Description

CRI plugin monitors ImageCreate events and calls CRIImageService.UpdateImage to update references and labels.

UpdateImage calls getLabels to calculate the labels for the image. getLabels will add the pinned image label to an image if the image matches a configured pinned image.

Usually the pinned image is configured as reference, e.g this is the default config in CRI:

[plugins.'io.containerd.cri.v1.images'.PinnedImages]
  sandbox = 'registry.k8s.io/pause:3.9'  

However the argument passed by UpdateImage to getLabels is the image id, which is a SHA value, e.g. sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c. Therefore the pause image is never pinned correctly.

Note that the same getLabels routine is also called by PullImage which correctly passes the image ref value.

Should we update the UpdateImage routine to pass image ref the same way?

Steps to reproduce the issue

1. ctr -n k8s.io i pull --local registry.k8s.io/pause:3.9
2. crictl images -v
ID: sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c
RepoTags: registry.k8s.io/pause:3.9
Size: 321520
Uid: &Int64Value{Value:65535,}

Describe the results you received and expected

1. ctr -n k8s.io i pull --local registry.k8s.io/pause:3.9
2. crictl images -v
ID: sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c
RepoTags: registry.k8s.io/pause:3.9
Size: 321520
Uid: &Int64Value{Value:65535,}
Pinned: true

What version of containerd are you using?

main

Any other relevant information

None

Show configuration if it is related to CRI plugin.

default config