Skip to content

chore(deps): update kubernetes components (ansible/playbooks)#8596

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ansible/playbooks-kubernetes-components
Open

chore(deps): update kubernetes components (ansible/playbooks)#8596
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ansible/playbooks-kubernetes-components

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 26, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
cri-o/cri-o minor 1.35.2 → 1.36.0
kubernetes/kubernetes minor 1.35.4 → 1.36.1

Release Notes

cri-o/cri-o (cri-o/cri-o)

v1.36.0

Compare Source

CRI-O v1.36.0

The release notes have been generated for the commit range
v1.35.0...v1.36.0 on Tue, 05 May 2026 18:27:19 UTC.

Downloads
Release Bundles

Download one of our static release bundles via our Google Cloud Bucket.
Each bundle includes a SHA-256 checksum, a cosign signature (.bundle), and a SPDX bill of materials (.spdx) with its own signature:

Supply Chain Artifacts

The OpenVEX vulnerability report:

The SLSA provenance attestation:

OCI Distribution

All release artifacts are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.36.0.

Verification

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.36.0.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.36.0.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.36.0.tar.gz
> bom validate -e cri-o.amd64.v1.36.0.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.36.0.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.0.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.36.0.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.0.provenance.json.bundle
Changelog since v1.35.0
Changes by Kind
Feature
  • Add OpenVEX vulnerability report generation for releases (#​9767, @​saschagrunert)
  • Add container_runtime_crio_default_runtime metric to display which default runtime the node is configured to use (#​9870, @​haircommander)
  • Add min_injected_gomaxprocs option, which allows a user to specify GOMAXPROCS in every container CRI-O creates. The config field itself is an integer that represents the floor of GOMAXPROCS. CRI-O will inject max(floor, cpu.request), if the pod is not a guaranteed pod or is part of a partitioned workload (#​9860, @​harche)
  • Added tls_min_version and tls_cipher_suites configuration options to [crio.api] for configuring TLS settings on streaming and metrics servers. Supports TLS 1.2 (default) and TLS 1.3. (#​9723, @​asahay19)
  • Added support for configuring additional read-only artifact stores via the additional_artifact_stores configuration option. (#​9702, @​pauloappbr)
  • CRI-O now continuously monitors CNI plugin health using the STATUS verb. If a plugin becomes unhealthy after initial readiness, the node is reported as NetworkReady=false, preventing pod scheduling on affected nodes. The node self-heals when the plugin recovers. (#​9855, @​tsorya)
  • Implement StreamContainers, StreamContainerStats, StreamPodSandboxes, StreamPodSandboxStats, StreamPodSandboxMetrics, StreamImages (#​9761, @​bitoku)
Dependency-Change
Bug or Regression
  • Fix concurrent RemoveImage race condition by handling ErrNotAnImage as an idempotent deletion result. (#​9803, @​jnovy)
  • Fixed UpdateContainerResources to apply cgroupv2 unified settings (#​9820, @​PannagaRao)
  • Fixed a bug where CRI-O didn't return all metrics when "all" is set. (#​9719, @​bitoku)
  • Fixed a panic when concurrent StopContainer calls race against the stop lifecycle completing. (#​9799, @​sabujmaity)
  • Fixed a regression in v1.35.0 where systemd containers with hostUsers: false (user namespaces enabled) would fail with "Permission denied" errors when systemd attempted to create cgroups. (#​9712, @​saschagrunert)
  • Fixed cases where regular container images could accidentally be pulled into the OCI artifact store (#​9782, @​bitoku)
  • Fixed the race condition where cri-o reports exitCode 255 when the container exits fast. (#​9846, @​bitoku)
  • PullImage now returns the image ID directly, ensuring compatibility with Kubernetes credential verification for image pulls. (#​9728, @​saschagrunert)
  • Respect the same pinned_images configuration used by regular container images (#​9836, @​bitoku)
Other
  • Nri: pass any container POSIX rlimits to NRI plugins as input. (#​9707, @​klihub)
  • Nri: pass any container user ID/group ID information to NRI plugins as input (#​9708, @​klihub)
  • Nri: pass more complete container status to NRI, including PID, exit code, and timestamps fro container creation, start, and exit events (#​9706, @​klihub)
  • Skip the OCI artifact pull fallback when the initial image pull fails due to a retryable error (#​9778, @​bitoku)
Dependencies
Added
  • cyphar.com/go-pathrs: v0.2.1
  • github.com/checkpoint-restore/go-criu/v8: v8.2.0
  • github.com/clipperhouse/displaywidth: v0.6.0
  • github.com/clipperhouse/stringish: v0.1.1
  • github.com/clipperhouse/uax29/v2: v2.3.0
  • github.com/mistifyio/go-zfs/v4: v4.0.0
  • github.com/olekukonko/cat: 50322a0
  • k8s.io/cri-streaming: v0.36.0-rc.0
  • k8s.io/streaming: v0.36.0-rc.0
Changed
Removed
  • github.com/antlr4-go/antlr/v4: v4.13.0
  • github.com/checkpoint-restore/go-criu/v6: v6.3.0
  • github.com/coreos/go-oidc: v2.3.0+incompatible
  • github.com/coreos/go-semver: v0.3.1
  • github.com/google/cel-go: v0.26.0
  • github.com/gregjones/httpcache: 901d907
  • github.com/jonboulle/clockwork: v0.5.0
  • github.com/klauspost/cpuid/v2: v2.0.4
  • github.com/minio/sha256-simd: v1.0.0
  • github.com/pquerna/cachecontrol: v0.1.0
  • github.com/stoewer/go-strcase: v1.3.0
  • github.com/tmc/grpc-websocket-proxy: 673ab2c
  • github.com/xiang90/probing: a49e3df
  • go.etcd.io/etcd/api/v3: v3.6.5
  • go.etcd.io/etcd/client/pkg/v3: v3.6.5
  • go.etcd.io/etcd/client/v3: v3.6.5
  • go.etcd.io/etcd/pkg/v3: v3.6.5
  • go.etcd.io/etcd/server/v3: v3.6.5
  • go.etcd.io/raft/v3: v3.6.0
  • gopkg.in/go-jose/go-jose.v2: v2.6.3
  • gopkg.in/natefinch/lumberjack.v2: v2.2.1
  • k8s.io/kms: v0.35.0-rc.0
  • sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.31.2

