From 20f4c53bedb12a3807a550d51bb7dd1562b008ba Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 1 Feb 2024 15:23:23 +0100 Subject: [PATCH] Bump containerd to v1.7.13 https://github.com/containerd/containerd/releases/tag/v1.7.13 Fixes CVE-2024-21626 by bumping the runc binary version. That bump doesn't affect k0s directly, since we're shipping our on runc binary. Signed-off-by: Tom Wieczorek (cherry picked from commit 2f9f88ddb4cfe198544f3e432d24dd13c407d63f) --- docs/external-runtime-deps.md | 2 +- docs/nllb.md | 8 ++++---- docs/raspberry-pi4.md | 4 ++-- embedded-bins/Makefile.variables | 2 +- go.mod | 2 +- go.sum | 4 ++-- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/external-runtime-deps.md b/docs/external-runtime-deps.md index a7b14b021bb8..7718e824e383 100644 --- a/docs/external-runtime-deps.md +++ b/docs/external-runtime-deps.md @@ -169,7 +169,7 @@ In order to use containerd in conjunction with [AppArmor], it must be enabled in the kernel and the `/sbin/apparmor_parser` executable must be installed on the host, otherwise containerd will [disable][cd-aa] AppArmor support. -[cd-aa]: https://github.com/containerd/containerd/blob/v1.7.12/pkg/apparmor/apparmor_linux.go#L34-L45 +[cd-aa]: https://github.com/containerd/containerd/blob/v1.7.13/pkg/apparmor/apparmor_linux.go#L34-L45 [AppArmor]: https://wiki.ubuntu.com/AppArmor #### iptables diff --git a/docs/nllb.md b/docs/nllb.md index 01303b5bbcfa..bdcc10c748bc 100644 --- a/docs/nllb.md +++ b/docs/nllb.md @@ -252,8 +252,8 @@ listed, too: ```console $ kubectl get nodes -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -k0s-worker-0 Ready 2m16s v{{{ extra.k8s_version }}}+k0s 10.81.146.198 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.12 -k0s-worker-1 Ready 2m15s v{{{ extra.k8s_version }}}+k0s 10.81.146.51 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.12 +k0s-worker-0 Ready 2m16s v{{{ extra.k8s_version }}}+k0s 10.81.146.198 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.13 +k0s-worker-1 Ready 2m15s v{{{ extra.k8s_version }}}+k0s 10.81.146.51 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.13 ``` There is one node-local load balancer pod running for each worker node: @@ -298,8 +298,8 @@ $ sed -i s#https://10\\.81\\.146\\.254:6443#https://10.81.146.184:6443#g k0s-kub $ kubectl get nodes -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -k0s-worker-0 Ready 3m35s v{{{ extra.k8s_version }}}+k0s 10.81.146.198 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.12 -k0s-worker-1 Ready 3m34s v{{{ extra.k8s_version }}}+k0s 10.81.146.51 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.12 +k0s-worker-0 Ready 3m35s v{{{ extra.k8s_version }}}+k0s 10.81.146.198 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.13 +k0s-worker-1 Ready 3m34s v{{{ extra.k8s_version }}}+k0s 10.81.146.51 Alpine Linux v3.17 5.15.83-0-virt containerd://1.7.13 $ kubectl -n kube-system get pods -owide -l app.kubernetes.io/managed-by=k0s,app.kubernetes.io/component=nllb NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES diff --git a/docs/raspberry-pi4.md b/docs/raspberry-pi4.md index fc936aba5731..067e4bb5b493 100644 --- a/docs/raspberry-pi4.md +++ b/docs/raspberry-pi4.md @@ -294,7 +294,7 @@ When the cluster is up, try to have a look: ```console ubuntu@ubuntu:~$ sudo k0s kc get nodes -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -ubuntu Ready control-plane 4m41s v{{{ extra.k8s_version }}}+k0s 10.152.56.54 Ubuntu 22.04.1 LTS 5.15.0-1013-raspi containerd://1.7.12 +ubuntu Ready control-plane 4m41s v{{{ extra.k8s_version }}}+k0s 10.152.56.54 Ubuntu 22.04.1 LTS 5.15.0-1013-raspi containerd://1.7.13 ubuntu@ubuntu:~$ sudo k0s kc get pod -owide -A NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES kube-system kube-proxy-kkv2l 1/1 Running 0 4m44s 10.152.56.54 ubuntu @@ -503,7 +503,7 @@ Using the above kubeconfig, you can now access and use the cluster: ```console ubuntu@ubuntu:~$ KUBECONFIG=/path/to/kubeconfig kubectl get nodes,deployments,pods -owide -A NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -node/ubuntu Ready 5m1s v{{{ extra.k8s_version }}}+k0s 10.152.56.54 Ubuntu 22.04.1 LTS 5.15.0-1013-raspi containerd://1.7.12 +node/ubuntu Ready 5m1s v{{{ extra.k8s_version }}}+k0s 10.152.56.54 Ubuntu 22.04.1 LTS 5.15.0-1013-raspi containerd://1.7.13 NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR kube-system deployment.apps/coredns 1/1 1 1 33m coredns registry.k8s.io/coredns/coredns:v1.7.0 k8s-app=kube-dns diff --git a/embedded-bins/Makefile.variables b/embedded-bins/Makefile.variables index 37f01f3ed60e..082a39f3fbba 100644 --- a/embedded-bins/Makefile.variables +++ b/embedded-bins/Makefile.variables @@ -12,7 +12,7 @@ runc_build_go_tags = "seccomp" #runc_build_go_ldflags = runc_build_go_ldflags_extra = "-w -s -extldflags=-static" -containerd_version = 1.7.12 +containerd_version = 1.7.13 containerd_buildimage = $(golang_buildimage) containerd_build_go_tags = "apparmor,selinux" containerd_build_shim_go_cgo_enabled = 0 diff --git a/go.mod b/go.mod index b8f3e33d2612..d2a2c273bb70 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/cilium/ebpf v0.12.3 github.com/cloudflare/cfssl v1.6.4 github.com/containerd/cgroups/v3 v3.0.3 - github.com/containerd/containerd v1.7.12 + github.com/containerd/containerd v1.7.13 github.com/denisbrodbeck/machineid v1.0.1 github.com/evanphx/json-patch v5.7.0+incompatible github.com/fsnotify/fsnotify v1.7.0 diff --git a/go.sum b/go.sum index d00a55e44661..4fe47d3d08dd 100644 --- a/go.sum +++ b/go.sum @@ -106,8 +106,8 @@ github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGD github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0= github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw= github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= -github.com/containerd/containerd v1.7.12 h1:+KQsnv4VnzyxWcfO9mlxxELaoztsDEjOuCMPAuPqgU0= -github.com/containerd/containerd v1.7.12/go.mod h1:/5OMpE1p0ylxtEUGY8kuCYkDRzJm9NO1TFMWjUpdevk= +github.com/containerd/containerd v1.7.13 h1:wPYKIeGMN8vaggSKuV1X0wZulpMz4CrgEsZdaCyB6Is= +github.com/containerd/containerd v1.7.13/go.mod h1:zT3up6yTRfEUa6+GsITYIJNgSVL9NQ4x4h1RPzk0Wu4= github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM= github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ= github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=