OCPBUGS-84691: prom rules: add alert for nodes using runc

[haircommander]

relies on a cri-o metric that's emitted when the cluster is using runc
generated with claude

Summary by CodeRabbit

• New Features
  • Added an informational alert (RuncDeprecated) that notifies when the deprecated runc runtime is detected for 10 minutes; includes summary, migration guidance, and a runbook link.
  • Extended CRI-O metrics collection to include a new "default_runtime" metric collector on control-plane and worker nodes.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@haircommander: This pull request references OCPNODE-4446 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

relies on a cri-o metric that's emitted when the cluster is using runc
generated with claude

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Added a new Prometheus alert group runc-deprecated with alert RuncDeprecated that fires when count(container_runtime_crio_default_runtime{runtime="runc"}) > 0 for 10m, and added the default_runtime metrics collector to CRI-O configs for arbiter, master, and worker.

Changes

Cohort / File(s)	Summary
Prometheus Alert Rule install/0000_90_machine-config_01_prometheus-rules.yaml	Added new alert group runc-deprecated containing RuncDeprecated which triggers on count(container_runtime_crio_default_runtime{runtime="runc"}) > 0 for 10m; includes labels namespace: openshift-machine-config-operator, severity: info, and annotations summary, description, runbook_url.
CRI-O Metrics Configs templates/arbiter/01-arbiter-container-runtime/_base/files/crio.yaml, templates/master/01-master-container-runtime/_base/files/crio.yaml, templates/worker/01-worker-container-runtime/_base/files/crio.yaml	Added the "default_runtime" entry to [crio.metrics].metrics_collectors alongside the existing "processes_defunct" in arbiter, master, and worker CRI-O configurations.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR modifies only YAML configuration files (Prometheus rules and CRI-O settings), not Ginkgo test code. No test files are added or modified.
Test Structure And Quality	✅ Passed	This check is not applicable to the pull request. The PR modifies only declarative configuration files (Prometheus alert rule in YAML and CRI-O metrics configuration), not test files.
Microshift Test Compatibility	✅ Passed	This PR does not introduce any Ginkgo e2e tests. The changes consist solely of configuration files: a Prometheus alert rule YAML file and three CRI-O configuration template files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This pull request does not add any Ginkgo e2e tests. The PR modifies only YAML configuration files: a Prometheus alert rules file and three CRI-O configuration files. Since the custom check specifically applies to "When new Ginkgo e2e tests are added," and no such tests exist in this PR, the check is not applicable and passes by default.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR introduces Prometheus alert rules and CRI-O metric collectors; no pod deployments, scheduling constraints, affinity rules, or topology assumptions are added.
Ote Binary Stdout Contract	✅ Passed	PR modifies only configuration files (Prometheus rules and CRI-O YAML configs); no executable Go code entry points are introduced or modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests are being added. The PR only modifies YAML configuration and CRI-O template files.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a Prometheus alert rule for detecting nodes using runc.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@install/0000_90_machine-config_01_prometheus-rules.yaml`:
- Around line 29-30: Fix the grammar typo in the Prometheus alert rule
description: update the description field value (the YAML key "description" in
the rule) to change “support will removed” to “support will be removed” so the
user-facing message reads correctly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 199b41d8-1f05-4044-a1a5-3bacba2e627a

📥 Commits

Reviewing files that changed from the base of the PR and between c3a9db7 and 7e20fb5.

📒 Files selected for processing (1)

• install/0000_90_machine-config_01_prometheus-rules.yaml

[openshift-ci-robot]

@haircommander: This pull request references OCPNODE-4382 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set.

Details

In response to this:

relies on a cri-o metric that's emitted when the cluster is using runc
generated with claude

Summary by CodeRabbit

• New Features
• Added an informational alert that detects use of the deprecated runc container runtime and fires after sustained detection (10 minutes).
• Alert includes a clear summary, detailed migration guidance, and a runbook link to assist operators.
• Targets the machine-config-operator area and is additive (no existing alerts changed).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@haircommander: This pull request references OCPNODE-4383 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

relies on a cri-o metric that's emitted when the cluster is using runc
generated with claude

Summary by CodeRabbit

• New Features
• Added an informational alert that detects use of the deprecated runc container runtime and fires after sustained detection (10 minutes).
• Alert includes a clear summary, detailed migration guidance, and a runbook link to assist operators.
• Targets the machine-config-operator area and is additive (no existing alerts changed).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

{}

[haircommander]

/retest

[haircommander]

/retest

[yuqi-zhang]

Overall seems fine, just some questions in line

[openshift-ci-robot]

@haircommander: This pull request references Jira Issue OCPBUGS-84691, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

relies on a cri-o metric that's emitted when the cluster is using runc
generated with claude

Summary by CodeRabbit

• New Features
• Added an informational alert (RuncDeprecated) that notifies when the deprecated runc runtime is detected for 10 minutes; includes summary, migration guidance, and a runbook link.
• Extended CRI-O metrics collection to include a new "default_runtime" metric collector on control-plane and worker nodes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[haircommander]

/jira refresh
@yuqi-zhang LGTY?

[openshift-ci-robot]

@haircommander: This pull request references Jira Issue OCPBUGS-84691, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh
@yuqi-zhang LGTY?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[yuqi-zhang]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: haircommander, yuqi-zhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [yuqi-zhang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@haircommander: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-upgrade	6c48b96	link	true	/test e2e-aws-ovn-upgrade

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.