cri: add warning for untrusted_workload_runtime

samuelkarp · ruiwen-zhao · commit d421b8fda9d0 · 2023-12-14T18:39:37.000Z
Signed-off-by: Samuel Karp <samuelkarp@google.com> (cherry picked from commit afef7ec) Signed-off-by: ruiwen-zhao <ruiwen@google.com>
diff --git a/pkg/cri/config/config.go b/pkg/cri/config/config.go
@@ -351,6 +351,7 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W
 		if _, ok := c.ContainerdConfig.Runtimes[RuntimeUntrusted]; ok {
 			return warnings, fmt.Errorf("conflicting definitions: configuration includes both `untrusted_workload_runtime` and `runtimes[%q]`", RuntimeUntrusted)
 		}
+		warnings = append(warnings, deprecation.CRIUntrustedWorkloadRuntime)
 		c.ContainerdConfig.Runtimes[RuntimeUntrusted] = c.ContainerdConfig.UntrustedWorkloadRuntime
 	}
 
diff --git a/pkg/cri/config/config_test.go b/pkg/cri/config/config_test.go
@@ -64,6 +64,7 @@ func TestValidateConfig(t *testing.T) {
 					},
 				},
 			},
+			warnings: []deprecation.Warning{deprecation.CRIUntrustedWorkloadRuntime},
 		},
 		"both untrusted_workload_runtime and runtime[untrusted]": {
 			config: &PluginConfig{
diff --git a/pkg/deprecation/deprecation.go b/pkg/deprecation/deprecation.go
@@ -27,6 +27,8 @@ const (
 	GoPluginLibrary Warning = Prefix + "go-plugin-library"
 	// CRISystemdCgroupV1 is a warning for the `systemd_cgroup` property
 	CRISystemdCgroupV1 Warning = Prefix + "cri-systemd-cgroup-v1"
+	// CRIUntrustedWorkloadRuntime is a warning for the `untrusted_workload_runtime` property
+	CRIUntrustedWorkloadRuntime Warning = Prefix + "cri-untrusted-workload-runtime"
 	// CRIRegistryMirrors is a warning for the use of the `mirrors` property
 	CRIRegistryMirrors Warning = Prefix + "cri-registry-mirrors"
 	// CRIRegistryAuths is a warning for the use of the `auths` property
@@ -49,6 +51,8 @@ var messages = map[Warning]string{
 	GoPluginLibrary: "Dynamically-linked Go plugins as containerd runtimes are deprecated since containerd v2.0 and removed in containerd v2.1.",
 	CRISystemdCgroupV1: "The `systemd_cgroup` property (old form) of `[plugins.\"io.containerd.grpc.v1.cri\"] is deprecated since containerd v1.3 and will be removed in containerd v2.0. " +
 		"Use `SystemdCgroup` in [plugins.\"io.containerd.grpc.v1.cri\".containerd.runtimes.runc.options] options instead.",
+	CRIUntrustedWorkloadRuntime: "The `untrusted_workload_runtime` property of [plugins.\"io.containerd.grpc.v1.cri\".containerd] is deprecated since containerd v1.2 and will be removed in containerd v2.0. " +
+		"Create an `untrusted` runtime in `runtimes` instead.",
 	CRIRegistryMirrors: "The `mirrors` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0." +
 		"Use `config_path` instead.",
 	CRIRegistryAuths: "The `auths` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.3 and will be removed in containerd v2.0." +

Original file line number	Diff line number	Diff line change
`@@ -351,6 +351,7 @@ func ValidatePluginConfig(ctx context.Context, c *PluginConfig) ([]deprecation.W`
`351`	`351`	`if _, ok := c.ContainerdConfig.Runtimes[RuntimeUntrusted]; ok {`
`352`	`352`	return warnings, fmt.Errorf("conflicting definitions: configuration includes both `untrusted_workload_runtime` and `runtimes[%q]`", RuntimeUntrusted)
`353`	`353`	`}`
	`354`	`+ warnings = append(warnings, deprecation.CRIUntrustedWorkloadRuntime)`
`354`	`355`	`c.ContainerdConfig.Runtimes[RuntimeUntrusted] = c.ContainerdConfig.UntrustedWorkloadRuntime`
`355`	`356`	`}`
`356`	`357`