Release Kata Containers 3.27.0 · kata-containers/kata-containers (original) (raw)

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-6f787300c-5106e7b34-1.91-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-5c0269881-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-e02e22643-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-b2c943931-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.24.13-rust-1.91-5c0269881-x86_64
• tools: quay.io/kata-containers/builders:tools-0621e65e7-c53910eb1-8025fa045-f6e0a7c33-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-2962e14c1-x86_64

Installation

Follow the Kata installation instructions.

Security Fixes

• CVE-2026-24834 in e17f962, c727332, 48aa077, 336b922

What's Changed

• tests: Remove terminationGracePeriod in manifests by @manuelh-dev in #12350
• tests: policy test improvements by @danmihai1 in #12409
• packaging: Delete pause_bundle dir before unpack by @manuelh-dev in #12423
• kata-deploy: Make update strategy configurable for kata-deploy DaemonSet by @nlle in #12415
• kata-deploy: nydus: Always start from a clean state by @fidencio in #12428
• runtime: tdx QEMU configuration changes by @mythi in #12390
• build(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.4.1 by @dependabot[bot] in #12426
• kata-deploy: Avoid text file busy error with nydus-snapshotter by @fidencio in #12442
• tests: kata-deploy: Wait for RuntimeClass before running E2E by @fidencio in #12429
• tests: nvidia: cc: Use sealed secrets for NGC_API_KEY by @fidencio in #12424
• runtimes: Sanitize trailing whitespaces by @manuelh-dev in #12433
• shim: Add CRI-O annotation support for device cold plug by @bpradipt in #12435
• runtime(-rs): rootfs: Use dm-mod.create kernel parameters for dm-verity protected root filesystems by @manuelh-dev in #12396
• gpu: Install packages for devkit by @manuelh-dev in #12454
• runtime-rs: use FIRMWARETDVFPATH like Go runtime by @mythi in #12464
• gpu: Add Agent NUMA Support 1 of N by @zvonkok in #12160
• Go bump 1.24.13 by @stevenhorsman in #12473
• runtime-rs: Fix stdout empty when exec process by @Apokleos in #12376
• docs: add OS_VERSION to rootfs script by @jirimoravcik in #12470
• kernel: unify confidential and non-confidential by @fidencio in #12468
• runtime: Enable NUMA optionally by @zvonkok in #11592
• tests: Clean up superfluous GPU annotation by @manuelh-dev in #12462
• genpolicy: support multiple NVIDIA GPU resource keys via allowlist in vfio settings by @Park-Jiyeonn in #12386
• Fix CVE 2026 25541 by @stevenhorsman in #12475
• Fix CVE 2026 25727 by @stevenhorsman in #12474
• ci: add editorconfig checker by @manuelh-dev in #12448
• versions: Bump rust to 1.91 by @stevenhorsman in #12476
• tools.gatekeeper: Add support to paginate workflows by @ldoktor in #12466
• runtime: disable nvdimm for confidential guest by @katexochen in #12472
• kata-deploy: rely more on drop-in configs by @fidencio in #12456
• tests: Make editorconfig-checker happy by @fidencio in #12483
• runtime-rs: Add support configurable network_queues via configuration and annotation by @Apokleos in #12408
• runtime-rs: Skip sockets and threads for hotplug_vcpus on Z/P by @BbolroC in #12486
• genpolicy: suppress YAML output when --{base64/raw}-out are used by @sespiros in #12439
• versions: Tidy up versions file by @stevenhorsman in #12385
• tests/coco: disable k8s-sandbox-vcpus-allocation.bats for TDX by @mythi in #12493
• kata-deploy: re-work delete / uninstall by @fidencio in #12491
• kata-deploy: use get_kata_containers_original_config_path() for custom runtimes by @fidencio in #12498
• build: Tighten upstream download path for ORAS by @manuelh-dev in #12480
• tests: Retry k8s deployment by @fidencio in #12495
• kata-deploy: use k3s/rke2 base template by @fidencio in #12488
• versions: Switch gperf mirror again by @sprt in #12506
• ci: add workflow to push ORAS tarball cache by @fidencio in #12510
• kata-deploy: add node selector to nvidia runtime classes by @jojimt in #12432
• tests: nvidia: Fix genpolicy error when pulling nvcr.io images by @fidencio in #12514
• security: x/net update in tools by @stevenhorsman in #12482
• scripts: use temporary GPG home when verifying cached gperf tarball by @fidencio in #12522
• ci: tdx: properly skip k8s-sandbox-vcpus-allocation.bats by @fidencio in #12519
• kata-deploy: set CRI images runtime_platform snapshotter for containerd v3 by @fidencio in #12520
• runtime: refactor hypervisor devices cgroup creation by @balintTobik in #11140
• security: Rkyv 0.7.46 bump by @stevenhorsman in #12499
• kata-deploy: Temporarily comment GPU specific labels by @fidencio in #12523
• infra: fix multi-arch manifest publish by @fidencio in #12524
• kata-deploy: disable provenance/SBOM for quay.io compatibility by @fidencio in #12528
• agent: Don't pass empty options to mount by @skazi0 in #10746
• kata-deploy: Add TEE nodeSelectors for TEE shims when NFD is detected by @fidencio in #12521
• kata-deploy: runtime_platform -> runtime_platforms ... plus a few fixes by @fidencio in #12530
• qemu: log exit code after failure by @burgerdev in #12533
• tests: mariner annotations for k8s-openvpn by @danmihai1 in #12449
• versions: bump to Linux v6.18.12 and QEMU v10.2.1 by @mythi in #12540
• kata-deploy: preserve symlinks when installing artifacts by @fidencio in #12538
• ci: Add integration tests for secret & configmap propagation by @ajaypvictor in #12455
• runtime-rs/ch: Fix inverted vcpu/tid mapping in get_ch_vcpu_tids by @chiranjeevi-max in #12526
• kata-deploy: enable kata-remote for ppc64le by @Amulyam24 in #12546
• genpolicy: allow RO and RW for sysfs with privileged container by @fidencio in #12541
• release: Bump version to 3.27.0 by @fidencio in #12547

New Contributors

• @nlle made their first contribution in #12415
• @jirimoravcik made their first contribution in #12470
• @sespiros made their first contribution in #12439
• @chiranjeevi-max made their first contribution in #12526

Full Changelog: 3.26.0...3.27.0