Sandbox container image being GC'd in 1.29 about bottlerocket HOT 8 CLOSED

#3757 is merged and this fix will be in the next release. We will update this issue when it is available.

from bottlerocket.

For anyone affected, @cartermckinnon shared a workaround of overriding the sandbox image URI to one that doesn't require credentials.

This can be done through user-data settings:

[settings.kubernetes]
pod-infra-container-image = "registry.k8s.io/pause:3.9"

Or this:

[settings.kubernetes]
pod-infra-container-image = "public.ecr.aws/eks-distro/kubernetes/pause:v1.29.0-eks-1-29-latest"

from bottlerocket.

@z0rc Thanks for opening this issue! we're able to reproduce the issue and work on the fix now!

from bottlerocket.

@henry118 is looking into this in containerd/containerd#9726.

Although Bottlerocket is on a version of containerd (1.6.26) that supports the sandbox image pinning required by kubelet 1.29, that pinning is not currently happening when the sandbox image is pulled by its containerd client (host-ctr). That client is used in order to support pulling from private ECR repositories.

from bottlerocket.

We have released 1.19.1 which should resolve this issue.

from bottlerocket.

Applying a DaemonSet to use the sandbox image should prevent the image from being garbage collected. A DaemonSet template and instructions can be found below.

Sandbox Workaround

from bottlerocket.

any updates on a fix ?

from bottlerocket.

@doramar97 there is a PR in review:

#3757

from bottlerocket.