Merge pull request #2071 from SergeyKanzhelev/nri-integration-tests-smoke

first success path test for NRI integration tests

Author: k8s-ci-robot

.github/workflows/containerd.yml

@@ -308,6 +308,21 @@ jobs:
               runtime_type = \"${{matrix.runtime}}\"
           EOF'
 
+          # Enable NRI explicitly to ensure the expected socket path is used.
+          # Containerd 1.7 is EOL soon so only test main branch.
+          # TODO: Remove the condition once 1.7 is removed or extend when specific 2.x branch is added to the test matrix.
+          if [[ "${{ matrix.version }}" == "main" ]]; then
+            sudo bash -c 'cat >> ${BDIR}/config.toml <<EOF
+            [plugins."io.containerd.nri.v1.nri"]
+              disable = false
+              disable_connections = false
+              plugin_path = "/opt/nri/plugins"
+              socket_path = "/var/run/nri/nri.sock"
+          EOF'
+            sudo mkdir -p /var/run/nri
+            sudo mkdir -p /opt/nri/plugins
+          fi
+
           # Remove possibly existing containerd configuration
           sudo rm -rf /etc/containerd
           sudo PATH=$PATH bash -c "/usr/local/bin/containerd -a ${BDIR}/c.sock -root ${BDIR}/root -state ${BDIR}/state -log-level debug &> ${BDIR}/containerd-cri.log &"
@@ -320,8 +335,15 @@ jobs:
           sudo /usr/local/sbin/runc --version
           sudo mount
 
+          # Build critest flags
+          CRITEST_FLAGS="--ginkgo.v --runtime-endpoint=unix:///${BDIR}/c.sock --parallel=8"
+          # TODO: Remove the condition once 1.7 is removed or extend when specific 2.x branch is added to the test matrix.
+          if [[ "${{ matrix.version }}" == "main" ]]; then
+            CRITEST_FLAGS="${CRITEST_FLAGS} --nri-socket=/var/run/nri/nri.sock"
+          fi
+
           TEST_RC=0
-          sudo -E PATH=$PATH critest --ginkgo.v --runtime-endpoint=unix:///${BDIR}/c.sock --parallel=8 || TEST_RC=$?
+          sudo -E PATH=$PATH critest ${CRITEST_FLAGS} || TEST_RC=$?
           test $TEST_RC -ne 0 && cat ${BDIR}/containerd-cri.log
           sudo pkill containerd
           echo "CONTD_CRI_DIR=$BDIR" >> $GITHUB_ENV

.github/workflows/crio.yml

@@ -61,6 +61,16 @@ jobs:
           sudo mkdir -p /etc/crio/crio.conf.d
           printf '[crio.runtime]\nlog_level = "debug"\n[crio.image]\nshort_name_mode = "disabled"\n' | sudo tee /etc/crio/crio.conf.d/01-log-level.conf
 
+      - name: Configure NRI for CRI-O
+        run: |
+          sudo mkdir -p /var/run/nri /opt/nri/plugins
+          sudo tee /etc/crio/crio.conf.d/05-nri.conf <<EOF
+          [crio.nri]
+          enable_nri = true
+          nri_listen = "/var/run/nri/nri.sock"
+          nri_plugin_dir = "/opt/nri/plugins"
+          EOF
+
       - name: Configure CRI-O to use conmon-rs instead of the default conmon
         if: ${{matrix.monitor == 'conmon-rs'}}
         run: |
@@ -94,6 +104,7 @@ jobs:
           set +o errexit
           sudo -E PATH=$PATH critest \
             --runtime-endpoint=unix:///var/run/crio/crio.sock \
+            --nri-socket=/var/run/nri/nri.sock \
             --parallel=$(nproc) \
             --ginkgo.flake-attempts=3 \
             --ginkgo.randomize-all \

Makefile

@@ -222,6 +222,7 @@ test-critest-containerd: ## Run the critest in a container with containerd.
 	# AppArmor tests must be skipped as the containerized environment does not support them.
 	hack/run-e2e-container.sh /usr/local/bin/critest-tools/critest \
 		--runtime-endpoint=unix:///run/containerd/containerd.sock \
+		--nri-socket=/var/run/nri/nri.sock \
 		--ginkgo.vv \
 		--ginkgo.skip="AppArmor" \
 		$(TESTFLAGS)

docs/validation.md

@@ -101,6 +101,55 @@ critest connects to Unix: `unix:///run/containerd/containerd.sock` or Windows: `
 - `-ginkgo.no-color`: Suppress color output in default reporter.
 - `-ginkgo.trace`: Print out the full stack trace when a failure occurs.
 
+### NRI (Node Resource Interface) Testing
+
+- `-nri-socket`: Path to the NRI socket (e.g., `/var/run/nri/nri.sock`). When set, NRI integration tests are enabled. When not set, NRI tests are skipped.
+
+NRI tests validate runtime behavior when NRI plugins are active. They verify plugin lifecycle hooks (RunPodSandbox, StopPodSandbox, RemovePodSandbox, CreateContainer, StartContainer, StopContainer, RemoveContainer), failure handling, retry semantics, blocking behavior, and multi-plugin ordering guarantees.
+
+NRI tests are Linux-only and marked `[Serial]` because they register NRI plugins that affect runtime-wide behavior.
+
+#### Running NRI tests against a local runtime
+
+The following are example configurations. Refer to the official documentation
+for your container runtime for complete and up-to-date setup instructions:
+
+- [NRI repository](https://github.com/containerd/nri) for NRI specification and configuration reference
+- [containerd documentation](https://github.com/containerd/containerd/blob/main/docs/NRI.md) for containerd NRI setup
+- [CRI-O documentation](https://github.com/cri-o/cri-o/blob/main/docs/crio.conf.5.md) for CRI-O NRI configuration
+
+Example containerd config with NRI enabled:
+
+```toml
+[plugins."io.containerd.nri.v1.nri"]
+  disable = false
+  disable_connections = false
+  plugin_path = "/opt/nri/plugins"
+  socket_path = "/var/run/nri/nri.sock"
+```
+
+Create the NRI socket directory and restart containerd:
+
+```sh
+sudo mkdir -p /var/run/nri
+sudo systemctl restart containerd
+```
+
+Then run critest with the NRI socket flag:
+
+```sh
+critest --nri-socket=/var/run/nri/nri.sock
+```
+
+For CRI-O, add an NRI config drop-in at `/etc/crio/crio.conf.d/10-nri.conf`:
+
+```ini
+[crio.nri]
+enable_nri = true
+nri_listen = "/var/run/nri/nri.sock"
+nri_plugin_dir = "/opt/nri/plugins"
+```
+
 ### Other Options
 
