kubeadm: added container runtime version check to preflight

[carlory]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR is related to:

Part of kubernetes/kubeadm#3229

Special notes for your reviewer:

Does this PR introduce a user-facing change?

kubeadm: added a new preflight check `ContainerRuntimeVersion ` to validate if the installed container runtime supports the RuntimeConfig gRPC method. If the container runtime does not support the RuntimeConfig gRPC method, kubeadm will print a warning message. 

Once Kubernetes 1.36 is released, the kubelet might refuse to start if the CRI runtime does not support this feature. More information can be found in https://kubernetes.io/blog/2025/09/12/kubernetes-v1-34-cri-cgroup-driver-lookup-now-ga/.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP]: https://kep.k8s.io/4033

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: carlory

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kubeadm/OWNERS [carlory]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[carlory]

/hold

[pacoxu]

kubeadm: added a new preflight check to validate if the container runtime supports the RuntimeConfig gRPC method. If the container runtime does not support the RuntimeConfig gRPC method, a warning is printed.

https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/cri-api/README.md#v128

• kubelet: get cgroup driver config from CRI kubelet: get cgroup driver config from CRI #118770

Checking RuntimeConfig is a little trick here. However, containerd version is not in cri info. I think this would be OK.

[carlory]

This PR assumes that the container runtime is running on the node when we do init, join or upgrade operations. I'm unsure whether it is correct? If yes, I will add the same check for init/join operations.

[neolit123]

SGTM, added a few minor comments.

[neolit123]

This PR assumes that the container runtime is running on the node when we do init, join or upgrade operations. I'm unsure whether it is correct? If yes, I will add the same check for init/join operations.

yes, think we assume the container runtime is running before these commands are executed.

[neolit123]

kubeadm: added a new preflight check to validate if the container runtime supports the RuntimeConfig gRPC method. If the container runtime does not support the RuntimeConfig gRPC method, a warning is printed.

best to also mention what actions the users need to take for what releases and what this config used for.
if they don't take an action we return error.

[carlory]

best to also mention what actions the users need to take for what releases and what this config used for.
if they don't take an action we return error.

Added a blog link in release note

[neolit123]

ok, i understand your point about 1.35.
this LGTM

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: fe850a255bc2d62e37fcce1592a8823a514c243a

[carlory]

The pull-kubernetes-cmd failed, it seems that we need to create the container runtime in each check function which is related to the container runtime.

[carlory]

a known flaky test: #132956
/test pull-kubernetes-unit

[HirazawaUi]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 7ddba2cc7b73c19db4b5b3e8d28ffe78e137d326

[neolit123]

@carlory please check if the external kinder jobs (kubeadm-test) are going to show the warning. that will be an indication if we need to make some updates for the node images.

also onhold if this is ready to merge.