Bump containerd from 1.7.21 to 2.0.3

README.md

@@ -163,7 +163,7 @@ Note: Upstart/SysV init based OS types are not supported.
   - [kubernetes](https://github.com/kubernetes/kubernetes) v1.30.4
   - [etcd](https://github.com/etcd-io/etcd) v3.5.12
   - [docker](https://www.docker.com/) v26.1
-  - [containerd](https://containerd.io/) v1.7.21
+  - [containerd](https://containerd.io/) v2.0.3
   - [cri-o](http://cri-o.io/) v1.30.3 (experimental: see [CRI-O Note](docs/CRI/cri-o.md). Only on fedora, ubuntu and centos based OS)
 - Network Plugin
   - [cni-plugins](https://github.com/containernetworking/plugins) v1.2.0

cache/containerd-amd64

@@ -0,0 +1 @@
+ac70856f1d8bd3aa9ca5d62db5516b86dfa0f934c1fd1d1c5fa4422dd12ba45e  containerd-2.0.3-linux-amd64.tar.gz

cache/containerd-arm64

@@ -0,0 +1 @@
+3701008e72e983259afaa594cca5d8126e78e38cf0a586a1f6971cb3f61c4b6b  containerd-2.0.3-linux-arm64.tar.gz

cache/containerd-ppc64le

@@ -0,0 +1 @@
+2f0faa0086ae81d00680367ee9d75aafd3c4ca4535362db83fea62dd19c47079  containerd-2.0.3-linux-ppc64le.tar.gz

