CRI-O v1.20.0-rc.1
The release notes have been generated for the commit range
v1.19.0…62afeec on Fri, 11 Dec 2020 00:06:58 UTC.
Downloads
Download the static release bundle via our Google Cloud Bucket:
crio-62afeec00.tar.gz
Changelog since v1.19.0
Changes by Kind
Other
API Change
- Add allowed_annotations option to runtime handler structure, which allows admins to gate which runtime classes interpret the annotation io.kubernetes.cri-o.userns-mode. In doing so, also drop the experimental allow_userns_annotation option. (#4281, @haircommander)
Feature
- Add
io.kubernetes.cri-o.Devices annotation to the list interpretable allowed annotations. Now, users can pass in devices they want added to their containers, but only if the runtime class is allowed to use the annotation. (#4349, @haircommander)
- Add option
seccomp_override_empty to override an unspecified seccomp profile from being unconfined to being the runtime default. Note: setting this option makes CRI-O not fully CRI compliant, but does increase security. (#4212, @haircommander)
- Allow using userns together with ManageNSLifecycle (#4333, @kolyshkin)
Design
- When running under systemd, image pulls happen in a new cgroup (#4057, @giuseppe)
Documentation
- The
manage_ns_lifecycle option is now deprecated, and will be set to true unconditionally in the future. (#4209, @haircommander)
Bug or Regression
- CRIO allow to run pods with default runtime profile in the Pod.Spec, if seccomp is disabled (#4370, @aojea)
- Crio-o portMapping dual-stack support (#4361, @aojea)
- Fix a bug where a timeout in RunPodSandbox or CreateContainer requests caused CRI-O to delete the newly created resource. Now, it saves that resource, until the kubelet re-requests it, thus allowing kubelet and CRI-O to reconcile quicker when nodes are under load. (#4430, @haircommander)
- Fix bug where runAsUser would only work with runAsGroup if userns annotations were specified (#4300, @haircommander)
- Fix bug where we attempted to chown with the mappings configured on server level, when they could have been from annotations (#4294, @haircommander)
- Fix making /etc/resolv.conf bind-mount to be readonly for a readonly container. (#4268, @kolyshkin)
- Fix occasional “chown: interrupted system call” error on container creation. (#4334, @kolyshkin)
- Fixed bug that all custom sandbox annotations will be passed to OCI hooks and therefore are also available on the containers (#4138, @saschagrunert)
- Provide an option to run performance hooks via specifying allowed_annotations under the runtime handler configuration
[DEPRECATION] The run of performance hooks for the high-performance runtime handler without specifying allowed_annotations will be deprecated under release 1.21
[DEPRECATION] Usage of performance annotation with the true value, will be deprecated under release 1.21, instead, the disable value should be used (#4389, @cynepco3hahue)
Other (Cleanup or Flake)
- Changed the output of the printed seccomp profile to JSON instead of the struct. The profile will be only printed on CRI-O startup and if the
--log-level/log_level is set to trace. (#4158, @saschagrunert)
- Fixed a bug where a container creation failure caused that container to leak in the runtime (#4198, @haircommander)
Uncategorized
Dependencies
Added
- bazil.org/fuse: 371fbbd
- cloud.google.com/go/firestore: v1.1.0
- cloud.google.com/go/logging: v1.1.0
- github.com/Azure/go-autorest: v14.2.0+incompatible
- github.com/armon/go-metrics: f0300d1
- github.com/armon/go-radix: 7fddfc3
- github.com/bketelsen/crypt: 5cbc8cc
- github.com/cenkalti/backoff/v4: v4.1.0
- github.com/containers/libpod/v2: v2.0.6
- github.com/docker/cli: a8ff7f8
- github.com/form3tech-oss/jwt-go: v3.2.2+incompatible
- github.com/fvbommel/sortorder: v1.0.1
- github.com/go-gl/glfw: e6da0ac
- github.com/gomarkdown/markdown: 8c8b381
- github.com/google/go-containerregistry: v0.1.3
- github.com/google/martian/v3: v3.1.0
- github.com/hashicorp/consul/api: v1.1.0
- github.com/hashicorp/consul/sdk: v0.1.1
- github.com/hashicorp/go-cleanhttp: v0.5.1
- github.com/hashicorp/go-immutable-radix: v1.0.0
- github.com/hashicorp/go-msgpack: v0.5.3
- github.com/hashicorp/go-rootcerts: v1.0.0
- github.com/hashicorp/go-sockaddr: v1.0.0
- github.com/hashicorp/go-uuid: v1.0.1
- github.com/hashicorp/go.net: v0.0.1
- github.com/hashicorp/logutils: v1.0.0
- github.com/hashicorp/mdns: v1.0.0
- github.com/hashicorp/memberlist: v0.1.3
- github.com/hashicorp/serf: v0.8.2
- github.com/jmespath/go-jmespath/internal/testify: v1.5.1
- github.com/mitchellh/cli: v1.0.0
- github.com/mitchellh/go-testing-interface: v1.0.0
- github.com/mitchellh/gox: v0.4.0
- github.com/mitchellh/iochan: v1.0.0
- github.com/mmarkdown/mmark: v2.0.40+incompatible
- github.com/pascaldekloe/goe: 57f6aae
- github.com/pelletier/go-buffruneio: v0.2.0
- github.com/posener/complete: v1.1.1
- github.com/ryanuber/columnize: 9b3edd6
- github.com/sclevine/agouti: v3.0.0+incompatible
- github.com/sean-/seed: e2103e2
- github.com/src-d/gcfg: v1.4.0
- github.com/vdemeester/k8s-pkg-credentialprovider: v1.17.4
- github.com/willf/bitset: d5bec33
- golang.org/dl: 82a15e2
- gopkg.in/src-d/go-billy.v4: v4.3.2
- gopkg.in/src-d/go-git-fixtures.v3: v3.5.0
- gopkg.in/src-d/go-git.v4: v4.13.1
- k8s.io/kubernetes/staging/src/k8s.io/component-helpers: 3321f00
- k8s.io/kubernetes/staging/src/k8s.io/controller-manager: 3321f00
- k8s.io/kubernetes/staging/src/k8s.io/mount-utils: 3321f00
- sigs.k8s.io/mdtoc: v1.0.1
- sigs.k8s.io/structured-merge-diff/v4: v4.0.2
Changed
Removed
- github.com/containers/libpod: v1.9.2
- github.com/etcd-io/bbolt: v1.3.3
- github.com/go-ini/ini: v1.9.0
- github.com/openshift/api: 7ab22a2
- github.com/theckman/go-flock: v0.7.1
- sigs.k8s.io/structured-merge-diff/v3: 43c19bb