Kubernetes and CRI release conformance

The stackie-kubernetes-conformance binary is the release-only proof that the pinned upstream K3s kubelet uses Stackie’s CRI v1 plugin without a container-runtime fallback. It first proves one catalog-mapped image and one ordinary OCI image through a real Kubernetes node, then stops K3s, requires a clean dedicated CRI endpoint, and runs the unmodified version-matched upstream critest suite.

The runner has no focus, skip, retry, flake-attempt, label, or source-patch option. Its only critest behavior inputs are the runtime and image endpoints. Fixed JSON and JUnit destinations are added solely to collect evidence. The compact public summary binds exact artifact and traceability hashes; raw process logs and upstream reports remain private.

Supported release profile

Every upstream artifact comes from the exact HTTPS URL in the plugin’s checked-in lock. Stackie enforces the byte ceiling while downloading, verifies SHA-256 before use, and re-verifies cached bytes. A concurrent run cannot replace an existing cache entry.

What the release proof does

In text: Stackie verifies the artifacts, starts an agentless K3s server on a reserved loopback port, and then starts a separate K3s agent. That agent’s upstream kubelet receives the same explicit Stackie endpoint for both CRI services. The runner requires exactly one Ready node, a Stackie runtime identity, and no embedded containerd socket. It then observes the catalog annotation and HTTP behavior of mapped nginx plus the digest and log marker of unmatched busybox. After deleting both pods, it stops agent then server, proves that the endpoint is empty, and gives that dedicated endpoint to the complete upstream suite.

K3s supplies the API server, controllers, scheduler, kubelet, and client behavior. Stackie does not reimplement Kubernetes. Managed EKS, GKE, and AKS support is a separate Spaceport follow-up.

Run the release proof

Build the separately selectable conformance package from the exact release commit:

cargo build --locked --release -p stackie-plugin-kubernetes --features conformance --bin stackie-kubernetes-conformance

Start the release CRI plugin with real Mocker compatibility and Stackied workload dependencies on a new dedicated socket. Then choose a reusable artifact cache and two new absolute directories. The run and evidence directories must not already exist or contain each other.

target/release/stackie-kubernetes-conformance run \
  --artifact-dir /var/cache/stackie/kubernetes-conformance \
  --evidence-dir /var/lib/stackie/conformance/evidence-000120 \
  --runtime-endpoint unix:///run/stackie/conformance-000120/cri-v1.sock \
  --image-endpoint unix:///run/stackie/conformance-000120/cri-v1.sock \
  --run-root /var/lib/stackie/conformance/run-000120 \
  --traceability /src/stackie/crates/stackie-plugin-cri/cri-traceability.yaml \
  --release-commit 0123456789abcdef0123456789abcdef01234567

Replace the example object ID with the exact lowercase 40-character parent release commit. The host needs the privileges required by real K3s and the pinned OCI runtime. The endpoint must not be shared with another kubelet, suite, or user workload.

The upstream suite receives exactly the two configurable endpoint arguments plus fixed report destinations:

--runtime-endpoint <dedicated endpoint>
--image-endpoint <same dedicated endpoint>
--report-dir <private fixed directory>
--ginkgo.json-report critest.json
--ginkgo.junit-report critest.xml

The runner exposes no focus, skip, label, fail-fast, retry, flake-attempt, repeat, alternate-test, or source-patch option.

Release decision table

Stackie-selected skips are never accepted. A newly legitimate upstream platform, capability, or NRI automatic skip must first be sourced in the canonical CRI applicability overlay, regenerated into traceability, and reviewed before another unmodified run.

Interruption and private evidence

The runner stores its random server token, K3s logs, and upstream reports in owner-only files. It reserves unique server, agent load-balancer, and mapped host ports until the corresponding owner binds them. On interruption it deletes smoke pods when possible, stops agent before server, reaps owned children, and force-cleans suite-owned CRI state after kubelet stops.

If the foreground process or host is lost, do not kill K3s by name and do not delete the run directory. Recover the exact marker-owned run:

target/release/stackie-kubernetes-conformance recover \
  --run-root /var/lib/stackie/conformance/run-000120

Recovery requires each live PID’s verified executable, role, complete argument hash, and owned run-root argument to match /proc. It refuses PID reuse or marker tampering before sending a signal. It cleans only the recorded endpoint and removes only the exact marker-owned directory.

Raw files under evidence/private/ are controlled release-attempt evidence; do not attach them to ordinary tickets or publish them. The owner-only release-evidence.json is the compact review input: it binds the release commit, platform, artifact and traceability hashes, redacted endpoint identity, topology facts, both smoke outcomes, report hashes, sourced skips, denominator counts, and the required 100% applicable passage.