From 1b254d4efb4cf002e5e2ba708feb86c3c3be2a02 Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 15:45:48 +0200 Subject: [PATCH 1/7] Update router patching --- .../010-ingress-deployment-clientCA.patch | 18 ++++++------- ...11-ingress-deployment-access-logging.patch | 27 +++++++++++++++---- scripts/auto-rebase/rebase.sh | 3 +++ 3 files changed, 34 insertions(+), 14 deletions(-) diff --git a/scripts/auto-rebase/manifests_patches/010-ingress-deployment-clientCA.patch b/scripts/auto-rebase/manifests_patches/010-ingress-deployment-clientCA.patch index ac99db2fe3..18eaf09e74 100644 --- a/scripts/auto-rebase/manifests_patches/010-ingress-deployment-clientCA.patch +++ b/scripts/auto-rebase/manifests_patches/010-ingress-deployment-clientCA.patch @@ -1,8 +1,8 @@ diff --git a/assets/components/openshift-router/deployment.yaml b/assets/components/openshift-router/deployment.yaml -index a63157f21..596be2aa0 100644 +index b88af94..59aca8c 100644 --- a/assets/components/openshift-router/deployment.yaml +++ b/assets/components/openshift-router/deployment.yaml -@@ -95,6 +95,14 @@ spec: +@@ -157,6 +157,14 @@ spec: value: '{{ .RouterCompressionMime }}' - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE value: "true" @@ -17,9 +17,9 @@ index a63157f21..596be2aa0 100644 livenessProbe: failureThreshold: 3 httpGet: -@@ -134,6 +142,11 @@ spec: - - mountPath: /var/run/configmaps/service-ca - name: service-ca-bundle +@@ -201,6 +209,11 @@ spec: + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access readOnly: true + {{- if .ClientCAMapName }} + - mountPath: '{{ .ClientCAMountPath }}' @@ -29,10 +29,10 @@ index a63157f21..596be2aa0 100644 image: '{{ .ReleaseImage.haproxy_router }}' ports: - name: http -@@ -168,6 +181,16 @@ spec: - path: service-ca.crt - name: service-ca-bundle - optional: false +@@ -254,6 +267,16 @@ spec: + - path: namespace + fieldRef: + fieldPath: metadata.namespace + {{- if .ClientCAMapName }} + - name: '{{ .ClientCAMapName }}' + configMap: diff --git a/scripts/auto-rebase/manifests_patches/011-ingress-deployment-access-logging.patch b/scripts/auto-rebase/manifests_patches/011-ingress-deployment-access-logging.patch index b9517e5751..543a43ca3f 100644 --- a/scripts/auto-rebase/manifests_patches/011-ingress-deployment-access-logging.patch +++ b/scripts/auto-rebase/manifests_patches/011-ingress-deployment-access-logging.patch @@ -1,8 +1,25 @@ diff --git a/assets/components/openshift-router/deployment.yaml b/assets/components/openshift-router/deployment.yaml -index 916e4b601..9261e3700 100644 +index d615ed0..f4f8f9a 100644 --- a/assets/components/openshift-router/deployment.yaml +++ b/assets/components/openshift-router/deployment.yaml -@@ -104,6 +104,53 @@ spec: +@@ -75,6 +75,16 @@ spec: + - mountPath: /var/run/configmaps/service-ca + name: service-ca-bundle + readOnly: true ++ {{- if .HttpErrorCodePages }} ++ - mountPath: /var/lib/haproxy/errorfiles ++ name: error-code-pages ++ readOnly: true ++ {{- end }} ++ {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }} ++ - mountPath: /var/lib/rsyslog ++ name: rsyslog-socket ++ readOnly: false ++ {{- end }} + image: '{{ .ReleaseImage.haproxy_router }}' + containers: + - name: router +@@ -165,6 +175,53 @@ spec: - name: ROUTER_MUTUAL_TLS_AUTH_FILTER value: '{{ .ClientAuthFilter }}' {{- end }} @@ -56,7 +73,7 @@ index 916e4b601..9261e3700 100644 livenessProbe: failureThreshold: 3 httpGet: -@@ -148,6 +195,16 @@ spec: +@@ -214,6 +271,16 @@ spec: name: '{{ .ClientCAMapName}}' readOnly: true {{- end }} @@ -73,7 +90,7 @@ index 916e4b601..9261e3700 100644 image: '{{ .ReleaseImage.haproxy_router }}' ports: - name: http -@@ -163,6 +218,29 @@ spec: +@@ -227,6 +294,29 @@ spec: protocol: TCP args: - -v=4 @@ -103,7 +120,7 @@ index 916e4b601..9261e3700 100644 tolerations: # Ensure the pod isn't deleted during serial NoExecuteTaintManager tests. # Remember that NoExecute uses Delete, not Evict, because removing the pod -@@ -194,6 +272,19 @@ spec: +@@ -277,6 +367,19 @@ spec: name: '{{ .ClientCAMapName }}' optional: false {{- end }} diff --git a/scripts/auto-rebase/rebase.sh b/scripts/auto-rebase/rebase.sh index 524fa64163..6819c477e0 100755 --- a/scripts/auto-rebase/rebase.sh +++ b/scripts/auto-rebase/rebase.sh @@ -794,7 +794,10 @@ EOF yq -i '.spec.selector = {"matchLabels": {"ingresscontroller.operator.openshift.io/deployment-ingresscontroller": "default"}}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.metadata += {"labels": {"ingresscontroller.operator.openshift.io/deployment-ingresscontroller": "default"}}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.metadata.annotations += {"openshift.io/required-scc": "restricted"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml + yq -i '.spec.template.spec.initContainers[0].image = "{{ .ReleaseImage.haproxy_router }}"' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml + yq -i '.spec.template.spec.initContainers[1].image = "{{ .ReleaseImage.haproxy_router }}"' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.spec.containers[0].image = "{{ .ReleaseImage.haproxy_router }}"' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml + yq -i '.spec.template.spec.containers[0].env += {"name": "ROUTER_HAPROXY_ADMIN_UNIX_SOCKET", "value": "/var/lib/haproxy/run/admin.sock"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.spec.containers[0].env += {"name": "STATS_PORT", "value": "1936"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.spec.containers[0].env += {"name": "RELOAD_INTERVAL", "value": "5s"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml yq -i '.spec.template.spec.containers[0].env += {"name": "ROUTER_ALLOW_WILDCARD_ROUTES", "value": "{{ .RouterAllowWildcardRoutes }}"}' "${REPOROOT}"/assets/components/openshift-router/deployment.yaml From 7563c51f942bd437e6268f896a2b73c945f03b45 Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 18:06:49 +0200 Subject: [PATCH 2/7] update last_rebase.sh --- scripts/auto-rebase/last_rebase.