CRI-O v1.21.0
The release notes have been generated for the commit range
v1.20.0…741bd7c on Wed, 30 Jun 2021 15:29:05 UTC.
Downloads
Download one of our static release bundles via our Google Cloud Bucket:
Changelog since v1.20.0
Changes by Kind
Dependency-Change
API Change
- Update how the resources for a workload is specified. Now, to override a workload, the pod must have the annotation
$prefix/$ctr_name = {"$resource_type": "$resource_value"}. The workloads feature has also been marked as experimental, which should have happened from the beginning. (#4787, @haircommander)
Feature
- A new CLI option
--registries-conf-dir is added which allows users to select
a specific registries.conf.d(5) path which will be used instead of the user or
system default paths. (#4595, @maybe-sybr)
- Added
container_runtime_crio_containers_oom_total and container_runtime_crio_containers_oom metrics,
which collects out of memory (oom) containers. (#4690, @saschagrunert)
- Added
crio-status.8 man page to static release bundle (#4510, @saschagrunert)
- Added arm64 variant to static binary bundle. The bundle is now available via the URL
https://storage.googleapis.com/k8s-conform-cri-o/artifacts/cri-o.$ARCH.$VERSION.tar.gz,
where $ARCH can be amd64 or arm64 and $VERSION a tag or full length git SHA.
Beside that, we provide a new installation script
curl https://raw.githubusercontent.com/cri-o/cri-o/master/scripts/get | bash.
For this script, it is also possible to pass the architecture and version as arguments:
get [amd64|arm64] [VERSION|SHA].
The static binary bundle now uses crun as default container runtime for CRI-O. (#4552, @saschagrunert)
- Added feature to allow the OCI seccomp BPF hook to trace containers into dedicated files by
using the annotation key
io.containers.trace-syscall/container-name (#4544, @saschagrunert)
- Added generation of self-signed certificates for the secure metrics endpoint
if the provided cert and key paths are not available on disk. (#5012, @saschagrunert)
- Added secure metrics endpoint configuration options (#4805, @saschagrunert)
- Automatically reload metrics TLS certificate and key if any of those specified files change. (#4927, @saschagrunert)
- Bump containers image to v5.10.1 (#4519, @QiWang19)
- CNI plugins are now passed a K8S_POD_UID environment variable containing the pod UID this sandbox was started for. (#5026, @dcbw)
- CRI-O does not return
<none> placeholders for missing tags and digests any more when doing a ListImages RPC (#4673, @saschagrunert)
- Changed
VersionResponse.RuntimeApiVersion to return either the v1alpha2 or v1 CRI API version (#4473, @saschagrunert)
- Changed the logging behavior of klog messages to be included in the CRI-O logs.
The klog info verbositry is converted to CRI-O debug to lower the log verbosity. (#4973, @saschagrunert)
- Enable the “volatile” option for the overlay drivers when it is supported by the underlying kernel. (#4885, @giuseppe)
- Fall back to search registries list if short name alias is not found in the alias table. (#4730, @umohnani8)
- Fix a bug where pods with
hostNetwork: true couldn’t have ports forwarded from them when drop_infra_ctr=true (#4495, @haircommander)
- It is possible to override cgroup v2 unified configuration through the io.kubernetes.cri-o.UnifiedCgroup.$CTR_NAME annotation (#4479, @giuseppe)
- Port-forward works for IPv6 only pods (#4639, @aojea)
- Provide a new configuration flag to specify CPUs that will be used to run infra containers (#4459, @cynepco3hahue)
- Rootless: enable resource limit when cgroup v2 controllers are delegated. (#4528, @AkihiroSuda)
- Support Container Runtime Interface (CRI) security profiles for seccomp, which has been introduced with Kubernetes v1.20.0 and the graduation of the CRI. (#4358, @saschagrunert)
- Support enabling pprof profile over CRI-O’s unix socket (#4514, @mrunalp)
