diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index 0919561ece..0ad5b66338 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-02-035219 +OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-06-155219 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index 7af74ab9f6..bdcdf2a623 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-2026-07-01-125918 +OCP_VERSION := 5.0.0-0.nightly-2026-07-05-172708 diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index 78d51fde24..437278824f 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-155219" }, "images": { "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b2e551ce30a36b4bb1e26de7abd739b045767cef27e16e30d1add5cfc5acdcf5", diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index aec2bd3c93..a5ec865656 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6021b7fe340a630889ad00e43e237bb39289524ce6396cf3ae28b892ef9e5cd0", diff --git a/assets/components/openshift-router/deployment.yaml b/assets/components/openshift-router/deployment.yaml index af1f48f67f..4764fc5c8d 100644 --- a/assets/components/openshift-router/deployment.yaml +++ b/assets/components/openshift-router/deployment.yaml @@ -1,4 +1,7 @@ # Deployment with default values +# +# Methods hashableDeployment() and deploymentConfigChanged() +# must be updated when adding new fields to this manifest. kind: Deployment apiVersion: apps/v1 spec: @@ -11,15 +14,71 @@ spec: labels: ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default spec: + # manually configure the service account, so we can configure it only in the router container. + automountServiceAccountToken: false serviceAccountName: router priorityClassName: system-cluster-critical - containers: - - name: router + shareProcessNamespace: true + initContainers: + - name: init-router imagePullPolicy: IfNotPresent + terminationMessagePolicy: FallbackToLogsOnError + command: ["/bin/bash", "-c", "cp -R -p /var/lib/haproxy/* /mnt/config/"] + volumeMounts: + - mountPath: /mnt/config + name: haproxy-config + - name: haproxy + imagePullPolicy: IfNotPresent + restartPolicy: Always securityContext: # See https://bugzilla.redhat.com/2007246 allowPrivilegeEscalation: true - readOnlyRootFilesystem: false + readOnlyRootFilesystem: true + terminationMessagePolicy: FallbackToLogsOnError + command: ["/var/lib/haproxy/start-haproxy"] + # admin.sock should follow routerHAProxyAdminSocket const + args: ["-W", "-db", "-S", "/var/lib/haproxy/run/admin.sock,mode,600", "-f", "/var/lib/haproxy/conf/haproxy.config"] + livenessProbe: + exec: + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"] + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + terminationGracePeriodSeconds: 10 + readinessProbe: + failureThreshold: 3 + exec: + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"] + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + failureThreshold: 120 + exec: + # admin.sock should follow routerHAProxyAdminSocket const + command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/admin.sock"] + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + resources: + requests: + cpu: 100m + memory: 256Mi + volumeMounts: + - mountPath: /var/lib/haproxy + name: haproxy-config + - mountPath: /etc/pki/tls/private + name: default-certificate + readOnly: true + - mountPath: /var/run/configmaps/service-ca + name: service-ca-bundle + readOnly: true + containers: + - name: router + imagePullPolicy: IfNotPresent + securityContext: + readOnlyRootFilesystem: true terminationMessagePolicy: FallbackToLogsOnError env: - name: ROUTER_SERVICE_NAMESPACE @@ -96,61 +155,6 @@ spec: value: '{{ .RouterCompressionMime }}' - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE value: "true" - {{- if .ClientAuthCAPath }} - - name: ROUTER_MUTUAL_TLS_AUTH - value: '{{ .ClientAuthPolicy }}' - - name: ROUTER_MUTUAL_TLS_AUTH_CA - value: '{{ .ClientAuthCAPath }}' - - name: ROUTER_MUTUAL_TLS_AUTH_FILTER - value: '{{ .ClientAuthFilter }}' - {{- end }} - {{- if .AccessLoggingEnabled }} - - name: ROUTER_SYSLOG_ADDRESS - {{- if .AccessLoggingSyslogAddress }} - value: '{{ .AccessLoggingSyslogAddress }}' - {{- else }} - value: /var/lib/rsyslog/rsyslog.sock - {{- /* AccessLoggingSyslogAddress*/}} - {{- end }} - - name: ROUTER_LOG_LEVEL - value: info - {{- if .AccessLoggingMaxLength}} - - name: ROUTER_LOG_MAX_LENGTH - value: '{{ .AccessLoggingMaxLength }}' - {{- /* AccessLoggingMaxLength */}} - {{- end }} - {{- if .AccessLoggingSyslogFacility }} - - name: ROUTER_LOG_FACILITY - value: {{ .AccessLoggingSyslogFacility }} - {{- end }} - {{- if .HttpLogFormat }} - - name: ROUTER_SYSLOG_FORMAT - value: '"{{ .HttpLogFormat }}"' - {{- /* HttpLogFormat */}} - {{- end }} - {{- if .HttpCaptureHeadersRequest }} - - name: ROUTER_CAPTURE_HTTP_REQUEST_HEADERS - value: '{{ .HttpCaptureHeadersRequest }}' - {{- /* HttpCaptureHeadersRequest */}} - {{- end }} - {{- if .HttpCaptureHeadersResponse }} - - name: ROUTER_CAPTURE_HTTP_RESPONSE_HEADERS - value: '{{ .HttpCaptureHeadersResponse }}' - {{- /* HttpCaptureHeadersResponse */}} - {{- end }} - {{- if .HttpCaptureCookies }} - - name: ROUTER_CAPTURE_HTTP_COOKIE - value: '{{ .HttpCaptureCookies }}' - {{- /* HttpCaptureCookies */}} - {{- end }} - {{- /* AccessLoggingEnabled */}} - {{- end }} - {{- if .HttpErrorCodePages }} - - name: ROUTER_ERRORFILE_503 - value: /var/lib/haproxy/errorfiles/error-page-503.http - - name: ROUTER_ERRORFILE_404 - value: /var/lib/haproxy/errorfiles/error-page-404.http - {{- end }} livenessProbe: failureThreshold: 3 httpGet: @@ -181,30 +185,20 @@ spec: timeoutSeconds: 1 resources: requests: - cpu: 100m - memory: 256Mi + cpu: 25m + memory: 64Mi volumeMounts: + - mountPath: /var/lib/haproxy + name: haproxy-config - mountPath: /etc/pki/tls/private name: default-certificate readOnly: true - mountPath: /var/run/configmaps/service-ca name: service-ca-bundle readOnly: true - {{- if .ClientCAMapName }} - - mountPath: '{{ .ClientCAMountPath }}' - name: '{{ .ClientCAMapName}}' + - mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: kube-api-access readOnly: true - {{- end }} - {{- if .HttpErrorCodePages }} - - mountPath: /var/lib/haproxy/errorfiles - name: error-code-pages - readOnly: true - {{- end }} - {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }} - - mountPath: /var/lib/rsyslog - name: rsyslog-socket - readOnly: false - {{- end }} image: '{{ .ReleaseImage.haproxy_router }}' ports: - name: http @@ -218,29 +212,6 @@ spec: protocol: TCP args: - -v=4 - {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }} - - name: logs - imagePullPolicy: IfNotPresent - terminationMessagePolicy: FallbackToLogsOnError - image: '{{ .ReleaseImage.haproxy_router }}' - imagePullPolicy: IfNotPresent - command: - - /sbin/rsyslogd - - -n - - -i - - /tmp/rsyslogd.pid - - -f - - /etc/rsyslog/rsyslog.conf - resources: - requests: - cpu: 50m - memory: 128Mi - volumeMounts: - - mountPath: /var/lib/rsyslog - name: rsyslog-socket - - mountPath: /etc/rsyslog - name: rsyslog-config - {{- end}} tolerations: # Ensure the pod isn't deleted during serial NoExecuteTaintManager tests. # Remember that NoExecute uses Delete, not Evict, because removing the pod @@ -254,6 +225,8 @@ spec: secret: defaultMode: 420 secretName: '{{ .ServingCertificateSecret }}' + - name: haproxy-config + emptyDir: {} - name: service-ca-bundle configMap: defaultMode: 420 @@ -262,29 +235,23 @@ spec: path: service-ca.crt name: service-ca-bundle optional: false - {{- if .ClientCAMapName }} - - name: '{{ .ClientCAMapName }}' - configMap: - defaultMode: 420 - items: - - key: '{{ .ClientCABundleFilename }}' - path: '{{ .ClientCABundleFilename }}' - name: '{{ .ClientCAMapName }}' - optional: false - {{- end }} - {{- if .HttpErrorCodePages }} - - name: error-code-pages - configMap: - name: {{ .HttpErrorCodePages }} - {{- end }} - {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }} - - name: rsyslog-socket - emptyDir: {} - - name: rsyslog-config - configMap: - name: access-logs-rsyslog-config - optional: false - {{- end }} + - name: kube-api-access + projected: + defaultMode: 0400 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + fieldPath: metadata.namespace restartPolicy: Always dnsPolicy: ClusterFirst nodeSelector: diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml index 04aec312e3..2cf8c7f110 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml @@ -2,10 +2,10 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e + digest: sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0 + digest: sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev digest: sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433 @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index 9991a3f3da..3d96ced2af 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,10 +2,10 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509 + digest: sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0 + digest: sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev digest: sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614 @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index 1dd405cc9f..5d7806e35c 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-155219" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0", + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433" } } diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index 007b55343e..5b459b6c92 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0", + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614" } } diff --git a/assets/optional/sriov/kustomization.aarch64.yaml b/assets/optional/sriov/kustomization.aarch64.yaml index d1574ea6ea..6dd7a4ae3a 100644 --- a/assets/optional/sriov/kustomization.aarch64.yaml +++ b/assets/optional/sriov/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:d7ee254fc9d47bd5179f76e4122983304ec75b5ea43f4defe2d0f96f04eb8690 + digest: sha256:5b33fe72cbe5486de2dca91f912b39cd757fafad1d3a984916a5ec776897cda2 patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:71edd9e131252d72242756270e02b75859134de7ccbb49bd109f9b3e349c2367 + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:a704b198ba93a09cce192cbe8fc75f6cc244e8dd5eef91ccbc30480046f39391 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:6be7361f4c3a345589994dc785b2cd5da3c8123c6ad56211e4af5de232800f76 + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:bac558d1114459fba8e902e8cb5dc42dac09e1d22579132f22bb69dced8d97e2 - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:162cbf43222d4c7943574f84f59e29f69b6996e1693db85ddee19832441a0718 + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:5bc744e22de2110b04d0acb18dda686698dda1eb34b866198d71f26f11a6c206 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:6d7ed1bc1504105bbad73bc98c78a19074e81b9ea5fc1a090612086893f5130a + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:d212a6afdd7301459bca05ad8f485cef8d92e24636c89a6c76efff73554d92e9 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5142fd6ea06766233e916ee0564fdb02e75582c8154814da05f66e9695665f35 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5e365ccbdb73529fc78d30e15ac2f8a324c7ee0be6a8b19cb51f183dc5e2e867 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:003aaeab02e56e3ea2d46cd0ac875f001f18939915fdd1bb6767a8e67e552877 + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:1862d64b746ce762d64256a3158dc56cb391cb700d6c53a453e42aec24a0b847 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e43211c222e1734a5443826afc1f1104b61457ef7b67647e5f608136a355d5d6 + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e0585578cdf9309bd08028d7d0fbf05c45ddcf0d768328f88ad2eedb6a5f31d8 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:7b7b706bc0c431f1961336b0b205c59ae8b87d89e05d54d038f67e7acfbc241c + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:3869072b9179c673bcae7f7929abb525fbd6a8f0aaf601ce992a0a994e8fd2c4 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:22469fe4645b112b9db600a2eb90b93d55ea18ce2da2a8637c50ac781618c495 + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:ed3194db7c7e8cafdcc73a706a3526fba1c419f8961d5bc69abc536e9e89a035 target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/kustomization.x86_64.yaml b/assets/optional/sriov/kustomization.x86_64.yaml index 89063ce487..1e9ef893c8 100644 --- a/assets/optional/sriov/kustomization.x86_64.yaml +++ b/assets/optional/sriov/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:568d7734e5bd64f9bd74b836810c1b89f2f481a4eb403d93b218604fa8a5ee62 + digest: sha256:bdaf084ae63e7179c0a60e5e809fba881cac0fc8c21de516eacfea199b54be60 patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:309f2975276b6407402bd1ac0ef7a07e809845a33259283c28925ee2321271e8 + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:539e34a367837a297ceef7fc657615280d97d02a10f503a5636cd844e91113df - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:479a1835efcb315af7681a0c6e9cb959570e850a4cb5844a797390e27cd619c6 + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:e0cd00e5c691226c1bdcd0c56caf8393fb1668f27aca92891f9572e90817102d - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:671dd3ee25bb4a24ec5741cbb6b5d168d7af4e4e7e90a332913552ff6576efa0 + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:59fef90610984eeac0b9b1d4fb74e7551e97091bd8082fd05cc9e00e30d8de47 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:837d9b0b190a87e6037babecde6c7667f9e69fd044620da0fc795881b6a42ad7 + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:deda65fbe9ce9978c0543f26add8e9b648b3ac37db440a92b93891357596d08d - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:cc70de95764cdd38fd41500e34e40640782095a84a12a797981946a95dbfdd83 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:232f9e8658170ff3d88bdb460265c56e4fef0a978429dee7ba18b969c7934e0f - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:77c3b55e366168b1eb1dbdf9482595d547b8cc0a69a1655a34c873c0d3487cab + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:ff5f87b8464c172ae1bb5cf15c370b7250bda12696491cf77197af37352122f5 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:7fccda1ff324927248587007f684dea1db2bfdd6d1943dd9c2d24a4a0ccda33e + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:195f1d0d7040fb2b6b60ae9356593788c5e15ccbb8bd0e036835100b4d5fc641 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:8ad8a53e0df7112d0f4f0abc373bf24bbec42e3033f5b27dfe9e6be674cef94d + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:64a524df1a3cc4d449d0962704fce2bfc65023cd2fbb954e52a2aaba2677ef2e - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:0299bce77fb9f786465c23efc36aca6557ddea63b9642c2176b17f827addddb2 + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:6c1c4d4bcbfa2b29b8588b68b7ce022ea65f12bec037d32dd461736b67c45d7b target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/release-sriov-aarch64.json b/assets/optional/sriov/release-sriov-aarch64.json index 8f84c5e58b..f1554115f4 100644 --- a/assets/optional/sriov/release-sriov-aarch64.json +++ b/assets/optional/sriov/release-sriov-aarch64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202605261300" + "base": "4.21.0-202606240914" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:7b7b706bc0c431f1961336b0b205c59ae8b87d89e05d54d038f67e7acfbc241c", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:22469fe4645b112b9db600a2eb90b93d55ea18ce2da2a8637c50ac781618c495", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:162cbf43222d4c7943574f84f59e29f69b6996e1693db85ddee19832441a0718", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e43211c222e1734a5443826afc1f1104b61457ef7b67647e5f608136a355d5d6", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:71edd9e131252d72242756270e02b75859134de7ccbb49bd109f9b3e349c2367", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:6be7361f4c3a345589994dc785b2cd5da3c8123c6ad56211e4af5de232800f76", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:003aaeab02e56e3ea2d46cd0ac875f001f18939915fdd1bb6767a8e67e552877", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:6d7ed1bc1504105bbad73bc98c78a19074e81b9ea5fc1a090612086893f5130a", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:d7ee254fc9d47bd5179f76e4122983304ec75b5ea43f4defe2d0f96f04eb8690", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5142fd6ea06766233e916ee0564fdb02e75582c8154814da05f66e9695665f35" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:3869072b9179c673bcae7f7929abb525fbd6a8f0aaf601ce992a0a994e8fd2c4", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:ed3194db7c7e8cafdcc73a706a3526fba1c419f8961d5bc69abc536e9e89a035", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:5bc744e22de2110b04d0acb18dda686698dda1eb34b866198d71f26f11a6c206", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e0585578cdf9309bd08028d7d0fbf05c45ddcf0d768328f88ad2eedb6a5f31d8", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:a704b198ba93a09cce192cbe8fc75f6cc244e8dd5eef91ccbc30480046f39391", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:bac558d1114459fba8e902e8cb5dc42dac09e1d22579132f22bb69dced8d97e2", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:1862d64b746ce762d64256a3158dc56cb391cb700d6c53a453e42aec24a0b847", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:d212a6afdd7301459bca05ad8f485cef8d92e24636c89a6c76efff73554d92e9", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:5b33fe72cbe5486de2dca91f912b39cd757fafad1d3a984916a5ec776897cda2", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5e365ccbdb73529fc78d30e15ac2f8a324c7ee0be6a8b19cb51f183dc5e2e867" } } diff --git a/assets/optional/sriov/release-sriov-x86_64.json b/assets/optional/sriov/release-sriov-x86_64.json index 74ca5c5588..cad1a10447 100644 --- a/assets/optional/sriov/release-sriov-x86_64.json +++ b/assets/optional/sriov/release-sriov-x86_64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202605261300" + "base": "4.21.0-202606240914" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:8ad8a53e0df7112d0f4f0abc373bf24bbec42e3033f5b27dfe9e6be674cef94d", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:0299bce77fb9f786465c23efc36aca6557ddea63b9642c2176b17f827addddb2", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:671dd3ee25bb4a24ec5741cbb6b5d168d7af4e4e7e90a332913552ff6576efa0", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:7fccda1ff324927248587007f684dea1db2bfdd6d1943dd9c2d24a4a0ccda33e", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:309f2975276b6407402bd1ac0ef7a07e809845a33259283c28925ee2321271e8", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:479a1835efcb315af7681a0c6e9cb959570e850a4cb5844a797390e27cd619c6", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:77c3b55e366168b1eb1dbdf9482595d547b8cc0a69a1655a34c873c0d3487cab", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:837d9b0b190a87e6037babecde6c7667f9e69fd044620da0fc795881b6a42ad7", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:568d7734e5bd64f9bd74b836810c1b89f2f481a4eb403d93b218604fa8a5ee62", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:cc70de95764cdd38fd41500e34e40640782095a84a12a797981946a95dbfdd83" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:64a524df1a3cc4d449d0962704fce2bfc65023cd2fbb954e52a2aaba2677ef2e", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:6c1c4d4bcbfa2b29b8588b68b7ce022ea65f12bec037d32dd461736b67c45d7b", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:59fef90610984eeac0b9b1d4fb74e7551e97091bd8082fd05cc9e00e30d8de47", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:195f1d0d7040fb2b6b60ae9356593788c5e15ccbb8bd0e036835100b4d5fc641", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:539e34a367837a297ceef7fc657615280d97d02a10f503a5636cd844e91113df", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:e0cd00e5c691226c1bdcd0c56caf8393fb1668f27aca92891f9572e90817102d", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:ff5f87b8464c172ae1bb5cf15c370b7250bda12696491cf77197af37352122f5", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:deda65fbe9ce9978c0543f26add8e9b648b3ac37db440a92b93891357596d08d", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:bdaf084ae63e7179c0a60e5e809fba881cac0fc8c21de516eacfea199b54be60", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:232f9e8658170ff3d88bdb460265c56e4fef0a978429dee7ba18b969c7934e0f" } } diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 1f6bd1b6ba..3c4521cb2f 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,13 +1,13 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-02-035219" + "base": "5.0.0-0.nightly-arm64-2026-07-06-155219" }, "images": { "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c10d50cb3876b58d05cf3a8c651a96593b668c8c44f9a60aed4df15495188e55", "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:7b8674c484522e90c92dd7701c2c7d6b8fa412e1ea9407eb4bee6cca26840af2", "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:40aeb4e2ff402d58295dc34e1817151ed4a9ad3af4576988d6608f66976b90d1", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c03ee82dd0efb3d5cc62c52225c38efcd0fbbf1aa1b4b8e7e8fe4cf701f1f85", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:aaabe7b8816bae6d0ba5901bb68bace83e9b4e792335f65c0ff323b38c570989", "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e77470864ee29dcb7b4b33d76b700a1e76006b0c78d5fb15474c550b3cb8f9de", "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5476719db99b2dc909fe6bf8362b71479a14c43b938930ce011f66f663f5beea", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index 4d46762374..d5b9c925b4 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,13 +1,13 