v1.35.3

Compare Source

CRI-O v1.35.3

The release notes have been generated for the commit range
v1.35.2...v1.35.3 on Tue, 05 May 2026 00:45:32 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.35.3.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.35.3.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.35.3.tar.gz
> bom validate -e cri-o.amd64.v1.35.3.tar.gz.spdx -d cri-o
Changelog since v1.35.2
Changes by Kind
Feature
  • CRI-O now continuously monitors CNI plugin health using the STATUS
    verb. If a plugin becomes unhealthy after initial readiness, the node
    is reported as NetworkReady=false, preventing pod scheduling on
    affected nodes. The node self-heals when the plugin recovers. (#​9903, @​haircommander)
Uncategorized
Dependencies
Added

Nothing has changed.

Changed
Removed

Nothing has changed.

kubernetes/kubernetes (kubernetes/kubernetes)

v1.36.1

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.35.5

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

This comment has been minimized.

Sign in to view
@renovate renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from 92037f7 to 6c37c9b Compare May 8, 2026 05:56
@renovate renovate Bot changed the title chore(deps): update dependency kubernetes/kubernetes to v1.36.0 (ansible/playbooks) chore(deps): update kubernetes components (ansible/playbooks) May 8, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from 6c37c9b to f95e3e5 Compare May 8, 2026 20:36
@renovate renovate Bot changed the title chore(deps): update kubernetes components (ansible/playbooks) chore(deps): update kubernetes components to v1.36.0 (ansible/playbooks) May 8, 2026
@github-actions

This comment has been minimized.

Sign in to view
@renovate renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from f95e3e5 to 4144ffb Compare May 14, 2026 16:38
@renovate renovate Bot force-pushed the renovate/ansible/playbooks-kubernetes-components branch from 4144ffb to 071f990 Compare May 15, 2026 17:01
@renovate renovate Bot changed the title chore(deps): update kubernetes components to v1.36.0 (ansible/playbooks) chore(deps): update kubernetes components (ansible/playbooks) May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

kubernetes manual-review-required

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants