chore(deps): update kubernetes components (ansible/playbooks)

[renovate]

This PR contains the following updates:

Package	Update	Change
cri-o/cri-o	patch	1.36.1 → 1.36.5
kubernetes/kubernetes	minor	1.36.1 → 1.37.0

---

Release Notes

cri-o/cri-o (cri-o/cri-o)

v1.36.5

Compare Source

• CRI-O v1.36.5
  • Downloads
  • Changelog since v1.36.4
    • Changes by Kind
      • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed

CRI-O v1.36.5

The release notes have been generated for the commit range
v1.36.4...v1.36.5 on Wed, 02 Sep 2026 08:47:31 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

• cri-o.amd64.v1.36.5.tar.gz
  • cri-o.amd64.v1.36.5.tar.gz.sha256sum
  • cri-o.amd64.v1.36.5.tar.gz.bundle
  • cri-o.amd64.v1.36.5.tar.gz.spdx
  • cri-o.amd64.v1.36.5.tar.gz.spdx.bundle
• cri-o.arm64.v1.36.5.tar.gz
  • cri-o.arm64.v1.36.5.tar.gz.sha256sum
  • cri-o.arm64.v1.36.5.tar.gz.bundle
  • cri-o.arm64.v1.36.5.tar.gz.spdx
  • cri-o.arm64.v1.36.5.tar.gz.spdx.bundle
• cri-o.ppc64le.v1.36.5.tar.gz
  • cri-o.ppc64le.v1.36.5.tar.gz.sha256sum
  • cri-o.ppc64le.v1.36.5.tar.gz.bundle
  • cri-o.ppc64le.v1.36.5.tar.gz.spdx
  • cri-o.ppc64le.v1.36.5.tar.gz.spdx.bundle
• cri-o.s390x.v1.36.5.tar.gz
  • cri-o.s390x.v1.36.5.tar.gz.sha256sum
  • cri-o.s390x.v1.36.5.tar.gz.bundle
  • cri-o.s390x.v1.36.5.tar.gz.spdx
  • cri-o.s390x.v1.36.5.tar.gz.spdx.bundle

The OpenVEX report for this release is available at:

• cri-o.v1.36.5.openvex.json

The SLSA provenance attestation for this release is available at:

• cri-o.v1.36.5.provenance.json
  • cri-o.v1.36.5.provenance.json.bundle

All release artifacts (bundles, SBOMs, VEX, and provenance) are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.36.5.

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.36.5.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.36.5.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.36.5.tar.gz
> bom validate -e cri-o.amd64.v1.36.5.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.36.5.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.5.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.36.5.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.5.provenance.json.bundle

Changelog since v1.36.4

Changes by Kind

Bug or Regression

• Deduplicate concurrent image volume MountImage calls to avoid containers/storage lock serialization when many pods mount the same image volume simultaneously. (#​10255, @​openshift-cherrypick-robot)
• Fix a bug in high performance hooks where an init container would continue to hold a cpuset that could be used by a regular container in the same pod. (#​10236, @​openshift-cherrypick-robot)

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

v1.36.4

Compare Source

• CRI-O v1.36.4
  • Downloads
  • Changelog since v1.36.3
    • Changes by Kind
      • Feature
      • Bug or Regression
  • Dependencies
    • Added
    • Changed
    • Removed

CRI-O v1.36.4

The release notes have been generated for the commit range
v1.36.3...v1.36.4 on Mon, 24 Aug 2026 16:51:10 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

• cri-o.amd64.v1.36.4.tar.gz
  • cri-o.amd64.v1.36.4.tar.gz.sha256sum
  • cri-o.amd64.v1.36.4.tar.gz.bundle
  • cri-o.amd64.v1.36.4.tar.gz.spdx
  • cri-o.amd64.v1.36.4.tar.gz.spdx.bundle
• cri-o.arm64.v1.36.4.tar.gz
  • cri-o.arm64.v1.36.4.tar.gz.sha256sum
  • cri-o.arm64.v1.36.4.tar.gz.bundle
  • cri-o.arm64.v1.36.4.tar.gz.spdx
  • cri-o.arm64.v1.36.4.tar.gz.spdx.bundle
• cri-o.ppc64le.v1.36.4.tar.gz
  • cri-o.ppc64le.v1.36.4.tar.gz.sha256sum
  • cri-o.ppc64le.v1.36.4.tar.gz.bundle
  • cri-o.ppc64le.v1.36.4.tar.gz.spdx
  • cri-o.ppc64le.v1.36.4.tar.gz.spdx.bundle
• cri-o.s390x.v1.36.4.tar.gz
  • cri-o.s390x.v1.36.4.tar.gz.sha256sum
  • cri-o.s390x.v1.36.4.tar.gz.bundle
  • cri-o.s390x.v1.36.4.tar.gz.spdx
  • cri-o.s390x.v1.36.4.tar.gz.spdx.bundle

