fix: get_sandbox_image_from_containerd_config fails to read containerd v2 config

parts/linux/cloud-init/artifacts/cse_config.sh

@@ -579,10 +579,14 @@ ensurePodInfraContainerImage() {
 
     pod_infra_container_image=$(get_sandbox_image)
 
+    if [ -z "${pod_infra_container_image}" ]; then
+        echo "Failed to recognize pod infra container image"
+        exit $ERR_PULL_POD_INFRA_CONTAINER_IMAGE
+    fi
+
     echo "Checking if $pod_infra_container_image already exists locally..."
     if ctr -n k8s.io images list -q | grep -q "^${pod_infra_container_image}$"; then
         echo "Image $pod_infra_container_image already exists locally, skipping pull"
-        echo "Cached image details:"
         return 0
     fi
     base_name="${pod_infra_container_image%@:*}"

parts/linux/cloud-init/artifacts/cse_helpers.sh

@@ -1250,7 +1250,7 @@ get_kubernetes_tools() {
 
 function get_sandbox_image(){
     sandbox_image=$(get_sandbox_image_from_containerd_config "/etc/containerd/config.toml")
-    if [ -z "$sandbox_image" ]; then
+    if [ -z "$sandbox_image" ] && ! semverCompare ${KUBERNETES_VERSION:-"0.0.0"} "1.35.0"; then
         sandbox_image=$(extract_value_from_kubelet_flags "$KUBELET_FLAGS" "pod-infra-container-image")
     fi
 
@@ -1277,15 +1277,24 @@ function get_sandbox_image_from_containerd_config() {
 
     # Extract sandbox_image value from the CRI plugin section
     # The sandbox_image is typically under [plugins."io.containerd.grpc.v1.cri"]
-    sandbox_image=$(awk '/sandbox_image/ && /=/ {
-        # Remove quotes and spaces
-        gsub(/[" ]/, "", $3)
-        print $3
-    }' FS='=' "$config_file")
+    sandbox_image=$(
+    awk -F '=' '
+    /^[[:space:]]*(sandbox_image|sandbox)[[:space:]]*=/ {
+        val=$2
+        sub(/#.*/, "", val)
+        gsub(/^[[:space:]]*"/, "", val)
+        gsub(/"[[:space:]]*$/, "", val)
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", val)
+        print val
+    }
+    ' "$config_file"
+    )
 
     # Alternative method if the above doesn't work
     if [ -z "$sandbox_image" ]; then
-        sandbox_image=$(grep -E '^\s*sandbox_image\s*=' "$config_file" | sed 's/.*sandbox_image\s*=\s*"\([^"]*\)".*/\1/')
+        sandbox_image=$(grep -E '^[[:space:]]*(sandbox_image|sandbox)[[:space:]]*=' "$config_file" | \
+            head -n1 | \
+            sed -e 's/^[^=]*=[[:space:]]*//' -e 's/[[:space:]]*#.*//' -e 's/^"//' -e 's/"$//' -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
     fi
 
     echo "$sandbox_image"

spec/parts/linux/cloud-init/artifacts/cse_helpers_spec.sh

@@ -583,6 +583,33 @@ Describe 'cse_helpers.sh'
             The status should be success
         End
 
+
+        It 'get result from kubelet flags when k8s < 1.35.0 if failed to get from containerd config'
+            get_sandbox_image_from_containerd_config(){
+                echo ""
+            }
+            extract_value_from_kubelet_flags(){
+                echo "sandbox_image_from_kubelet_flags"
+            }
+            KUBERNETES_VERSION="1.34.0"
+            When call get_sandbox_image
+            The output should eq "sandbox_image_from_kubelet_flags"
+            The status should be success
+        End
+
+        It 'should not try to read from kubelet flags when k8s >= 1.35.0'
+            get_sandbox_image_from_containerd_config(){
+                echo ""
+            }
+            extract_value_from_kubelet_flags(){
+                echo "sandbox_image_from_kubelet_flags"
+            }
+            KUBERNETES_VERSION="1.35.0"
+            When call get_sandbox_image
+            The output should eq ""
+            The status should be success
+        End
+
         It 'returns empty string if both failed'
             get_sandbox_image_from_containerd_config(){
                 echo ""
@@ -603,7 +630,7 @@ Describe 'cse_helpers.sh'
             The status should be success
         End
 
-        It 'get result from containerd config'
+        It 'get result from v1 containerd config'
             cat > existing_file << EOF
 version = 2
 oom_score = -999
@@ -617,5 +644,35 @@ EOF
             The status should be success
 			rm -f existing_file
         End
+
+        It 'get result from v2 containerd config'
+            cat > existing_file << EOF
+version = 3
+oom_score = -999
+[plugins."io.containerd.grpc.v1.cri"]
+  sandbox = "sandbox_image_from_containerd_config"
+[metrics]
+  address = "0.0.0.0:10257"
+EOF
+            When call get_sandbox_image_from_containerd_config "existing_file"
+            The output should eq "sandbox_image_from_containerd_config"
+            The status should be success
+			rm -f existing_file
+        End
+
+        It 'fails from invalid containerd config'
+            cat > existing_file << EOF
+version = 2
+oom_score = -999
+[plugins."io.containerd.grpc.v1.cri"]
+  sandbox_xxxx = "sandbox_image_from_containerd_config"
+[metrics]
+  address = "0.0.0.0:10257"
+EOF
+            When call get_sandbox_image_from_containerd_config "existing_file"
+            The output should eq ""
+            The status should be success
+			rm -f existing_file
+        End
     End
 End