support attach metadata in PullImage CRI interface

Signed-off-by: liuzhenwei <dui_zhang@163.com>

rerun e2e

apis/apps/v1alpha1/imagepulljob_types.go

@@ -61,6 +61,10 @@ type ImagePullJobSpec struct {
 	// CompletionPolicy indicates the completion policy of the job.
 	// Default is Always CompletionPolicyType.
 	CompletionPolicy CompletionPolicy `json:"completionPolicy"`
+
+	// SandboxConfig support attach metadata in PullImage CRI interface during ImagePulljobs
+	// +optional
+	SandboxConfig *SandboxConfig `json:"sandboxConfig,omitempty"`
 }
 
 // ImagePullJobPodSelector is a selector over pods

apis/apps/v1alpha1/nodeimage_types.go

@@ -38,6 +38,10 @@ type ImageSpec struct {
 
 	// Tags is a list of versions of this image
 	Tags []ImageTagSpec `json:"tags"`
+
+	// SandboxConfig support attach metadata in PullImage CRI interface during ImagePulljobs
+	// +optional
+	SandboxConfig *SandboxConfig `json:"sandboxConfig,omitempty"`
 }
 
 // ReferenceObject comprises a resource name, with a mandatory namespace,

apis/apps/v1alpha1/sandboxconfig_types.go

@@ -0,0 +1,25 @@
+/*
+Copyright 2023 The Kruise Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+// SandboxConfig support attach metadata in PullImage CRI interface during ImagePulljobs
+type SandboxConfig struct {
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+}

config/crd/bases/apps.kruise.io_imagepulljobs.yaml

@@ -175,6 +175,19 @@ spec:
                 items:
                   type: string
                 type: array
+              sandboxConfig:
+                description: SandboxConfig support attach metadata in PullImage CRI
+                  interface during ImagePulljobs
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
               selector:
                 description: Selector is a query over nodes that should match the
                   job. nil to match all nodes.

config/crd/bases/apps.kruise.io_nodeimages.yaml

@@ -80,6 +80,19 @@ spec:
                             type: string
                         type: object
                       type: array
+                    sandboxConfig:
+                      description: SandboxConfig support attach metadata in PullImage
+                        CRI interface during ImagePulljobs
+                      properties:
+                        annotations:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        labels:
+                          additionalProperties:
+                            type: string
+                          type: object
+                      type: object
                     tags:
                       description: Tags is a list of versions of this image
                       items:

pkg/controller/imagepulljob/imagepulljob_controller.go

@@ -253,7 +253,6 @@ func (r *ReconcileImagePullJob) syncNodeImages(job *appsv1alpha1.ImagePullJob, n
 	ownerRef := getOwnerRef(job)
 	secrets := getSecrets(job)
 	pullPolicy := getImagePullPolicy(job)
-
 	now := metav1.NewTime(r.clock.Now())
 	imageName, imageTag, _ := daemonutil.NormalizeImageRefToNameTag(job.Spec.Image)
 	for i := 0; i < parallelism; i++ {
@@ -267,6 +266,7 @@ func (r *ReconcileImagePullJob) syncNodeImages(job *appsv1alpha1.ImagePullJob, n
 				nodeImage.Spec.Images = make(map[string]appsv1alpha1.ImageSpec, 1)
 			}
 			imageSpec := nodeImage.Spec.Images[imageName]
+			imageSpec.SandboxConfig = job.Spec.SandboxConfig
 
 			for _, secret := range secrets {
 				if !containsObject(imageSpec.PullSecrets, secret) {

