Packages changed: cri-o kubernetes kubic-control podman (1.6.1 -> 1.6.2) weave (2.5.2 -> 2.6.0) === Details === ==== cri-o ==== Subpackages: cri-o-kubeadm-criconfig - Switch to `systemd` cgroup driver in kubelet config also - Switch to `systemd` cgroup manager in replacement for `cgroupfs` - Remove obsolete Groups tag (fate#326485) ==== kubernetes ==== Subpackages: kubernetes-client kubernetes-kubeadm kubernetes-kubelet - Ensure that BPPFS is mounted before starting kubelet (bsc#1146991) ==== kubic-control ==== Subpackages: kubicctl kubicd - Fix path of /usr/etc/kubicd ==== podman ==== Version update (1.6.1 -> 1.6.2) Subpackages: podman-cni-config - Add container-start-fix.patch to correct output of container-start to show container_name, not _id. - Update podman to v1.6.2 * Features - Added a --runtime flag to podman system migrate to allow the OCI runtime for all containers to be reset, to ease transition to the crun runtime on CGroups V2 systems until runc gains full support - The podman rm command can now remove containers in broken states which previously could not be removed - The podman info command, when run without root, now shows information on UID and GID mappings in the rootless user namespace - Added podman build --squash-all flag, which squashes all layers (including those of the base image) into one layer - The --systemd flag to podman run and podman create now accepts a string argument and allows a new value, always, which forces systemd support without checking if the the container entrypoint is systemd * Bugfixes - Fixed a bug where the podman top command did not work on systems using CGroups V2 (#4192) - Fixed a bug where rootless Podman could double-close a file, leading to a panic - Fixed a bug where rootless Podman could fail to retrieve some containers while refreshing the state - Fixed a bug where podman start --attach --sig-proxy=false would still proxy signals into the container - Fixed a bug where Podman would unconditionally use a non-default path for authentication credentials (auth.json), breaking podman login integration with skopeo and other tools using the containers/image library - Fixed a bug where podman ps --format=json and podman images - -format=json would display null when no results were returned, instead of valid JSON - Fixed a bug where podman build --squash was incorrectly squashing all layers into one, instead of only new layers - Fixed a bug where rootless Podman would allow volumes with options to be mounted (mounting volumes requires root), creating an inconsistent state where volumes reported as mounted but were not (#4248) - Fixed a bug where volumes which failed to unmount could not be removed (#4247) - Fixed a bug where Podman incorrectly handled some errors relating to unmounted or missing containers in containers/storage - Fixed a bug where podman stats was broken on systems running CGroups V2 when run rootless (#4268) - Fixed a bug where the podman start command would print the short container ID, instead of the full ID - Fixed a bug where containers created with an OCI runtime that is no longer available (uninstalled or removed from the config file) would not appear in podman ps and could not be removed via podman rm - Fixed a bug where containers restored via podman container restore --import would retain the CGroup path of the original container, even if their container ID changed; thus, multiple containers created from the same checkpoint would all share the same CGroup * Misc - The default PID limit for containers is now set to 4096. It can be adjusted back to the old default (unlimited) by passing - -pids-limit 0 to podman create and podman run - The podman start --attach command now automatically attaches STDIN if the container was created with -i - The podman network create command now validates network names using the same regular expression as container and pod names - The --systemd flag to podman run and podman create will now only enable systemd mode when the binary being run inside the container is /sbin/init, /usr/sbin/init, or ends in systemd (previously detected any path ending in init or systemd) - Updated vendored Buildah to 1.11.3 - Updated vendored containers/storage to 1.13.5 - Updated vendored containers/image to 4.0.1 ==== weave ==== Version update (2.5.2 -> 2.6.0) - Update weave to 2.6.0 - Fix a race condition in Kubernetes addon when reclaiming IP addresses after node deletion #3724, #3716 - Buffer events so Docker won't drop them, and Weave Net can clean up after dead containers #3432, #3705 - Weave reconnect occasionally fails after network interface disconnect #3666, #3669, #3676 - Ingress NetworkPolicy would accepts all traffic when specifying both IPBlock and port #3653, #3654 - Support both podSelector and namespaceSelector in NetworkPolicy #3312, #3647 - Only add default-drop egress rule if network policies are in use #3639 - Manifests use 'apps/v1' rather than deprecated 'apps/v1beta1' #3660 - Avoid Weave Net pods being evicted by setting priorityClassName: system-node-critical #3697 - Manifests use recommended DNS policy ClusterFirstWithHostNet #3692 - Weave Net now tolerates 'NoExecute' taint #3655 - Allow extra arguments to NetworkPolicy controller to be set in an environment variable #3683 - Stop reporting a failure to connect to self #3454, #3585 - Minor reduction in log noise when reclaiming IPs #3710 - Update weave.yaml for kubernetes 1.16