 - `-version`: Display version of critest.

go.mod

@@ -3,6 +3,7 @@ module sigs.k8s.io/cri-tools
 go 1.26.3
 
 require (
+	github.com/containerd/nri v0.12.0
 	github.com/distribution/reference v0.6.0
 	github.com/docker/go-units v0.5.0
 	github.com/google/uuid v1.6.0
@@ -41,6 +42,8 @@ require (
 	github.com/buger/jsonparser v1.1.2 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -54,14 +57,17 @@ require (
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/knqyf263/go-plugin v0.9.0 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/runtime-spec v1.3.0 // indirect
 	github.com/pb33f/ordered-map/v2 v2.3.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/tetratelabs/wazero v1.11.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect

go.sum

@@ -10,12 +10,20 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
+github.com/brianvoe/gofakeit/v7 v7.12.1 h1:df1tiI4SL1dR5Ix4D/r6a3a+nXBJ/OBGU5jEKRBmmqg=
+github.com/brianvoe/gofakeit/v7 v7.12.1/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
 github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=
 github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/nri v0.12.0 h1:RvZtyCM64XOB1UmMAFOlfReTTwCd+hE2IEQ5XEpkKA0=
+github.com/containerd/nri v0.12.0/go.mod h1:TGAfPLH4a+qwbv0PxsefPiR+PobYecDj2aXMtz7GQcg=
+github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
+github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
@@ -80,6 +88,8 @@ github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE
 github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/knqyf263/go-plugin v0.9.0 h1:CQs2+lOPIlkZVtcb835ZYDEoyyWJWLbSTWeCs0EwTwI=
+github.com/knqyf263/go-plugin v0.9.0/go.mod h1:2z5lCO1/pez6qGo8CvCxSlBFSEat4MEp1DrnA+f7w8Q=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -112,13 +122,17 @@ github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
 github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.14.1 h1:a7XlXV/nN/l5zFP1FWZYoExpClu1QOPMfWUV2CZ8kEQ=
 github.com/opencontainers/selinux v1.14.1/go.mod h1:LenyElirjUHszfxrjuFqC85HIeXZKumHcKMQtnaDlQQ=
 github.com/pb33f/ordered-map/v2 v2.3.1 h1:5319HDO0aw4DA4gzi+zv4FXU9UlSs3xGZ40wcP1nBjY=
 github.com/pb33f/ordered-map/v2 v2.3.1/go.mod h1:qxFQgd0PkVUtOMCkTapqotNgzRhMPL7VvaHKbd1HnmQ=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
+github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -133,6 +147,8 @@ github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
+github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
 github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
 github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=

hack/setup-containerd.sh

@@ -35,8 +35,17 @@ version = 2
         runtime_type = "${RUNTIME}"
         [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
           SystemdCgroup = false
+  [plugins."io.containerd.nri.v1.nri"]
+    disable = false
+    disable_connections = false
+    plugin_path = "/opt/nri/plugins"
+    socket_path = "/var/run/nri/nri.sock"
 EOF
 
+echo "Setting up NRI socket directory..."
+mkdir -p /var/run/nri
+mkdir -p /opt/nri/plugins
+
 echo "Setting up CNI networking in ${CNI_CONFIG_DIR}..."
 mkdir -p "${CNI_CONFIG_DIR}"
 cat <<EOF > "${CNI_CONFIG_DIR}/10-containerd-net.conflist"

images/containerd-local-test/entrypoint.sh

@@ -30,6 +30,9 @@ fi
 echo "Initializing container environment..."
 setup-containerd.sh
 
+echo "Setting up NRI socket directory..."
+mkdir -p /var/run/nri
+
 echo "Starting containerd..."
 mkdir -p /run/containerd
 

pkg/framework/test_context.go

@@ -117,6 +117,9 @@ type TestContextType struct {
 	UseWebsocketForExec        bool
 	UseWebsocketForAttach      bool
 	UseWebsocketForPortForward bool
+
+	// NRI (Node Resource Interface) settings.
+	NRISocketPath string
 }
 
 // TestContext is a test context.
@@ -181,6 +184,8 @@ func RegisterFlags() {
 	flag.BoolVar(&TestContext.UseWebsocketForExec, "websocket-exec", false, "Use websocket connections over SPDY for exec streaming tests.")
 	flag.BoolVar(&TestContext.UseWebsocketForAttach, "websocket-attach", false, "Use websocket connections over SPDY for attach streaming tests.")
 	flag.BoolVar(&TestContext.UseWebsocketForPortForward, "websocket-portforward", false, "Use websocket connections over SPDY for portforward streaming tests.")
+
+	flag.StringVar(&TestContext.NRISocketPath, "nri-socket", "", "Path to the NRI socket. NRI tests are skipped when not set.")
 }
 
 // LoadYamlConfigFiles loads any external file-based parameters into the TestContextType.