Invoke crio dedup if enabled at startup

[ngopalak-redhat]

- What I did

Run cri-o dedup at startup if enabled

cc: @asahay19 @haircommander

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• New Features
  • Added CRI-O image deduplication support that can run during node startup.
  • Introduced an auto-enabled one-shot service that performs physical-disk deduplication when the feature is turned on, and skips cleanly otherwise.
  • Implemented a configuration toggle to control deduplication, with dedup disabled by default.
• Tests
  • Added an extended test suite to verify the default behavior and check service logs.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ngopalak-redhat
Once this PR has been reviewed and has the lgtm label, please assign proietfb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

Walkthrough

This PR adds CRI-O dedup boot-time wiring: a default-disabled env file, a guarded shell script, a systemd oneshot unit, and an extended-privilege test for the disabled path.

Changes

CRI-O Dedup Boot Flow

Layer / File(s)	Summary
Config and script templates/common/_base/files/crio-dedup-enabled.yaml, templates/common/_base/files/crio-dedup.yaml	Adds /etc/crio-dedup-enabled.env with CRIO_IMAGE_DEDUP=false and /usr/local/sbin/crio-dedup.sh with enablement, runtime, and command execution checks.
Systemd unit and test templates/common/_base/units/crio-dedup.service.yaml, test/extended-priv/mco.go	Adds crio-dedup.service boot ordering and an extended-privilege test that verifies the env file and journal output on a worker node.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: running CRI-O dedup at startup when enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only changes a YAML template and adds no Ginkgo tests or titles, so there are no unstable test names to flag.
Test Structure And Quality	✅ Passed	No Ginkgo test files were added or changed; the PR only updates a CRI-O dedup shell script.
Microshift Test Compatibility	✅ Passed	PR only adds a YAML template shell script; no Ginkgo e2e tests or MicroShift-unsupported APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only adds YAML templates/scripts for CRI-O dedup; diff contains no Ginkgo/e2e test files or SNO-sensitive test code.
Topology-Aware Scheduling Compatibility	✅ Passed	Only node-local file/systemd templates were added; no pod replicas, affinities, selectors, PDBs, or topology-spread rules were introduced.
Ote Binary Stdout Contract	✅ Passed	PASS: The PR only changes a YAML template for crio-dedup; no Go/main/TestMain/init code or binary stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only adds YAML/service templates; no Ginkgo e2e tests or IPv4/external-network assumptions were introduced.
No-Weak-Crypto	✅ Passed	The added YAML/systemd/bash files contain no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB use, no custom crypto, and no secret/token comparisons.
Container-Privileges	✅ Passed	No privileged/root/securityContext settings were added; the PR only updates CRI-O dedup templates and a script, with no container/K8s manifest privileges present.
No-Sensitive-Data-In-Logs	✅ Passed	Only generic status messages and a boolean env value are logged; no passwords, tokens, PII, hostnames, or customer data are exposed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

templates/common/_base/files/crio-dedup.yaml (1)

18-22: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Prefer systemctl is-active for the running-service check.

systemctl status ... >/dev/null 2>&1 conflates several distinct non-zero exit states (dead, failed, not-found); systemctl is-active --quiet is the purpose-built, scripting-friendly check.

♻️ Proposed refactor

-    if systemctl status crio.service >/dev/null 2>&1; then
+    if systemctl is-active --quiet crio.service; then
         echo "CRI-O service is already running, skipping dedup"
         exit 0
     fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@templates/common/_base/files/crio-dedup.yaml` around lines 18 - 22, The CRI-O
running-service check in the dedup script should use the purpose-built
active-state probe instead of the broader status command. Update the service
check in the script that handles the crio.service guard to use systemctl
is-active --quiet so it only treats an actually running service as active, while
preserving the existing skip-and-exit behavior in the same control flow.

templates/common/_base/units/crio-dedup.service.yaml (1)

6-7: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Unnecessary network dependency for a local dedup operation.

crio dedup deduplicates local image storage and doesn't need network; requiring network-online.target before this unit (which itself gates crio.service via Before=) can add avoidable boot latency if network-online is slow to reach.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@templates/common/_base/units/crio-dedup.service.yaml` around lines 6 - 7,
Remove the unnecessary network gating from the crio dedup unit so it no longer
waits on network-online.target before starting. Update the
crio-dedup.service.yaml unit stanza around the dedup service definition to drop
the Wants=network-online.target dependency and adjust the After= ordering so
crio dedup only keeps the firstboot-osupdate.target relationship and other
required local startup ordering.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/common/_base/files/crio-dedup.yaml`:
- Line 6: The dedup script is too strict because `set -e` in `crio-dedup.yaml`
lets `/usr/bin/crio dedup` failures fail the unit and block `crio.service`
startup. Update the `crio-dedup` script to make the dedup step best-effort,
either by removing the fail-fast behavior or explicitly swallowing non-zero exit
codes around the dedup command so the unit always succeeds. Keep the change
localized to the dedup logic and ensure the service can continue even when dedup
fails.

---

Nitpick comments:
In `@templates/common/_base/files/crio-dedup.yaml`:
- Around line 18-22: The CRI-O running-service check in the dedup script should
use the purpose-built active-state probe instead of the broader status command.
Update the service check in the script that handles the crio.service guard to
use systemctl is-active --quiet so it only treats an actually running service as
active, while preserving the existing skip-and-exit behavior in the same control
flow.

In `@templates/common/_base/units/crio-dedup.service.yaml`:
- Around line 6-7: Remove the unnecessary network gating from the crio dedup
unit so it no longer waits on network-online.target before starting. Update the
crio-dedup.service.yaml unit stanza around the dedup service definition to drop
the Wants=network-online.target dependency and adjust the After= ordering so
crio dedup only keeps the firstboot-osupdate.target relationship and other
required local startup ordering.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bfc6f723-b29c-48e0-b034-69dfa76fb7f5

📥 Commits

Reviewing files that changed from the base of the PR and between 88815d3 and e6d0c36.

📒 Files selected for processing (3)

• templates/common/_base/files/crio-dedup-enabled.yaml
• templates/common/_base/files/crio-dedup.yaml
• templates/common/_base/units/crio-dedup.service.yaml

[ngopalak-redhat]

/cherry-pick release-4.20

[openshift-cherrypick-robot]

@ngopalak-redhat: once the present PR merges, I will cherry-pick it on top of release-4.20 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.