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 9acfa29dd8..8dbcb02f15 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-01-125918" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-02-035219" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-05-172708" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-06-035219" From 096a16a29a8311a16c4467e1e4e1ec0a0b1434bd Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 18:06:50 +0200 Subject: [PATCH 3/7] update changelog --- scripts/auto-rebase/changelog.txt | 312 ++++++++++++++---------------- scripts/auto-rebase/commits.txt | 16 +- 2 files changed, 156 insertions(+), 172 deletions(-) diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 225714fe11..b6e73d15c0 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,166 +1,150 @@ -- api embedded-component 5346161d1bf2a4b45d998678f00e1e8d224acf7b to 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 - - cc6e909a 2026-06-29T11:21:29+01:00 Move pre-flight checks earlier to start of genGroup - - e9fc655c 2026-06-29T11:21:27+01:00 Update verify protobuf scripts - - cba640f1 2026-06-29T11:21:26+01:00 Enable codegen protobuf on legacy APIs - - f1e1d672 2026-06-29T11:21:25+01:00 Add the ability to skip protobuf generation for certain versions - - 85578e6e 2026-06-29T11:21:24+01:00 Add verification of generated protobuf files - - 10804f69 2026-06-29T11:18:37+01:00 Implement protobuf generator within codegen - - ce609dbc 2026-06-29T11:18:36+01:00 Add gogoproto to vendor - - 36b8e4d2 2026-06-29T11:18:35+01:00 Bootstrap initial go-to-protobuf generator in codegen - - 0b97f9b9 2026-06-26T09:06:58-07:00 AUTOSCALE-827: add KarpenterOperator feature gate - - e096b7be 2026-06-24T09:40:03-04:00 OCPBUGS-63219: Add protocol to AWS NLB parameters - - 8f87a41c 2026-06-24T08:01:53-04:00 Add MutableTopology feature gate for spec.controlPlaneTopology - - fd7d48b8 2026-06-23T12:34:23-03:00 chore: SPLAT-2588: enable feature on Hypershift - - 3d2c4233 2026-06-23T11:29:45+01:00 - Adding cabilities for crdcompatibilitychecker and capi CRs - - 5300823d 2026-06-22T17:33:15-03:00 fix(tools): use external topology for hypershift Sippy queries - - f74255e3 2026-06-22T17:33:12-03:00 fix(tools): display hypershift in HTML/markdown reports for external topology - - cc00868b 2026-06-22T17:33:12-03:00 test(tools): add unit tests for featuregate-test-analyzer - - 97133a45 2026-06-22T15:54:14-04:00 Promote VSphereMixedNodeEnv to GA - - c85beac3 2026-06-22T10:41:40-04:00 Add v1 type CRIOCredentialProviderConfig - - 6f5089fa 2026-06-22T13:57:57+05:30 Add API integration tests - - 09b9bcb8 2026-06-22T13:57:55+05:30 Add Secrets Store CSI driver configuration to ClusterCSIDriver API - - 1d2fb194 2026-06-16T09:39:23+02:00 STOR-2966: Promote ExternalSnapshotMetadata feature gate to TechPreviewNoUpgrade - - 3f52e05e 2026-06-09T15:44:21+02:00 Add SELinuxMountGAReadiness FG - -- cluster-ingress-operator embedded-component bf13f251347308b80b170582de455c59cb0510be to 6d4e06c4f11b2536386d14b701a766be34742adf - - d76f79cc 2026-06-26T00:38:57Z Revert "NE-2664: deploy haproxy as sidecar (#1439)" - - f322b5de 2026-06-24T15:02:18-04:00 Fix useOLM guard logic and and add remediation guidance - - a78ff4ec 2026-06-19T10:00:23-03:00 deploy haproxy as sidecar - - 398622a0 2026-06-18T17:50:52-04:00 OCPBUGS-90505: Guard subscriptionCache creation with OLM capability check - - 6f3c80ba 2026-06-18T17:50:45-04:00 OCPBUGS-90505: Guard OLM watches with capability check in gatewayclass controller - - 0421cc19 2026-06-15T22:29:43-04:00 OCPBUGS-86833: Detect orphaned OSSM subscription after noOLM migration - -- cluster-kube-apiserver-operator embedded-component e3c762513675e506be2be1e219f1ef621db18275 to 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f - - 020339b 2026-06-29T16:50:32+03:00 Bump library-go for sync - - 039a08d 2026-06-25T11:13:10+03:00 Wire health reporter - - 4dd7f19 2026-06-25T11:03:52+03:00 Bump library-go - - a1e06e7 2026-06-24T17:50:06+03:00 Update openshift dependencies - - cc13111 2026-06-22T15:06:38+02:00 NO-JIRA: add kms preflight to NP to allow egress - - a960532 2026-06-12T13:35:26+02:00 add openshift/kms parent to kms test suites - -- cluster-kube-controller-manager-operator embedded-component c35307f04313369c9ba4dcab3308506a3987065e to 8bef9812e7a3ec026397acd34633a7ecd479f357 - - c3f74d9 2026-06-26T15:00:24+02:00 Use %w for error wrapping consistently - -- cluster-network-operator embedded-component c376140ed1842c6a5f78cb74c55b4b49ba212041 to 7b341b420baeb655d65e551a1f04e3bcbe2631f1 - - c90d9fb 2026-06-24T14:14:20+02:00 Add CodeRabbit configuration for automated PR reviews - - 8db6228 2026-06-18T10:50:36-07:00 Watch Network and Infrastructure in proxyconfig controller - - b223b6c 2026-06-09T18:00:33+02:00 Update openshift/api and openshift/client-go to latest - - 050d838 2026-05-09T08:13:12-04:00 Add missing CNCC NetworkPolicies - - 39ffe54 2026-05-09T08:08:17-04:00 Add proper CVO annotations to CNO default-deny NP - -- cluster-policy-controller embedded-component bb429f5b2a7d77791110b06d8ec5c017183e3ab9 to 050c1ee6aeb0838daf75858fd853cca1e0098fa9 - - a03103a 2026-06-19T15:45:24+02:00 update OWNERS file - - 69f126c 2026-06-19T11:46:31+02:00 add serviceAccountToken volume type to psalabelsyncer - - aefcd82 2026-06-19T11:43:58+02:00 go mod vendor - - ab6e156 2026-06-19T11:42:00+02:00 bump openshift/api - -- csi-external-snapshotter embedded-component e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- kubernetes embedded-component d8d517e6bbe7cf7359026cac26bb96ea45e18806 to a466682e3867da746be24d7d56c6641612721d6c - - 410f58272 2026-06-16T23:18:18-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for standalone clusters - - 7ffb8b2ae 2026-06-15T13:17:06-04:00 UPSTREAM: : fix kubernetes/conformance to filter on [Conformance] label - -- machine-config-operator embedded-component fb5bfe252ba774a014af1059223cea3d07ef14dd to f05e48737d9db0a62f45f6ef06fc7382a4333fed - - 6618f142 2026-06-30T06:18:16Z OCPEDGE-2473: feat: enabled graceful shutdown for TNF clusters (#6036) - - 1ccbd74e 2026-06-27T12:19:59+05:30 NO-ISSUE: Use DebugNodeWithChrootStd for FIPS check to separate stdout from stderr - - 3a9d76eb 2026-06-26T12:53:29-04:00 OCPBUGS-88333: Fix bootupd workaround in old nodes - - 46030024 2026-06-25T12:46:37+05:30 NO-ISSUE: Use /proc/sys/crypto/fips_enabled for FIPS check in tests - - 5676f30e 2026-06-24T08:28:02-05:00 Remove verbose ignition config logging from bootstrap MCS - - fb2491ab 2026-06-23T11:59:01-04:00 test: remove stub upgrade test - - 95e21734 2026-06-23T17:55:50+05:30 NO-ISSUE: Temporarily disable sandboxed-containers extension from tests - - ba2edec9 2026-06-22T15:40:19-04:00 upgrademonitor: skip no-op MCN SSA calls - - ea5455d8 2026-06-22T10:23:33-04:00 temporarily remove sandboxed-containers from extensions test - - 754cec07 2026-06-22T08:44:40+02:00 OCPBUGS-59958: Updated Unit Test, added extra getconfig check - - 9fac87e5 2026-06-19T20:40:14+05:30 Migrate OS layering tests from openshift-tests-private - - 449a1f79 2026-06-19T12:01:03+05:30 Revert "OKD-294: Migrate runtime from runc to crun on an upgrade for OKD" - - f617a2c5 2026-06-18T10:28:19-04:00 bootimage: add reset cluster bootimage capability - - fa12d23e 2026-06-18T10:28:19-04:00 bootimage: remove configmap version checks - - db282613 2026-06-18T10:28:19-04:00 bootimage: rename patchSkipped to reconcileSkipped - - 0ebbf630 2026-06-18T10:27:15-04:00 bootimage: make vsphere updates atomic - - a552644b 2026-06-17T17:42:55+02:00 NO-ISSUE: Remove dead code - - 51e1b0df 2026-06-17T12:41:32+02:00 OCPBUGS-59958: move cleanUpDuplicatedMC to after pool loop in syncNodeConfigHandler - - 50a50881 2026-06-09T13:29:35Z Block runc on RHEL 10 in bootstrap render path - - fd486c21 2026-06-09T13:29:35Z Block MachineConfig rendering when runc is configured on RHEL 10 pools - -- operator-framework-olm embedded-component 32225496430f8607ece581277f56e254fed708be to cea3be72ef5704256bd35ab88acfa9ab03edf6df - - a6faf7ea 2026-06-29T10:49:09-04:00 fix: warn-and-continue when cluster TLS profile lookup fails at startup (#3860) - - 6907f19c 2026-06-29T10:46:02-04:00 Revert "Merge pull request #1334 from redhat-chai-bot/revert-1330-1782684731" - - 4b0c882b 2026-06-28T22:12:12Z Revert "Merge pull request #1330 from openshift-bot/synchronize-upstream" - - 80043d4c 2026-06-25T00:05:29Z :seedling: Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#3858) - - aef2567a 2026-06-25T00:04:48Z Upgrade hashstructure and mapstructure to v2 (#3854) - - 07fd0b98 2026-06-25T00:04:32Z :seedling: Bump github.com/prometheus/common from 0.68.1 to 0.69.0 (#3857) - - 20fa2f20 2026-06-25T00:04:17Z :seedling: Bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 (#3856) - - 546c08d1 2026-06-25T00:04:01Z Bump actions/checkout from 6 to 7 (#3855) - - 3a95edb6 2026-06-25T00:03:46Z Apply cluster TLS security profile to packageserver serving options (#3849) - - 83332273 2026-06-25T00:03:27Z :seedling: Bump the k8s-dependencies group across 1 directory with 8 updates (#3850) - -- route-controller-manager embedded-component e454c01fbe561cce9973f54b1ddbcdd35a9d18ff to 01ccbfb991fdbc559820a04c4932fc5ddf2339d0 - - d825fa2 2026-06-23T23:22:09-04:00 Update go.mod to match Go 1.26.3 builder images - - d809961 2026-06-06T09:48:07Z Updating ose-route-controller-manager-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/7691ed4dc0b6585b358f9e73fb736ace9a48a286/images/ose-route-controller-manager.yml - -- service-ca-operator embedded-component 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config - -- oc image-amd64 74e525a6a4523a23a5db585c411943b0a0a338da to a7ad57244d4327c77d0fa190bb6d215d2d5faa86 - - fa71bfe5 2026-06-29T14:27:49+02:00 Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README - - 15da98fa 2026-06-24T18:47:01+05:30 Assert expected tempDir in codesign extraction tests - - 2419b54b 2026-06-23T15:13:38+05:30 Catch exact '..' entry in archive containment check - - 9710f19c 2026-06-23T13:59:01+05:30 Fix zipslip in image archive unpack and refine codesign guard - - d7534960 2026-06-19T14:54:01+05:30 Fix tar slip path traversal in codesign archive extraction - -- csi-external-snapshotter image-amd64 e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- router image-amd64 3553702970b094986d91f218e3191487de46e476 to 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f - - 0e72c4d 2026-06-29T16:03:08-03:00 Add HAProxy standalone images for 2.8 and 3.2 - - 42ee1e6 2026-06-08T06:07:59Z Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/openshift-enterprise-haproxy-router.yml - -- ovn-kubernetes image-amd64 62baca4832f3aeb3fc7032d38619835c04208c95 to f0527039dfc4901637721e7cecfdb9d0ea1c9c38 - - 10d5782c 2026-06-16T20:56:43-07:00 Fix perma-failing security presubmit job - - 133ba1e4 2026-05-08T09:45:38+02:00 Promote EVPN E2Es from informing to blocking tests - -- kubernetes image-amd64 d8d517e6bbe7cf7359026cac26bb96ea45e18806 to a466682e3867da746be24d7d56c6641612721d6c - - 410f58272 2026-06-16T23:18:18-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for standalone clusters - - 7ffb8b2ae 2026-06-15T13:17:06-04:00 UPSTREAM: : fix kubernetes/conformance to filter on [Conformance] label - -- service-ca-operator image-amd64 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config - -- oc image-arm64 74e525a6a4523a23a5db585c411943b0a0a338da to a7ad57244d4327c77d0fa190bb6d215d2d5faa86 - - fa71bfe5 2026-06-29T14:27:49+02:00 Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README - - 15da98fa 2026-06-24T18:47:01+05:30 Assert expected tempDir in codesign extraction tests - - 2419b54b 2026-06-23T15:13:38+05:30 Catch exact '..' entry in archive containment check - - 9710f19c 2026-06-23T13:59:01+05:30 Fix zipslip in image archive unpack and refine codesign guard - - d7534960 2026-06-19T14:54:01+05:30 Fix tar slip path traversal in codesign archive extraction - -- csi-external-snapshotter image-arm64 e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- router image-arm64 3553702970b094986d91f218e3191487de46e476 to 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f - - 0e72c4d 2026-06-29T16:03:08-03:00 Add HAProxy standalone images for 2.8 and 3.2 - - 42ee1e6 2026-06-08T06:07:59Z Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/openshift-enterprise-haproxy-router.yml - -- ovn-kubernetes image-arm64 62baca4832f3aeb3fc7032d38619835c04208c95 to 6617c2a2ce4ab2e060e649672c91cf349d8500f7 +- api embedded-component 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 to 02e2c3de12fb849770deaa3ac9bb3b160a1cb4d8 + - 9f503bcd 2026-07-02T13:00:10-04:00 fix(crd): adjust storage settings for CRIOCredentialProviderConfig versions + - 6c8739bc 2026-07-02T12:30:27+01:00 Updates API review skill + - 02030eb8 2026-07-01T17:56:40-04:00 Fix Typo + - 483b3d02 2026-07-01T16:52:04-04:00 Fix integration test + - 9f8751d7 2026-07-01T13:41:53-04:00 make update During code generation, the manifest-merge tool combines this override with the v1 schema generated from Go types to produce a final CRD that serves both versions: + - 9ab6f8f9 2026-07-01T13:28:01-04:00 Add v1alpha1 schema override for InternalReleaseImage + - 63d1eff4 2026-06-26T21:53:42+02:00 Adding documentation related to some cases for the network observability instalation field + - 831b00a7 