- Validate certificate dates for TLS metrics endpoint (#4990, @saschagrunert)
Design
- Add support for customizing container specs based on workloads. Each workload has an activation_annotation that, when present, activates the specific workload. Then, each workload has the option to configure different resources. Resources can have default values, or require that they’re specified for each individual container. This is done by annotation, which is of the form
$annotation_prefix.$resource_name/$container_name, where annotation_prefix is configured for the particular workload, resource_name corresponds to the resource being configured, and container name is the container in a pod that should have its resource configured. (#4725, @haircommander)
- ExecSync requests now don’t use conmon, instead calling the runtime directly, which reduces overhead. (#4943, @haircommander)
Documentation
- The installed cri-o.service file now attempts to be run before kubelet.service (#4443, @haircommander)
Bug or Regression
- Add support for
absent_mount_sources_to_reject, which allows admins to configure paths that, when mounted into a container despite not existing on the host, causes a container creation request to fail. This is useful for paths like /etc/hostname, which causes trouble as a directory, but possibly shouldn’t be created as a file either (in the case of a dynamic hostname). (#4844, @haircommander)
- Add the config field
internal_wipe which moves the responsibility of wiping containers after a reboot and images after an upgrade from the external binary crio wipe to the main crio server. This has a handful of advantages, the main one being crio is now better able to cleanup CNI resources after a reboot. (#4767, @haircommander)
- Allow users to customize conmon’s resources if a pod is in a workload. (#4907, @haircommander)
- Fix a bug in
internal_wipe that would mean CNI resources would be leaked across reboots. (#4900, @haircommander)
- Fix a bug where CRI-O can’t work with runc 1.0.0-rc93 because of an incorrectly specified list of capabilities (#4828, @haircommander)
- Fix a bug where CRI-O would leak opened files for namespaces on a server restore (#4758, @haircommander)
- Fix a bug where CollectMode wouldn’t be set if the feature was backported to systemd (in RHEL/CentOS 7, for instance) (#4563, @haircommander)
- Fix a bug where
crio config would print a string for privileged_without_host_devices, not a boolean (#4827, @haircommander)
- Fix a bug where an exec sync timeout would fail to cleanup the runtime exec process (#4999, @haircommander)
- Fix a bug where containers didn’t have a finished time set when using the “vm” style runtimes. (#4468, @haircommander)
- Fix a bug where crio wipe incorrectly wiped container storage even though the node wasn’t rebooted (#4691, @haircommander)
- Fix a bug where pods or containers could be cleaned up out of order if the request timed out (#4722, @haircommander)
- Fix a bug where server startup was significantly slowed down by attempting to clean up CNI resources after a reboot. (#4929, @haircommander)
- Fix a segfault when CRI-O has takes more than 8 minutes to create a pod or container (#4834, @haircommander)
- Fix drop ALL and add back few caps behavior to not include the default configured capabilities (#4923, @mrunalp)
- Fix running privileged systemd containers with bidirectional mounts (#4575, @giuseppe)
- Fixed a bug that could cause CRI-O to segfault when a node is under heavy load (#4530, @haircommander)
- Fixed a bug which would cause configuration files to not be reloaded properly on SIGHUP when one or more “drop-in” configuration files were being used. (#4694, @nalind)
- Fixed bug where it was not possible to run containers using the default or no seccomp profile on
seccomp disabled builds/machines (#4789, @saschagrunert)
- Fixed bug where runtime VM created containers never reach their