pkg/daemon/criruntime/factory.go

@@ -102,18 +102,7 @@ func NewFactory(varRunPath string, accountManager daemonutil.ImagePullAccountMan
 				klog.Warningf("Failed to new image service for %v (%s, %s): %v", cfg.runtimeType, cfg.runtimeURI, cfg.runtimeRemoteURI, err)
 				continue
 			}
-		case ContainerRuntimeContainerd:
-			addr, _, err := kubeletutil.GetAddressAndDialer(cfg.runtimeRemoteURI)
-			if err != nil {
-				klog.Warningf("Failed to get address for %v (%s, %s): %v", cfg.runtimeType, cfg.runtimeURI, cfg.runtimeRemoteURI, err)
-				continue
-			}
-			imageService, err = runtimeimage.NewContainerdImageService(addr, accountManager)
-			if err != nil {
-				klog.Warningf("Failed to new image service for %v (%s, %s): %v", cfg.runtimeType, cfg.runtimeURI, cfg.runtimeRemoteURI, err)
-				continue
-			}
-		case ContainerRuntimeCommonCRI:
+		case ContainerRuntimeContainerd, ContainerRuntimeCommonCRI:
 			addr, _, err := kubeletutil.GetAddressAndDialer(cfg.runtimeRemoteURI)
 			if err != nil {
 				klog.Warningf("Failed to get address for %v (%s, %s): %v", cfg.runtimeType, cfg.runtimeURI, cfg.runtimeRemoteURI, err)
@@ -227,7 +216,7 @@ func detectRuntime(varRunPath string) (cfgs []runtimeConfig) {
 		}
 	}
 
-	// containerd
+	// containerd, with the same behavior of pullImage as commonCRI
 	{
 		if _, err = os.Stat(fmt.Sprintf("%s/containerd.sock", varRunPath)); err == nil {
 			cfgs = append(cfgs, runtimeConfig{

pkg/daemon/criruntime/imageruntime/containerd.go

@@ -27,6 +27,8 @@ import (
 	"net/url"
 	"time"
 
+	appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
+
 	"github.com/alibaba/pouch/pkg/jsonstream"
 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/errdefs"
@@ -85,7 +87,7 @@ type containerdImageClient struct {
 }
 
 // PullImage implements ImageService.PullImage.
-func (d *containerdImageClient) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret) (ImagePullStatusReader, error) {
+func (d *containerdImageClient) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret, _ *appsv1alpha1.SandboxConfig) (ImagePullStatusReader, error) {
 	ctx = namespaces.WithNamespace(ctx, k8sContainerdNamespace)
 
 	if tag == "" {

pkg/daemon/criruntime/imageruntime/cri.go

@@ -18,6 +18,8 @@ import (
 	"io"
 	"time"
 
+	appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
+
 	daemonutil "github.com/openkruise/kruise/pkg/daemon/util"
 	"github.com/pkg/errors"
 	"google.golang.org/grpc"
@@ -66,7 +68,7 @@ type commonCRIImageService struct {
 }
 
 // PullImage implements ImageService.PullImage.
-func (c *commonCRIImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret) (ImagePullStatusReader, error) {
+func (c *commonCRIImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret, sandboxConfig *appsv1alpha1.SandboxConfig) (ImagePullStatusReader, error) {
 	registry := daemonutil.ParseRegistry(imageName)
 	fullImageName := imageName + ":" + tag
 	// Reader
@@ -81,6 +83,12 @@ func (c *commonCRIImageService) PullImage(ctx context.Context, imageName, tag st
 		},
 		Auth: auth, //default is nil
 	}
+	if sandboxConfig != nil {
+		pullImageReq.SandboxConfig = &runtimeapi.PodSandboxConfig{
+			Annotations: sandboxConfig.Annotations,
+			Labels:      sandboxConfig.Labels,
+		}
+	}
 	var err error
 	if len(pullSecrets) > 0 {
 		var authInfos []daemonutil.AuthInfo

pkg/daemon/criruntime/imageruntime/docker.go

@@ -21,6 +21,8 @@ import (
 	"io"
 	"sync"
 
+	appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
+
 	dockertypes "github.com/docker/docker/api/types"
 	dockerapi "github.com/docker/docker/client"
 	daemonutil "github.com/openkruise/kruise/pkg/daemon/util"
@@ -68,7 +70,7 @@ func (d *dockerImageService) handleRuntimeError(err error) {
 	}
 }
 
-func (d *dockerImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret) (reader ImagePullStatusReader, err error) {
+func (d *dockerImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret, _ *appsv1alpha1.SandboxConfig) (reader ImagePullStatusReader, err error) {
 	if err = d.createRuntimeClientIfNecessary(); err != nil {
 		return nil, err
 	}

pkg/daemon/criruntime/imageruntime/interface.go

@@ -19,6 +19,8 @@ package imageruntime
 import (
 	"context"
 