2026-06-26T13:21:48-04:00 Update generated code after rebase + - 13e4ae16 2026-06-26T13:07:27-04:00 AGENT-1522: Graduate InternalReleaseImage from v1alpha1 to v1 + - a62c9890 2026-06-25T16:10:17+02:00 config/v1alpha1: tombstone remote write auth fields and add tests + - 08db43df 2026-06-25T14:06:14+02:00 config/v1alpha1: regenerate after tombstoned auth field godoc fix + - 0ef6b40c 2026-06-25T12:01:51+02:00 config/v1alpha1: fix tombstoned remote write auth field godoc + - 62a162bf 2026-06-25T11:10:52+02:00 config/v1alpha1: keep deprecated remote write auth fields for crdify + - 0fa312d8 2026-06-24T16:16:45+02:00 config/v1alpha1: align remote write auth union with review feedback + - 1bb239b7 2026-06-23T13:25:14+02:00 config/v1alpha1: rename remote write SafeAuthorization to Authorization + - 6a8233b0 2026-05-20T14:36:40-03:00 Add feature gate for multiple HAProxy versions + +- cluster-ingress-operator embedded-component 6d4e06c4f11b2536386d14b701a766be34742adf to 7b7406ee0d4bf03de360d53c9cc4a83ee14332cc + - 45f06392 2026-06-29T18:36:05-03:00 deploy haproxy as sidecar + +- cluster-kube-apiserver-operator embedded-component 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f to 6b0696abb88d7e2f7a8275f831519234851121c0 + - 0ba9af7 2026-07-02T12:14:17+02:00 Fix inaccuracies in AGENTS.md and ARCHITECTURE.md + - 11ba053 2026-07-02T11:42:39+02:00 Address review feedback on AGENTS.md and ARCHITECTURE.md + - 16b5200 2026-07-01T08:36:04+03:00 Add new test suite for KMS to KMS migration + - d6d43ac 2026-07-01T08:13:24+05:30 test: Add network policy enforcement tests + - 2d10c6b 2026-06-26T12:51:19+02:00 Add CLAUDE.md + - ecca0ca 2026-06-26T12:51:19+02:00 Add AGENTS.md and ARCHITECTURE.md for developer and AI agent reference + - f515794 2026-06-26T12:51:19+02:00 Add common CONTRIBUTING.md + +- cluster-network-operator embedded-component 7b341b420baeb655d65e551a1f04e3bcbe2631f1 to 8f06c7ead50937cb25d0f829d2cff003eff12bb8 + - 8d52d3a 2026-06-30T09:56:50+02:00 Add path-specific review instructions to CodeRabbit config + +- machine-config-operator embedded-component f05e48737d9db0a62f45f6ef06fc7382a4333fed to 28f12d28b9be52db0830b5d6ed0b6f141bbd2ae7 + - 28f12d28 2026-07-03T08:36:38Z OCPBUGS-64681: fix: add arbiter to control plane mcp sync (#5436) + - f88cf20d 2026-07-01T00:04:09Z chore: update AMIs + - ba9dad39 2026-06-29T11:45:04-05:00 Remove verbose ControllerConfig logging from bootstrap MCS + - 4c2e88be 2026-06-11T15:54:45-04:00 create digest configmap without oc binary + +- operator-framework-olm embedded-component cea3be72ef5704256bd35ab88acfa9ab03edf6df to 834f3e052edb84e6f316563d9a6f23035c03945f + - e461cff5 2026-07-01T13:26:34-04:00 Apply cluster TLS security profile to packageserver serving options + - 24e9dd6f 2026-06-30T15:03:07+02:00 OPRUN-4612: Add E2E tests for ExperimentalListPackageCustomSchemas gRPC endpoint + +- ovn-kubernetes image-amd64 f0527039dfc4901637721e7cecfdb9d0ea1c9c38 to fc46681bd5720c0139c394eea3d2ab686a2cf46f - 91d29f7b 2026-06-18T18:51:01+05:30 Dockerfile.base: Bump OVN to 26.03 - - 10d5782c 2026-06-16T20:56:43-07:00 Fix perma-failing security presubmit job - - 133ba1e4 2026-05-08T09:45:38+02:00 Promote EVPN E2Es from informing to blocking tests - -- service-ca-operator image-arm64 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config + - 8e2a679f 2026-06-15T15:05:50Z sync test annotations with upstream changes + - dfcb2426 2026-06-12T14:10:55+02:00 Fix UDN controller startup timeout during pod sync + - 3ac5bf95 2026-06-11T12:15:58-04:00 Use TLS config params in the ovnkube-identity webhook + - 857ce9a9 2026-06-11T12:15:58-04:00 Add CLI flags for configuring TLS to ovnkube-identity + - 8512a3bf 2026-06-11T16:27:20+02:00 Address review feedback on CUDN transport metric + - 75597a67 2026-06-11T16:27:20+02:00 Add transport label to CUDN count metric + - 9ebc3afa 2026-06-10T12:41:53-04:00 Adding missing labels for UDN workloads + - 268848f5 2026-06-10T10:20:30+02:00 e2e: fix UDN subnet overlap with downstream service CIDR + - d59e62b0 2026-06-09T15:07:42-04:00 cni: gracefully handle missing device info file for primary UDN + - 85979507 2026-06-09T10:05:01+02:00 e2e(virt): Add evpn failed migration test + - 08dee44f 2026-06-09T10:05:01+02:00 test(evpn): add unit tests for neighbor timing during live migration + - 94cf737b 2026-06-09T10:05:01+02:00 fix(evpn): remove dead EEXIST check from LinkFDBSet caller + - 8fd2cad4 2026-06-09T10:05:01+02:00 refactor: rename LinkFDBAdd to LinkFDBSet, use NeighSet + - ff611433 2026-06-09T10:05:01+02:00 refactor: rename LinkNeighAdd to LinkNeighSet + - 9e8bb31c 2026-06-09T10:05:01+02:00 fix(evpn): gate neighbor programming on migration domain readiness + - a11c389d 2026-06-09T08:10:33+02:00 area-maintainers: introduce kubevirt area with merge bot + - 2d545a0b 2026-06-08T15:02:18-07:00 contrib: refresh OVN pods on kind-helm.sh --deploy + - 1160194c 2026-06-08T14:49:52-04:00 Make TFT report failure for DPU CI jobs + - f8f3c2b5 2026-06-08T14:49:52-04:00 Route DPU host no-overlay traffic through OVN + - 95380fd4 2026-06-08T14:49:52-04:00 Peer DPU sim FRR over gateway network + - 107c5d5b 2026-06-08T14:49:52-04:00 Handle renamed FRR-K8S controller in DPU sim + - 7fc0f4b1 2026-06-08T14:49:52-04:00 Add DPU simulator no-overlay CI lane + - d7ac03e4 2026-06-08T14:49:52-04:00 Support manual DPU simulator Helm installs + - ca608635 2026-06-08T09:26:08-07:00 ovn: drop unreachable IPAMClaim reconciler after non-IC removal + - 7a7f4caa 2026-06-08T09:26:08-07:00 ovn: drop dead IPAMClaim watch after non-IC removal + - 047d5d36 2026-06-08T08:55:12-07:00 Sync reconcile pod-selector address sets at creation time + - e08225fc 2026-06-08T14:08:17Z RA contrioller: add unicast allowas-in origin to raw FRR config + - 4b4d0b9a 2026-06-08T14:01:09Z RA controller: rename evpn_rawconfig to rawconfig for future broader use + - c83b6f3d 2026-06-08T13:19:21Z e2e: configure framework TestContext to verify service accounts + - 0fe6e3d9 2026-06-06T09:54:52-04:00 dpulease: fix nil pointer panic in CNI health check + - 09cf4944 2026-06-05T17:43:18+02:00 [FYI] prevent duplicate logical_router_static_route + - d9cefde5 2026-06-04T17:55:23-04:00 Use FRR-K8S next-hop API in kind installs + - 4ab105d4 2026-06-04T20:14:49+02:00 ci: wait for service reachability after dual-stack conversion + - 351aa103 2026-06-04T13:35:15-04:00 Bump OpenTelemetry to v1.41.0 + - cc84a978 2026-06-04T13:35:15-04:00 Stop using deprecated frr-k8s DisableMP field + - fa24ddb5 2026-06-04T13:28:56-04:00 Fix using docker for dpu-sim CI lane + - a0c9fa1f 2026-06-04T13:21:57-04:00 Set DPU host BGP next-hop for no-overlay routes + - fc34b18f 2026-06-04T09:45:23-07:00 tests,e2e: add BFD route-cleanup coverage and fix stale wording + - ebc865ca 2026-06-04T09:45:23-07:00 tests,e2e: drop orphaned external-gw-pod-ips constant + - 1355df27 2026-06-04T09:45:23-07:00 tests: cover external-gateway route deletion for APB-managed routes + - c824eb88 2026-06-04T09:45:23-07:00 node: run periodic external-gateway conntrack cleanup for APB namespaces + - be576f25 2026-06-04T09:45:22-07:00 tests,e2e: remove legacy external-gateway annotation specs + - 52634fa1 2026-06-04T09:45:22-07:00 util,node,config: drop legacy external-gateway annotations + - 2d0beded 2026-06-04T09:45:22-07:00 apbroute: stop honoring legacy external-gateway annotations + - 0afda7bf 2026-06-04T09:45:22-07:00 ovn: remove legacy external-gateway annotation handling + - 1d8db6ee 2026-06-04T10:47:34-04:00 Bump frr-k8s for next-hop API + - 7525f9ce 2026-06-04T11:11:50+02:00 e2e: wait for localnet multi network policy convergence + - be80cc06 2026-05-15T09:04:49-07:00 test/e2e: drop dead multi-node-per-zone branching + - 1e20211e 2026-05-15T09:04:49-07:00 docs/installation: drop manual zone-name labeling step + - ffed9316 2026-05-15T09:04:49-07:00 test/e2e/kubevirt: simplify worker selection for live-migration + - fbeeaea7 2026-05-15T09:04:49-07:00 dist, helm, contrib: drop manual zone-name labeling + +- ovn-kubernetes image-arm64 6617c2a2ce4ab2e060e649672c91cf349d8500f7 to fc46681bd5720c0139c394eea3d2ab686a2cf46f + - 8e2a679f 2026-06-15T15:05:50Z sync test annotations with upstream changes + - dfcb2426 2026-06-12T14:10:55+02:00 Fix UDN controller startup timeout during pod sync + - 3ac5bf95 2026-06-11T12:15:58-04:00 Use TLS config params in the ovnkube-identity webhook + - 857ce9a9 2026-06-11T12:15:58-04:00 Add CLI flags for configuring TLS to ovnkube-identity + - 8512a3bf 2026-06-11T16:27:20+02:00 Address review feedback on CUDN transport metric + - 75597a67 2026-06-11T16:27:20+02:00 Add transport label to CUDN count metric + - 9ebc3afa 2026-06-10T12:41:53-04:00 Adding missing labels for UDN workloads + - 268848f5 2026-06-10T10:20:30+02:00 e2e: fix UDN subnet overlap with downstream service CIDR + - d59e62b0 2026-06-09T15:07:42-04:00 cni: gracefully handle missing device info file for primary UDN + - 85979507 2026-06-09T10:05:01+02:00 e2e(virt): Add evpn failed migration test + - 08dee44f 2026-06-09T10:05:01+02:00 test(evpn): add unit tests for neighbor timing during live migration + - 94cf737b 2026-06-09T10:05:01+02:00 fix(evpn): remove dead EEXIST check from LinkFDBSet caller + - 8fd2cad4 2026-06-09T10:05:01+02:00 refactor: rename LinkFDBAdd to LinkFDBSet, use NeighSet + - ff611433 2026-06-09T10:05:01+02:00 refactor: rename LinkNeighAdd to LinkNeighSet + - 9e8bb31c 2026-06-09T10:05:01+02:00 fix(evpn): gate neighbor programming on migration domain readiness + - a11c389d 2026-06-09T08:10:33+02:00 area-maintainers: introduce kubevirt area with merge bot + - 2d545a0b 2026-06-08T15:02:18-07:00 contrib: refresh OVN pods on kind-helm.sh --deploy + - 1160194c 2026-06-08T14:49:52-04:00 Make TFT report failure for DPU CI jobs + - f8f3c2b5 2026-06-08T14:49:52-04:00 Route DPU host no-overlay traffic through OVN + - 95380fd4 2026-06-08T14:49:52-04:00 Peer DPU sim FRR over gateway network + - 107c5d5b 2026-06-08T14:49:52-04:00 Handle renamed FRR-K8S controller in DPU sim + - 7fc0f4b1 2026-06-08T14:49:52-04:00 Add DPU simulator no-overlay CI lane + - d7ac03e4 2026-06-08T14:49:52-04:00 Support manual DPU simulator Helm installs + - ca608635 2026-06-08T09:26:08-07:00 ovn: drop unreachable IPAMClaim reconciler after non-IC removal + - 7a7f4caa 2026-06-08T09:26:08-07:00 ovn: drop dead IPAMClaim watch after non-IC removal + - 047d5d36 2026-06-08T08:55:12-07:00 Sync reconcile pod-selector address sets at creation time + - e08225fc 2026-06-08T14:08:17Z RA contrioller: add unicast allowas-in origin to raw FRR config + - 4b4d0b9a 2026-06-08T14:01:09Z RA controller: rename evpn_rawconfig to rawconfig for future broader use + - c83b6f3d 2026-06-08T13:19:21Z e2e: configure framework TestContext to verify service accounts + - 0fe6e3d9 2026-06-06T09:54:52-04:00 dpulease: fix nil pointer panic in CNI health check + - 09cf4944 2026-06-05T17:43:18+02:00 [FYI] prevent duplicate logical_router_static_route + - d9cefde5 2026-06-04T17:55:23-04:00 Use FRR-K8S next-hop API in kind installs + - 4ab105d4 2026-06-04T20:14:49+02:00 ci: wait for service reachability after dual-stack conversion + - 351aa103 2026-06-04T13:35:15-04:00 Bump OpenTelemetry to v1.41.0 + - cc84a978 2026-06-04T13:35:15-04:00 Stop using deprecated frr-k8s DisableMP field + - fa24ddb5 2026-06-04T13:28:56-04:00 Fix using docker for dpu-sim CI lane + - a0c9fa1f 2026-06-04T13:21:57-04:00 Set DPU host BGP next-hop for no-overlay routes + - fc34b18f 2026-06-04T09:45:23-07:00 tests,e2e: add BFD route-cleanup coverage and fix stale wording + - ebc865ca 2026-06-04T09:45:23-07:00 tests,e2e: drop orphaned external-gw-pod-ips constant + - 1355df27 2026-06-04T09:45:23-07:00 tests: cover external-gateway route deletion for APB-managed routes + - c824eb88 2026-06-04T09:45:23-07:00 node: run periodic external-gateway conntrack cleanup for APB namespaces + - be576f25 2026-06-04T09:45:22-07:00 tests,e2e: remove legacy external-gateway annotation specs + - 52634fa1 2026-06-04T09:45:22-07:00 util,node,config: drop legacy external-gateway annotations + - 2d0beded 2026-06-04T09:45:22-07:00 apbroute: stop honoring legacy external-gateway annotations + - 0afda7bf 2026-06-04T09:45:22-07:00 ovn: remove legacy external-gateway annotation handling + - 1d8db6ee 2026-06-04T10:47:34-04:00 Bump frr-k8s for next-hop API + - 7525f9ce 2026-06-04T11:11:50+02:00 e2e: wait for localnet multi network policy convergence + - be80cc06 2026-05-15T09:04:49-07:00 test/e2e: drop dead multi-node-per-zone branching + - 1e20211e 2026-05-15T09:04:49-07:00 docs/installation: drop manual zone-name labeling step + - ffed9316 2026-05-15T09:04:49-07:00 test/e2e/kubevirt: simplify worker selection for live-migration + - fbeeaea7 2026-05-15T09:04:49-07:00 dist, helm, contrib: drop manual zone-name labeling diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index fca884c802..82ac34a227 