OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5389

Prashanth684 · 2025-11-03T23:03:29Z

Centos stream 10 dopped the runc package. For now OKD users are following the workaround to edit the MC to point to crun before the upgrade, but this should help with the migration rather than having to intervene manually.

This PR:

checks for presence of the configmap
if MCO is built for OKD, edit the MC so the runtime is crun.
deletes the configmap

Borrows from the implementation here: #4635

openshift-ci-robot · 2025-11-03T23:03:33Z

@Prashanth684: This pull request references OKD-294 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

Centos stream 10 dopped the runc package. For now OKD users are following the workaround to edit the MC to point to crun before the upgrade, but this should help with the migration rather than having to intervene manually.

This PR:

checks for presence of the configmap

if MCO is built for OKD, edit the MC so the runtime is crun.

deletes the configmap

Borrows from the mplementation here: #4635

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-03T23:03:43Z

@Prashanth684: This pull request references OKD-294 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

Centos stream 10 dopped the runc package. For now OKD users are following the workaround to edit the MC to point to crun before the upgrade, but this should help with the migration rather than having to intervene manually.

This PR:

checks for presence of the configmap

if MCO is built for OKD, edit the MC so the runtime is crun.

deletes the configmap

Borrows from the implementation here: #4635

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Prashanth684 · 2025-11-04T17:45:17Z

/test bootstrap-unit

Prashanth684 · 2025-11-04T17:45:24Z

/test okd-scos-e2e-aws-ovn

isabella-janssen · 2025-11-06T10:40:26Z

/retest-required

isabella-janssen · 2025-11-06T10:53:19Z

pkg/controller/container-runtime-config/container_runtime_config_controller.go

+	// Only process master and worker pools for the migration
+	for _, pool := range pools {
+		if pool.Name != ctrlcommon.MachineConfigPoolMaster && pool.Name != ctrlcommon.MachineConfigPoolWorker {
+			continue
+		}


From the context in #4635 (comment), I'm gathering that the intention is to only target default MCPs. What about the arbiter MCP? Should it also be included in this list of default MCPs?

machine-config-operator/pkg/controller/common/constants.go

Lines 66 to 67 in a1ac217

// MachineConfigPoolArbiter is the MachineConfigPool name given to the arbiter

MachineConfigPoolArbiter = "arbiter"

cc @yuqi-zhang Since it looks like you had the original suggestion to scope to default MCPs.

@yuqi-zhang do we need to consider the arbiter here? or are we good with the changes as is?

I think arbiter probably isn't relevant here, since 2-node-with-fencing is not yet GA'ed and even if it was, I don't think there would be any OKD overlap with it atm for upgrades, so we should be good.

So basically this is "forcing" any OKD clusters to use crun since runc is gone on upgrades, is installs still possible for runc if you set it (and is there a guard against it if so, I forget if we deprecated it)? Is RHEL10 also dropping runc? Maybe we need this generally speaking cc @sdodson

Yes, RHEL10 dropped runc but AFAIK the plan is to start building it for OCP as we're hesitant to drop runc until crun sees more adoption even if crun is the default since 4.18.

yuqi-zhang · 2025-11-12T23:57:47Z

pkg/controller/container-runtime-config/container_runtime_config_controller.go

+	// Only process master and worker pools for the migration
+	for _, pool := range pools {
+		if pool.Name != ctrlcommon.MachineConfigPoolMaster && pool.Name != ctrlcommon.MachineConfigPoolWorker {
+			continue
+		}


I think arbiter probably isn't relevant here, since 2-node-with-fencing is not yet GA'ed and even if it was, I don't think there would be any OKD overlap with it atm for upgrades, so we should be good.

So basically this is "forcing" any OKD clusters to use crun since runc is gone on upgrades, is installs still possible for runc if you set it (and is there a guard against it if so, I forget if we deprecated it)? Is RHEL10 also dropping runc? Maybe we need this generally speaking cc @sdodson

pkg/controller/container-runtime-config/container_runtime_config_controller.go

yuqi-zhang · 2025-11-13T00:07:06Z

pkg/controller/container-runtime-config/container_runtime_config_controller.go


 	ctrl.clusterVersionLister = clusterVersionInformer.Lister()
 	ctrl.clusterVersionListerSynced = clusterVersionInformer.Informer().HasSynced
+	ctrl.queue.Add(forceSyncOnUpgrade)


Have you observed this to be necessary? The new controller is expected to re-gen all the MCs so it should always be synced post-new controller deployment

yes - i noticed that before i added this, the upgrade to an image with these changes did not change the MC at all.

pkg/controller/container-runtime-config/container_runtime_config_controller.go

Prashanth684 · 2025-11-20T00:19:12Z

changed to delete the MC rather than editing it. @yuqi-zhang if you could look over and give a final approval, that'd be great

Centos stream 10 dopped the runc package. For now OKD users are following the workaround to edit the MC to point to crun before the upgrade, but this should help with the migration rather than having to intervene manually. This PR: - checks for presence of the configmap - if MCO is built for OKD, edit the MC so the runtime is crun. - deletes the configmap

yuqi-zhang

/lgtm

We should probably open a followup card to track the removal of this code if it hasn't been done already

openshift-ci · 2025-11-24T21:18:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Prashanth684, yuqi-zhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~pkg/controller/container-runtime-config/OWNERS~~ [yuqi-zhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Prashanth684 · 2025-11-25T17:36:30Z

/verified by @Prashanth684

openshift-ci-robot · 2025-11-25T17:36:41Z

@Prashanth684: This PR has been marked as verified by @Prashanth684.

In response to this:

/verified by @Prashanth684

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Prashanth684 · 2025-11-25T17:38:19Z

/lgtm

We should probably open a followup card to track the removal of this code if it hasn't been done already

filed OKD-305. We want to cherry-pick this to 4.20, so once that is done, we might remove it in 4.21 itself.

openshift-ci-robot · 2025-11-25T18:09:30Z

/retest-required

Remaining retests: 0 against base HEAD db39958 and 2 for PR HEAD 8b3391f in total

openshift-ci · 2025-11-25T20:58:53Z

@Prashanth684: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	`7700e81`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/bootstrap-unit	`8b3391f`	link	false	`/test bootstrap-unit`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Prashanth684 · 2025-11-25T21:57:47Z

/test e2e-gcp-op-single-node

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 3, 2025

openshift-ci bot requested review from QiWang19 and mtrmac November 3, 2025 23:04

Prashanth684 force-pushed the mco-crun branch 2 times, most recently from 493b483 to 2c63371 Compare November 3, 2025 23:51

Prashanth684 force-pushed the mco-crun branch from 2c63371 to 7700e81 Compare November 4, 2025 19:25

isabella-janssen reviewed Nov 6, 2025

View reviewed changes

yuqi-zhang reviewed Nov 13, 2025

View reviewed changes

Prashanth684 force-pushed the mco-crun branch from 7700e81 to e601997 Compare November 20, 2025 00:15

Prashanth684 force-pushed the mco-crun branch from e601997 to 8b3391f Compare November 20, 2025 00:27

yuqi-zhang approved these changes Nov 24, 2025

View reviewed changes

openshift-ci bot assigned yuqi-zhang Nov 24, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 24, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 24, 2025

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 25, 2025

openshift-merge-bot bot merged commit 71ee88e into openshift:main Nov 26, 2025
13 of 14 checks passed

	// MachineConfigPoolArbiter is the MachineConfigPool name given to the arbiter
	MachineConfigPoolArbiter = "arbiter"

OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5389

OKD-294: Migrate runtime from runc to crun on an upgrade for OKD #5389

Uh oh!

Conversation

Prashanth684 commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 3, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 3, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Prashanth684 commented Nov 4, 2025

Uh oh!

Prashanth684 commented Nov 4, 2025

Uh oh!

isabella-janssen commented Nov 6, 2025

Uh oh!

isabella-janssen Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

Prashanth684 Nov 10, 2025

Choose a reason for hiding this comment

Uh oh!

yuqi-zhang Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

sdodson Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

yuqi-zhang Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yuqi-zhang Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Prashanth684 Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Prashanth684 commented Nov 20, 2025

Uh oh!

yuqi-zhang left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 24, 2025

Uh oh!

Prashanth684 commented Nov 25, 2025

Uh oh!

openshift-ci-robot commented Nov 25, 2025

Uh oh!

Prashanth684 commented Nov 25, 2025

Uh oh!

openshift-ci-robot commented Nov 25, 2025

Uh oh!

openshift-ci bot commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Prashanth684 commented Nov 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Prashanth684 commented Nov 3, 2025 •

edited

Loading

openshift-ci-robot commented Nov 3, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Nov 3, 2025 •

edited by openshift-ci bot

Loading

yuqi-zhang left a comment •

edited

Loading

openshift-ci bot commented Nov 25, 2025 •

edited

Loading