Merge pull request kubernetes#123583 from saschagrunert/image-id-cont…

…ainer-status

Add `image_id` to CRI `ContainerStatus` message

pkg/kubelet/container/helpers.go

@@ -273,6 +273,7 @@ func ConvertPodStatusToRunningPod(runtimeName string, podStatus *PodStatus) Pod
 			Name:                 containerStatus.Name,
 			Image:                containerStatus.Image,
 			ImageID:              containerStatus.ImageID,
+			ImageRef:             containerStatus.ImageRef,
 			ImageRuntimeHandler:  containerStatus.ImageRuntimeHandler,
 			Hash:                 containerStatus.Hash,
 			HashWithoutResources: containerStatus.HashWithoutResources,

pkg/kubelet/container/runtime.go

@@ -357,6 +357,8 @@ type Status struct {
 	Image string
 	// ID of the image.
 	ImageID string
+	// The digested reference of the image used by the container.
+	ImageRef string
 	// Runtime handler used to pull the image if any.
 	ImageRuntimeHandler string
 	// Hash of the container, used for comparison.

pkg/kubelet/kubelet_pods.go

@@ -1986,8 +1986,11 @@ func (kl *Kubelet) convertToAPIContainerStatuses(pod *v1.Pod, podStatus *kubecon
 			Name:         cs.Name,
 			RestartCount: int32(cs.RestartCount),
 			Image:        cs.Image,
-			ImageID:      cs.ImageID,
-			ContainerID:  cid,
+			// Converting the digested image ref to the Kubernetes public
+			// ContainerStatus.ImageID is historically intentional and should
+			// not change.
+			ImageID:     cs.ImageRef,
+			ContainerID: cid,
 		}
 		switch {
 		case cs.State == kubecontainer.ContainerStateRunning:

pkg/kubelet/kubelet_pods_test.go

@@ -4585,7 +4585,8 @@ func TestConvertToAPIContainerStatusesForResources(t *testing.T) {
 		Name:      testContainerName,
 		ID:        testContainerID,
 		Image:     "img",
-		ImageID:   "img1234",
+		ImageID:   "1234",
+		ImageRef:  "img1234",
 		State:     kubecontainer.ContainerStateRunning,
 		StartedAt: nowTime,
 	}

pkg/kubelet/kuberuntime/kuberuntime_container.go

@@ -609,14 +609,22 @@ func toKubeContainerStatus(status *runtimeapi.ContainerStatus, runtimeName strin
 		// If runtime reports cpu & memory resources info, add it to container status
 		cStatusResources = toKubeContainerResources(status.Resources)
 	}
+
+	// Keep backwards compatibility to older runtimes, status.ImageId has been added in v1.30
+	imageID := status.ImageRef
+	if status.ImageId != "" {
+		imageID = status.ImageId
+	}
+
 	cStatus := &kubecontainer.Status{
 		ID: kubecontainer.ContainerID{
 			Type: runtimeName,
 			ID:   status.Id,
 		},
 		Name:                 labeledInfo.ContainerName,
 		Image:                status.Image.Image,
-		ImageID:              status.ImageRef,
+		ImageID:              imageID,
+		ImageRef:             status.ImageRef,
 		ImageRuntimeHandler:  status.Image.RuntimeHandler,
 		Hash:                 annotatedInfo.Hash,
 		HashWithoutResources: annotatedInfo.HashWithoutResources,

staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto

@@ -1202,7 +1202,7 @@ message Container {
     ContainerMetadata metadata = 3;
     // Spec of the image.
     ImageSpec image = 4;
-    // Reference to the image in use.
+    // Digested reference to the image in use.
     string image_ref = 5;
     // State of the container.
     ContainerState state = 6;
@@ -1257,7 +1257,7 @@ message ContainerStatus {
     int32 exit_code = 7;
     // Spec of the image.
     ImageSpec image = 8;
-    // Reference to the image in use.
+    // Digested reference to the image in use.
     string image_ref = 9;
     // Brief CamelCase string explaining why container is in its current state.
     // Must be set to "OOMKilled" for containers terminated by cgroup-based Out-of-Memory killer.
@@ -1278,6 +1278,14 @@ message ContainerStatus {
     string log_path = 15;
     // Resource limits configuration of the container.
     ContainerResources resources = 16;
+    // Reference to the unique identifier of the image, on the node, as
+    // returned in the image service apis.
+    //
+    // Note: The image_ref above has been historically used by container
+    // runtimes to reference images by digest. To separate and avoid possible
+    // misusage, we now introduce the image_id field, which should always refer
+    // to a unique image identifier on the node.
+    string image_id = 17;
 }
 
 message ContainerStatusResponse {