The OpenVEX report for this release is available at:

• cri-o.v1.36.4.openvex.json

The SLSA provenance attestation for this release is available at:

• cri-o.v1.36.4.provenance.json
  • cri-o.v1.36.4.provenance.json.bundle

All release artifacts (bundles, SBOMs, VEX, and provenance) are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.36.4.

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.36.4.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.36.4.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.36.4.tar.gz
> bom validate -e cri-o.amd64.v1.36.4.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.36.4.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.4.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.36.4.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.4.provenance.json.bundle

Changelog since v1.36.3

Changes by Kind

Feature

• Added support for per-container targeting of cpu-load-balancing.crio.io, irq-load-balancing.crio.io, and cpu-quota.crio.io annotations. A container name can be appended to the annotation key (e.g. cpu-load-balancing.crio.io/my-container: "disable") to apply the setting to a specific container rather than all containers in the pod. Container-specific annotations take precedence over pod-level annotations when both are present. (#​10152, @​openshift-cherrypick-robot)

Bug or Regression

• Fix CRI-O crash (nil pointer dereference) in ListPodSandboxStats when a container's cgroup is cleaned up during teardown. (#​10216, @​openshift-cherrypick-robot)

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

v1.36.3

Compare Source

• CRI-O v1.36.3
  • Downloads
  • Changelog since v1.36.2
    • Changes by Kind
      • Bug or Regression
      • Uncategorized
  • Dependencies
    • Added
    • Changed
    • Removed

CRI-O v1.36.3

The release notes have been generated for the commit range
v1.36.2...v1.36.3 on Tue, 04 Aug 2026 00:41:01 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

• cri-o.amd64.v1.36.3.tar.gz
  • cri-o.amd64.v1.36.3.tar.gz.sha256sum
  • cri-o.amd64.v1.36.3.tar.gz.bundle
  • cri-o.amd64.v1.36.3.tar.gz.spdx
  • cri-o.amd64.v1.36.3.tar.gz.spdx.bundle
• cri-o.arm64.v1.36.3.tar.gz
  • cri-o.arm64.v1.36.3.tar.gz.sha256sum
  • cri-o.arm64.v1.36.3.tar.gz.bundle
  • cri-o.arm64.v1.36.3.tar.gz.spdx
  • cri-o.arm64.v1.36.3.tar.gz.spdx.bundle
• cri-o.ppc64le.v1.36.3.tar.gz
  • cri-o.ppc64le.v1.36.3.tar.gz.sha256sum
  • cri-o.ppc64le.v1.36.3.tar.gz.bundle
  • cri-o.ppc64le.v1.36.3.tar.gz.spdx
  • cri-o.ppc64le.v1.36.3.tar.gz.spdx.bundle
• cri-o.s390x.v1.36.3.tar.gz
  • cri-o.s390x.v1.36.3.tar.gz.sha256sum
  • cri-o.s390x.v1.36.3.tar.gz.bundle
  • cri-o.s390x.v1.36.3.tar.gz.spdx
  • cri-o.s390x.v1.36.3.tar.gz.spdx.bundle

The OpenVEX report for this release is available at:

• cri-o.v1.36.3.openvex.json

The SLSA provenance attestation for this release is available at:

• cri-o.v1.36.3.provenance.json
  • cri-o.v1.36.3.provenance.json.bundle

All release artifacts (bundles, SBOMs, VEX, and provenance) are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.36.3.

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.36.3.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.36.3.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.36.3.tar.gz
> bom validate -e cri-o.amd64.v1.36.3.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.36.3.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.3.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.36.3.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.3.provenance.json.bundle

Changelog since v1.36.2

Changes by Kind

Bug or Regression

• Added namespace, pod, and container labels to CRI metrics (#​10174, @​openshift-cherrypick-robot)
• Fixed CVE-2026-15809: bypass of CVE-2022-4318 fix allowing /etc/passwd injection via newline characters in the HOME environment variable. The original check incorrectly matched the literal string "\n" instead of actual newline bytes. (#​10197, @​openshift-cherrypick-robot)

Uncategorized

• Add enable_cni_status_monitoring config option (default false) and
  cni_status_grace_period (default 60s) to gate continuous CNI STATUS
  monitoring and tolerate brief plugin disruptions during upgrades. (#​10069, @​openshift-cherrypick-robot)
• Restores pre-1.34 behavior handling envvar values containing non-utf8 data (#​10185, @​liggitt)

Dependencies

Added

Nothing has changed.