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-01-125918" + "base": "5.0.0-0.nightly-2026-07-05-172708" }, "images": { "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f05e455da699c1ae675c26bd45e979f38bf7e57afb7c3c71ae4576221be69dc8", "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:bda7069b8d610370dde4649f16439931dd9d9b84386dfd0706188718d037f8af", "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fbbbddc10e6888e156a0b36b1e9751e8dc053de3e0203af7e014bf61b2ef5ac4", "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:84c30ba6de3831698b6efba8b8fa347911f2cd3443ffb7e08286dd286fd7ba80", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e99e72dc1b3d4efcbc87f5a163736bb2e4cabf8d653673f96044320b49cc37c5", "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:539080a9bef7f24561af6953d3e24e827dd1e5aa74311c77d93924c0b024419b", "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:cba3482d1c4d6acb0bafc88286dc117f880421fde1785b4c30b83166b2de4cd8", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", diff --git a/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go b/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go index 8fea3f4a3b..35fafe3a26 100644 --- a/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go +++ b/etcd/vendor/github.com/openshift/microshift/pkg/config/config.go @@ -184,7 +184,7 @@ func (c *Config) fillDefaults() error { ForwardedHeaderPolicy: "Append", HTTPEmptyRequestsPolicy: "Respond", ServingCertificateSecret: "router-certs-default", - TLSSecurityProfile: &configv1.TLSSecurityProfile{ + TLSSecurityProfile: &TLSSecurityProfile{ Type: configv1.TLSProfileIntermediateType, }, AccessLogging: AccessLogging{ diff --git a/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go b/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go index 5ca98daf96..454c1c4800 100644 --- a/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go +++ b/etcd/vendor/github.com/openshift/microshift/pkg/config/ingress.go @@ -42,6 +42,86 @@ type IngressStatusEnum string type DefaultHttpVersionPolicy int32 type WildcardPolicy string +// TLSSecurityProfile defines the schema for a TLS security profile. This object +// is used by operators to apply TLS security settings to operands. +// +union +type TLSSecurityProfile struct { + // type is one of Old, Intermediate, Modern or Custom. Custom provides the + // ability to specify individual TLS security profile parameters. + // + // The profiles are based on the Mozilla Server Side TLS configuration + // guidelines. The cipher lists consist of the configuration's + // "ciphersuites" followed by the "ciphers" from the guidelines. + // + // The profiles are intent based, so they may change over time as new ciphers are + // developed and existing ciphers are found to be insecure. Depending on + // precisely which ciphers are available to a process, the list may be reduced. + // + // +unionDiscriminator + // +optional + Type configv1.TLSProfileType `json:"type"` + + // old is a TLS profile for use when services need to be accessed by very old + // clients or libraries and should be used only as a last resort. + // + // +optional + // +nullable + Old *configv1.OldTLSProfile `json:"old,omitempty"` + + // intermediate is a TLS profile for use when you do not need compatibility with + // legacy clients and want to remain highly secure while being compatible with + // most clients currently in use. + // + // +optional + // +nullable + Intermediate *configv1.IntermediateTLSProfile `json:"intermediate,omitempty"` + + // modern is a TLS security profile for use with clients that support TLS 1.3 and + // do not need backward compatibility for older clients. + // + // +optional + // +nullable + Modern *configv1.ModernTLSProfile `json:"modern,omitempty"` + + // custom is a user-defined TLS security profile. Be extremely careful using a custom + // profile as invalid configurations can be catastrophic. An example custom profile + // looks like this: + // + // minTLSVersion: VersionTLS11 + // ciphers: + // - ECDHE-ECDSA-CHACHA20-POLY1305 + // - ECDHE-RSA-CHACHA20-POLY1305 + // - ECDHE-RSA-AES128-GCM-SHA256 + // - ECDHE-ECDSA-AES128-GCM-SHA256 + // + // +optional + // +nullable + Custom *CustomTLSProfile `json:"custom,omitempty"` +} + +// CustomTLSProfile is a user-defined TLS security profile. Be extremely careful +// using a custom TLS profile as invalid configurations can be catastrophic. +type CustomTLSProfile struct { + // ciphers is used to specify the cipher algorithms that are negotiated + // during the TLS handshake. Operators may remove entries that their operands + // do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml): + // + // ciphers: + // - ECDHE-RSA-AES128-GCM-SHA256 + // + // TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable + // and are always enabled when TLS 1.3 is negotiated. + // +listType=atomic + Ciphers []string `json:"ciphers"` + // minTLSVersion is used to specify the minimal version of the TLS protocol + // that is negotiated during the TLS handshake. For example, to use TLS + // versions 1.1, 1.2 and 1.3 (yaml): + // + // minTLSVersion: VersionTLS11 + // + MinTLSVersion configv1.TLSProtocolVersion `json:"minTLSVersion"` +} + type IngressConfig struct { // Default router status, can be Managed or Removed. // +kubebuilder:default=Managed @@ -148,7 +228,7 @@ type IngressConfig struct { // controller, resulting in a rollout. // // +optional - TLSSecurityProfile *configv1.TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` + TLSSecurityProfile *TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"` // clientTLS specifies settings for requesting and verifying client // certificates, which can be used to enable mutual TLS for diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 225714fe11..b6e73d15c0 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,166 +1,150 @@ -- api embedded-component 5346161d1bf2a4b45d998678f00e1e8d224acf7b to 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 - - cc6e909a 2026-06-29T11:21:29+01:00 Move pre-flight checks earlier to start of genGroup - - e9fc655c 2026-06-29T11:21:27+01:00 Update verify protobuf scripts - - cba640f1 2026-06-29T11:21:26+01:00 Enable codegen protobuf on legacy APIs - - f1e1d672 2026-06-29T11:21:25+01:00 Add the ability to skip protobuf generation for certain versions - - 85578e6e 2026-06-29T11:21:24+01:00 Add verification of generated protobuf files - - 10804f69 2026-06-29T11:18:37+01:00 Implement protobuf generator within codegen - - ce609dbc 2026-06-29T11:18:36+01:00 Add gogoproto to vendor - - 36b8e4d2 2026-06-29T11:18:35+01:00 Bootstrap initial go-to-protobuf generator in codegen - - 0b97f9b9 2026-06-26T09:06:58-07:00 AUTOSCALE-827: add KarpenterOperator feature gate - - e096b7be 2026-06-24T09:40:03-04:00 OCPBUGS-63219: Add protocol to AWS NLB parameters - - 8f87a41c 2026-06-24T08:01:53-04:00 Add MutableTopology feature gate for spec.controlPlaneTopology - - fd7d48b8 2026-06-23T12:34:23-03:00 chore: SPLAT-2588: enable feature on Hypershift - - 3d2c4233 2026-06-23T11:29:45+01:00 - Adding cabilities for crdcompatibilitychecker and capi CRs - - 5300823d 2026-06-22T17:33:15-03:00 fix(tools): use external topology for hypershift Sippy queries - - f74255e3 2026-06-22T17:33:12-03:00 fix(tools): display hypershift in HTML/markdown reports for external topology - - cc00868b 2026-06-22T17:33:12-03:00 test(tools): add unit tests for featuregate-test-analyzer - - 97133a45 2026-06-22T15:54:14-04:00 Promote VSphereMixedNodeEnv to GA - - c85beac3 2026-06-22T10:41:40-04:00 