Skip to content

chore(deps): update kubernetes components to v1.37.0 (ansible/playbooks) - #10832

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ansible/playbooks-kubernetes-components
Open

chore(deps): update kubernetes components to v1.37.0 (ansible/playbooks)#10832
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ansible/playbooks-kubernetes-components

Conversation

@renovate

@renovate renovate Bot commented Jul 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change Pending
cri-o/cri-o minor 1.36.1 → 1.37.0 1.37.1
kubernetes/kubernetes minor 1.36.1 → 1.37.0

Release Notes

cri-o/cri-o (cri-o/cri-o)

v1.37.0

Compare Source

CRI-O v1.37.0

The release notes have been generated for the commit range
v1.36.0...v1.37.0 on Tue, 15 Sep 2026 12:48:48 UTC.

Downloads
Release Bundles

Download one of our static release bundles via our Google Cloud Bucket.
Each bundle includes a SHA-256 checksum, a cosign signature (.bundle), and a SPDX bill of materials (.spdx) with its own signature:

Supply Chain Artifacts

The OpenVEX vulnerability report:

The SLSA provenance attestation:

OCI Distribution

All release artifacts are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.37.0.

Verification

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.37.0.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.37.0.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.37.0.tar.gz
> bom validate -e cri-o.amd64.v1.37.0.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.37.0.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.37.0.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.37.0.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.37.0.provenance.json.bundle
Changelog since v1.36.0
Changes by Kind
Dependency-Change
Deprecation
  • The deprecated insecure_registries configuration option and --insecure-registry CLI flag have been removed. Use the insecure option in registries.conf instead. (#​10303, @​amritansh1502)
Feature
  • Add enable_cni_status_monitoring config option (default false) and
    cni_status_grace_period (default 60s) to gate continuous CNI STATUS
    monitoring and tolerate brief plugin disruptions during upgrades. (#​9918, @​tsorya)
  • Add a new config field to allow node admins to only allow checkpointing, and disallowing restore. (#​10248, @​haircommander)
  • Add btrfs storage driver support to static builds (#​9993, @​saschagrunert)
  • Added container memory metrics container_memory_active_anon_bytes and container_memory_inactive_anon_bytes (cgroup v1 and v2), and container_memory_anon_thp_bytes, container_memory_shmem_thp_bytes and container_memory_file_thp_bytes (cgroup v2 only). These are gated behind a new memoryExtra value for included_pod_metrics, separate from memory. (#​10143, @​cragr)
  • Added support for per-container targeting of cpu-load-balancing.crio.io, irq-load-balancing.crio.io, and cpu-quota.crio.io annotations. A container name can be appended to the annotation key (e.g. cpu-load-balancing.crio.io/my-container: "disable") to apply the setting to a specific container rather than all containers in the pod. Container-specific annotations take precedence over pod-level annotations when both are present. (#​9989, @​bartwensley)
  • CRI-O now reports runtimeFeatures.UserNamespacesHostNetwork as enabled on Linux and uses a recursively read-only /sys bind mount for containers running with both host network and user namespaces. (#​9930, @​HirazawaUi)
  • Support for encrypted container images in Confidential Containers use case: cri-o will now ignore the container image layers, allowing the underlying Confidential Container runtime to manage the image pull management.
    This makes sure that Confidential Containers can use encrypted containers without sharing the encryption key with cri-o, allowing a fully confidential use case. (#​9907, @​littlejawa)
  • Support gVisor containerd-shim-runsc-v1 (#​9974, @​xw19)
Design
  • Default the checkpoint_restore config field container_level_enabled to "checkpoint_only", thus disabling restore by default. It can be turned on by setting the field to "checkpoint_restore" (#​10251, @​haircommander)
  • Renamed --checkpoint-restore-container-level-enabled flag to --checkpoint-restore-level (#​10319, @​haircommander)
Documentation
Bug or Regression
  • Added namespace, pod, and container labels to CRI metrics (#​10173, @​dgrisonnet)
  • CRI-O now keeps logging blocked syscalls detected by the seccomp notifier instead of only reporting the first event when the notifier action is not "stop". (#​10120, @​adilGhaffarDev)
