Skip to content

v1.34.0
Compare
Choose a tag to compare
@github-actions github-actions released this 10 Sep 15:57
· 53 commits to main since this release
v1.34.0
d91a449
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CRI-O v1.34.0

The release notes have been generated for the commit range
v1.33.0...v1.34.0 on Wed, 10 Sep 2025 15:54:36 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.34.0.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --signature cri-o.amd64.v1.34.0.tar.gz.sig \
    --certificate cri-o.amd64.v1.34.0.tar.gz.cert

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.34.0.tar.gz
> bom validate -e cri-o.amd64.v1.34.0.tar.gz.spdx -d cri-o

Changelog since v1.33.0

Changes by Kind

Other

  • Log additional container information when stopping container. (#9302, @bitoku)
  • Updated NRI dependency to v0.10.0. Added configuration options for the built-in default validator NRI plugin. (#9415, @klihub)

Dependency-Change

Deprecation

API Change

  • Add HostNetwork field to the /info endpoint to inform cadvisor whether a container is in the host network or not. (#9411, @haircommander)

Feature

  • Added HugeTLB usage (container_hugetlb_usage_bytes) and maxUsage (container_hugetlb_max_usage_bytes) metrics. (#9257, @gavinkflam)
  • Added exec_cpu_affinity type which can specify cpu where exec command runs. (#9286, @bitoku)
  • Added container processes (container_processes) metric. (#9366, @gavinkflam)
  • Added feature to track conmon processes and emit containers_stopped_monitor_count{name="$ctr_name"} metric when it's stopped. (#9205, @bitoku)
  • Added feature to track conmon-rs processes and emit containers_stopped_monitor_count{name="$ctr_name"} metric when it's stopped. (#9348, @bitoku)
  • Added support for conmon-rs log driver and heaptrack config by using the monitor_env runtime configuration. (#9402, @saschagrunert)
  • Added support for conmon-rs streaming server on Exec and Attach. To enable it, set
    stream_websockets = true as part of the runtime handler configuration. (#9289, @saschagrunert)
  • Allow configuration of a default seccomp profile per runtime. (#9424, @gavinkflam)
  • Early pre-validate the configured pod runtime (conmon-rs) on config validation. (#9324, @saschagrunert)

Documentation

  • Fixed typos in CLI and error messages.
  • Deprecated CONTAINER_INCLUDED_POD_METRCIS CLI environment variable in favor of CONTAINER_INCLUDED_POD_METRICS. (#9299, @saschagrunert)
  • Updated tracing docs to use the latest jaeger image as well as simplify the configuration. (#9342, @saschagrunert)

Bug or Regression

  • Fix a bug where CRI-O did not respect cases where the kubelet instructed it to unmask /proc for containers (#9285, @haircommander)
  • Fix a potential deadlock when an infra container is taking a long time to exit and the sandbox's readiness is blocked on the infra container's opLock (#9188, @haircommander)
  • Fix log rotation not working for containers running with the kata-containers runtime (#9433, @littlejawa)
  • Fix terminal resize race condition (#9246, @sohankunkerkar)
  • Fix the bug that pod can't be terminated when the process is uninterruptible sleep for a while. (#9256, @bitoku)
  • Fix the bug where it continues to emit a metric after it confirms the conmon is stopped once (#9333, @bitoku)
  • Fixed a bug which caused CDI injection by NRI plugins to not being honored. NRI plugins are now able to inject CDI devices into containers. (#9128, @klihub)
  • Fixed segmentation fault when trying to create a lot of pods at a time. (#9272, @bitoku)
  • Fixes a crash introduced in 1.33.0 when cleaning up a pod that uses HostPorts
    on a system that has either just iptables (but not nftables) or just nftables
    (but not iptables). (#9222, @danwinship)
  • Handle missing network namespace gracefully during networkStop (#9301, @sohankunkerkar)
  • Server: add real-time memory validation for limit updates (#9385, @sohankunkerkar)
  • Server: delay CDI device injection, to ensure that CDI Spec edits take precedence over image defaults and the Pod Spec. (#9292, @klihub)
  • Server: ensure CNI teardown prevents IP leaks with missing netns (#9372, @sohankunkerkar)