Add v1 type CRIOCredentialProviderConfig - - 6f5089fa 2026-06-22T13:57:57+05:30 Add API integration tests - - 09b9bcb8 2026-06-22T13:57:55+05:30 Add Secrets Store CSI driver configuration to ClusterCSIDriver API - - 1d2fb194 2026-06-16T09:39:23+02:00 STOR-2966: Promote ExternalSnapshotMetadata feature gate to TechPreviewNoUpgrade - - 3f52e05e 2026-06-09T15:44:21+02:00 Add SELinuxMountGAReadiness FG - -- cluster-ingress-operator embedded-component bf13f251347308b80b170582de455c59cb0510be to 6d4e06c4f11b2536386d14b701a766be34742adf - - d76f79cc 2026-06-26T00:38:57Z Revert "NE-2664: deploy haproxy as sidecar (#1439)" - - f322b5de 2026-06-24T15:02:18-04:00 Fix useOLM guard logic and and add remediation guidance - - a78ff4ec 2026-06-19T10:00:23-03:00 deploy haproxy as sidecar - - 398622a0 2026-06-18T17:50:52-04:00 OCPBUGS-90505: Guard subscriptionCache creation with OLM capability check - - 6f3c80ba 2026-06-18T17:50:45-04:00 OCPBUGS-90505: Guard OLM watches with capability check in gatewayclass controller - - 0421cc19 2026-06-15T22:29:43-04:00 OCPBUGS-86833: Detect orphaned OSSM subscription after noOLM migration - -- cluster-kube-apiserver-operator embedded-component e3c762513675e506be2be1e219f1ef621db18275 to 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f - - 020339b 2026-06-29T16:50:32+03:00 Bump library-go for sync - - 039a08d 2026-06-25T11:13:10+03:00 Wire health reporter - - 4dd7f19 2026-06-25T11:03:52+03:00 Bump library-go - - a1e06e7 2026-06-24T17:50:06+03:00 Update openshift dependencies - - cc13111 2026-06-22T15:06:38+02:00 NO-JIRA: add kms preflight to NP to allow egress - - a960532 2026-06-12T13:35:26+02:00 add openshift/kms parent to kms test suites - -- cluster-kube-controller-manager-operator embedded-component c35307f04313369c9ba4dcab3308506a3987065e to 8bef9812e7a3ec026397acd34633a7ecd479f357 - - c3f74d9 2026-06-26T15:00:24+02:00 Use %w for error wrapping consistently - -- cluster-network-operator embedded-component c376140ed1842c6a5f78cb74c55b4b49ba212041 to 7b341b420baeb655d65e551a1f04e3bcbe2631f1 - - c90d9fb 2026-06-24T14:14:20+02:00 Add CodeRabbit configuration for automated PR reviews - - 8db6228 2026-06-18T10:50:36-07:00 Watch Network and Infrastructure in proxyconfig controller - - b223b6c 2026-06-09T18:00:33+02:00 Update openshift/api and openshift/client-go to latest - - 050d838 2026-05-09T08:13:12-04:00 Add missing CNCC NetworkPolicies - - 39ffe54 2026-05-09T08:08:17-04:00 Add proper CVO annotations to CNO default-deny NP - -- cluster-policy-controller embedded-component bb429f5b2a7d77791110b06d8ec5c017183e3ab9 to 050c1ee6aeb0838daf75858fd853cca1e0098fa9 - - a03103a 2026-06-19T15:45:24+02:00 update OWNERS file - - 69f126c 2026-06-19T11:46:31+02:00 add serviceAccountToken volume type to psalabelsyncer - - aefcd82 2026-06-19T11:43:58+02:00 go mod vendor - - ab6e156 2026-06-19T11:42:00+02:00 bump openshift/api - -- csi-external-snapshotter embedded-component e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- kubernetes embedded-component d8d517e6bbe7cf7359026cac26bb96ea45e18806 to a466682e3867da746be24d7d56c6641612721d6c - - 410f58272 2026-06-16T23:18:18-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for standalone clusters - - 7ffb8b2ae 2026-06-15T13:17:06-04:00 UPSTREAM: : fix kubernetes/conformance to filter on [Conformance] label - -- machine-config-operator embedded-component fb5bfe252ba774a014af1059223cea3d07ef14dd to f05e48737d9db0a62f45f6ef06fc7382a4333fed - - 6618f142 2026-06-30T06:18:16Z OCPEDGE-2473: feat: enabled graceful shutdown for TNF clusters (#6036) - - 1ccbd74e 2026-06-27T12:19:59+05:30 NO-ISSUE: Use DebugNodeWithChrootStd for FIPS check to separate stdout from stderr - - 3a9d76eb 2026-06-26T12:53:29-04:00 OCPBUGS-88333: Fix bootupd workaround in old nodes - - 46030024 2026-06-25T12:46:37+05:30 NO-ISSUE: Use /proc/sys/crypto/fips_enabled for FIPS check in tests - - 5676f30e 2026-06-24T08:28:02-05:00 Remove verbose ignition config logging from bootstrap MCS - - fb2491ab 2026-06-23T11:59:01-04:00 test: remove stub upgrade test - - 95e21734 2026-06-23T17:55:50+05:30 NO-ISSUE: Temporarily disable sandboxed-containers extension from tests - - ba2edec9 2026-06-22T15:40:19-04:00 upgrademonitor: skip no-op MCN SSA calls - - ea5455d8 2026-06-22T10:23:33-04:00 temporarily remove sandboxed-containers from extensions test - - 754cec07 2026-06-22T08:44:40+02:00 OCPBUGS-59958: Updated Unit Test, added extra getconfig check - - 9fac87e5 2026-06-19T20:40:14+05:30 Migrate OS layering tests from openshift-tests-private - - 449a1f79 2026-06-19T12:01:03+05:30 Revert "OKD-294: Migrate runtime from runc to crun on an upgrade for OKD" - - f617a2c5 2026-06-18T10:28:19-04:00 bootimage: add reset cluster bootimage capability - - fa12d23e 2026-06-18T10:28:19-04:00 bootimage: remove configmap version checks - - db282613 2026-06-18T10:28:19-04:00 bootimage: rename patchSkipped to reconcileSkipped - - 0ebbf630 2026-06-18T10:27:15-04:00 bootimage: make vsphere updates atomic - - a552644b 2026-06-17T17:42:55+02:00 NO-ISSUE: Remove dead code - - 51e1b0df 2026-06-17T12:41:32+02:00 OCPBUGS-59958: move cleanUpDuplicatedMC to after pool loop in syncNodeConfigHandler - - 50a50881 2026-06-09T13:29:35Z Block runc on RHEL 10 in bootstrap render path - - fd486c21 2026-06-09T13:29:35Z Block MachineConfig rendering when runc is configured on RHEL 10 pools - -- operator-framework-olm embedded-component 32225496430f8607ece581277f56e254fed708be to cea3be72ef5704256bd35ab88acfa9ab03edf6df - - a6faf7ea 2026-06-29T10:49:09-04:00 fix: warn-and-continue when cluster TLS profile lookup fails at startup (#3860) - - 6907f19c 2026-06-29T10:46:02-04:00 Revert "Merge pull request #1334 from redhat-chai-bot/revert-1330-1782684731" - - 4b0c882b 2026-06-28T22:12:12Z Revert "Merge pull request #1330 from openshift-bot/synchronize-upstream" - - 80043d4c 2026-06-25T00:05:29Z :seedling: Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#3858) - - aef2567a 2026-06-25T00:04:48Z Upgrade hashstructure and mapstructure to v2 (#3854) - - 07fd0b98 2026-06-25T00:04:32Z :seedling: Bump github.com/prometheus/common from 0.68.1 to 0.69.0 (#3857) - - 20fa2f20 2026-06-25T00:04:17Z :seedling: Bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 (#3856) - - 546c08d1 2026-06-25T00:04:01Z Bump actions/checkout from 6 to 7 (#3855) - - 3a95edb6 2026-06-25T00:03:46Z Apply cluster TLS security profile to packageserver serving options (#3849) - - 83332273 2026-06-25T00:03:27Z :seedling: Bump the k8s-dependencies group across 1 directory with 8 updates (#3850) - -- route-controller-manager embedded-component e454c01fbe561cce9973f54b1ddbcdd35a9d18ff to 01ccbfb991fdbc559820a04c4932fc5ddf2339d0 - - d825fa2 2026-06-23T23:22:09-04:00 Update go.mod to match Go 1.26.3 builder images - - d809961 2026-06-06T09:48:07Z Updating ose-route-controller-manager-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/7691ed4dc0b6585b358f9e73fb736ace9a48a286/images/ose-route-controller-manager.yml - -- service-ca-operator embedded-component 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config - -- oc image-amd64 74e525a6a4523a23a5db585c411943b0a0a338da to a7ad57244d4327c77d0fa190bb6d215d2d5faa86 - - fa71bfe5 2026-06-29T14:27:49+02:00 Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README - - 15da98fa 2026-06-24T18:47:01+05:30 Assert expected tempDir in codesign extraction tests - - 2419b54b 2026-06-23T15:13:38+05:30 Catch exact '..' entry in archive containment check - - 9710f19c 2026-06-23T13:59:01+05:30 Fix zipslip in image archive unpack and refine codesign guard - - d7534960 2026-06-19T14:54:01+05:30 Fix tar slip path traversal in codesign archive extraction - -- csi-external-snapshotter image-amd64 e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- router image-amd64 3553702970b094986d91f218e3191487de46e476 to 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f - - 0e72c4d 2026-06-29T16:03:08-03:00 Add HAProxy standalone images for 2.8 and 3.2 - - 42ee1e6 2026-06-08T06:07:59Z Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/openshift-enterprise-haproxy-router.yml - -- ovn-kubernetes image-amd64 62baca4832f3aeb3fc7032d38619835c04208c95 to f0527039dfc4901637721e7cecfdb9d0ea1c9c38 - - 10d5782c 2026-06-16T20:56:43-07:00 Fix perma-failing security presubmit job - - 133ba1e4 2026-05-08T09:45:38+02:00 Promote EVPN E2Es from informing to blocking tests - -- kubernetes image-amd64 d8d517e6bbe7cf7359026cac26bb96ea45e18806 to a466682e3867da746be24d7d56c6641612721d6c - - 410f58272 2026-06-16T23:18:18-06:00 UPSTREAM: : Add NodeSelectorAdjuster admission plugin for standalone clusters - - 7ffb8b2ae 2026-06-15T13:17:06-04:00 UPSTREAM: : fix kubernetes/conformance to filter on [Conformance] label - -- service-ca-operator image-amd64 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config - -- oc image-arm64 74e525a6a4523a23a5db585c411943b0a0a338da to a7ad57244d4327c77d0fa190bb6d215d2d5faa86 - - fa71bfe5 2026-06-29T14:27:49+02:00 Add ARCHITECTURE.md, adopt shared CONTRIBUTING.md, slim README - - 15da98fa 2026-06-24T18:47:01+05:30 Assert expected tempDir in codesign extraction tests - - 2419b54b 2026-06-23T15:13:38+05:30 Catch exact '..' entry in archive containment check - - 9710f19c 2026-06-23T13:59:01+05:30 Fix zipslip in image archive unpack and refine codesign guard - - d7534960 2026-06-19T14:54:01+05:30 Fix tar slip path traversal in codesign archive extraction - -- csi-external-snapshotter image-arm64 e695e2bd0b548afd0fce049d86d4af29dd34e574 to b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 - - 9c6d440 2026-06-26T14:15:39+02:00 UPSTREAM: : disable verify-subtree check - - ae3f2e8 2026-06-26T14:13:11+02:00 UPSTREAM: : Updating ose-csi-snapshot-controller-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/ose-csi-snapshot-controller.yml - - 30b4b2b 2026-06-25T14:54:26+02:00 UPSTREAM: : Add OpenShift files - -- router image-arm64 3553702970b094986d91f218e3191487de46e476 to 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f - - 0e72c4d 2026-06-29T16:03:08-03:00 Add HAProxy standalone images for 2.8 and 3.2 - - 42ee1e6 2026-06-08T06:07:59Z Updating openshift-enterprise-haproxy-router-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/af322abdd1a4d7d0161a69a16369a0ab1748515a/images/openshift-enterprise-haproxy-router.yml - -- ovn-kubernetes image-arm64 62baca4832f3aeb3fc7032d38619835c04208c95 to 6617c2a2ce4ab2e060e649672c91cf349d8500f7 +- api embedded-component 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 to 02e2c3de12fb849770deaa3ac9bb3b160a1cb4d8 + - 9f503bcd 2026-07-02T13:00:10-04:00 fix(crd): adjust storage settings for CRIOCredentialProviderConfig versions + - 6c8739bc 2026-07-02T12:30:27+01:00 Updates API review skill + - 02030eb8 2026-07-01T17:56:40-04:00 Fix Typo + - 483b3d02 2026-07-01T16:52:04-04:00 Fix integration test + - 9f8751d7 2026-07-01T13:41:53-04:00 make update During code generation, the manifest-merge tool combines this override with the v1 schema generated from Go types to produce a final CRD that serves both versions: + - 9ab6f8f9 2026-07-01T13:28:01-04:00 Add v1alpha1 schema override for InternalReleaseImage + - 63d1eff4 2026-06-26T21:53:42+02:00 Adding documentation related to some cases for the network observability instalation field + - 831b00a7 2026-06-26T13:21:48-04:00 Update generated code after rebase + - 13e4ae16 2026-06-26T13:07:27-04:00 AGENT-1522: Graduate InternalReleaseImage from v1alpha1 to v1 + - a62c9890 2026-06-25T16:10:17+02:00 config/v1alpha1: tombstone remote write auth fields and add tests + - 08db43df 2026-06-25T14:06:14+02:00 config/v1alpha1: regenerate after tombstoned auth field godoc fix + - 0ef6b40c 2026-06-25T12:01:51+02:00 config/v1alpha1: fix tombstoned remote write auth field godoc + - 62a162bf 2026-06-25T11:10:52+02:00 config/v1alpha1: keep deprecated remote write auth fields for crdify + - 0fa312d8 2026-06-24T16:16:45+02:00 config/v1alpha1: align remote write auth union with review feedback + - 1bb239b7 2026-06-23T13:25:14+02:00 config/v1alpha1: rename remote write SafeAuthorization to Authorization + - 6a8233b0 2026-05-20T14:36:40-03:00 Add feature gate for multiple HAProxy versions + +- cluster-ingress-operator embedded-component 6d4e06c4f11b2536386d14b701a766be34742adf to 7b7406ee0d4bf03de360d53c9cc4a83ee14332cc + - 45f06392 2026-06-29T18:36:05-03:00 deploy haproxy as sidecar + +- cluster-kube-apiserver-operator embedded-component 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f to 6b0696abb88d7e2f7a8275f831519234851121c0 + - 0ba9af7 2026-07-02T12:14:17+02:00 Fix inaccuracies in AGENTS.md and ARCHITECTURE.md + - 11ba053 2026-07-02T11:42:39+02:00 Address review feedback on AGENTS.md and ARCHITECTURE.md + - 16b5200 2026-07-01T08:36:04+03:00 Add new test suite for KMS to KMS migration + - d6d43ac 2026-07-01T08:13:24+05:30 test: Add network policy enforcement tests + - 2d10c6b 2026-06-26T12:51:19+02:00 Add CLAUDE.md + - ecca0ca 2026-06-26T12:51:19+02:00 Add AGENTS.md and ARCHITECTURE.md for developer and AI agent reference + - f515794 2026-06-26T12:51:19+02:00 Add common CONTRIBUTING.md + +- cluster-network-operator embedded-component 7b341b420baeb655d65e551a1f04e3bcbe2631f1 to 8f06c7ead50937cb25d0f829d2cff003eff12bb8 + - 8d52d3a 2026-06-30T09:56:50+02:00 Add path-specific review instructions to CodeRabbit config + +- machine-config-operator embedded-component f05e48737d9db0a62f45f6ef06fc7382a4333fed to 28f12d28b9be52db0830b5d6ed0b6f141bbd2ae7 + - 28f12d28 2026-07-03T08:36:38Z OCPBUGS-64681: fix: add arbiter to control plane mcp sync (#5436) + - f88cf20d 2026-07-01T00:04:09Z chore: update AMIs + - ba9dad39 2026-06-29T11:45:04-05:00 Remove verbose ControllerConfig logging from bootstrap MCS + - 4c2e88be 2026-06-11T15:54:45-04:00 create digest configmap without oc binary + +- operator-framework-olm embedded-component cea3be72ef5704256bd35ab88acfa9ab03edf6df to 834f3e052edb84e6f316563d9a6f23035c03945f + - e461cff5 2026-07-01T13:26:34-04:00 Apply cluster TLS security profile to packageserver serving options + - 24e9dd6f 2026-06-30T15:03:07+02:00 OPRUN-4612: Add E2E tests for ExperimentalListPackageCustomSchemas gRPC endpoint + +- ovn-kubernetes image-amd64 f0527039dfc4901637721e7cecfdb9d0ea1c9c38 to fc46681bd5720c0139c394eea3d2ab686a2cf46f - 91d29f7b 2026-06-18T18:51:01+05:30 Dockerfile.base: Bump OVN to 26.03 - - 10d5782c 2026-06-16T20:56:43-07:00 Fix perma-failing security presubmit job - - 133ba1e4 2026-05-08T09:45:38+02:00 Promote EVPN E2Es from informing to blocking