CRI-O v1.21.4

The release notes have been generated for the commit range v1.21.3…030755e on Tue, 01 Mar 2022 15:32:22 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

Add functionality to use taskset to spawn new commands cri-o runs. Now, if InfraCtrCPUSet is called, all newly spawned commands will be placed in the InfraCtrCPUSet (as it’s expected to be set to the reserved CPU set that system commands should run on). (#5557, @haircommander)
Add support for “io.kubernetes.cri-o.TrySkipVolumeSELinuxLabel” annotation, which tells CRI-O to skip relabeling volumes if the top level is already correctly labeled Skip SELinux volume relabeling for super privileged containers (securityContext.seLinuxOptions.type = "spc_t"). (#5406, @haircommander)

Fix a bug where a pod given a host IPC or network namespace could configure sysctls on the host (#5686, @haircommander)

Fix a PID leak in situations where conmon fails to be moved into the pod cgroup (#5297, @openshift-cherrypick-robot)
Fix a bug where CRI-O waits forever on a conmon process that will not stop (#5407, @openshift-cherrypick-robot)
Fix a bug where host network containers couldn’t read their cgroup hierarchy (#5389, @openshift-cherrypick-robot)
Fix a bug where situations of excessive load on nodes causes containers to never actually start (#5666, @openshift-cherrypick-robot)
Fix a case where conmon children are sometimes leaked (#5510, @openshift-cherrypick-robot)
Fixed missing quantile values in container_runtime_crio_operations_latency_microseconds_total metrics (#5266, @saschagrunert)
Merge storage_option from drop-in files to sttorage_option from storage.conf (#5436, @openshift-cherrypick-robot)
Move namespace cleanup from sandbox stop to sandbox remove. This allows veth entries in the network namespaces of pods to be cleaned up earlier (#5502, @openshift-cherrypick-robot)

Nothing has changed.

Nothing has changed.