containerd
v2.2.2Kubernetes Corecontainerd 2.2.2 fixes critical CRI networking bugs, registry credential leakage, and AppArmor compatibility issues that could affect production Kubernetes workloads.
securityUpdate to prevent registry credential exposure
Registry credentials could leak in error messages and pod events. Deploy this patch immediately if you use private registries with authentication, as these credentials might appear in logs or Kubernetes events that could be accessed by unauthorized users.
breakingFix CNI network cleanup after restarts
CNI DEL operations weren't executing after containerd restarts, leaving stale network configurations. This affects pod networking reliability. Update before your next maintenance window to prevent network namespace leaks and potential IP conflicts.
enhancementUpgrade for AppArmor compatibility
AppArmor profiles now work correctly with unix domain sockets on modern kernels. If you're running newer kernel versions and experiencing socket connection issues with AppArmor enabled, this update resolves the compatibility problem.
主な変更 (5)
- Fixed CNI cleanup issue where network teardown failed after containerd restarts
- Resolved credential leakage in error messages when registry authentication fails
- Fixed AppArmor profile causing unix socket failures on newer kernels
- Corrected registry mirror configuration migration for legacy setups
- Fixed nil pointer crashes in memory metrics when constraints are partially configured