Changed

• k8s.io/api: v0.36.0-rc.0 → v0.36.3
• k8s.io/apimachinery: v0.36.0-rc.0 → v0.36.3
• k8s.io/client-go: v0.36.0-rc.0 → v0.36.3
• k8s.io/component-base: v0.36.0-rc.0 → v0.36.3
• k8s.io/cri-api: v0.36.0-rc.0 → v0.36.3
• k8s.io/cri-client: v0.36.0-rc.0 → v0.36.3
• k8s.io/cri-streaming: v0.36.0-rc.0 → v0.36.3
• k8s.io/kubelet: v0.36.0-rc.0 → v0.36.3
• k8s.io/streaming: v0.36.0-rc.0 → v0.36.3
• sigs.k8s.io/structured-merge-diff/v6: v6.3.2 → v6.3.3

Removed

• github.com/goccy/go-json: v0.10.5

v1.36.2

Compare Source

• CRI-O v1.36.2
  • Downloads
  • Changelog since v1.36.1
    • Changes by Kind
      • Uncategorized
  • Dependencies
    • Added
    • Changed
    • Removed

CRI-O v1.36.2

The release notes have been generated for the commit range
v1.36.1...v1.36.2 on Thu, 02 Jul 2026 00:55:41 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

• cri-o.amd64.v1.36.2.tar.gz
  • cri-o.amd64.v1.36.2.tar.gz.sha256sum
  • cri-o.amd64.v1.36.2.tar.gz.bundle
  • cri-o.amd64.v1.36.2.tar.gz.spdx
  • cri-o.amd64.v1.36.2.tar.gz.spdx.bundle
• cri-o.arm64.v1.36.2.tar.gz
  • cri-o.arm64.v1.36.2.tar.gz.sha256sum
  • cri-o.arm64.v1.36.2.tar.gz.bundle
  • cri-o.arm64.v1.36.2.tar.gz.spdx
  • cri-o.arm64.v1.36.2.tar.gz.spdx.bundle
• cri-o.ppc64le.v1.36.2.tar.gz
  • cri-o.ppc64le.v1.36.2.tar.gz.sha256sum
  • cri-o.ppc64le.v1.36.2.tar.gz.bundle
  • cri-o.ppc64le.v1.36.2.tar.gz.spdx
  • cri-o.ppc64le.v1.36.2.tar.gz.spdx.bundle
• cri-o.s390x.v1.36.2.tar.gz
  • cri-o.s390x.v1.36.2.tar.gz.sha256sum
  • cri-o.s390x.v1.36.2.tar.gz.bundle
  • cri-o.s390x.v1.36.2.tar.gz.spdx
  • cri-o.s390x.v1.36.2.tar.gz.spdx.bundle

The OpenVEX report for this release is available at:

• cri-o.v1.36.2.openvex.json

The SLSA provenance attestation for this release is available at:

• cri-o.v1.36.2.provenance.json
  • cri-o.v1.36.2.provenance.json.bundle

All release artifacts (bundles, SBOMs, VEX, and provenance) are also available as signed OCI artifacts at ghcr.io/cri-o/bundle:v1.36.2.

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.v1.36.2.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.v1.36.2.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.v1.36.2.tar.gz
> bom validate -e cri-o.amd64.v1.36.2.tar.gz.spdx -d cri-o

To verify the OpenVEX vulnerability report, run:

> cosign verify-blob cri-o.v1.36.2.openvex.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.2.openvex.json.bundle

To verify the SLSA provenance attestation, run:

> cosign verify-blob cri-o.v1.36.2.provenance.json \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.v1.36.2.provenance.json.bundle

Changelog since v1.36.1

Changes by Kind

Uncategorized

• Update gomaxprocs hook to ignore workload partitioning when considering whether to inject, as well as update the calculation to ensure containers get at least double the requested number of CPUs, to reduce potential go scheduler throttling. (#​10008, @​openshift-cherrypick-robot)

Dependencies

Added

Nothing has changed.

Changed

Nothing has changed.

Removed

Nothing has changed.

kubernetes/kubernetes (kubernetes/kubernetes)

v1.37.0

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.4

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

v1.36.2

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.