cri: add warning for untrusted_workload_runtime

samuelkarp · samuelkarp · commit afef7ec64691 · 2023-12-05T22:28:07.000-08:00
Signed-off-by: Samuel Karp &lt;samuelkarp@google.com&gt;
diff --git a/pkg/cri/config/config.go b/pkg/cri/config/config.go
@@ -433,6 +433,7 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W
 		if _, ok := c.ContainerdConfig.Runtimes[RuntimeUntrusted]; ok {
 			return warnings, fmt.Errorf("conflicting definitions: configuration includes both `untrusted_workload_runtime` and `runtimes[%q]`", RuntimeUntrusted)
 		}
+		warnings = append(warnings, deprecation.CRIUntrustedWorkloadRuntime)
 		c.ContainerdConfig.Runtimes[RuntimeUntrusted] = c.ContainerdConfig.UntrustedWorkloadRuntime
 	}
 
diff --git a/pkg/cri/config/config_test.go b/pkg/cri/config/config_test.go
@@ -67,6 +67,7 @@ func TestValidateConfig(t *testing.T) {
 					},
 				},
 			},
+			warnings: []deprecation.Warning{deprecation.CRIUntrustedWorkloadRuntime},
 		},
 		"both untrusted_workload_runtime and runtime[untrusted]": {
 			config: &PluginConfig{
diff --git a/pkg/deprecation/deprecation.go b/pkg/deprecation/deprecation.go
@@ -27,6 +27,8 @@ const (
 	GoPluginLibrary Warning = Prefix + "go-plugin-library"
 	// CRISystemdCgroupV1 is a warning for the `systemd_cgroup` property
 	CRISystemdCgroupV1 Warning = Prefix + "cri-systemd-cgroup-v1"
+	// CRIUntrustedWorkloadRuntime is a warning for the `untrusted_workload_runtime` property
+	CRIUntrustedWorkloadRuntime Warning = Prefix + "cri-untrusted-workload-runtime"
 	// CRIRegistryMirrors is a warning for the use of the `mirrors` property
 	CRIRegistryMirrors Warning = Prefix + "cri-registry-mirrors"
 	// CRIRegistryAuths is a warning for the use of the `auths` property
@@ -49,6 +51,8 @@ var messages = map[Warning]string{
 	GoPluginLibrary: "Dynamically-linked Go plugins as containerd runtimes will be deprecated in containerd v2.0 and removed in containerd v2.1.",
 	CRISystemdCgroupV1: "The `systemd_cgroup` property (old form) of `[plugins.\"io.containerd.grpc.v1.cri\"] is deprecated since containerd v1.3 and will be removed in containerd v2.0. " +
 		"Use `SystemdCgroup` in [plugins.\"io.containerd.grpc.v1.cri\".containerd.runtimes.runc.options] options instead.",
+	CRIUntrustedWorkloadRuntime: "The `untrusted_workload_runtime` property of [plugins.\"io.containerd.grpc.v1.cri\".containerd] is deprecated since containerd v1.2 and will be removed in containerd v2.0. " +
+		"Create an `untrusted` runtime in `runtimes` instead.",
 	CRIRegistryMirrors: "The `mirrors` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0." +
 		"Use `config_path` instead.",
 	CRIRegistryAuths: "The `auths` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.3 and will be removed in containerd v2.0." +

Original file line number	Diff line number	Diff line change
`@@ -433,6 +433,7 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W`
`433`	`433`	`if _, ok := c.ContainerdConfig.Runtimes[RuntimeUntrusted]; ok {`
`434`	`434`	return warnings, fmt.Errorf("conflicting definitions: configuration includes both `untrusted_workload_runtime` and `runtimes[%q]`", RuntimeUntrusted)
`435`	`435`	`}`
	`436`	`+ warnings = append(warnings, deprecation.CRIUntrustedWorkloadRuntime)`
`436`	`437`	`c.ContainerdConfig.Runtimes[RuntimeUntrusted] = c.ContainerdConfig.UntrustedWorkloadRuntime`
`437`	`438`	`}`
`438`	`439`