OCPNODE-3833: PodAndContainerStatsFromCRI as Tech-Preview

[dgrisonnet]

The feature graduated to Beta in Kubernetes 1.37: kubernetes/enhancements#2371. We want to start enabling as TP as soon as 5.0 to test it downstream ahead of 5.1.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@dgrisonnet: This pull request references OCPSTRAT-2556 which is a valid jira issue.

Details

In response to this:

The feature graduated to Beta in Kubernetes 1.37: kubernetes/enhancements#2371. We want to start enabling as TP as soon as 5.0 to test it downstream ahead of 5.1.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @dgrisonnet! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[dgrisonnet]

/cc @haircommander @JoelSpeed

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds the exported PodAndContainerStatsFromCRI feature gate, enabling it for DevPreviewNoUpgrade and TechPreviewNoUpgrade configurations. Updates the feature-gate matrix and 4.10 Hypershift and SelfManagedHA manifests to list the gate as enabled for preview configurations and disabled for Default and OKD configurations.

Suggested reviewers: barbacbd, sadasu, vr4manta

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were added or modified; the diff only changes feature-gate docs, manifests, and one feature-gate registration.
Test Structure And Quality	✅ Passed	No test code changed in this PR; only feature-gate metadata/registration files were touched, so the Ginkgo-specific quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo/e2e tests were added or changed; the PR only updates feature-gate code, manifests, and docs.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes feature-gate code and manifests, so SNO-specific test compatibility is not implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only adds a feature gate and updates feature-gate manifests/docs; no affinity, nodeSelector, replica, or topology-dependent scheduling logic was added.
Ote Binary Stdout Contract	✅ Passed	The PR only adds a feature-gate initializer and manifest entries; no main/init/TestMain/RunSpecs setup or stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only adds feature-gate declarations and manifests; no Ginkgo e2e test code or network/I/O assumptions were introduced.
No-Weak-Crypto	✅ Passed	Diff only adds a feature gate and manifests; scans found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	PR only adds a feature gate and updates feature-gate manifests; no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation changes found.
No-Sensitive-Data-In-Logs	✅ Passed	Touched files only add static feature-gate entries/YAML; scans found no log statements or sensitive-data exposures.
Title check	✅ Passed	The title matches the main change by calling out PodAndContainerStatsFromCRI as Tech Preview.
Description check	✅ Passed	The description is directly related, explaining why the feature is being enabled as Tech Preview.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-rh-openshift]

PR Summary by Qodo

Enable PodAndContainerStatsFromCRI as Tech Preview / Dev Preview (no-upgrade)

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Register PodAndContainerStatsFromCRI as a supported feature gate (KEP-2371).
• Enable the gate for TechPreviewNoUpgrade and DevPreviewNoUpgrade feature sets.
• Propagate the gate into payload FeatureGate manifests and the feature matrix docs.

Diagram

graph TD
  A["features/features.go"] --> B["FeatureGate registry"] --> C["payload featuregates"] --> D[("Cluster FeatureGate")]
  A --> E["features.md"]
  D --> F["Kubelet/CRI stats"]

  subgraph Legend
    direction LR
    _code["Code"] ~~~ _cfg["Config manifest"] ~~~ _cr[("Cluster CR")]
  end

Loading

High-Level Assessment

This matches the established pattern for introducing/graduating a Kubernetes feature gate in this repo: register it once with metadata, enable it only in the intended preview feature-sets, and ensure payload manifests and docs reflect the same policy. Alternatives like component-specific toggles or deferring until the next major release would reduce downstream test coverage and diverge from the feature-set mechanism.

Files changed (10) +33 / -0

Enhancement (1) +8 / -0

features.goRegister PodAndContainerStatsFromCRI and enable for TP/DevPreview (no-upgrade) +8/-0

Register PodAndContainerStatsFromCRI and enable for TP/DevPreview (no-upgrade)

• Adds a new FeatureGate definition for PodAndContainerStatsFromCRI with node ownership metadata and a link to KEP-2371. Enables it specifically in TechPreviewNoUpgrade and DevPreviewNoUpgrade.

features/features.go

Documentation (1) +1 / -0

features.mdAdd PodAndContainerStatsFromCRI to the feature-set matrix +1/-0

Add PodAndContainerStatsFromCRI to the feature-set matrix

• Documents the PodAndContainerStatsFromCRI gate in the feature table so consumers can discover it and understand its availability across feature-sets.

features.md

Other (8) +24 / -0

featureGate-4-10-Hypershift-Default.yamlInclude PodAndContainerStatsFromCRI in HyperShift Default manifest (disabled list) +3/-0

Include PodAndContainerStatsFromCRI in HyperShift Default manifest (disabled list)

• Adds PodAndContainerStatsFromCRI to the HyperShift Default FeatureGate payload manifest so the gate is explicitly tracked for that feature-set (kept non-enabled by default via placement in the disabled list).

