As we hit cases of deadlock when a sandbox is stuck stopping

Signed-off-by: Peter Hunt <pehunt@redhat.com>

…9188-to-release-1.33

[release-1.33] RFC: sandbox: use created/stopped instead of infra container for readiness

Signed-off-by: Kubernetes Release Robot <k8s-release-robot@users.noreply.github.com>

If `iptables --version` failed, iptables.New() would log a warning
and assume that the problem was that you had an implausibly ancient
version of iptables installed. Change it to instead assume that the
problem is that you don't have iptables installed at all (and only
log at debug).

Signed-off-by: Dan Winship <danwinship@redhat.com>

Add an internal constructor so that the unit tests share the same
logic as the real constructor, and fix it to handle nil sub-managers
correctly.

Signed-off-by: Dan Winship <danwinship@redhat.com>

…9222-to-release-1.33

[release-1.33] Fix HostPort manager when one backend is unavailable

Bump version to 1.33.1

otherwise, we break umasked proc mount type feature

Signed-off-by: Peter Hunt <pehunt@redhat.com>

…9285-to-release-1.33

[release-1.33] server: only append default masked paths if any paths are specified

Signed-off-by: Kubernetes Release Robot <k8s-release-robot@users.noreply.github.com>

Bump version to 1.33.2

Signed-off-by: Krisztian Litkey <krisztian.litkey@intel.com>

Signed-off-by: Ayato Tokubi <atokubi@redhat.com>

…-internal-version

dependencies.yaml: bump/sync internal version.

…9256-to-release-1.33

[release-1.33]: OCPBUGS-55485: Fix deadlock when stopping uninterruptible container

After host reboot, network namespaces are destroyed but CRI-O attempts
to clean them up during pod sandbox destruction, causing CNI plugin
failures and preventing pods from restarting properly. The fix ensures
pods can restart normally after host reboots.

Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>

…etns

Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>

Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>

Kata VMs use real infra containers that persist in storage, unlike normal
containers that use spoofed infra containers. This fundamental architectural
difference means the 'Network recovery after reboot with destroyed netns'
test scenario doesn't apply to Kata VMs in the same way.

Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>

…9301-to-release-1.33

[release-1.33] : server: handle missing network namespace gracefully during networkStop