Containerd 1.3 is validated against v1.15, but it is also compatible with Kubernetes v1.12+. (See more details about support metrics)

Features

• Supported per-pod containerd shim. The io.containerd.runc.v2 runtime is fully validated and ready to be used in production. This helps minimizing per-pod resource overhead. Note that io.containerd.runtime.v1.linux is still the default runtime. (Use per-pod shim. cri#1075)
• Added file-based generic runtime config options. This will be used by out-of-tree runtimes like gvisor and kata (Add a generic runtime options api. cri#1029), e.g.

[plugins.cri.containerd.runtimes.kata]
  runtime_type = "io.containerd.kata.v1"
[plugins.cri.containerd.runtimes.kata.options]
  TypeUrl = "io.containerd.kata.v1.options"
  ConfigPath = "/etc/kata/config.toml"

• Added the pod_annotations runtime option. Pod annotations specified in the list will be passed to the runtime as OCI annotations. This enables runtimes to support annotation-based experimental features. (Add support for passing sandbox annotations to runtime cri#1084)
• Added stream_idle_time option. This makes idle connection timeout of the streaming server configurable. (Add configurable timeout for idle streaming connections cri#1057)
• Added traffic shaping pod annotations support. NOTE: traffic shaping is still an experimental feature in Kubernetes. (Add support for traffic shaping cri#1150)
• Added max_conf_num option to plugins.cri.cni. This makes it possible to setup multiple CNI networks in a pod. NOTE: multi-network is not an officially supported feature in Kubernetes.(Make cni plugin config file num configurable cri#1154)
• Added plugins.cri.registry.configs option to support TLS and auth configs of registries. (TLS auth with image registries  cri#1143) NOTE: Non-mutual TLS is also supported. (Registry TLS Config usually no key file, only have crt file #3521) (see registry.md for more details)
• Added tcp endpoint for CRI service. The tcp service can be disabled with the disable_tcp_service option, and it is disabled by default. (Support a TCP endpoint cri#1181)
• Added max_concurrent_downloads option to restrict the number of concurrent downloads for each image. The default concurrency is 3. (Add max concurrent downloads support. cri#1211)
• Added privileged_without_host_devices runtime option to disable host devices for privileged pods for the runtime. This is especially useful for runtimes like kata. (runtime based privileged container translation cri#1213)

Enhancements

• Avoided Status lockup when CNI network setup/teardown is slow. (Consider load cni conf in a goroutine to prevent stuckup in Status cri#1078)
• Added CNI config in Status (crictl info) output. (adds cni config data to the cri status/info cri#1158)
• Fixed a bug that https is still attempted when an http mirror is configured. (Attempting to pull missing image from insecure registry gives wrong message cri#1201)
• Supported URL path in plugins.cri.registry.mirrors, e.g. https://my.custom.registry/anypath. (New registry mirror cri#1227)
• Added wildcard * support in plugins.cri.registry.mirrors. (Add support for pull-through cache with registry cri#1196)
• Removed an unnecessary round-trip to the image registry when pulling image. (Remove extra resolve for detecting schema1 image cri#1229)
• Updated cni library to v0.7.1 which has better context cancellation support. (need to move up to cni v0.7.1  cri#1236)
• Updated cni plugins to v0.7.6 to fix a race condition in the bridge plugin. (Bad test: CRI could not add IP address to \"cni0\": file exists #3507)

Deprecation

• ctr cri load command is deprecated, use ctr -n=k8s.io images import instead.(Consolidate ctr cri load and ctr import cri#909)
• The plugins.cri.containerd.default_runtime option is deprecated, use plugins."io.containerd.grpc.v1.cri".containerd.default_runtime_name instead. ([config] Move DefaultRuntime to Runtimes cri#1076)
• Runtime options including systemd_cgroups, runtime_engine and runtime_root are deprecated, use runtime options instead. (Print warning message for deprecated options. cri#1217)
• runtimeHandler field is moved from the sandbox info into status. (Add RuntimeHandler into PodSandbox and PodSandboxStatus cri#1063)
• plugins.cri.registry.auths is deprecated, use plugins.cri.registry.configs instead. (New registry mirror cri#1227)

Signed-off-by: Lantao Liu [email protected]