node-installer: configure and run tardev-snapshotter

[katexochen]

With this change, we improve the stability of Contrast by deploying our own tardev-snapshotter on the host as part of the node-installer deployment. Previously, the Contrast runtime would use the tardev-snapshotter installed on the host, which is managed by Azure. However, the snapshotter is highly coupled with the guest image, and breaking changes to the snaphotter led to workload pods not being able to start in Contrast. Therefore, we are shipping a pinned snapshotter as part of the runtime. This will also allow running multiple Contrast runtime next to each other that require different versions of the snapshotter.

[burgerdev]

Why is this not tardev-$hash?

[katexochen]

It is set to that a few lines below in case we are on a platform that uses a snapshotter.

[burgerdev]

Ah, I see - thanks.

[burgerdev]

Interestingly, we're already switching on the platform outside these functions:

contrast/node-installer/node-installer.go

Lines 128 to 141 in 59826da

	switch platform {
	case platforms.AKSCloudHypervisorSNP:
	// AKS or any external-containerd based K8s distro: We can just patch the existing containerd config at /etc/containerd/config.toml
	if err := patchContainerdConfig(config.RuntimeHandlerName, runtimeBase, containerdConfigPath, platform); err != nil {
	return fmt.Errorf("patching containerd configuration: %w", err)
	}
	case platforms.K3sQEMUTDX, platforms.RKE2QEMUTDX:
	// K3s or RKE2: We need to extend the configuration template, which, in it's un-templated form, is non-TOML.
	// Therefore just write the TOML configuration fragment ourselves and append it to the template file.
	// This assumes that the user does not yet have a runtime with the same name configured himself,
	// but as our runtimes are hash-named, this should be a safe assumption.
	if err := patchContainerdConfigTemplate(config.RuntimeHandlerName, runtimeBase, containerdConfigPath, platform); err != nil {
	return fmt.Errorf("patching containerd configuration: %w", err)
	}

.

[katexochen]

That's indeed confusing (but necessary with the current structure, as some platforms won't call patchContainerdConfig.

[burgerdev]

Ah, I see - thanks.