

What this PR does / why we need it:

Implement KEP-3857: Recursive Read-only (RRO) mounts

• Recursive Read-only (RRO) mounts kubernetes/enhancements#3857
• KEP-3857: Recursive Read-only (RRO) mounts kubernetes/enhancements#3858

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Support Recursive Read-only (RRO) mounts  (KEP-3857)

[kannon92]

@AkihiroSuda is this required as part of the KEP merge? Just trying to gauge priority and if we should get some reviews before freeze?

[haircommander]

cri-tools has a less strict release cycle than kubernetes. We can merge this after kubernetes freeze if we need to.

[AkihiroSuda]

containerd/containerd#9787 was already merged, so we'd like to see this critest to be available in the upstream soon

[AkihiroSuda]

Rebased

[AkihiroSuda]

critest CRI-O / main / linux amd64 (pull_request) Failing after 2m

This failure is an issue of CRI-O (it reports that it implements RRO, but actually it does not)
https://github.com/cri-o/cri-o/pull/7765/files#r1506892815

[saschagrunert]

I'm going to rebuild the CRI-O bundle in https://github.com/cri-o/packaging/actions/runs/8096897942, after that the CI should pick-up the merge of cri-o/cri-o#7828

Edit: Done ✔️

[saschagrunert]

Just one nit, otherwise LGTM

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AkihiroSuda, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment