From 501dae7c68ab3aeede696c8762e3c216a1d26dd4 Mon Sep 17 00:00:00 2001 From: Manuel Huber Date: Fri, 10 Jul 2026 22:18:22 +0000 Subject: [PATCH] kata-deploy: warn on guest-pull timeout Reuse the kubelet runtimeRequestTimeout validation for guest-pull configurations. Guest pull can also keep kubelet waiting during CreateContainer. Warn when kata-deploy can see that runtimeRequestTimeout is below the same suggested timeout used for EROFS layer conversion. Detect both the regular guest-pull mapping and the experimental force guest-pull configuration so nodes get the warning for either path. Signed-off-by: Manuel Huber Assisted-by: OpenAI --- .../packaging/kata-deploy/binary/src/main.rs | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tools/packaging/kata-deploy/binary/src/main.rs b/tools/packaging/kata-deploy/binary/src/main.rs index c784ec133c..00ba0c8db6 100644 --- a/tools/packaging/kata-deploy/binary/src/main.rs +++ b/tools/packaging/kata-deploy/binary/src/main.rs @@ -446,6 +446,10 @@ async fn install_stage_host_check(config: &config::Config, runtime: &str) -> Res } } + if config_uses_guest_pull(config) { + validate_kubelet_runtime_request_timeout(config, "guest pull").await?; + } + info!("install (host-check): node prerequisites satisfied"); Ok(()) } @@ -706,6 +710,28 @@ fn warn_runtime_request_timeout(operation: &str, detail: &str) { ); } +fn config_uses_guest_pull(config: &config::Config) -> bool { + !config.experimental_force_guest_pull_for_arch.is_empty() + || mapping_contains_value(config.pull_type_mapping_for_arch.as_deref(), "guest-pull") + || config + .custom_runtimes + .iter() + .any(|runtime| runtime.crio_pull_type.as_deref() == Some("guest-pull")) +} + +fn mapping_contains_value(mapping: Option<&str>, expected_value: &str) -> bool { + mapping.is_some_and(|mapping| { + mapping.split(',').any(|entry| { + let value = entry + .split_once(':') + .map(|(_, value)| value) + .unwrap_or(entry) + .trim(); + value == expected_value + }) + }) +} + /// Install stage 1 (artifacts): place kata artifacts/config on the host and set /// up any configured snapshotters. This does not touch CRI configuration, but it /// still needs privileged host access: writing under the host install dir and