tests - -- service-ca-operator image-arm64 35cf51895f4dc77dca8a709e7635980753f87e17 to 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 - - e258072 2026-06-25T21:42:09+01:00 Update CONTRIBUTING.md to match updates to template - - 0ef0d32 2026-06-25T15:53:28+01:00 Merge in changes from PR#363 - - 5e8bcab 2026-06-24T21:16:29+01:00 Add AI SDLC context files - - 6b9cb8c 2026-06-24T12:03:49+02:00 feat: have CVO inject the centralized TLS configuration into the operator's config + - 8e2a679f 2026-06-15T15:05:50Z sync test annotations with upstream changes + - dfcb2426 2026-06-12T14:10:55+02:00 Fix UDN controller startup timeout during pod sync + - 3ac5bf95 2026-06-11T12:15:58-04:00 Use TLS config params in the ovnkube-identity webhook + - 857ce9a9 2026-06-11T12:15:58-04:00 Add CLI flags for configuring TLS to ovnkube-identity + - 8512a3bf 2026-06-11T16:27:20+02:00 Address review feedback on CUDN transport metric + - 75597a67 2026-06-11T16:27:20+02:00 Add transport label to CUDN count metric + - 9ebc3afa 2026-06-10T12:41:53-04:00 Adding missing labels for UDN workloads + - 268848f5 2026-06-10T10:20:30+02:00 e2e: fix UDN subnet overlap with downstream service CIDR + - d59e62b0 2026-06-09T15:07:42-04:00 cni: gracefully handle missing device info file for primary UDN + - 85979507 2026-06-09T10:05:01+02:00 e2e(virt): Add evpn failed migration test + - 08dee44f 2026-06-09T10:05:01+02:00 test(evpn): add unit tests for neighbor timing during live migration + - 94cf737b 2026-06-09T10:05:01+02:00 fix(evpn): remove dead EEXIST check from LinkFDBSet caller + - 8fd2cad4 2026-06-09T10:05:01+02:00 refactor: rename LinkFDBAdd to LinkFDBSet, use NeighSet + - ff611433 2026-06-09T10:05:01+02:00 refactor: rename LinkNeighAdd to LinkNeighSet + - 9e8bb31c 2026-06-09T10:05:01+02:00 fix(evpn): gate neighbor programming on migration domain readiness + - a11c389d 2026-06-09T08:10:33+02:00 area-maintainers: introduce kubevirt area with merge bot + - 2d545a0b 2026-06-08T15:02:18-07:00 contrib: refresh OVN pods on kind-helm.sh --deploy + - 1160194c 2026-06-08T14:49:52-04:00 Make TFT report failure for DPU CI jobs + - f8f3c2b5 2026-06-08T14:49:52-04:00 Route DPU host no-overlay traffic through OVN + - 95380fd4 2026-06-08T14:49:52-04:00 Peer DPU sim FRR over gateway network + - 107c5d5b 2026-06-08T14:49:52-04:00 Handle renamed FRR-K8S controller in DPU sim + - 7fc0f4b1 2026-06-08T14:49:52-04:00 Add DPU simulator no-overlay CI lane + - d7ac03e4 2026-06-08T14:49:52-04:00 Support manual DPU simulator Helm installs + - ca608635 2026-06-08T09:26:08-07:00 ovn: drop unreachable IPAMClaim reconciler after non-IC removal + - 7a7f4caa 2026-06-08T09:26:08-07:00 ovn: drop dead IPAMClaim watch after non-IC removal + - 047d5d36 2026-06-08T08:55:12-07:00 Sync reconcile pod-selector address sets at creation time + - e08225fc 2026-06-08T14:08:17Z RA contrioller: add unicast allowas-in origin to raw FRR config + - 4b4d0b9a 2026-06-08T14:01:09Z RA controller: rename evpn_rawconfig to rawconfig for future broader use + - c83b6f3d 2026-06-08T13:19:21Z e2e: configure framework TestContext to verify service accounts + - 0fe6e3d9 2026-06-06T09:54:52-04:00 dpulease: fix nil pointer panic in CNI health check + - 09cf4944 2026-06-05T17:43:18+02:00 [FYI] prevent duplicate logical_router_static_route + - d9cefde5 2026-06-04T17:55:23-04:00 Use FRR-K8S next-hop API in kind installs + - 4ab105d4 2026-06-04T20:14:49+02:00 ci: wait for service reachability after dual-stack conversion + - 351aa103 2026-06-04T13:35:15-04:00 Bump OpenTelemetry to v1.41.0 + - cc84a978 2026-06-04T13:35:15-04:00 Stop using deprecated frr-k8s DisableMP field + - fa24ddb5 2026-06-04T13:28:56-04:00 Fix using docker for dpu-sim CI lane + - a0c9fa1f 2026-06-04T13:21:57-04:00 Set DPU host BGP next-hop for no-overlay routes + - fc34b18f 2026-06-04T09:45:23-07:00 tests,e2e: add BFD route-cleanup coverage and fix stale wording + - ebc865ca 2026-06-04T09:45:23-07:00 tests,e2e: drop orphaned external-gw-pod-ips constant + - 1355df27 2026-06-04T09:45:23-07:00 tests: cover external-gateway route deletion for APB-managed routes + - c824eb88 2026-06-04T09:45:23-07:00 node: run periodic external-gateway conntrack cleanup for APB namespaces + - be576f25 2026-06-04T09:45:22-07:00 tests,e2e: remove legacy external-gateway annotation specs + - 52634fa1 2026-06-04T09:45:22-07:00 util,node,config: drop legacy external-gateway annotations + - 2d0beded 2026-06-04T09:45:22-07:00 apbroute: stop honoring legacy external-gateway annotations + - 0afda7bf 2026-06-04T09:45:22-07:00 ovn: remove legacy external-gateway annotation handling + - 1d8db6ee 2026-06-04T10:47:34-04:00 Bump frr-k8s for next-hop API + - 7525f9ce 2026-06-04T11:11:50+02:00 e2e: wait for localnet multi network policy convergence + - be80cc06 2026-05-15T09:04:49-07:00 test/e2e: drop dead multi-node-per-zone branching + - 1e20211e 2026-05-15T09:04:49-07:00 docs/installation: drop manual zone-name labeling step + - ffed9316 2026-05-15T09:04:49-07:00 test/e2e/kubevirt: simplify worker selection for live-migration + - fbeeaea7 2026-05-15T09:04:49-07:00 dist, helm, contrib: drop manual zone-name labeling + +- ovn-kubernetes image-arm64 6617c2a2ce4ab2e060e649672c91cf349d8500f7 to fc46681bd5720c0139c394eea3d2ab686a2cf46f + - 8e2a679f 2026-06-15T15:05:50Z sync test annotations with upstream changes + - dfcb2426 2026-06-12T14:10:55+02:00 Fix UDN controller startup timeout during pod sync + - 3ac5bf95 2026-06-11T12:15:58-04:00 Use TLS config params in the ovnkube-identity webhook + - 857ce9a9 2026-06-11T12:15:58-04:00 Add CLI flags for configuring TLS to ovnkube-identity + - 8512a3bf 2026-06-11T16:27:20+02:00 Address review feedback on CUDN transport metric + - 75597a67 2026-06-11T16:27:20+02:00 Add transport label to CUDN count metric + - 9ebc3afa 2026-06-10T12:41:53-04:00 Adding missing labels for UDN workloads + - 268848f5 2026-06-10T10:20:30+02:00 e2e: fix UDN subnet overlap with downstream service CIDR + - d59e62b0 2026-06-09T15:07:42-04:00 cni: gracefully handle missing device info file for primary UDN + - 85979507 2026-06-09T10:05:01+02:00 e2e(virt): Add evpn failed migration test + - 08dee44f 2026-06-09T10:05:01+02:00 test(evpn): add unit tests for neighbor timing during live migration + - 94cf737b 2026-06-09T10:05:01+02:00 fix(evpn): remove dead EEXIST check from LinkFDBSet caller + - 8fd2cad4 2026-06-09T10:05:01+02:00 refactor: rename LinkFDBAdd to LinkFDBSet, use NeighSet + - ff611433 2026-06-09T10:05:01+02:00 refactor: rename LinkNeighAdd to LinkNeighSet + - 9e8bb31c 2026-06-09T10:05:01+02:00 fix(evpn): gate neighbor programming on migration domain readiness + - a11c389d 2026-06-09T08:10:33+02:00 area-maintainers: introduce kubevirt area with merge bot + - 2d545a0b 2026-06-08T15:02:18-07:00 contrib: refresh OVN pods on kind-helm.sh --deploy + - 1160194c 2026-06-08T14:49:52-04:00 Make TFT report failure for DPU CI jobs + - f8f3c2b5 2026-06-08T14:49:52-04:00 Route DPU host no-overlay traffic through OVN + - 95380fd4 2026-06-08T14:49:52-04:00 Peer DPU sim FRR over gateway network + - 107c5d5b 2026-06-08T14:49:52-04:00 Handle renamed FRR-K8S controller in DPU sim + - 7fc0f4b1 2026-06-08T14:49:52-04:00 Add DPU simulator no-overlay CI lane + - d7ac03e4 2026-06-08T14:49:52-04:00 