Convert usages of nerdctl and crt to crictl

[KubeKyrie]

What type of PR is this?
/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #10907

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Convert usages of nerdctl and crt to crictl

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: KubeKyrie
Once this PR has been reviewed and has the lgtm label, please assign liupeng0518 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Hi @KubeKyrie. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yankay]

/ok-to-test

[KubeKyrie]

One question is that crictl is not yet a complete replacement for ctr due to a known issue #10670, as this PR ci failure shows.

And on the other hand, crictl does not support load/save image.

@yankay @VannTen @mzaian Could u give some help please?
Thanks.

[VannTen]

One question is that `crictl` is not yet a complete replacement for `ctr` due to a known issue #10670, as this PR ci failure shows.

The CI shows nerdctl failing, so not sure of the relation ? ``` task path: /builds/kargo-ci/kubernetes-sigs-kubespray/roles/download/tasks/download_container.yml:57 changed: [instance-3 -> instance-1(172.30.76.107)] => {"attempts": 1, "changed": true, "cmd": ["/usr/local/bin/crictl", "pull", "quay.io/kubespray/k8s-netchecker-server:v1.2.2"], "delta": "0:00:03.778364", "end": "2024-04-02 06:15:56.326782", "msg": "", "rc": 0, "start": "2024-04-02 06:15:52.548418", "stderr": "", "stderr_lines": [], "stdout": "Image is up to date for sha256:3fe402881a14307b8d56a81a0e123d9a433f8502ac1d77d311123f3c022772ec", "stdout_lines": ["Image is up to date for sha256:3fe402881a14307b8d56a81a0e123d9a433f8502ac1d77d311123f3c022772ec"]} Tuesday 02 April 2024 06:15:56 +0000 (0:00:04.120) 0:05:02.474 ********* TASK [download : Download_container | Save and compress image] ***************** task path: /builds/kargo-ci/kubernetes-sigs-kubespray/roles/download/tasks/download_container.yml:72 fatal: [instance-3 -> instance-1(172.30.76.107)]: FAILED! => {"changed": true, "cmd": "/usr/local/bin/nerdctl -n k8s.io image save -o /builds/kargo-ci/kubernetes-sigs-kubespray/downloads/images/quay.io_kubespray_k8s-netchecker-server_v1.2.2.tar quay.io/kubespray/k8s-netchecker-server:v1.2.2", "delta": "0:00:00.027034", "end": "2024-04-02 06:15:56.693218", "failed_when_result": true, "msg": "non-zero return code", "rc": 1, "start": "2024-04-02 06:15:56.666184", "stderr": "time=\"2024-04-02T06:15:56Z\" level=fatal msg=\"failed to get reader: content digest sha256:16708e34354589f10d0f402e59f7251e0a685a98c1497dffbd84cce4a11a62d6: not found\"", "stderr_lines": ["time=\"2024-04-02T06:15:56Z\" level=fatal msg=\"failed to get reader: content digest sha256:16708e34354589f10d0f402e59f7251e0a685a98c1497dffbd84cce4a11a62d6: not found\""], "stdout": "", "stdout_lines": []} ```

[KubeKyrie]

One question is that crictl is not yet a complete replacement for ctr due to a known issue #10670, as this PR ci failure shows.
The CI shows nerdctl failing, so not sure of the relation ? ```

As discussed in #10907, we use crictl uniformly to pull images.
But just as this CI failure shows:
we first pull image by

crictl pull quay.m.daocloud.io/kubespray/k8s-netchecker-server:v1.2.2

then image save

nerdctl -n k8s.io image save -o  xxx.tar quay.m.daocloud.io/kubespray/k8s-netchecker-server:v1.2.2

an error occurs:

FATA[0000] failed to get reader: content digest sha256:16708e34354589f10d0f402e59f7251e0a685a98c1497dffbd84cce4a11a62d6: not found

This is a known issue #10670, and workaround way is to use ctr to pull image. So I am not sure how to handle it.

[yckaolalala]

Can convert all save/load image operations to only use skopeo ?

- name: Set image save/load command for docker
  set_fact:
    image_save_command: "{{ docker_bin_dir }}/docker save {{ image_reponame }} | gzip -{{ download_compress }} > {{ image_path_final }}"
    image_load_command: "{{ docker_bin_dir }}/docker load < {{ image_path_final }}"
  when: container_manager == 'docker'

- name: Set image save/load command for containerd
  set_fact:
    image_save_command: "{{ bin_dir }}/nerdctl -n k8s.io image save -o {{ image_path_final }} {{ image_reponame }}"
    image_load_command: "{{ bin_dir }}/nerdctl -n k8s.io image load < {{ image_path_final }}"
  when: container_manager == 'containerd'

- name: Set image save/load command for crio
  set_fact:
    image_save_command: "{{ bin_dir }}/skopeo copy containers-storage:{{ image_reponame }} docker-archive:{{ image_path_final }} 2>/dev/null"
    image_load_command: "{{ bin_dir }}/skopeo copy docker-archive:{{ image_path_final }} containers-storage:{{ image_reponame }} 2>/dev/null"
  when: container_manager == 'crio'

[VannTen]

Can convert all save/load image operations to only use skopeo ?

If it does the job. Unfortunately we can't do this with crictl, because CRI does not define a load / save interface (maybe they should...)