cache/containerd.json

@@ -0,0 +1,7 @@
+{
+  "tagName": "v2.0.3",
+  "url": "https://github.com/containerd/containerd/releases/tag/v2.0.3",
+  "description": "Welcome to the v2.0.3 release of containerd!\n\nThe third patch release for containerd 2.0 includes various bug fixes and updates.\n\n### Highlights\n\n* Update remote content to break up writes to avoid grpc message size limits ([#11457](https://github.com/containerd/containerd/pull/11457))\n* Update runc binary to v1.2.5 ([#11394](https://github.com/containerd/containerd/pull/11394))\n\n#### Container Runtime Interface (CRI)\n\n* Fix privileged container sysfs can't be rw because pod is ro by default ([#11456](https://github.com/containerd/containerd/pull/11456))\n* Fix recursive RLock() mutex acquisition ([containerd/go-cni#126](https://github.com/containerd/go-cni/pull/126))\n\n#### Node Resource Interface (NRI)\n\n* Fix initial sync race when registering NRI plugins ([#11329](https://github.com/containerd/containerd/pull/11329))\n\nPlease try out the release binaries and report any issues at\nhttps://github.com/containerd/containerd/issues.\n\n### Contributors\n\n* Derek McGowan\n* Akihiro Suda\n* Mike Brown\n* Phil Estes\n* Akhil Mohan\n* Chifeng Cai\n* Krisztian Litkey\n* Wei Fu\n* Andrey Smirnov\n* Austin Vazquez\n* Chris Henzie\n* Jing Xu\n* Jonathan A. Sternberg\n* Jose Fernandez\n* Kirtana Ashok\n* Lei Liu\n* Maksym Pavlenko\n* Michael Zappa\n* Samuel Karp\n* fengwei0328\n* zounengren\n\n### Changes\n<details><summary>42 commits</summary>\n<p>\n\n* Prepare release notes for v2.0.3 ([#11443](https://github.com/containerd/containerd/pull/11443))\n  * [`b8dde9189`](https://github.com/containerd/containerd/commit/b8dde9189df2e62b1650fb699ea8e8f612cdfb66) Prepare release notes for v2.0.3\n* Update remote content to break up writes to avoid grpc message size limits ([#11457](https://github.com/containerd/containerd/pull/11457))\n  * [`eaa7ca80d`](https://github.com/containerd/containerd/commit/eaa7ca80dcc1ea3e3dffe1382d96d77377720c30) proxy: break up writes from the remote writer to avoid grpc limits\n* Fix privileged container sysfs can't be rw because pod is ro by default ([#11456](https://github.com/containerd/containerd/pull/11456))\n  * [`c7f64196f`](https://github.com/containerd/containerd/commit/c7f64196fcbc792fd9383eb9aa8d43be0f9fa748) Fix privileged container sysfs can't be rw because pod is ro by default\n* go.{mod,sum}: bump CDI deps to v.0.8.1. ([#11430](https://github.com/containerd/containerd/pull/11430))\n  * [`92ae2951f`](https://github.com/containerd/containerd/commit/92ae2951ffd92e39a38aba2ab48b31a6cb49138e) Update CDI dependency to v0.8.1.\n* Prefer runtime options for PluginInfo request ([#11446](https://github.com/containerd/containerd/pull/11446))\n  * [`569af34cb`](https://github.com/containerd/containerd/commit/569af34cbb761f0507546457ffe376f4454c87ea) Prefer runtime options for PluginInfo request\n* pkg: prevent oom watcher from depending on shim pkg ([#11439](https://github.com/containerd/containerd/pull/11439))\n  * [`0ce93e16a`](https://github.com/containerd/containerd/commit/0ce93e16a9fd91c03a67150a6098d09f5258c300) prevent oom watcher depend on shim pkg.\n* CI: arm64-8core-32gb -> ubuntu-24.04-arm ([#11436](https://github.com/containerd/containerd/pull/11436))\n  * [`f3284aa68`](https://github.com/containerd/containerd/commit/f3284aa68f864f2303b42546b14f7af15eccd063) CI: arm64-8core-32gb -> ubuntu-24.04-arm\n* Revert \"Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG\" ([#11403](https://github.com/containerd/containerd/pull/11403))\n  * [`b5313993c`](https://github.com/containerd/containerd/commit/b5313993c16f8ae9d4a053162a75bacced36e246) Revert \"Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG\"\n* move the device after the options when using mkfs.ext4 ([#11411](https://github.com/containerd/containerd/pull/11411))\n  * [`f95a426b8`](https://github.com/containerd/containerd/commit/f95a426b83ec716feaab0a436d5e2280dc4e9d99) move the device after the options when using mkfs.ext4\n* update build to go1.23.6, test go1.24.0 ([#11410](https://github.com/containerd/containerd/pull/11410))\n  * [`4d19a6adf`](https://github.com/containerd/containerd/commit/4d19a6adfec9440d0806a1cc4633deaef3e5d53c) update build to go1.23.6, test go1.24.0\n* build(deps): bump actions/cache from 4.1.2 to 4.2.0 ([#11405](https://github.com/containerd/containerd/pull/11405))\n  * [`c738c3aab`](https://github.com/containerd/containerd/commit/c738c3aabc350ae67c5200de4c504c5038834e91) build(deps): bump actions/cache from 4.1.2 to 4.2.0\n* Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 ([#11387](https://github.com/containerd/containerd/pull/11387))\n  * [`fcf64305c`](https://github.com/containerd/containerd/commit/fcf64305cef019c8bf135d7373e2b658e02019b3) Update vendor files to fix build failure\n  * [`d3437eb29`](https://github.com/containerd/containerd/commit/d3437eb2918f6e266e97c5ee08737926519dc40d) Upgrade x/net to 0.33.0\n* Update install-imgcrypt to allow change install repo ([#11357](https://github.com/containerd/containerd/pull/11357))\n  * [`0785bd8cc`](https://github.com/containerd/containerd/commit/0785bd8cc6405b346a81025c983365825910e77f) Update install-imgcrypt to allow change install repo\n* Update runc binary to v1.2.5 ([#11394](https://github.com/containerd/containerd/pull/11394))\n  * [`697c59c63`](https://github.com/containerd/containerd/commit/697c59c63568a8d722e958e68ef52bbb25160b63) Update runc binary to v1.2.5\n* Update go-cni version to fix Race Condition issue ([#11269](https://github.com/containerd/containerd/pull/11269))\n  * [`06891f899`](https://github.com/containerd/containerd/commit/06891f899d25de9dd1cb5e5443ec099e17a57e00) fix go-cni race condition\n* Fix initial sync race when registering NRI plugins ([#11329](https://github.com/containerd/containerd/pull/11329))\n  * [`79cdbf61b`](https://github.com/containerd/containerd/commit/79cdbf61b6f7e4be2feb1bb2d631bdb1b9c5cd7f) cri,nri: block NRI plugin sync. during event processing.\n* Update github.com/containerd/imgcrypt to v2.0.0 ([#11325](https://github.com/containerd/containerd/pull/11325))\n  * [`9d5cfce83`](https://github.com/containerd/containerd/commit/9d5cfce833cf7dc98319390ce002bd4f6a20d423) Update github.com/containerd/imgcrypt to v2.0.0\n* Move CDI device spec out of the OCI package ([#11265](https://github.com/containerd/containerd/pull/11265))\n  * [`f58939c33`](https://github.com/containerd/containerd/commit/f58939c33d5777c3c813927831bc260cd94baf57) Remove deprecated WithCDIDevices in oci spec opts\n  * [`3d53430fe`](https://github.com/containerd/containerd/commit/3d53430fe14eb76849a6c997d60b21a9f95c19ed) Move CDI device spec out of the OCI package\n* update to go1.23.5 / go1.22.11 ([#11297](https://github.com/containerd/containerd/pull/11297))\n  * [`1f4e5688e`](https://github.com/containerd/containerd/commit/1f4e5688efd71cb9db26158ed697d27ba26dd6b3) update to go1.23.5 / go1.22.11\n* build(deps): bump google.golang.org/protobuf from 1.35.1 to 1.35.2 ([#11263](https://github.com/containerd/containerd/pull/11263))\n  * [`3a6ab80d0`](https://github.com/containerd/containerd/commit/3a6ab80d0176e205bd9f6a958450f9dce4415091) build(deps): bump google.golang.org/protobuf from 1.35.1 to 1.35.2\n</p>\n</details>\n\n### Changes from containerd/go-cni\n<details><summary>2 commits</summary>\n<p>\n\n* Fix recursive RLock() mutex acquisition ([containerd/go-cni#126](https://github.com/containerd/go-cni/pull/126))\n  * [`75a2440`](https://github.com/containerd/go-cni/commit/75a24409e8193fc64b0e9ed777ff884c338a21ca) fix: recursive RLock() mutex acquision\n</p>\n</details>\n\n### Dependency Changes\n\n* **github.com/containerd/go-cni**             v1.1.11 -> v1.1.12\n* **github.com/containerd/imgcrypt/v2**        v2.0.0-rc.1 -> v2.0.0\n* **github.com/containers/ocicrypt**           v1.2.0 -> v1.2.1\n* **github.com/petermattis/goid**              4fcff4a6cae7 **_new_**\n* **github.com/sasha-s/go-deadlock**           v0.3.5 **_new_**\n* **github.com/smallstep/pkcs7**               v0.1.1 **_new_**\n* **golang.org/x/crypto**                      v0.28.0 -> v0.31.0\n* **golang.org/x/net**                         v0.30.0 -> v0.33.0\n* **golang.org/x/oauth2**                      v0.22.0 -> v0.23.0\n* **golang.org/x/sync**                        v0.8.0 -> v0.10.0\n* **golang.org/x/sys**                         v0.26.0 -> v0.28.0\n* **golang.org/x/term**                        v0.25.0 -> v0.27.0\n* **golang.org/x/text**                        v0.19.0 -> v0.21.0\n* **google.golang.org/grpc**                   v1.67.1 -> v1.68.1\n* **google.golang.org/protobuf**               v1.35.1 -> v1.35.2\n* **tags.cncf.io/container-device-interface**  v0.8.0 -> v0.8.1\n\nPrevious release can be found at [v2.0.2](https://github.com/containerd/containerd/releases/tag/v2.0.2)\n### Which file should I download?\n* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         \u2705Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).\n* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.\n\nIn addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)\nand [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.\n\nSee also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.\n",
+  "publishedAt": "2025-02-28T19:08:59Z",
+  "isLatest": true
+}

