CRI-O

v1.37.3Kubernetes Core

2026年11月3日

正確性の修正と `conmon-rs` 連携の見直しを中心としたメンテナンスリリースです。依存関係も更新されていますが、セキュリティ関連の変更は公表されていません。

影響確認 (1)

breakingconmon-rs に渡す環境変数の範囲を monitor_env に統一
monitor_env を設定していない場合に適用されます。
conmon-rs には、conmon と同じ monitor_env の環境変数だけが渡され、CRI-O サービスでのみ設定された変数は渡らなくなりました。OTEL_* やプロキシ設定を conmon-rs と OCI ランタイムにも渡す場合は、monitor_env に追加します。

その他の記録済み変更 10 件すべてfixes 9 · value changes 1

- Fixed exclusive CPU cleanup when cgroups disappear during container cleanup. (#10468, @bitoku)
- Attaching to stdin once containers with conmon-rs no longer loses the output after the client closes its stdin.
Attaching to a stdin once container through the conmon-rs streaming server now closes the container stdin when the client closes its stdin. (#10445, @openshift-cherrypick-robot)
- Fix userns-mode when combined with a Kubelet supporting user namespaces. (#10429, @openshift-cherrypick-robot)
- Fixed a possible crash and a panic of CRI-O with the pod runtime type (conmon-rs),
and a leaked conmon-rs server after removing a pod with pod events enabled. (#10505, @openshift-cherrypick-robot)
- When crio.service is restarted while containers are being created, an in-flight conmon process can still be killed and its crio-conmon-*.scope unit can still enter a failed state. That scope is now automatically garbage collected by systemd instead of persisting in systemctl --failed indefinitely. (#10451, @openshift-cherrypick-robot)
- Fixed CRI-O crash loops and stuck-Terminating pods caused by dead kata shims. (#10422, @openshift-cherrypick-robot)
- Fixed a leak of the seccomp notifier file descriptor into the container monitor, which left the kernel's seccomp notify listener attached with no reader after a CRI-O restart, causing process creation inside seccomp-notifier-armed containers to block indefinitely. (#10462, @openshift-cherrypick-robot)

- With stream_websockets and conmon-rs v1.2.0 or later, conmon-rs also serves port forwarding and its streaming sessions end after stream_idle_timeout of inactivity. Older conmon-rs versions disable stream_websockets, and pods started by them keep using the CRI-O streaming server. A conmon-rs server which does not exit on pod removal gets killed. A negative stream_idle_timeout fails the config validation. With conmon-rs, log_to_journald also logs containers to the journal, and exec syncs which conmon-rs could not start fail instead of returning exit code -2 or -3. (#10481, @openshift-cherrypick-robot)

CRI-Oをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回の破壊的変更も、その一例です。