completed state. (#4803, @saschagrunert)
- Ingress/Egress burst limit is now set slightly below 4GB, which properly sets 4GB as the upper limit of burst (#4348, @zizon)
- Instead of failing to start, CRI-O now only prints a warning and ignores the runtime, in case a *non- default runtime is misconfigured. (#4631, @fidencio)
- Re-attempt setting up conmon’s cgroup if it fails on EAGAIN from dbus (#4921, @haircommander)
- Reduce the permission on the listen socket to 0660 (#4886, @haircommander)
- Reuse connection when connecting to dbus, as well as reattempt the connection if it fails temporarily (#4974, @haircommander)
- Some fields in the crio configuration related to storage and images were commented out by default (when running
crio config). They have been uncommented, and will be applied (if they’re different from the default value). (#4748, @haircommander)
- When dropping the infra container, the container inspect endpoint now returns a PID when requesting the infra container. (#4613, @haircommander)
Other (Cleanup or Flake)
Uncategorized
- “crio config” only prints the fields that are different than the default configuration. (#4682, @ityuhui)
- Add Particule as adopters (#4994, @ArchiFleKs)
- Allows users to set stream timeout from config (#4529, @wgahnagl)
- CRI-O now supports short-name aliases which can be configured in the
containers-registries.conf(5) configuration files. Please refer to the following article for further details on short-name aliases: www.redhat.com/sysadmin/container-image-short-names
The registries option in the crio.conf has been deprecated and takes no effect any more. CRI-O will warn when loading the config and note that containers-registries.conf(5) should be used instead for configuring unqualified-search registries. (#4455, @vrothberg)
- Cri-o managed scopes now depend on the shutdown.target and network.target to allow graceful shutdowns. (#4654, @rphillips)
- Crio adds info level log of the physical image source. (#4438, @QiWang19)
- Fix OOMs when using crun together with CPU Manager (#4592, @odinuge)
- Fixed a bug where image authentication failed from not finding the auth file. (#4461, @QiWang19)
- Raise a warning when creating a bind mount on the container root (#4853, @giuseppe)
- Set conmon scope KillSignal to SIGPIPE (#4560, @openshift-cherrypick-robot)
- This new release of ocicrypt contains new usable interfaces and thus is a new minor number. This issue details the notable features added as well as a checklist before making a new release that will be used by consuming projects. Target date for completion is 24th January.
Changes
There are several significant changes in release 1.1.0, this includes:
- Experimental PKCS11 support enabled via ENV variable
- Custom keyprovider support enabled via ENV variable (#4537, @pravinrajr9)
- Update nix pin with
make nixpkgs (#4395, @hswong3i)
- When using high performance hooks, CRI-O now restarts the irqbalance service after updating the irqbalance config file. rather than calling
irqbalance --oneshot. A new config value irqbalance_config_file has been introduced to configure the file to update with IRQBALANCE_BANNED_CPUS settings. The default of this config value is /etc/sysconfig/irqbalance, but must be set to /etc/default/irqbalance for Ubuntu-like distributions. (#4441, @pperiyasamy)
Dependencies
Added
- github.com/Microsoft/hcsshim/test: 43a75bb
- github.com/Shopify/logrus-bugsnag: 577dee2
- github.com/andybalholm/brotli: v1.0.0
- github.com/bitly/go-simplejson: v0.5.0
- github.com/bits-and-blooms/bitset: v1.2.0
- github.com/bmizerany/assert: b7ed37b
- github.com/bshuster-repo/logrus-logstash-hook: v0.4.1
- github.com/bugsnag/bugsnag-go: b1d1530
- github.com/bugsnag/osext: 0dd3f91
- github.com/bugsnag/panicwrap: e2c2850
- github.com/carolynvs/magex: v0.6.0
- github.com/checkpoint-restore/checkpointctl: a2024f5
- github.com/checkpoint-restore/go-criu/v4: v4.1.0
- github.com/checkpoint-restore/go-criu/v5: v5.0.0
- github.com/cheggaaa/pb/v3: v3.0.5
- github.com/cncf/udpa/go: 5459f2c
- github.com/containerd/aufs: v1.0.0
- github.com/containerd/btrfs: v1.0.0
- github.com/containerd/go-cni: v1.0.2
- github.com/containerd/imgcrypt: v1.1.1
- github.com/containerd/nri: v0.1.0
- github.com/containerd/stargz-snapshotter/estargz: 2b97b58
- github.com/containerd/zfs: v1.0.0
- github.com/containers/podman/v3: v3.1.2
- github.com/danieljoos/wincred: v1.1.0
- github.com/denverdino/aliyungo: a747050
- github.com/docker/go-events: e31b211
- github.com/docker/go-plugins-helpers: c9a8a2d
- github.com/dsnet/compress: v0.0.1
- github.com/dsnet/golib: 1ea1667
- github.com/fanliao/go-promise: 1890db3
- github.com/frankban/quicktest: v1.11.3
- github.com/garyburd/redigo: 535138d
- github.com/go-errors/errors: v1.0.1
- github.com/go-ini/ini: v1.25.4
- github.com/go-kit/log: v0.1.0
- github.com/go-task/slim-sprig: 348f09d
- github.com/gobuffalo/here: v0.6.0
- github.com/gogo/googleapis: v1.4.0
- github.com/golang/snappy: v0.0.3
- github.com/google/go-github/v33: v33.0.0
- github.com/google/go-intervals: v0.0.2
- github.com/google/licenseclassifier/v2: v2.0.0-alpha.1
- github.com/gorilla/handlers: 60c7bfd
- github.com/hashicorp/go-hclog: v0.9.2
- github.com/hashicorp/go-retryablehttp: v0.6.4
- github.com/hugelgupf/socketpair: 05d35a9
- github.com/jpillora/backoff: v1.0.0
- github.com/jsimonetti/rtnetlink: d2c2404
- github.com/juju/ansiterm: 720a095
- github.com/lunixbochs/vtclean: 2d01aac
- github.com/magefile/mage: v1.11.0
- github.com/manifoldco/promptui: v0.8.0
- github.com/markbates/pkger: v0.17.1
- github.com/marstr/guid: v1.1.0
- github.com/mdlayher/ethernet: 0394541
- github.com/mdlayher/netlink: v1.1.1
- github.com/mdlayher/raw: 50f2db8
- github.com/mholt/archiver/v3: v3.5.0
- github.com/miekg/pkcs11: v1.0.3
- github.com/mitchellh/osext: 5e2d6d4
- github.com/moby/locker: v1.0.1
- github.com/moby/spdystream: v0.2.0
- github.com/moby/sys/mount: v0.2.0
- github.com/moby/sys/symlink: v0.1.0
- github.com/monochromegane/go-gitignore: 205db1a
- github.com/ncw/swift: v1.0.47
- github.com/nwaples/rardecode: v1.1.0
- github.com/pierrec/lz4/v4: v4.0.3
- github.com/rivo/uniseg: v0.2.0
- github.com/shirou/gopsutil/v3: v3.20.12
- github.com/spiegel-im-spiegel/errs: v1.0.2
- github.com/spiegel-im-spiegel/go-cvss: v0.4.0
- github.com/stefanberger/go-pkcs11uri: 78d3cae
- github.com/vbauerster/mpb/v6: v6.0.3
- github.com/vbauerster/mpb/v7: v7.0.2
- github.com/xanzy/go-gitlab: v0.43.0
- github.com/xi2/xz: 48954b6
- github.com/xlab/treeprint: a009c39
- github.com/yvasiyarov/go-metrics: 57bccd1
- github.com/yvasiyarov/gorelic: a9bba5b
- github.com/yvasiyarov/newrelic_platform_go: b21fdbd
- go.starlark.net: 8dd3e2e
- google.golang.org/cloud: 975617b
- sigs.k8s.io/kustomize/api: v0.8.5
- sigs.k8s.io/kustomize/cmd/config: v0.9.7
- sigs.k8s.io/kustomize/kustomize/v4: v4.0.5
- sigs.k8s.io/kustomize/kyaml: v0.10.15
- sigs.k8s.io/release-utils: v0.3.0
- sigs.k8s.io/zeitgeist: v0.3.0
Changed
Removed
- github.com/bazelbuild/rules_go: v0.22.1
- github.com/bombsimon/wsl/v2: v2.0.0
- github.com/codahale/hdrhistogram: 3a0bb77
- github.com/codegangsta/negroni: v1.0.0
- github.com/containers/libpod/v2: v2.0.6
- github.com/docker/spdystream: 449fdfc
- github.com/golangplus/bytes: 45c989f
- github.com/golangplus/fmt: 2a5d6d7
- github.com/google/go-github/v29: v29.0.3
- github.com/gorilla/context: v1.1.1
- github.com/juju/errors: 22422da
- github.com/juju/loggo: 6e530bc
- github.com/juju/testing: e811894
- github.com/sclevine/agouti: v3.0.0+incompatible
- github.com/seccomp/containers-golang: v0.5.0
- github.com/uber/jaeger-lib: v2.2.0+incompatible
- github.com/varlink/go: 0f1d566
- github.com/xlab/handysort: fb3537e
- gopkg.in/mgo.v2: 9856a29
- sigs.k8s.io/kustomize: v2.0.3+incompatible
- vbom.ml/util: efcd4e0