fix: change the position of the containerd_extra_args parameter to make the parameter more universal.

[qcu266]

fix: change the position of the containerd_extra_args parameter to make the parameter more universal.

/kind bug

What this PR does / why we need it:

The template parameter containerd_extra_args is currently limited to the TOML global table, which is not versatile enough. It can be adjusted to be under the global table.

In my scenario, it can be configured as follows:

containerd_extra_args: |
  plugins."io.containerd.grpc.v1.cri".device_ownership_from_security_context = true

And this adjustment should not break compatibility.

Which issue(s) this PR fixes:

Fixes #11007

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Change the position of the containerd_extra_args parameter to enhance its universality.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: qcu266 / name: QCU (c63b207)

[k8s-ci-robot]

Welcome @qcu266!

It looks like this is your first PR to kubernetes-sigs/kubespray 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kubespray has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @qcu266. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yankay]

/ok-to-test

[yankay]

Thanks @qcu266

the good idea is awsome.

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qcu266, yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qcu266]

@yankay Is there any issue with this PR? Why not merge?

[VannTen]

the template parameter containerd_extra_args is currently limited to the TOML global table, which is not versatile enough. It can be adjusted to be under the global table.

It's not entirely clear (to me, at least), what this means. Could you add a more thorough explanation or maybe a link explaining what the TOML global table is ?

Please also add a proper release note

@yankay Is there any issue with this PR? Why not merge?

Because reviewers and maintainers don't have infinite time 🤷

[qcu266]

@VannTen "global table" is mean that toml root level table

version = 2
root = "/var/lib/containerd"
state = "/run/containerd"
oom_score = 0

plugins."io.containerd.grpc.v1.cri".device_ownership_from_security_context = true

[grpc]
  max_recv_message_size = 16777216
  max_send_message_size = 16777216

[debug]
  level = "info"

[metrics]
  address = ""
  grpc_histogram = false

[plugins]
  [plugins."io.containerd.grpc.v1.cri"]
    sandbox_image = "k8s.gcr.io/pause:3.9"
    max_container_log_line_size = -1
    enable_unprivileged_ports = false
    enable_unprivileged_icmp = false
    [plugins."io.containerd.grpc.v1.cri".registry]
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://registry-1.docker.io"]

in this case, if plugins."io.containerd.grpc.v1.cri".device_ownership_from_security_context = true add to the end of file, it's mean
plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io".plugins."io.containerd.grpc.v1.cri".device_ownership_from_security_context = true

[VannTen]

Ok that's clearer ! Could you add that explanation (that you can only place thing in the root table in a toml document before the first table heading) in your commit message ? It helps people not familiar enough with toml to understand why we're doing this.

(also, you'll need a release note)

[qcu266]

@VannTen Thank you for your review and suggestions, I have already made the adjustments.

[VannTen]

/lgtm

Thanks.