OCPBUGS-86890: fix: update arbiter crio config

[eggfoobar]

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Chores
  • Updated container runtime configuration to optimize performance and compatibility for the Arbiter deployment environment.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-86890, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The Arbiter container runtime configuration is updated with three CRI-O settings: the default runtime changes from runc to crun, a default annotation enabling run.oci.systemd.subgroup is added, and short name mode is disabled.

Changes

CRI-O Runtime Configuration Update

Layer / File(s)	Summary
CRI-O runtime configuration updates templates/arbiter/01-arbiter-container-runtime/_base/files/crio.yaml	CRI-O default_runtime switches from runc to crun; default_annotations is added to enable run.oci.systemd.subgroup; short_name_mode is set to disabled.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only modifies crio.yaml (YAML configuration), containing zero Ginkgo test file changes. Custom check for test name stability is not applicable.
Test Structure And Quality	✅ Passed	The PR only modifies a YAML configuration file (crio.yaml) with no Ginkgo test code changes, making the test quality check inapplicable.
Microshift Test Compatibility	✅ Passed	PR modifies only CRI-O YAML configuration file; no new Ginkgo e2e tests are added, making the MicroShift test compatibility check not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR contains no Ginkgo e2e tests—only YAML configuration file changes (crio.yaml). SNO test compatibility check does not apply to non-test code.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies CRI-O configuration file, not deployment manifests or controllers. No Kubernetes scheduling constraints present—only container runtime config changes.
Ote Binary Stdout Contract	✅ Passed	PR contains only YAML configuration file changes (crio.yaml), no code changes that could affect OTE binary stdout behavior.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests are added in this PR; only a YAML CRI-O configuration file is modified, making this check not applicable.
No-Weak-Crypto	✅ Passed	PR contains only YAML configuration changes for CRI-O runtime settings; no cryptographic code, weak algorithms, or secret comparisons are present.
Container-Privileges	✅ Passed	The PR modifies CRI-O daemon configuration, not a container/K8s manifest. No privileged configurations found in the changes.
No-Sensitive-Data-In-Logs	✅ Passed	PR modifies only a CRI-O config file with runtime settings. No sensitive data like passwords, tokens, API keys, PII, or credentials are exposed.
Title check	✅ Passed	The title clearly identifies the specific configuration change (arbiter crio config update) and relates directly to the bug being fixed (OCPBUGS-86890), matching the primary purpose of the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-86890, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Chores
• Updated container runtime configuration to optimize performance and compatibility for the Arbiter deployment environment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eggfoobar]

/hold for local validation

[kasturinarra]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eggfoobar, kasturinarra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• templates/arbiter/01-arbiter-container-runtime/OWNERS [eggfoobar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kasturinarra]

/lgtm

Added lgtm after comparing master and arbiter files and found only these three things to be different.
https://github.com/openshift/machine-config-operator/blob/main/templates/master/01-master-container-runtime/_base/files/crio.yaml

[eggfoobar]

/retest-required

[eggfoobar]

/unhold
/verified by local build and deployment update to rhel-10

[openshift-ci-robot]

@eggfoobar: This PR has been marked as verified by local build and deployment update to rhel-10.

Details

In response to this:

/unhold
/verified by local build and deployment update to rhel-10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-86697, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Chores
• Updated container runtime configuration to optimize performance and compatibility for the Arbiter deployment environment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD c13cdd8 and 2 for PR HEAD 294bbd3 in total

[eggfoobar]

The jobs fail due to an issue in the container version of skopeo which will be fixed by openshift/release#79990

Once that's merged in retesting should resolve the issues here

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 9960aad and 1 for PR HEAD 294bbd3 in total

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 56ee9d2 and 0 for PR HEAD 294bbd3 in total

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-86890, which is invalid:

• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Chores
• Updated container runtime configuration to optimize performance and compatibility for the Arbiter deployment environment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eggfoobar]

/jira refresh

[openshift-ci-robot]

@eggfoobar: This pull request references Jira Issue OCPBUGS-86890, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[eggfoobar]

/cherry-pick release-4.22 release-4.21 release-4.20

[openshift-cherrypick-robot]

@eggfoobar: once the present PR merges, I will cherry-pick it on top of release-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.22 release-4.21 release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-bot]

/hold

Revision 294bbd3 was retested 3 times: holding

[eggfoobar]

/unhold
/retest-required

[openshift-ci]

@eggfoobar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@eggfoobar: Jira Issue Verification Checks: Jira Issue OCPBUGS-86890
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-86890 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

update arbtier crio config to keep inline with master and use crun as runc is no longer available in rhel10

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Chores
• Updated container runtime configuration to optimize performance and compatibility for the Arbiter deployment environment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@eggfoobar: new pull request created: #6142

Details

In response to this:

/cherry-pick release-4.22 release-4.21 release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.