Simplify containerd runtime configuration for gVisor

[fvoznika]

The previous code had a copy of config.toml which is easy to get out of
sync. Instead, append the necessary configuration to the existing file
to retain the rest of the configuration.

Also changed the location where runsc is downloaded to use the latest
release instead of hardcondig to a release which gets old quickly.

Fixes google/gvisor#7877

[k8s-ci-robot]

Hi @fvoznika. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[minikube-bot]

Can one of the admins verify this patch?

[spowelljr]

/ok-to-test

[fvoznika]

/retest

[k8s-ci-robot]

@fvoznika: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fvoznika]

There is 1 pending test, does it need to be retried?

[spowelljr]

/ok-to-test

[spowelljr]

k8s bot didn't seem to pickup my comment the first time

[spowelljr]

@fvoznika gVisor test is failing with the following:

Warning FailedCreatePodSandBox 1s (x20 over 4m) kubelet Failed to create pod sandbox: rpc error: code = Unknown desc = failed to get sandbox runtime: no runtime for "runsc" is configured

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[medyagh]

@spowelljr seems to break KVM gvisor test

[spowelljr]

@spowelljr seems to break KVM gvisor test

Yeah, the pod's not coming up
Warning FailedCreatePodSandBox 1s (x19 over 4m) kubelet Failed to create pod sandbox: rpc error: code = Unknown desc = failed to get sandbox runtime: no runtime for "runsc" is configured

[spowelljr]

I got it to work locally, needed to build a new gvisor image

[minikube-pr-bot]

kvm2 driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 14996) |
+----------------+----------+---------------------+
| minikube start | 54.1s    | 50.9s               |
| enable ingress | 28.0s    | 27.0s               |
+----------------+----------+---------------------+

Times for minikube (PR 14996) ingress: 27.2s 29.2s 25.7s 26.2s 26.7s
Times for minikube ingress: 29.2s 28.3s 28.3s 26.7s 27.8s

Times for minikube (PR 14996) start: 49.4s 51.3s 52.1s 51.9s 50.1s
Times for minikube start: 55.8s 55.7s 52.7s 53.7s 52.6s

docker driver with docker runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 14996) |
+----------------+----------+---------------------+
| minikube start | 23.4s    | 22.9s               |
| enable ingress | 44.4s    | 49.2s               |
+----------------+----------+---------------------+

Times for minikube start: 24.4s 22.4s 24.7s 24.4s 21.0s
Times for minikube (PR 14996) start: 22.2s 24.0s 24.6s 22.0s 21.9s

Times for minikube ingress: 48.3s 27.9s 48.8s 48.3s 48.9s
Times for minikube (PR 14996) ingress: 49.8s 48.4s 49.4s 49.3s 48.9s

docker driver with containerd runtime

+----------------+----------+---------------------+
|    COMMAND     | MINIKUBE | MINIKUBE (PR 14996) |
+----------------+----------+---------------------+
| minikube start | 20.9s    | 22.2s               |
| enable ingress | 31.1s    | 28.7s               |
+----------------+----------+---------------------+

Times for minikube ingress: 30.3s 31.4s 31.3s 32.3s 30.3s
Times for minikube (PR 14996) ingress: 31.3s 30.3s 19.4s 31.4s 31.3s

Times for minikube start: 20.8s 23.5s 19.8s 20.1s 20.2s
Times for minikube (PR 14996) start: 23.4s 21.3s 24.2s 21.0s 21.2s

[minikube-pr-bot]

These are the flake rates of all failed tests.

Environment	Failed Tests	Flake Rate (%)
Hyperkit_macOS	TestImageBuild/serial/Setup (gopogh)	0.65 (chart)
QEMU_macOS	TestFunctional/parallel/CpCmd (gopogh)	2.68 (chart)

To see the flake rates of all tests by environment, click here.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fvoznika, spowelljr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [spowelljr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fvoznika]

Thanks a lot for looking into the failures and merging it!!