OCPBUGS-111648: crio: drop criu support

[haircommander]

for one, it doesn't work with crun, which has been the default for a while. Also, upstream will be deprecating support And finally, there are some policy and security issues with the current implementation

Summary by CodeRabbit

• New Features
  • Added container checkpoint and restore support for master and worker nodes, limited to checkpoint operations.
• Configuration
  • Preserved crun as the default container runtime for worker nodes.
  • Reorganized worker runtime settings for consistent configuration.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 107394db-1427-490b-85bc-d6ce540f1627

📥 Commits

Reviewing files that changed from the base of the PR and between 58020ed and d7a245f.

📒 Files selected for processing (2)

• templates/master/01-master-container-runtime/_base/files/crio.yaml
• templates/worker/01-worker-container-runtime/_base/files/crio.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The CRI-O master and worker configurations add checkpoint-restore settings with container-level support limited to checkpoint operations. The worker configuration reorders the existing crun runtime setting without changing its value.

Changes

CRI-O runtime configuration

Layer / File(s)	Summary
Checkpoint-restore settings and worker runtime ordering templates/master/01-master-container-runtime/_base/files/crio.yaml, templates/worker/01-worker-container-runtime/_base/files/crio.yaml	Both configurations add [crio.checkpoint_restore] with container_level_enabled = "checkpoint_only". The worker configuration moves default_runtime = "crun" before existing logging, cgroup, and sysctl settings.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to d7a24

This localized change updates the worker and master CRI-O templates to drop CRIU support. No actionable merge-blocking risk remains in the supplied evidence, so it is merge-ready after normal checks.

Suggested reviewers: hasan4791, qiwang19

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only two CRI-O YAML templates. The diff adds configuration and reorders a setting; it changes no Ginkgo test titles or test source.
Test Structure And Quality	✅ Passed	The parent-to-HEAD diff changes only two CRI-O YAML files and no Ginkgo test code, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The pull request changes only two CRI-O YAML templates; the parent-to-HEAD diff adds no Ginkgo tests or test files, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only two CRI-O YAML templates; the verified diff adds no Ginkgo e2e tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only CRI-O configuration templates; it adds checkpoint settings and reorders a runtime key, with no deployment, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR diff changes only two CRI-O YAML templates; it does not change OTE binaries or process-level stdout handling.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff changes only two CRI-O YAML templates and adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The HEAD^..HEAD patch only reorders default_runtime and adds CRI-O checkpoint_restore settings; no weak algorithms, custom crypto, or secret comparisons were introduced.
Container-Privileges	✅ Passed	The diff only adds CRI-O checkpoint_restore settings and reorders existing default_runtime; it adds no privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation manifest setting.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only adds CRI-O checkpoint settings and reorders default_runtime; it adds no logging directives or sensitive values.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: removing CRIU support from the CRI-O configuration.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• templates/master/01-master-container-runtime/OWNERS [haircommander]
• templates/worker/01-worker-container-runtime/OWNERS [haircommander]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[haircommander]

/cherry-pick release-5.0

[openshift-cherrypick-robot]

@haircommander: once the present PR merges, I will cherry-pick it on top of release-5.0 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-5.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[haircommander]

/hold

we may take a slightly different approach

[openshift-ci-robot]

@haircommander: This pull request references Jira Issue OCPBUGS-111648, which is invalid:

• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

for one, it doesn't work with crun, which has been the default for a while. Also, upstream will be deprecating support And finally, there are some policy and security issues with the current implementation

Summary by CodeRabbit

• Bug Fixes
• Disabled CRIU support in container runtime configuration for master and worker nodes.
• Ensured crun remains the default runtime for worker nodes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[haircommander]

/unhold

[haircommander]

/retest

[openshift-ci]

@haircommander: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/perfscale-control-plane-6nodes	d7a245f	link	false	/test perfscale-control-plane-6nodes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.