use containerd cri image client for pulling sandbox

[ndbaker1]

Issue #, if available:

Description of changes:

• fix sandbox image pinning by using the containerd CRI remote image client to pull the sandbox image
• standardize containerd runtime endpoint usage/definition

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Testing Done

check output on launched instances for 1.29

prior behavior:

# containerd --version
containerd github.com/containerd/containerd 1.7.11 64b8a811b07ba6288238eefc14d898ee0b5b99ba

# journalctl -u nodeadm-run
...
Feb 02 17:14:51 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894091.48107,"caller":"containerd/sandbox.go:17","msg":"Looking up current sandbox image in containerd config.."}
Feb 02 17:14:52 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894092.8455882,"caller":"containerd/sandbox.go:29","msg":"Found sandbox image","image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause:3.5"}
Feb 02 17:14:52 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894092.8456254,"caller":"containerd/sandbox.go:31","msg":"Checking if sandbox image is cached.."}
Feb 02 17:14:53 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894093.4052234,"caller":"containerd/sandbox.go:42","msg":"Fetching ECR authorization token.."}
Feb 02 17:14:53 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894093.5235531,"caller":"containerd/sandbox.go:50","msg":"Pulling sandbox image..","image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause:3.5"}
Feb 02 17:14:54 ip-192-168-75-217.us-west-2.compute.internal nodeadm[1662]: {"level":"info","ts":1706894094.1667416,"caller":"containerd/sandbox.go:55","msg":"Finished pulling sandbox image","image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause:3.5"}
...

# crictl images --pinned
IMAGE                                                              TAG                          IMAGE ID            SIZE                PINNED
602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni-init   v1.12.6-eksbuild.2           9b00a5ea49c8d       22.2MB              false
602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni        v1.12.6-eksbuild.2           267e74075ea62       42.9MB              false
602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/kube-proxy        v1.27.1-minimal-eksbuild.1   ee0b1225fcfed       30MB                false
602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause             3.5                          6996f8da07bd4       299kB               false

updated behavior:

# containerd --version
containerd github.com/containerd/containerd 1.7.11 64b8a811b07ba6288238eefc14d898ee0b5b99ba

# journalctl -u nodeadm-run
...
Feb 02 08:49:21 ip-192-168-48-42.us-west-2.compute.internal nodeadm[1630]: {"level":"info","ts":1706863761.813914,"caller":"containerd/sandbox.go:21","msg":"Looking up current sandbox image in containerd config.."}
Feb 02 08:49:23 ip-192-168-48-42.us-west-2.compute.internal nodeadm[1630]: {"level":"info","ts":1706863763.6452808,"caller":"containerd/sandbox.go:33","msg":"Found sandbox image","image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause:3.5"}
Feb 02 08:49:23 ip-192-168-48-42.us-west-2.compute.internal nodeadm[1630]: {"level":"info","ts":1706863763.6453195,"caller":"containerd/sandbox.go:35","msg":"Fetching ECR authorization token.."}
Feb 02 08:49:23 ip-192-168-48-42.us-west-2.compute.internal nodeadm[1630]: {"level":"info","ts":1706863763.7877693,"caller":"containerd/sandbox.go:41","msg":"Pulling sandbox image..","image":"602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause:3.5"}
Feb 02 08:49:24 ip-192-168-48-42.us-west-2.compute.internal nodeadm[1630]: {"level":"info","ts":1706863764.4324055,"caller":"containerd/sandbox.go:57","msg":"Finished pulling sandbox image","image-ref":"sha256:6996f8da07bd405c6f82a549ef041deda57d1d658ec20a78584f9f436c9a3bb7"}
...

# crictl images --pinned
IMAGE                                                              TAG                          IMAGE ID            SIZE                PINNED
602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni-init   v1.12.6-eksbuild.2           9b00a5ea49c8d       22.2MB              false
602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni        v1.12.6-eksbuild.2           267e74075ea62       42.9MB              false
602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/kube-proxy        v1.27.1-minimal-eksbuild.1   ee0b1225fcfed       30MB                false
602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pause             3.5                          6996f8da07bd4       299kB               true

See this guide for recommended testing for PRs. Some tests may not apply. Completing tests and providing additional validation steps are not required, but it is recommended and may reduce review time and time to merge.

[Issacwww]

🚀