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yamlEnable PodAndContainerStatsFromCRI in HyperShift DevPreviewNoUpgrade manifest +3/-0

Enable PodAndContainerStatsFromCRI in HyperShift DevPreviewNoUpgrade manifest

• Adds PodAndContainerStatsFromCRI to the HyperShift DevPreviewNoUpgrade FeatureGate payload manifest so clusters in that preview channel can exercise the CRI stats behavior.

payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml

featureGate-4-10-Hypershift-OKD.yamlInclude PodAndContainerStatsFromCRI in HyperShift OKD manifest (disabled list) +3/-0

Include PodAndContainerStatsFromCRI in HyperShift OKD manifest (disabled list)

• Adds PodAndContainerStatsFromCRI to the HyperShift OKD FeatureGate payload manifest so the gate is represented in OKD, without enabling it by default.

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yamlEnable PodAndContainerStatsFromCRI in HyperShift TechPreviewNoUpgrade manifest +3/-0

Enable PodAndContainerStatsFromCRI in HyperShift TechPreviewNoUpgrade manifest

• Adds PodAndContainerStatsFromCRI to the HyperShift TechPreviewNoUpgrade FeatureGate payload manifest to allow early downstream validation ahead of broader enablement.

payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-Default.yamlInclude PodAndContainerStatsFromCRI in SelfManagedHA Default manifest (disabled list) +3/-0

Include PodAndContainerStatsFromCRI in SelfManagedHA Default manifest (disabled list)

• Adds PodAndContainerStatsFromCRI to the SelfManagedHA Default FeatureGate payload manifest so the gate is explicitly enumerated for Default (kept non-enabled by default via placement in the disabled list).

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yamlEnable PodAndContainerStatsFromCRI in SelfManagedHA DevPreviewNoUpgrade manifest +3/-0

Enable PodAndContainerStatsFromCRI in SelfManagedHA DevPreviewNoUpgrade manifest

• Adds PodAndContainerStatsFromCRI to the SelfManagedHA DevPreviewNoUpgrade FeatureGate payload manifest to support preview testing on the SelfManagedHA topology.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml

featureGate-4-10-SelfManagedHA-OKD.yamlInclude PodAndContainerStatsFromCRI in SelfManagedHA OKD manifest (disabled list) +3/-0

Include PodAndContainerStatsFromCRI in SelfManagedHA OKD manifest (disabled list)

• Adds PodAndContainerStatsFromCRI to the SelfManagedHA OKD FeatureGate payload manifest so the gate is represented in OKD without being enabled by default.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yamlEnable PodAndContainerStatsFromCRI in SelfManagedHA TechPreviewNoUpgrade manifest +3/-0

Enable PodAndContainerStatsFromCRI in SelfManagedHA TechPreviewNoUpgrade manifest

• Adds PodAndContainerStatsFromCRI to the SelfManagedHA TechPreviewNoUpgrade FeatureGate payload manifest to allow early downstream coverage in the Tech Preview channel.

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

[openshift-ci-robot]

@dgrisonnet: This pull request references OCPNODE-3833 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

The feature graduated to Beta in Kubernetes 1.37: kubernetes/enhancements#2371. We want to start enabling as TP as soon as 5.0 to test it downstream ahead of 5.1.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-for-rh-openshift]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[JoelSpeed]

/lgtm
/override-sticky ci/prow/verify-hypershift-integration

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [JoelSpeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dgrisonnet]

/retest-required

[dgrisonnet]

/retest-required

[haircommander]

what are the plans for exposing the stats config to container runtime config? i personally think that'll be a promising aspect of this feature, where customers can choose which controllers they want to collect stats for. That also could allow for us to tune the stats collection aspects (like eventually https://redhat.atlassian.net/browse/OCPSTRAT-2346 as well as collection period)

[dgrisonnet]

For https://redhat.atlassian.net/browse/OCPSTRAT-2346 I am working on a different approach than the stats API one.

To me it should be treated as an actual bug in how cri-o (and cadvisor) report network metrics. I want to leverage the fact that the runtime is aware of host network enabled pods: https://github.com/cri-o/cri-o/blob/11f2b51a5b6e9ff42dcd148b3df16858b2c2897f/internal/lib/sandbox/sandbox.go#L70 to filter-out pod-specific interfaces.

This could take two shapes:

1. I build a cache of pod-owned interfaces and skip them from host-network pod metrics
2. I get the list of interfaces from netlink and remove the veth ones. This approach could be brittle if the CNI plugins ever decide to use another type of interfaces for pods

[haircommander]

yeah I was thinking something like approach 1, though I worry about treating it like a bug and unilaterally making the change, in case users have problems with it. I'm open to how you want to approach, but I was imagining it'd be configurable (default on, but upgrades would keep off with an MC or smth)

[dgrisonnet]

I am still on the fence on whether this should be configurable or on by default. Once I have a proof of concept ready, I'll open a PR and we can discuss that there

/retest-required

[openshift-ci]

@dgrisonnet: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-serial-techpreview-1of2	bd6d9df	link	true	/test e2e-aws-serial-techpreview-1of2
ci/prow/e2e-aws-serial-techpreview-2of2	bd6d9df	link	true	/test e2e-aws-serial-techpreview-2of2
ci/prow/verify-hypershift-integration	bd6d9df	link	true	/test verify-hypershift-integration
ci/prow/e2e-aws-ovn-techpreview	bd6d9df	link	true	/test e2e-aws-ovn-techpreview

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.