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,20 +1,20 @@ -https://github.com/openshift/api embedded-component 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 +https://github.com/openshift/api embedded-component 02e2c3de12fb849770deaa3ac9bb3b160a1cb4d8 https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component d7262f23f8c661ef6a215377b9571b615a1ae0b8 https://github.com/openshift/cluster-dns-operator embedded-component 8395f9054f235aec2cd5185019d201146c9827ed -https://github.com/openshift/cluster-ingress-operator embedded-component 6d4e06c4f11b2536386d14b701a766be34742adf -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f +https://github.com/openshift/cluster-ingress-operator embedded-component 7b7406ee0d4bf03de360d53c9cc4a83ee14332cc +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 6b0696abb88d7e2f7a8275f831519234851121c0 https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 8bef9812e7a3ec026397acd34633a7ecd479f357 https://github.com/openshift/cluster-kube-scheduler-operator embedded-component d43423b583269eea8236040424609c3f108ac9c4 -https://github.com/openshift/cluster-network-operator embedded-component 7b341b420baeb655d65e551a1f04e3bcbe2631f1 +https://github.com/openshift/cluster-network-operator embedded-component 8f06c7ead50937cb25d0f829d2cff003eff12bb8 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 34f95b07f4afbc47558e54e4fa2710fd692e615e https://github.com/openshift/cluster-policy-controller embedded-component 050c1ee6aeb0838daf75858fd853cca1e0098fa9 https://github.com/openshift/csi-external-snapshotter embedded-component b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/etcd embedded-component bf6c0094589afdf6c814a28c24f8f1bb5a577816 https://github.com/openshift/kubernetes embedded-component a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component f05e48737d9db0a62f45f6ef06fc7382a4333fed +https://github.com/openshift/machine-config-operator embedded-component 28f12d28b9be52db0830b5d6ed0b6f141bbd2ae7 https://github.com/openshift/openshift-controller-manager embedded-component 5631cf493b006cbc72a8600a7435813272d71940 -https://github.com/openshift/operator-framework-olm embedded-component cea3be72ef5704256bd35ab88acfa9ab03edf6df +https://github.com/openshift/operator-framework-olm embedded-component 834f3e052edb84e6f316563d9a6f23035c03945f https://github.com/openshift/route-controller-manager embedded-component 01ccbfb991fdbc559820a04c4932fc5ddf2339d0 https://github.com/openshift/service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 https://github.com/openshift/oc image-amd64 a7ad57244d4327c77d0fa190bb6d215d2d5faa86 @@ -22,7 +22,7 @@ https://github.com/openshift/coredns image-amd64 97f7cc327ab5df7d6da38137b7be338 https://github.com/openshift/csi-external-snapshotter image-amd64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/router image-amd64 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f https://github.com/openshift/kube-rbac-proxy image-amd64 d12e274605248f6c59373240a7eae7a7a357dcb3 -https://github.com/openshift/ovn-kubernetes image-amd64 f0527039dfc4901637721e7cecfdb9d0ea1c9c38 +https://github.com/openshift/ovn-kubernetes image-amd64 fc46681bd5720c0139c394eea3d2ab686a2cf46f https://github.com/openshift/kubernetes image-amd64 a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 https://github.com/openshift/oc image-arm64 a7ad57244d4327c77d0fa190bb6d215d2d5faa86 @@ -30,6 +30,6 @@ https://github.com/openshift/coredns image-arm64 97f7cc327ab5df7d6da38137b7be338 https://github.com/openshift/csi-external-snapshotter image-arm64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/router image-arm64 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f https://github.com/openshift/kube-rbac-proxy image-arm64 d12e274605248f6c59373240a7eae7a7a357dcb3 -https://github.com/openshift/ovn-kubernetes image-arm64 6617c2a2ce4ab2e060e649672c91cf349d8500f7 +https://github.com/openshift/ovn-kubernetes image-arm64 fc46681bd5720c0139c394eea3d2ab686a2cf46f https://github.com/openshift/kubernetes image-arm64 a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/service-ca-operator image-arm64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 From 510722875562c690b0d2ceade92e378257928ccb Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 18:08:12 +0200 Subject: [PATCH 4/7] update etcd/vendor --- .../openshift/microshift/pkg/config/config.go | 2 +- .../microshift/pkg/config/ingress.go | 82 ++++++++++++++++++- 2 files changed, 82 insertions(+), 2 deletions(-) diff --git a/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go b/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go index 8fea3f4a3b..35fafe3a26 100644 --- a/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go +++ b/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go @@ -184,7 +184,7 @@ func (c *Config) fillDefaults() error { ForwardedHeaderPolicy: "Append", HTTPEmptyRequestsPolicy: "Respond", ServingCertificateSecret: "router-certs-default", - TLSSecurityProfile: &configv1.TLSSecurityProfile{ + TLSSecurityProfile: &TLSSecurityProfile{ Type: configv1.TLSProfileIntermediateType, }, AccessLogging: AccessLogging{ diff --git a/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go b/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go index 5ca98daf96..454c1c4800 100644 --- a/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go +++ b/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go @@ -42,6 +42,86 @@ type IngressStatusEnum string type DefaultHttpVersionPolicy int32 type WildcardPolicy string +// TLSSecurityProfile defines the schema for a TLS security profile. This object +// is used by operators to apply TLS security settings to operands. +// +union +type TLSSecurityProfile struct { + // type is one of Old, Intermediate, Modern or Custom. Custom provides the + // ability to specify individual TLS security profile parameters. + // + // The profiles are based on the Mozilla Server Side TLS configuration + // guidelines. The cipher lists consist of the configuration's + // "ciphersuites" followed by the "ciphers" from the guidelines. + // + // The profiles are intent based, so they may change over time as new ciphers are + // developed and existing ciphers are found to be insecure. Depending on + // precisely which ciphers are available to a process, the list may be reduced. + // + // +unionDiscriminator + // +optional + Type