  • Deduplicate concurrent image volume MountImage calls to avoid containers/storage lock serialization when many pods mount the same image volume simultaneously. (#​10233, @​saschagrunert)
  • Fix CRI-O crash (nil pointer dereference) in ListPodSandboxStats when a container's cgroup is cleaned up during teardown. (#​10206, @​dgrisonnet)
  • Fix SELinux labeling so systemd/init containers receive container_init_t again instead of remaining container_t and failing to create cgroups. (#​10259, @​abdhikal-tech)
  • Fix a bug in high performance hooks where an init container would continue to hold a cpuset that could be used by a regular container in the same pod. (#​10208, @​haircommander)
  • Fix a latent crash in pinns caused by a missing zero terminator on the getopt_long long options array. The crash surfaces on builds whose linker places non-zero data immediately after the array (observed with ThinLTO release builds on armv7 musl). (#​9935, @​cehoffman)
  • Fix artifact names from externally created OCI layouts (e.g. via skopeo) being incorrectly normalized to wrong docker references. (#​10192, @​saschagrunert)
  • Fix network metrics collection to use the pod's network namespace. (#​10204, @​dgrisonnet)
  • Fixed CVE-2026-15809: bypass of CVE-2022-4318 fix allowing /etc/passwd injection via newline characters in the HOME environment variable. The original check incorrectly matched the literal string "\n" instead of actual newline bytes. (#​10148, @​aksjadha)
  • Fixed a bug where ImageRef in container status changed from a repo@​digest to a raw image ID hash after CRI-O restart. (#​9925, @​saschagrunert)
  • Fixed privileged sandboxes inheriting generate.New()'s default-deny seccomp filter when privileged_seccomp_profile is unset, so they now run unconfined as intended. (#​10288, @​ShravanthReddy)
  • NRI container lifecycle events now correctly include the container name and pod sandbox ID. (#​10117, @​nispriha)
  • Reduced the verbosity of debug logs for List* RPC calls to improve performance (#​9919, @​fmuyassarov)
  • Restores pre-1.34 behavior handling envvar values containing non-utf8 data (#​10176, @​liggitt)
Other (Cleanup or Flake)
  • CRI-O now defaults grpc_max_send_msg_size and grpc_max_recv_msg_size to 16 MiB (previously 80 MiB), matching the receive cap kubelet and crictl set via k8s.io/cri-client. (#​10284, @​sohankunkerkar)
  • Drop the name label from CRI metrics (#​10175, @​dgrisonnet)
  • Optimized environment variable merging during container creation by eliminating redundant string operations, improving container startup performance. (#​9687, @​ankit98040)
  • Remove experimental markers from additional_artifact_stores configuration option. (#​10043, @​saschagrunert)
Uncategorized
Dependencies
Added
  • cloud.google.com/go/pubsub/v2: v2.0.0
  • github.com/ThalesGroup/crypto11: v1.6.0
  • github.com/apapsch/go-jsonmerge/v2: v2.0.0
  • github.com/aperturerobotics/json-iterator-lite: v1.1.0
  • github.com/aperturerobotics/protobuf-go-lite: v0.15.0
  • github.com/aws/aws-sdk-go-v2/internal/v4a: v1.4.24
  • github.com/aws/aws-sdk-go-v2/service/signin: v1.0.11
  • github.com/brianvoe/gofakeit/v7: v7.12.1
  • github.com/decred/dcrd/dcrec/secp256k1/v4: v4.4.0
  • github.com/go-openapi/runtime/server-middleware: v0.30.0
  • github.com/go-openapi/swag/jsonutils/fixtures_test: v0.28.0
  • github.com/go-openapi/swag/pools: v0.28.0
  • github.com/go-openapi/testify/enable/yaml/v2: v2.6.0
  • github.com/go-openapi/testify/v2: v2.6.0
  • github.com/google/go-github/v73: v73.0.0
  • github.com/google/go-github/v88: v88.0.0
  • github.com/kelseyhightower/envconfig: v1.4.0
  • github.com/klauspost/cpuid/v2: v2.3.0
  • github.com/lestrrat-go/blackmagic: v1.0.4
  • github.com/lestrrat-go/httpcc: v1.0.1
  • github.com/lestrrat-go/httprc/v3: v3.0.0
  • github.com/lestrrat-go/jwx/v3: v3.0.10
  • github.com/lestrrat-go/option: v1.0.1
  • github.com/lestrrat-go/option/v2: v2.0.0
  • github.com/moby/moby/api: v1.54.2
  • github.com/moby/moby/client: v0.4.1
  • github.com/moby/sys/devices: v0.1.0
  • github.com/oapi-codegen/runtime: v1.6.0
  • github.com/oklog/ulid/v2: v2.1.1
  • github.com/pborman/getopt: 7148bc3
  • github.com/segmentio/asm: v1.2.0
  • github.com/sigstore/rekor-tiles/v2: v2.0.1
  • github.com/sigstore/timestamp-authority/v2: v2.0.6
  • github.com/tink-crypto/tink-go-awskms/v3: v3.0.0
  • github.com/transparency-dev/formats: 404c0d5
  • github.com/valyala/fastjson: v1.6.4
  • github.com/vektah/gqlparser/v2: v2.5.30
  • go.opentelemetry.io/otel/exporters/stdout/stdouttrace: v1.45.0
  • pgregory.net/rapid: v1.2.0
Changed

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

This comment has been minimized.