roles/kubespray-defaults/defaults/main/checksums.yml

@@ -985,6 +985,7 @@ nerdctl_archive_checksums:
     1.7.0: e421ae655ff68461bad04b4a1a0ffe40c6f0fcfb0847d5730d66cd95a7fd10cd
 containerd_archive_checksums:
   arm:
+    2.0.3: 0
     1.7.21: 0
     1.7.20: 0
     1.7.19: 0
@@ -1029,6 +1030,7 @@ containerd_archive_checksums:
     1.6.15: 0
     1.6.14: 0
   arm64:
+    2.0.3: 3701008e72e983259afaa594cca5d8126e78e38cf0a586a1f6971cb3f61c4b6b
     1.7.21: 7b6b67d998eb86856d23df5d57269c054539072bbb27677975cf78269b2c5c10
     1.7.20: cf80cd305f7d1c23aaf0c57bc1c1e37089cad9130d533db6fe968cdebd16c759
     1.7.19: 1839e6f7cd7c62d9df3ef3deac3f404cdd5cd47bbdf8acfeb0b0f3776eb20002
@@ -1073,6 +1075,7 @@ containerd_archive_checksums:
     1.6.15: d63e4d27c51e33cd10f8b5621c559f09ece8a65fec66d80551b36cac9e61a07d
     1.6.14: 3ccb61218e60cbba0e1bbe1e5e2bf809ac1ead8eafbbff36c3195d3edd0e4809
   amd64:
+    2.0.3: ac70856f1d8bd3aa9ca5d62db5516b86dfa0f934c1fd1d1c5fa4422dd12ba45e
     1.7.21: 3d1fcdfd0b141f4dc4916b7aee7f9a7773dc344baffc8954e1ca66b1adc5c120
     1.7.20: e09410787b6f392748959177a84e024424f75d7aff33ea1c5b783f2260edce67
     1.7.19: 97f75e60f0ad19d335b1d23385835df721cad4492740d50576997f2717dc3f94
@@ -1117,6 +1120,7 @@ containerd_archive_checksums:
     1.6.15: 191bb4f6e4afc237efc5c85b5866b6fdfed731bde12cceaa6017a9c7f8aeda02
     1.6.14: 7da626d46c4edcae1eefe6d48dc6521db3e594a402715afcddc6ac9e67e1bfcd
   ppc64le:
+    2.0.3: 2f0faa0086ae81d00680367ee9d75aafd3c4ca4535362db83fea62dd19c47079
     1.7.21: 5ce0c1125e8d9ca04e2b524a2bac8b1eb97876c073023d5e083f7da64fcd8207
     1.7.20: dc611df0baa90509dda35e0be993da52f42b067514329fcf538d000b110364e8
     1.7.19: f41c2f28ee933a9ca24ff02cca159099fbcf798850e56cf0b7a6047ebe21fa86

roles/kubespray-defaults/defaults/main/download.yml

@@ -79,7 +79,7 @@ runc_version: v1.1.13
 kata_containers_version: 3.1.3
 youki_version: 0.1.0
 gvisor_version: 20240305
-containerd_version: 1.7.21
+containerd_version: 2.0.3
 cri_dockerd_version: 0.3.11
 
 # this is relevant when container_manager == 'docker'