+	appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
+
 	v1 "k8s.io/api/core/v1"
 )
 
@@ -46,6 +48,6 @@ type ImagePullStatusReader interface {
 }
 
 type ImageService interface {
-	PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret) (ImagePullStatusReader, error)
+	PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret, sandboxConfig *appsv1alpha1.SandboxConfig) (ImagePullStatusReader, error)
 	ListImages(ctx context.Context) ([]ImageInfo, error)
 }

pkg/daemon/criruntime/imageruntime/pouch.go

@@ -22,6 +22,8 @@ import (
 	"io"
 	"sync"
 
+	appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
+
 	pouchfilters "github.com/alibaba/pouch/apis/filters"
 	pouchtypes "github.com/alibaba/pouch/apis/types"
 	pouchapi "github.com/alibaba/pouch/client"
@@ -70,7 +72,7 @@ func (d *pouchImageService) handleRuntimeError(err error) {
 	}
 }
 
-func (d *pouchImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret) (reader ImagePullStatusReader, err error) {
+func (d *pouchImageService) PullImage(ctx context.Context, imageName, tag string, pullSecrets []v1.Secret, _ *appsv1alpha1.SandboxConfig) (reader ImagePullStatusReader, err error) {
 	if err = d.createRuntimeClientIfNecessary(); err != nil {
 		return nil, err
 	}

pkg/daemon/imagepuller/imagepuller_worker.go

@@ -214,7 +214,7 @@ func (w *realWorkerPool) Sync(spec *appsv1alpha1.ImageSpec, status *appsv1alpha1
 		_, ok := w.pullWorkers[tagSpec.Tag]
 
 		if !ok {
-			worker := newPullWorker(w.name, tagSpec, secrets, w.runtime, w, ref, w.eventRecorder)
+			worker := newPullWorker(w.name, tagSpec, spec.SandboxConfig, secrets, w.runtime, w, ref, w.eventRecorder)
 			w.pullWorkers[tagSpec.Tag] = worker
 		}
 	}
@@ -262,10 +262,11 @@ func (w *realWorkerPool) UpdateStatus(status *appsv1alpha1.ImageTagStatus) {
 	w.tagStatuses[status.Tag] = status
 }
 
-func newPullWorker(name string, tagSpec appsv1alpha1.ImageTagSpec, secrets []v1.Secret, runtime runtimeimage.ImageService, statusUpdater imageStatusUpdater, ref *v1.ObjectReference, eventRecorder record.EventRecorder) *pullWorker {
+func newPullWorker(name string, tagSpec appsv1alpha1.ImageTagSpec, sandboxConfig *appsv1alpha1.SandboxConfig, secrets []v1.Secret, runtime runtimeimage.ImageService, statusUpdater imageStatusUpdater, ref *v1.ObjectReference, eventRecorder record.EventRecorder) *pullWorker {
 	o := &pullWorker{
 		name:          name,
 		tagSpec:       tagSpec,
+		sandboxConfig: sandboxConfig,
 		secrets:       secrets,
 		runtime:       runtime,
 		statusUpdater: statusUpdater,
@@ -283,6 +284,7 @@ type pullWorker struct {
 
 	name          string
 	tagSpec       appsv1alpha1.ImageTagSpec
+	sandboxConfig *appsv1alpha1.SandboxConfig
 	secrets       []v1.Secret
 	runtime       runtimeimage.ImageService
 	statusUpdater imageStatusUpdater
@@ -435,7 +437,7 @@ func (w *pullWorker) doPullImage(ctx context.Context, newStatus *appsv1alpha1.Im
 	var statusReader runtimeimage.ImagePullStatusReader
 	pullChan := make(chan struct{})
 	go func() {
-		statusReader, err = w.runtime.PullImage(ctx, w.name, tag, w.secrets)
+		statusReader, err = w.runtime.PullImage(ctx, w.name, tag, w.secrets, w.sandboxConfig)
 		close(pullChan)
 	}()