Sign in to view
@renovate renovate Bot changed the title Update Kubernetes components to v1.36.2 (ansible/playbooks) chore(deps): update kubernetes components to v1.36.2 (ansible/playbooks) Jul 20, 2026
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from 20a8895 to f50a559 Compare July 26, 2026 03:57
@renovate renovate Bot changed the title chore(deps): update kubernetes components to v1.36.2 (ansible/playbooks) chore(deps): update kubernetes components (ansible/playbooks) Jul 26, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from f50a559 to e33a2b7 Compare August 7, 2026 05:54
@renovate renovate Bot changed the title chore(deps): update kubernetes components (ansible/playbooks) chore(deps): update kubernetes components to v1.36.3 (ansible/playbooks) Aug 7, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate renovate Bot changed the title chore(deps): update kubernetes components to v1.36.3 (ansible/playbooks) Update Kubernetes components to v1.36.3 (ansible/playbooks) Aug 16, 2026
@renovate renovate Bot changed the title Update Kubernetes components to v1.36.3 (ansible/playbooks) chore(deps): update kubernetes components to v1.36.3 (ansible/playbooks) Aug 17, 2026
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from e33a2b7 to f859c5f Compare August 23, 2026 14:05
@renovate renovate Bot changed the title chore(deps): update kubernetes components to v1.36.3 (ansible/playbooks) chore(deps): update kubernetes components (ansible/playbooks) Aug 23, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from f859c5f to 545bc93 Compare August 27, 2026 21:11
@renovate renovate Bot changed the title chore(deps): update kubernetes components (ansible/playbooks) chore(deps): update kubernetes components to v1.36.4 (ansible/playbooks) Aug 27, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from 545bc93 to b2dc403 Compare August 29, 2026 17:47
@renovate renovate Bot changed the title chore(deps): update kubernetes components to v1.36.4 (ansible/playbooks) chore(deps): update kubernetes components (ansible/playbooks) Aug 29, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from b2dc403 to d08f117 Compare September 5, 2026 10:02
@github-actions

This comment has been minimized.

Sign in to view
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from d08f117 to 83925df Compare September 18, 2026 19:40
@renovate renovate Bot changed the title chore(deps): update kubernetes components (ansible/playbooks) chore(deps): update kubernetes components to v1.37.0 (ansible/playbooks) Sep 18, 2026
@renovate
renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from d08f117 to 83925df Compare September 18, 2026 19:41
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Ansible Plan Results

Mode: --check --diff (dry run)

⚠️ Changes detected

golyat-4: worker-image

Host OK Changed Skipped Failed Unreachable
golyat-4 86 4 55 0 0

4 changed

Changed Tasks (4)
# Task Module
1 user_management : Update package cache unknown
2 kubernetes_components : Add CRI-O repository unknown
3 kubernetes_components : Add CRI-O version-specific repository unknown
4 kubernetes_components : Configure Kubernetes repository unknown

shanghai-1: control-plane

Host OK Changed Skipped Failed Unreachable
shanghai-1 106 3 37 0 0

3 changed

Changed Tasks (3)
# Task Module
1 user_management : Update package cache unknown
2 kubernetes_components : Configure Kubernetes repository unknown
3 kubernetes_components : Deploy kubeadm configuration with etcd tuning unknown

shanghai-1: node-shanghai-1

Host OK Changed Skipped Failed Unreachable
shanghai-1 9 0 0 0 0

No changes

shanghai-2: control-plane

Host OK Changed Skipped Failed Unreachable
shanghai-2 106 3 37 0 0

3 changed

Changed Tasks (3)
# Task Module
1 user_management : Update package cache unknown
2 kubernetes_components : Configure Kubernetes repository unknown
3 kubernetes_components : Deploy kubeadm configuration with etcd tuning unknown

shanghai-2: node-shanghai-2

Host OK Changed Skipped Failed Unreachable
shanghai-2 9 0 0 0 0

No changes

shanghai-3: control-plane

Host OK Changed Skipped Failed Unreachable
shanghai-3 106 3 37 0 0

3 changed

Changed Tasks (3)
# Task Module
1 user_management : Update package cache unknown
2 kubernetes_components : Configure Kubernetes repository unknown
3 kubernetes_components : Deploy kubeadm configuration with etcd tuning unknown

shanghai-3: node-shanghai-3

Host OK Changed Skipped Failed Unreachable
shanghai-3 9 0 0 0 0

No changes

Plan executed on all nodes in parallel.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kubernetes manual-review-required

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants