fix: align containerd v2 configs with 2.3 schema

[djsly]

Summary

Fix the containerd 2.3.x / NVIDIA GPU Operator config-version mismatch by making AgentBaker-owned Ubuntu 24.04/containerd 2.3 root configs use containerd config schema v4. This prevents NVIDIA-generated v4 drop-ins from being rejected under a lower-version root config.

Changes

• Updated legacy CSE Ubuntu 24.04 containerd v2 templates to declare version = 4 and use the split containerd v2 CRI images/runtime plugin namespaces.
• Updated the Ubuntu 24.04 GB static NVIDIA containerd config to schema v4 and the split images/runtime plugin namespaces.
• Updated aks-node-controller/scriptless containerd templates to emit schema v4 only when containerd_version >= 2.3.0; older or missing versions continue to render schema v2.
• Added parser tests that cover the containerd 2.3 v4 render path and the pre-2.3 v2 compatibility path.

Testing

• GOPROXY=https://proxy.golang.org,direct go test ./pkg/agent/...
• cd aks-node-controller && GOPROXY=https://proxy.golang.org,direct go test ./parser
• cd aks-node-controller && GOPROXY=https://proxy.golang.org,direct go test ./...
• GOPROXY=https://proxy.golang.org,direct make generate (generated agent testdata matched; command stopped during validate-shell on pre-existing SC3014 warnings in unrelated files)

Related

• AB#38808465

🤖 Generated by GitHub Copilot

[Copilot]

Pull request overview

Aligns AgentBaker-managed containerd v2 (Ubuntu 24.04) configuration with the containerd 2.3 config schema v4 so NVIDIA GPU Operator–generated v4 drop-ins are accepted, and updates runtime/plugin namespaces accordingly.

Changes:

• Updated Ubuntu 24.04 containerd v2 root config templates in pkg/agent to declare version = 4.
• Migrated Kata runtime blocks in the v2 templates to the split io.containerd.cri.v1.runtime plugin namespace.
• Updated the Ubuntu 24.04 GB static NVIDIA containerd config to schema v4 and the split images/runtime plugin namespaces.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/agent/baker.go	Updates Ubuntu 24.04 containerd v2 template schema to v4 and moves Kata runtime blocks to the split CRI runtime plugin namespace.
parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml	Updates the Ubuntu 24.04 GB NVIDIA containerd config to schema v4 and split CRI plugin namespaces.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

aks-node-controller/parser/templates/containerd.toml.gtpl:27

• When rendering config schema v4 (containerd >= 2.3), snapshotter / disable_snapshot_annotations should be configured under the images plugin (io.containerd.cri.v1.images) rather than under the runtime plugin’s .containerd section. Keeping these fields under [plugins."{{$runtimePlugin}}".containerd] means overlaybd artifact streaming (and potentially Kata’s snapshot-annotation behavior) may be ignored on v4 configs.

    disable_snapshot_annotations = false
    {{- end}}
    {{- if .GetEnableArtifactStreaming }}
    snapshotter = "overlaybd"
    disable_snapshot_annotations = false

aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl:23

• For config schema v4 (containerd >= 2.3), snapshotter / disable_snapshot_annotations need to be set on the images plugin (io.containerd.cri.v1.images), not under the runtime plugin’s .containerd table. As-is, the v4 path will still emit these fields under [plugins."{{$runtimePlugin}}".containerd], which containerd v2.3’s split plugins are unlikely to consume.

    {{- if .GetIsKata }}
    disable_snapshot_annotations = false
    {{- end}}
    {{- if .GetEnableArtifactStreaming }}
    snapshotter = "overlaybd"