From a2b6327653cc1ad100f371f28023249fb3901b6b Mon Sep 17 00:00:00 2001 From: CMGS Date: Mon, 7 Sep 2026 08:34:11 +0900 Subject: [PATCH] chore: containerd v2.3.5 and the nftables masquerade backend containerd v2.3.5 carries CVE-2026-53495 and GHSA-rp3h-jf77-q9p4. The bridge conflist now sets ipMasqBackend: nftables and nftables joins the essential packages: with the iptables backend, 100 concurrent container starts on an 8-vCPU node serialize on the xtables lock (~0.55 s each) and the slowest exceed the oci-hook's 60 s CNI timeout, so only 34-41 of 100 come up; with nftables the same 100 start in 9-11 s with none lost (50 in 5.6 s instead of 34 s). --- docs/configuration.md | 10 ++++++---- group_vars/all.yml | 2 +- roles/essential/defaults/main.yml | 1 + roles/node_containerd/templates/eru.conflist.j2 | 1 + 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/configuration.md b/docs/configuration.md index 5bc8225..d61c4a1 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -15,7 +15,7 @@ Every version the playbook installs is pinned here and nowhere else, so a bump i | `eru_cli_version` | `v0.1.4` | Release tag of `eru-cli` | | `eru_resource_extend_version` | `v0.1.4` | Release tag of the resource plugins | | `etcd_version` | `v3.6.14` | Release tag of etcd | -| `containerd_version` | `v2.3.4` | Release tag of containerd | +| `containerd_version` | `v2.3.5` | Release tag of containerd | | `runc_version` | `v1.5.1` | Release tag of runc | | `cni_plugins_version` | `v1.9.1` | Release tag of the CNI plugins | | `oras_version` | `v1.3.3` | Release tag of `oras`, used on process nodes | @@ -36,10 +36,12 @@ as the CNI hook and log shim, and that path is compiled into core. | Variable | Default | Meaning | | --- | --- | --- | -| `essential_packages` | `ca-certificates`, `curl`, `iptables`, `openssh-client` | Packages installed on every host before anything else | +| `essential_packages` | `ca-certificates`, `curl`, `iptables`, `nftables`, `openssh-client` | Packages installed on every host before anything else | -`iptables` is what the CNI bridge plugin shells out to for outbound NAT; `openssh-client` provides -the `ssh-keygen` that generates core's key pair. +`nftables` provides the `nft` the CNI bridge plugin drives for outbound NAT (the conflist sets +`ipMasqBackend: nftables`, which keeps concurrent container starts off the iptables lock); +`iptables` stays for tooling that still expects it; `openssh-client` provides the `ssh-keygen` +that generates core's key pair. ## etcd diff --git a/group_vars/all.yml b/group_vars/all.yml index 81b2c0c..e8def15 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -5,7 +5,7 @@ eru_agent_version: v0.1.2 eru_cli_version: v0.1.4 eru_resource_extend_version: v0.1.4 etcd_version: v3.6.14 -containerd_version: v2.3.4 +containerd_version: v2.3.5 runc_version: v1.5.1 cni_plugins_version: v1.9.1 oras_version: v1.3.3 diff --git a/roles/essential/defaults/main.yml b/roles/essential/defaults/main.yml index 74c73f4..01cc095 100644 --- a/roles/essential/defaults/main.yml +++ b/roles/essential/defaults/main.yml @@ -3,4 +3,5 @@ essential_packages: - ca-certificates - curl - iptables + - nftables - openssh-client diff --git a/roles/node_containerd/templates/eru.conflist.j2 b/roles/node_containerd/templates/eru.conflist.j2 index f8323ab..94182ca 100644 --- a/roles/node_containerd/templates/eru.conflist.j2 +++ b/roles/node_containerd/templates/eru.conflist.j2 @@ -7,6 +7,7 @@ "bridge": "{{ node_containerd_bridge }}", "isGateway": true, "ipMasq": true, + "ipMasqBackend": "nftables", "hairpinMode": true, "ipam": { "type": "host-local",