[release/1.6] Fix CRI snapshotter root path when not under containerd root

[Kern--]

Fixes #10095 in 1.6
Related to the release/1.7 backport #10096

This PR backports 4 changes:

1. Add platform config to proxy plugins #8417 - Allows proxy plugins to have platforms (not strictly necessary to fix the issue, but I thought it would be less weird to keep this than to take a newer change to ProxyPlugins without the older one)
2. Add exports to proxy plugin config #9253 - Allows proxy plugins to have exports (e.g. root)
3. Snapshotters: Export the root path #10073 - Exports root paths for a number of snapshotters that didn't already have them
4. CRI: "Fix" imageFSPath behavior #9216 - Uses exported root key for snapshotter root if present.

The result of this is that you can tell containerd about a remote snapshotter's root like:

[proxy_plugins.soci]
type = "snapshot"
address = "/run/soci-snapshotter-grpc/soci-snapshotter-grpc.sock"
[proxy_plugins.soci.exports]
root = "/var/lib/soci-snapshotter-grpc"

which will be correctly reported by CRI which unblocks the kubelet from enforcing ephemeral-storage limits and doing image garbage collection.

[k8s-ci-robot]

Hi @Kern--. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Kern--]

cc @dcantah

[dcantah]

While I think this probably shouldn't cause any issues, for 1.6 (and same for 1.7, but given it's not LTS I think we're generally more lenient) we really only try to backport bug/security fixes. I'm assuming this is hurting someone in production on 1.6 as well is the reason

[Kern--]

I think this falls under the category of bug fixes. Or do you mean you generally only backport bug fixes related to security issues?

[dcantah]

@Kern-- It's a weird one as it's a bug fix enabled by new functionality as proxy plugins get two new fields to play around with. I'm okay with this though