configv1.TLSProfileType `json:"type"` + + // old is a TLS profile for use when services need to be accessed by very old + // clients or libraries and should be used only as a last resort. + // + // +optional + // +nullable + Old *configv1.OldTLSProfile `json:"old,omitempty"` + + // intermediate is a TLS profile for use when you do not need compatibility with + // legacy clients and want to remain highly secure while being compatible with + // most clients currently in use. + // + // +optional + // +nullable + Intermediate *configv1.IntermediateTLSProfile `json:"intermediate,omitempty"` + + // modern is a TLS security profile for use with clients that support TLS 1.3 and + // do not need backward compatibility for older clients. + // + // +optional + // +nullable + Modern *configv1.ModernTLSProfile `json:"modern,omitempty"` + + // custom is a user-defined TLS security profile. Be extremely careful using a custom + // profile as invalid configurations can be catastrophic. An example custom profile + // looks like this: + // + // minTLSVersion: VersionTLS11 + // ciphers: + // - ECDHE-ECDSA-CHACHA20-POLY1305 + // - ECDHE-RSA-CHACHA20-POLY1305 + // - ECDHE-RSA-AES128-GCM-SHA256 + // - ECDHE-ECDSA-AES128-GCM-SHA256 + // + // +optional + // +nullable + Custom *CustomTLSProfile `json:"custom,omitempty"` +} + +// CustomTLSProfile is a user-defined TLS security profile. Be extremely careful +// using a custom TLS profile as invalid configurations can be catastrophic. +type CustomTLSProfile struct { + // ciphers is used to specify the cipher algorithms that are negotiated + // during the TLS handshake. Operators may remove entries that their operands + // do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + // + // ciphers: + // - ECDHE-RSA-AES128-GCM-SHA256 + // + // TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + // and are always enabled when TLS 1.3 is negotiated. + // +listType=atomic + Ciphers []string `json:"ciphers"` + // minTLSVersion is used to specify the minimal version of the TLS protocol + // that is negotiated during the TLS handshake. For example, to use TLS + // versions 1.1, 1.2 and 1.3 (yaml): + // + // minTLSVersion: VersionTLS11 + // + MinTLSVersion configv1.TLSProtocolVersion `json:"minTLSVersion"` +} + type IngressConfig struct { // Default router status, can be Managed or Removed. // +kubebuilder:default=Managed @@ -148,7 +228,7 @@ type IngressConfig struct { // controller, resulting in a rollout. // // +optional - TLSSecurityProfile *configv1.TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` + TLSSecurityProfile *TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` // clientTLS specifies settings for requesting and verifying client // certificates, which can be used to enable mutual TLS for From c2dd8b76e0c3bf93d1d0c14230a32b7dc12d4018 Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 18:08:18 +0200 Subject: [PATCH 5/7] update manifests --- .../multus/release-multus-aarch64.json | 2 +- .../multus/release-multus-x86_64.json | 2 +- .../openshift-router/deployment.yaml | 107 +++++++++++++++++- .../kustomization.x86_64.yaml | 8 +- .../release-olm-aarch64.json | 2 +- .../release-olm-x86_64.json | 6 +- assets/release/release-aarch64.json | 4 +- assets/release/release-x86_64.json | 4 +- 8 files changed, 116 insertions(+), 19 deletions(-) diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index 78d51fde24..9a407dde28 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-035219" }, "images": { "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b2e551ce30a36b4bb1e26de7abd739b045767cef27e16e30d1add5cfc5acdcf5", diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index aec2bd3c93..a5ec865656 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6021b7fe340a630889ad00e43e237bb39289524ce6396cf3ae28b892ef9e5cd0", diff --git a/assets/components/openshift-router/deployment.yaml b/assets/components/openshift-router/deployment.yaml index af1f48f67f..8a63622618 100644 --- a/assets/components/openshift-router/deployment.yaml +++ b/assets/components/openshift-router/deployment.yaml @@ -1,4 +1,7 @@ # Deployment with default values +# +# Methods hashableDeployment() and deploymentConfigChanged() +# must be updated when adding new fields to this manifest. kind: Deployment apiVersion: apps/v1 spec: @@ -11,15 +14,83 @@ spec: labels: ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default spec: + # manually configure the service account, so we can configure it only in the router container. + automountServiceAccountToken: false serviceAccountName: router priorityClassName: system-cluster-critical - containers: - - name: router + shareProcessNamespace: true + initContainers: + - name: init-router imagePullPolicy: IfNotPresent + terminationMessagePolicy: FallbackToLogsOnError + command: ["/bin/bash", "-c", "cp -R -p /var/lib/haproxy/* /mnt/config/"] + volumeMounts: + - mountPath: /mnt/config + name: haproxy-config + image: '{{ .ReleaseImage.haproxy_router }}' + - name: haproxy + imagePullPolicy: IfNotPresent + restartPolicy: Always securityContext: # See https://bugzilla.redhat.com/2007246 allowPrivilegeEscalation: true - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + command: ["/var/lib/haproxy/start-haproxy"] + # admin.sock should follow routerHAProxyAdminSocket const + args: ["-W", "-db", "-S", "/var/lib/haproxy/run/admin.sock,mode,600", "-f", "/var/lib/haproxy/conf/haproxy.config"] + livenessProbe: + exec: + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"] + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + terminationGracePeriodSeconds: 10 + readinessProbe: + failureThreshold: 3 + exec: + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"] + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + failureThreshold: 120 + exec: + # admin.sock should follow routerHAProxyAdminSocket const + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/admin.sock"] + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + resources: + requests: + cpu: 100m + memory: 256Mi + volumeMounts: + - mountPath: /var/lib/haproxy + name: haproxy-config + - mountPath: /etc/pki/tls/private + name: default-certificate + readOnly: true + - mountPath: /var/run/configmaps/service-ca + name: service-ca-bundle + readOnly: true + {{- if .HttpErrorCodePages }} + - mountPath: /var/lib/haproxy/errorfiles + name: error-code-pages + readOnly: true + {{- end }} + {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }} + - mountPath: /var/lib/rsyslog + name: rsyslog-socket + readOnly: false + {{- end }} + image: '{{ .ReleaseImage.haproxy_router }}' + containers: + - name: router + imagePullPolicy: IfNotPresent + securityContext: + readOnlyRootFilesystem: true terminationMessagePolicy: FallbackToLogsOnError env: - name: ROUTER_SERVICE_NAMESPACE @@ -28,6 +99,8 @@ spec: value: /etc/pki/tls/private - name: DEFAULT_DESTINATION_CA_PATH value: /var/run/configmaps/service-ca/service-ca.crt + - name: ROUTER_HAPROXY_ADMIN_UNIX_SOCKET + value: /var/lib/haproxy/run/admin.sock - name: STATS_PORT value: "1936" - name: RELOAD_INTERVAL @@ -181,15 +254,20 @@ spec: timeoutSeconds: 1 resources: requests: - cpu: 100m - memory: 256Mi + cpu: 25m + memory: 64Mi volumeMounts: + - mountPath: /var/lib/haproxy + name: haproxy-config - mountPath: /etc/pki/tls/private name: default-certificate readOnly: true - mountPath: /var/run/configmaps/service-ca name: service-ca-bundle readOnly: true + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access + readOnly: true {{- if .ClientCAMapName }} - mountPath: '{{ .ClientCAMountPath }}' name: '{{ .ClientCAMapName}}' @@ -254,6 +332,8 @@ spec: secret: defaultMode: 420 secretName: '{{ .ServingCertificateSecret }}' + - name: haproxy-config + emptyDir: {} - name: service-ca-bundle configMap: defaultMode: 420 @@ -262,6 +342,23 @@ spec: path: service-ca.crt name: service-ca-bundle optional: false + - name: kube-api-access + projected: + defaultMode: 0400 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + fieldPath: metadata.namespace {{- if .ClientCAMapName }} - name: '{{ .ClientCAMapName }}' configMap: diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index 9991a3f3da..3d96ced2af 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,10 +2,10 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509 + digest: sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0 + digest: sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev digest: sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614 @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index 1dd405cc9f..4116222770 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-035219" }, "images": { "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e", diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index 007b55343e..5b459b6c92 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0", + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614" } } diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 1f6bd1b6ba..aa4b351378 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,13 +1,13 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-035219" }, "images": { "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c10d50cb3876b58d05cf3a8c651a96593b668c8c44f9a60aed4df15495188e55", "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:7b8674c484522e90c92dd7701c2c7d6b8fa412e1ea9407eb4bee6cca26840af2", "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:40aeb4e2ff402d58295dc34e1817151ed4a9ad3af4576988d6608f66976b90d1", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c03ee82dd0efb3d5cc62c52225c38efcd0fbbf1aa1b4b8e7e8fe4cf701f1f85", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:aaabe7b8816bae6d0ba5901bb68bace83e9b4e792335f65c0ff323b38c570989", "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e77470864ee29dcb7b4b33d76b700a1e76006b0c78d5fb15474c550b3cb8f9de", "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5476719db99b2dc909fe6bf8362b71479a14c43b938930ce011f66f663f5beea", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index 4d46762374..d5b9c925b4 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,13 +1,13 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f05e455da699c1ae675c26bd45e979f38bf7e57afb7c3c71ae4576221be69dc8", "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:bda7069b8d610370dde4649f16439931dd9d9b84386dfd0706188718d037f8af", "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fbbbddc10e6888e156a0b36b1e9751e8dc053de3e0203af7e014bf61b2ef5ac4", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:84c30ba6de3831698b6efba8b8fa347911f2cd3443ffb7e08286dd286fd7ba80", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e99e72dc1b3d4efcbc87f5a163736bb2e4cabf8d653673f96044320b49cc37c5", "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:539080a9bef7f24561af6953d3e24e827dd1e5aa74311c77d93924c0b024419b", "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:cba3482d1c4d6acb0bafc88286dc117f880421fde1785b4c30b83166b2de4cd8", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", From bbf433ce8450f12f9b61463d04cd7d756eceeb31 Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 18:08:20 +0200 Subject: [PATCH 6/7] update buildfiles --- Makefile.version.aarch64.var | 2 +- Makefile.version.x86_64.var | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index 0919561ece..a1aed3f5ab 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-02-035219 +OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-06-035219 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index 7af74ab9f6..bdcdf2a623 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-2026-07-01-125918 +OCP_VERSION := 5.0.0-0.nightly-2026-07-05-172708 From 0d567d736268626d3ab58ada813d535407ae14f4 Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Mon, 6 Jul 2026 23:53:42 +0200 Subject: [PATCH 7/7] Update router access log tests --- test/suites/router/router.robot | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/test/suites/router/router.robot b/test/suites/router/router.robot index 2d7553517d..5e5608c582 100644 --- a/test/suites/router/router.robot +++ b/test/suites/router/router.robot @@ -429,7 +429,15 @@ Delete Custom CA Secret Oc Delete configmap/router-ca-certs-custom -n openshift-ingress Check Access Logs - [Documentation] Retrieve and check if a pattern appears in the router's access logs. + [Documentation] Send traffic through the router to generate access log entries, + ... then verify the pattern appears in the logs container output. + [Arguments] ${pattern} + Access Hello Microshift ${HTTP_PORT} + Wait Until Keyword Succeeds 10x 2s + ... Access Logs Should Contain ${pattern} + +Access Logs Should Contain + [Documentation] Check that the router's access logs contain the given pattern. [Arguments] ${pattern} ${logs}= Oc Logs deployment/router-default -c logs openshift-ingress Should Contain ${logs} ${pattern}