Failed to pull kong:3.9: helm chart use short name: not anymore supported with cri-o v1.34

[volker-raschek]

What happened?

I used the following installation commands to deploy the kubernetes-dashboard via helm:

# Add kubernetes-dashboard repository
helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
# Deploy a Helm Release named "kubernetes-dashboard" using the kubernetes-dashboard chart
helm upgrade --install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard --create-namespace --namespace kubernetes-dashboard

The deployment kubernetes-dashboard-kong runs into a ImageInspectError:

$ kubectl describe pod kubernetes-dashboard-kong-9b49bb989-xrpt8
...
Events
  Warning  InspectFailed  7s (x6 over 51s)  kubelet            Failed to inspect image "": rpc error: code = Unknown desc = short-name "kong:3.9" did not resolve to an alias and no unqualified-search registries are defined in "/etc/containers/registries.conf"
  Warning  Failed         7s (x6 over 51s)  kubelet            Error: ImageInspectError

I've fixed the deployment manually to get the application running:

  spec:
    template:
      spec:
        containers:
-       - image: kong:3.9
+       - image: docker.io/library/kong:3.9

Nevertheless, I think it would be great to use fully qualified container image names to support users which use cri-o as container runtime interface. The maintainers of cri-o has changed the behavior of unqualified container image names. Images without FQIN will not anymore work until a manually configuration has been applied in /etc/containers/registries.conf:

unqualified-search-registries = [
  "docker.io"
]

What did you expect to happen?

That the deployment works out of the box.

How can we reproduce it (as minimally and precisely as possible)?

As described

Anything else we need to know?

No response

What browsers are you seeing the problem on?

No response

Kubernetes Dashboard version

kubernetes-dashboard-7.14.0

Kubernetes version

1.34

Dev environment

No response

[adonaicosta]

In Oracle/OKE clusters, this is necessary starting from version 1.34, adding more work and more peculiarities. Why don't they just switch to containerd?