I have been following up this tutorial, and was able to create K8S cluster in aws environment, up to this step https://github.com/prabhatsharma/kubernetes-the-hard-way-aws/blob/master/docs/13-smoke-test.md. Everything works fine, but untrusted workloads. The untrusted workload container hangs in its pendind state.

$ k get pods -o wide
NAME        READY   STATUS    RESTARTS   AGE     IP           NODE           NOMINATED NODE   READINESS GATES
untrusted   0/1     Pending   0          3m38s   10.200.1.7   ip-10-0-1-21   <none>           <none>

Seems that runsc (gVisor) is not completely configured as untrusted workload runtime. Although the toml file contains this recommended configuration:

ubuntu@ip-10-0-1-21:~$ cat /etc/containerd/config.toml
[plugins]
  [plugins.cri.containerd]
    snapshotter = "overlayfs"
    [plugins.cri.containerd.default_runtime]
      runtime_type = "io.containerd.runtime.v1.linux"
      runtime_engine = "/usr/local/bin/runc"
      runtime_root = ""
    [plugins.cri.containerd.untrusted_workload_runtime]
      runtime_type = "io.containerd.runtime.v1.linux"
      runtime_engine = "/usr/local/bin/runsc"
      runtime_root = "/run/containerd/runsc"

I can see the running containers by launching the following commands:

ubuntu@ip-10-0-1-21:~$ sudo runsc --root  /run/containerd/runsc/k8s.io list
ID                                                                 PID         STATUS      BUNDLE                                                                                                                   CREATED                          OWNER
810812c901c432ef406bebe4730a925a73976e0f057a724cfd84ef8e5d9cefc4   1077        running     /run/containerd/io.containerd.runtime.v1.linux/k8s.io/810812c901c432ef406bebe4730a925a73976e0f057a724cfd84ef8e5d9cefc4   2021-04-18T15:35:46.15756454Z    
e1241cc457631f60ab8560317235fbe97bf8b0a89b86336c8dd59d5dc0a27654   1077        running     /run/containerd/io.containerd.runtime.v1.linux/k8s.io/e1241cc457631f60ab8560317235fbe97bf8b0a89b86336c8dd59d5dc0a27654   2021-04-18T15:35:48.208150407Z 

ubuntu@ip-10-0-1-21:~$ sudo ctr -n k8s.io containers list
CONTAINER                                                           IMAGE                                                                      RUNTIME                           
810812c901c432ef406bebe4730a925a73976e0f057a724cfd84ef8e5d9cefc4    sha256:da86e6ba6ca197bf6bc5e9d900febd906b133eaa4750e6bed647b0fbe50ed43e    io.containerd.runtime.v1.linux    
e1241cc457631f60ab8560317235fbe97bf8b0a89b86336c8dd59d5dc0a27654    sha256:f4dc9e2ce94362f78a358cbf0ffc71ffe2fc11224c94857f21a1f7e1df5997ef    io.containerd.runtime.v1.linux