Other (Cleanup or Flake)

  • Changed CONTAINER USER: … debug log message to become Container user: "…". (#9420, @saschagrunert)

Uncategorized

  • Enable shortname enforcement, requiring shortnames to be unambiguous if there are multiple entries that could be pulled from the list of 'unqualified-search-registries'. Generally, users should not enable 'unqualified-search-registries' but if they must be used, they should be unambiguous (#9401, @haircommander)

Dependencies

Added

  • github.com/alibabacloud-go/tea-utils/v2: v2.0.7
  • github.com/cenkalti/backoff/v5: v5.0.3
  • github.com/go-piv/piv-go/v2: v2.3.0
  • github.com/go-viper/mapstructure/v2: v2.3.0
  • github.com/google/go-github/v72: v72.0.0
  • github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus: v1.0.1
  • github.com/grpc-ecosystem/go-grpc-middleware/v2: v2.3.0
  • github.com/matttproud/golang_protobuf_extensions/v2: v2.0.0
  • github.com/moby/sys/atomicwriter: v0.1.0
  • github.com/modelpack/model-spec: v0.0.7
  • github.com/olekukonko/errors: v1.1.0
  • github.com/olekukonko/ll: v0.0.9
  • github.com/olekukonko/ts: 78ecb04
  • github.com/redis/go-redis/extra/rediscmd/v9: v9.5.3
  • github.com/redis/go-redis/extra/redisotel/v9: v9.5.3
  • github.com/smartystreets/goconvey: v1.8.1
  • gitlab.com/gitlab-org/api/client-go: v0.127.0
  • go.etcd.io/raft/v3: v3.6.0
  • go.yaml.in/yaml/v2: v2.4.2
  • go.yaml.in/yaml/v3: v3.0.4
  • gonum.org/v1/gonum: v0.16.0
  • sigs.k8s.io/structured-merge-diff/v6: v6.3.0

Changed

Removed

  • cloud.google.com/go/profiler: v0.4.2
  • cloud.google.com/go/storage: v1.50.0
  • github.com/14rcole/gopopulate: b175b21
  • github.com/AdamKorcz/go-fuzz-headers-1: 8b5d3ce
  • github.com/CloudNativeAI/model-spec: v0.0.4
  • github.com/DATA-DOG/go-sqlmock: v1.5.2
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric: v0.49.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping: v0.49.0
  • github.com/PuerkitoBio/purell: v1.1.1
  • github.com/PuerkitoBio/urlesc: de5bf2a
  • github.com/alessio/shellescape: v1.4.1
  • github.com/aws/aws-sdk-go-v2/feature/s3/manager: v1.17.10
  • github.com/cavaliercoder/badio: ce52801
  • github.com/cavaliercoder/go-rpm: 8cb9fd9
  • github.com/cavaliergopher/cpio: v1.0.1
  • github.com/containers/podman/v4: v4.2.0
  • github.com/go-piv/piv-go: v1.11.0
  • github.com/go-redis/redismock/v9: v9.2.0
  • github.com/google/go-github/v60: v60.0.0
  • github.com/google/rpmpack: v0.6.0
  • github.com/google/trillian: v1.7.1
  • github.com/google/wire: v0.6.0
  • github.com/grpc-ecosystem/grpc-gateway: v1.16.0
  • github.com/howeyc/gopass: c8aef6f
  • github.com/imdario/mergo: v0.3.16
  • github.com/jmoiron/sqlx: v1.4.0
  • github.com/ostreedev/ostree-go: 719684c
  • github.com/sassoftware/relic/v7: v7.6.2
  • github.com/xanzy/go-gitlab: v0.109.0
  • github.com/zalando/go-keyring: v0.2.3
  • go.etcd.io/etcd/client/v2: v2.305.21
  • go.etcd.io/etcd/raft/v3: v3.5.21
  • gocloud.dev: v0.40.0
  • software.sslmate.com/src/go-pkcs12: v0.4.0

Contributors

danwinship, saschagrunert, and 6 other contributors
Assets 2
Loading