with containerd v2 'kubeadm init' reports 'detected that the sandbox image "" of the container runtime is inconsistent with that used by kubeadm'

[robertdahlem]

What happened?

Installing Kubernetes v1.32 with containerd v2.0.1, runc v1.2.3 and cni_plugins v1.6.1. /etc/containerd/config.toml is just the output of /usr/local/bin/containerd config default

kubadm init succeeds, but reports:

W0105 15:55:18.584951 7068 checks.go:846] detected that the sandbox image "" of the container runtime is inconsistent with that used by kubeadm.It is recommended to use "registry.k8s.io/pause:3.10" as the CRI sandbox image.

It seems to read something that containerd v2 no longer provides.

What did you expect to happen?

kubadm init succeeds with no warning regarding sandbox image

How can we reproduce it (as minimally and precisely as possible)?

Install containerd, runc, cni_plugins and kubeadm.

/root/kubernetes.init.conf:

apiVersion: kubeadm.k8s.io/v1beta4
kind: InitConfiguration
---
apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/16
---
apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: nftables

# kubeadm init --config=/root/kubernetes.init.conf

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
Client Version: v1.32.0
Kustomize Version: v5.5.0
Server Version: v1.32.0

Cloud provider

None. Installing on VMs.

OS version

# On Linux:
$ cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="9.4 (Plow)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="9.4"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Red Hat Enterprise Linux 9.4 (Plow)"
ANSI_COLOR="0;31"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:redhat:enterprise_linux:9::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9"
BUG_REPORT_URL="https://issues.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 9"
REDHAT_BUGZILLA_PRODUCT_VERSION=9.4
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.4"
$ uname -a
Linux kubmaster1.my.domain 5.14.0-427.42.1.el9_4.x86_64 kubernetes/kubernetes#1 SMP PREEMPT_DYNAMIC Fri Oct 18 14:35:40 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>
containerd v2.0.1
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
runc v1.2.3

cni_plugins v1.6.1
</details>

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[thisisharrsh]

Hi @robertdahlem, Thank you for raising this issue, as most of the users are facing this issue.

[thisisharrsh]

As a quick resolution, we can fix the /etc/containerd/config.toml file and refer to the correct sandbox image.

[thisisharrsh]

And then we can update the configuration, restart the containerd service.

[pacoxu]

cc @neolit123
/area kubeadm
/sig cluster-lifecycle

We may fix the warning and do a cherry-pick.

[thisisharrsh]

As in the code file for this, we can add the logic for attempting to configure the runtime with the correct sandbox image.
https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/app/preflight/checks.go#L841C2-L848C3

[pacoxu]

For containerd 1.7,

[root@prod-master1 ~]# crictl info | jq  .config.sandboxImage
"10.5.14.100/registry.k8s.io/pause:3.9"

For containerd 2.0,

[root@paco ~]# crictl info | jq  .config.sandboxImage
null

https://github.com/kubernetes/kubernetes/blob/9fc9ddc7bceca86e805f674caff7d7acf31fad6c/cmd/kubeadm/app/util/runtime/runtime.go#L274-L298

[thisisharrsh]

related PR.