Support manual DPU simulator Helm installs + - ca608635 2026-06-08T09:26:08-07:00 ovn: drop unreachable IPAMClaim reconciler after non-IC removal + - 7a7f4caa 2026-06-08T09:26:08-07:00 ovn: drop dead IPAMClaim watch after non-IC removal + - 047d5d36 2026-06-08T08:55:12-07:00 Sync reconcile pod-selector address sets at creation time + - e08225fc 2026-06-08T14:08:17Z RA contrioller: add unicast allowas-in origin to raw FRR config + - 4b4d0b9a 2026-06-08T14:01:09Z RA controller: rename evpn_rawconfig to rawconfig for future broader use + - c83b6f3d 2026-06-08T13:19:21Z e2e: configure framework TestContext to verify service accounts + - 0fe6e3d9 2026-06-06T09:54:52-04:00 dpulease: fix nil pointer panic in CNI health check + - 09cf4944 2026-06-05T17:43:18+02:00 [FYI] prevent duplicate logical_router_static_route + - d9cefde5 2026-06-04T17:55:23-04:00 Use FRR-K8S next-hop API in kind installs + - 4ab105d4 2026-06-04T20:14:49+02:00 ci: wait for service reachability after dual-stack conversion + - 351aa103 2026-06-04T13:35:15-04:00 Bump OpenTelemetry to v1.41.0 + - cc84a978 2026-06-04T13:35:15-04:00 Stop using deprecated frr-k8s DisableMP field + - fa24ddb5 2026-06-04T13:28:56-04:00 Fix using docker for dpu-sim CI lane + - a0c9fa1f 2026-06-04T13:21:57-04:00 Set DPU host BGP next-hop for no-overlay routes + - fc34b18f 2026-06-04T09:45:23-07:00 tests,e2e: add BFD route-cleanup coverage and fix stale wording + - ebc865ca 2026-06-04T09:45:23-07:00 tests,e2e: drop orphaned external-gw-pod-ips constant + - 1355df27 2026-06-04T09:45:23-07:00 tests: cover external-gateway route deletion for APB-managed routes + - c824eb88 2026-06-04T09:45:23-07:00 node: run periodic external-gateway conntrack cleanup for APB namespaces + - be576f25 2026-06-04T09:45:22-07:00 tests,e2e: remove legacy external-gateway annotation specs + - 52634fa1 2026-06-04T09:45:22-07:00 util,node,config: drop legacy external-gateway annotations + - 2d0beded 2026-06-04T09:45:22-07:00 apbroute: stop honoring legacy external-gateway annotations + - 0afda7bf 2026-06-04T09:45:22-07:00 ovn: remove legacy external-gateway annotation handling + - 1d8db6ee 2026-06-04T10:47:34-04:00 Bump frr-k8s for next-hop API + - 7525f9ce 2026-06-04T11:11:50+02:00 e2e: wait for localnet multi network policy convergence + - be80cc06 2026-05-15T09:04:49-07:00 test/e2e: drop dead multi-node-per-zone branching + - 1e20211e 2026-05-15T09:04:49-07:00 docs/installation: drop manual zone-name labeling step + - ffed9316 2026-05-15T09:04:49-07:00 test/e2e/kubevirt: simplify worker selection for live-migration + - fbeeaea7 2026-05-15T09:04:49-07:00 dist, helm, contrib: drop manual zone-name labeling diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index fca884c802..82ac34a227 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,20 +1,20 @@ -https://github.com/openshift/api embedded-component 6bba8bc85ccc7fef33c4d19aaba85e3683fd3bc9 +https://github.com/openshift/api embedded-component 02e2c3de12fb849770deaa3ac9bb3b160a1cb4d8 https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component d7262f23f8c661ef6a215377b9571b615a1ae0b8 https://github.com/openshift/cluster-dns-operator embedded-component 8395f9054f235aec2cd5185019d201146c9827ed -https://github.com/openshift/cluster-ingress-operator embedded-component 6d4e06c4f11b2536386d14b701a766be34742adf -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 6ffdb079b3aa9249b101b58e6590a22c6cf5cb5f +https://github.com/openshift/cluster-ingress-operator embedded-component 7b7406ee0d4bf03de360d53c9cc4a83ee14332cc +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 6b0696abb88d7e2f7a8275f831519234851121c0 https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 8bef9812e7a3ec026397acd34633a7ecd479f357 https://github.com/openshift/cluster-kube-scheduler-operator embedded-component d43423b583269eea8236040424609c3f108ac9c4 -https://github.com/openshift/cluster-network-operator embedded-component 7b341b420baeb655d65e551a1f04e3bcbe2631f1 +https://github.com/openshift/cluster-network-operator embedded-component 8f06c7ead50937cb25d0f829d2cff003eff12bb8 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 34f95b07f4afbc47558e54e4fa2710fd692e615e https://github.com/openshift/cluster-policy-controller embedded-component 050c1ee6aeb0838daf75858fd853cca1e0098fa9 https://github.com/openshift/csi-external-snapshotter embedded-component b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/etcd embedded-component bf6c0094589afdf6c814a28c24f8f1bb5a577816 https://github.com/openshift/kubernetes embedded-component a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component f05e48737d9db0a62f45f6ef06fc7382a4333fed +https://github.com/openshift/machine-config-operator embedded-component 28f12d28b9be52db0830b5d6ed0b6f141bbd2ae7 https://github.com/openshift/openshift-controller-manager embedded-component 5631cf493b006cbc72a8600a7435813272d71940 -https://github.com/openshift/operator-framework-olm embedded-component cea3be72ef5704256bd35ab88acfa9ab03edf6df +https://github.com/openshift/operator-framework-olm embedded-component 834f3e052edb84e6f316563d9a6f23035c03945f https://github.com/openshift/route-controller-manager embedded-component 01ccbfb991fdbc559820a04c4932fc5ddf2339d0 https://github.com/openshift/service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 https://github.com/openshift/oc image-amd64 a7ad57244d4327c77d0fa190bb6d215d2d5faa86 @@ -22,7 +22,7 @@ https://github.com/openshift/coredns image-amd64 97f7cc327ab5df7d6da38137b7be338 https://github.com/openshift/csi-external-snapshotter image-amd64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/router image-amd64 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f https://github.com/openshift/kube-rbac-proxy image-amd64 d12e274605248f6c59373240a7eae7a7a357dcb3 -https://github.com/openshift/ovn-kubernetes image-amd64 f0527039dfc4901637721e7cecfdb9d0ea1c9c38 +https://github.com/openshift/ovn-kubernetes image-amd64 fc46681bd5720c0139c394eea3d2ab686a2cf46f https://github.com/openshift/kubernetes image-amd64 a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 https://github.com/openshift/oc image-arm64 a7ad57244d4327c77d0fa190bb6d215d2d5faa86 @@ -30,6 +30,6 @@ https://github.com/openshift/coredns image-arm64 97f7cc327ab5df7d6da38137b7be338 https://github.com/openshift/csi-external-snapshotter image-arm64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/router image-arm64 92a1fe6420e7fa5cff3ac1e4234b866e8f742c9f https://github.com/openshift/kube-rbac-proxy image-arm64 d12e274605248f6c59373240a7eae7a7a357dcb3 -https://github.com/openshift/ovn-kubernetes image-arm64 6617c2a2ce4ab2e060e649672c91cf349d8500f7 +https://github.com/openshift/ovn-kubernetes image-arm64 fc46681bd5720c0139c394eea3d2ab686a2cf46f https://github.com/openshift/kubernetes image-arm64 a466682e3867da746be24d7d56c6641612721d6c https://github.com/openshift/service-ca-operator image-arm64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 9acfa29dd8..d13357e495 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-01-125918" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-02-035219" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-05-172708" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-06-155219"