saschagrunert

CRI-O Extended Support Strategy for OpenShift EUS

Executive Summary

OpenShift EUS releases (4.14, 4.16, 4.18, etc.) have 36-month support lifecycles, but CRI-O only provides ~12 months per version. This creates a 24-month gap where EUS customers can't receive security updates without platform upgrades. This document proposes strategies to align CRI-O with OpenShift EUS while reducing maintenance burden.

Current State

OpenShift Lifecycle:

• Standard: 18 months total

saschagrunert

Setup the cluster to use

export FEATURE_GATES=KubeletServiceAccountTokenForCredentialProviders=true
export KUBELET_FLAGS='--image-credential-provider-bin-dir=/path/to/provider/dir --image-credential-provider-config=/path/to/credential-provider-config.yml'

Start Kubernetes, and apply the demo files

saschagrunert

#!/usr/bin/env bash
set -euo pipefail

# Following: https://developer.hashicorp.com/vault/tutorials/kubernetes/vault-secrets-operator

# Install vault
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

helm search repo hashicorp/vault

saschagrunert

{
  "ociVersion": "1.2.0",
  "process": {
    "user": {
      "uid": 0,
      "gid": 0,
      "additionalGids": [0, 10]
    },
    "args": ["sh", "-c", "top"],
    "env": [

saschagrunert

execve("/usr/sbin/ping6", ["ping6", "-c1", "1100:200::3"], 0xffffdc418380 /* 16 vars */) = 0
brk(NULL)                               = 0xaaaabc4f5000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffffb63e4000
faccessat(AT_FDCWD, "/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=9207, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 9207, PROT_READ, MAP_PRIVATE, 3, 0) = 0xffffb63e1000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832

saschagrunert

The k8s.io/cri-client Staging Repository

Timeline: March 7 - May 31

• k/k: External Repository Staging Area

Paperwork

• Mailing list discussion
• Tracking issue: REQUEST: Create kubernetes/cri-client staging repository

saschagrunert

---
# Verify signed image using a public key without a fulcio issued certificate.
apiVersion: config.openshift.io/v1alpha1
kind: ImagePolicy
metadata:
  name: image-is-signed
spec:
  images:
    - hostname:5000/myns/sigstore-signed-with-full-references
  policy:

saschagrunert

package api

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

type ImagePolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ImagePolicySpec   `json:"spec"`

saschagrunert

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrant box for testing
Vagrant.configure("2") do |config|
  config.vm.box = "fedora/35-cloud-base"
  memory = 6144
  cpus = 4

  config.vm.provider :virtualbox do |v|

saschagrunert

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: recreate-backingfsblockdev
spec:
  config:
    ignition:
      version: 3.2.0