CRI-O

v1.37.3Kubernetes Core

2026년 11월 3일

정확성 수정과 `conmon-rs` 연동 조정이 중심인 유지보수 릴리스입니다. 의존성 업데이트도 포함되며, 보안 변경 사항은 공개되지 않았습니다.

영향 확인 (1)

breakingconmon-rs 환경 전달 범위 조정
monitor_env를 설정하지 않은 경우에 적용됩니다.
conmon-rs가 전체 CRI-O 환경 대신 conmon과 같은 monitor_env 환경을 받도록 바뀌었습니다. 따라서 CRI-O 서비스에만 설정한 OTEL_*나 프록시 설정은 monitor_env에 추가하지 않으면 conmon-rs와 OCI 런타임에 전달되지 않습니다.

그 외 기록된 변경 10건 전체fixes 9 · value changes 1

- Fixed exclusive CPU cleanup when cgroups disappear during container cleanup. (#10468, @bitoku)
- Attaching to stdin once containers with conmon-rs no longer loses the output after the client closes its stdin.
Attaching to a stdin once container through the conmon-rs streaming server now closes the container stdin when the client closes its stdin. (#10445, @openshift-cherrypick-robot)
- Fix userns-mode when combined with a Kubelet supporting user namespaces. (#10429, @openshift-cherrypick-robot)
- Fixed a possible crash and a panic of CRI-O with the pod runtime type (conmon-rs),
and a leaked conmon-rs server after removing a pod with pod events enabled. (#10505, @openshift-cherrypick-robot)
- When crio.service is restarted while containers are being created, an in-flight conmon process can still be killed and its crio-conmon-*.scope unit can still enter a failed state. That scope is now automatically garbage collected by systemd instead of persisting in systemctl --failed indefinitely. (#10451, @openshift-cherrypick-robot)
- Fixed CRI-O crash loops and stuck-Terminating pods caused by dead kata shims. (#10422, @openshift-cherrypick-robot)
- Fixed a leak of the seccomp notifier file descriptor into the container monitor, which left the kernel's seccomp notify listener attached with no reader after a CRI-O restart, causing process creation inside seccomp-notifier-armed containers to block indefinitely. (#10462, @openshift-cherrypick-robot)

- With stream_websockets and conmon-rs v1.2.0 or later, conmon-rs also serves port forwarding and its streaming sessions end after stream_idle_timeout of inactivity. Older conmon-rs versions disable stream_websockets, and pods started by them keep using the CRI-O streaming server. A conmon-rs server which does not exit on pod removal gets killed. A negative stream_idle_timeout fails the config validation. With conmon-rs, log_to_journald also logs containers to the journal, and exec syncs which conmon-rs could not start fail instead of returning exit code -2 or -3. (#10481, @openshift-cherrypick-robot)

CRI-O 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.