NO-ISSUE: rebase-release-5.0-5.0.0-0.nightly-2026-07-05-172708_amd64-2026-07-05_arm64-2026-07-06

Makefile.version.aarch64.var

@@ -1 +1 @@
-OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-02-035219
+OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-06-155219

Makefile.version.x86_64.var

@@ -1 +1 @@
-OCP_VERSION := 5.0.0-0.nightly-2026-07-01-125918
+OCP_VERSION := 5.0.0-0.nightly-2026-07-05-172708

assets/components/multus/release-multus-aarch64.json

@@ -1,6 +1,6 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-arm64-2026-07-02-035219"
+    "base": "5.0.0-0.nightly-arm64-2026-07-06-155219"
   },
   "images": {
     "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b2e551ce30a36b4bb1e26de7abd739b045767cef27e16e30d1add5cfc5acdcf5",

assets/components/multus/release-multus-x86_64.json

@@ -1,6 +1,6 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-2026-07-01-125918"
+    "base": "5.0.0-0.nightly-2026-07-05-172708"
   },
   "images": {
     "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6021b7fe340a630889ad00e43e237bb39289524ce6396cf3ae28b892ef9e5cd0",

assets/components/openshift-router/deployment.yaml

@@ -1,4 +1,7 @@
 # Deployment with default values
+#
+# Methods hashableDeployment() and deploymentConfigChanged()
+# must be updated when adding new fields to this manifest.
 kind: Deployment
 apiVersion: apps/v1
 spec:
@@ -11,15 +14,71 @@ spec:
       labels:
         ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
     spec:
+      # manually configure the service account, so we can configure it only in the router container.
+      automountServiceAccountToken: false
       serviceAccountName: router
       priorityClassName: system-cluster-critical
-      containers:
-        - name: router
+      shareProcessNamespace: true
+      initContainers:
+        - name: init-router
           imagePullPolicy: IfNotPresent
+          terminationMessagePolicy: FallbackToLogsOnError
+          command: ["/bin/bash", "-c", "cp -R -p /var/lib/haproxy/* /mnt/config/"]
+          volumeMounts:
+            - mountPath: /mnt/config
+              name: haproxy-config
+        - name: haproxy
+          imagePullPolicy: IfNotPresent
+          restartPolicy: Always
           securityContext:
             # See https://bugzilla.redhat.com/2007246
             allowPrivilegeEscalation: true
-            readOnlyRootFilesystem: false
+            readOnlyRootFilesystem: true
+          terminationMessagePolicy: FallbackToLogsOnError
+          command: ["/var/lib/haproxy/start-haproxy"]
+          # admin.sock should follow routerHAProxyAdminSocket const
+          args: ["-W", "-db", "-S", "/var/lib/haproxy/run/admin.sock,mode,600", "-f", "/var/lib/haproxy/conf/haproxy.config"]
+          livenessProbe:
+            exec:
+              command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"]
+            failureThreshold: 3
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+            terminationGracePeriodSeconds: 10
+          readinessProbe:
+            failureThreshold: 3
+            exec:
+              command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/haproxy.sock"]
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          startupProbe:
+            failureThreshold: 120
+            exec:
+              # admin.sock should follow routerHAProxyAdminSocket const
+              command: ["/bin/sh", "-c", "echo show version | socat - /var/lib/haproxy/run/admin.sock"]
+            periodSeconds: 1
+            successThreshold: 1
+            timeoutSeconds: 1
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+          volumeMounts:
+            - mountPath: /var/lib/haproxy
+              name: haproxy-config
+            - mountPath: /etc/pki/tls/private
+              name: default-certificate
+              readOnly: true
+            - mountPath: /var/run/configmaps/service-ca
+              name: service-ca-bundle
+              readOnly: true
+      containers:
+        - name: router
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
           terminationMessagePolicy: FallbackToLogsOnError
           env:
             - name: ROUTER_SERVICE_NAMESPACE
@@ -96,61 +155,6 @@ spec:
               value: '{{ .RouterCompressionMime }}'
             - name: ROUTER_ENABLE_EXTERNAL_CERTIFICATE
               value: "true"
-            {{- if .ClientAuthCAPath }}
-            - name: ROUTER_MUTUAL_TLS_AUTH
-              value: '{{ .ClientAuthPolicy }}'
-            - name: ROUTER_MUTUAL_TLS_AUTH_CA
-              value: '{{ .ClientAuthCAPath }}'
-            - name: ROUTER_MUTUAL_TLS_AUTH_FILTER
-              value: '{{ .ClientAuthFilter }}'
-            {{- end }}
-            {{- if .AccessLoggingEnabled }}
-            - name: ROUTER_SYSLOG_ADDRESS
-            {{- if .AccessLoggingSyslogAddress }}
-              value: '{{ .AccessLoggingSyslogAddress }}'
-            {{- else }}
-              value: /var/lib/rsyslog/rsyslog.sock
-            {{- /* AccessLoggingSyslogAddress*/}}
-            {{- end }}
-            - name: ROUTER_LOG_LEVEL
-              value: info
-            {{- if .AccessLoggingMaxLength}}
-            - name: ROUTER_LOG_MAX_LENGTH
-              value: '{{ .AccessLoggingMaxLength }}'
-            {{- /* AccessLoggingMaxLength */}}
-            {{- end }}
-            {{- if .AccessLoggingSyslogFacility }}
-            - name: ROUTER_LOG_FACILITY
-              value: {{ .AccessLoggingSyslogFacility }}
-            {{- end }}
-            {{- if .HttpLogFormat }}
-            - name: ROUTER_SYSLOG_FORMAT
-              value: '"{{ .HttpLogFormat }}"'
-            {{- /* HttpLogFormat */}}
-            {{- end }}
-            {{- if .HttpCaptureHeadersRequest }}
-            - name: ROUTER_CAPTURE_HTTP_REQUEST_HEADERS
-              value: '{{ .HttpCaptureHeadersRequest }}'
-            {{- /* HttpCaptureHeadersRequest */}}
-            {{- end }}
-            {{- if .HttpCaptureHeadersResponse }}
-            - name: ROUTER_CAPTURE_HTTP_RESPONSE_HEADERS
-              value: '{{ .HttpCaptureHeadersResponse }}'
-            {{- /* HttpCaptureHeadersResponse */}}
-            {{- end }}
-            {{- if .HttpCaptureCookies }}
-            - name: ROUTER_CAPTURE_HTTP_COOKIE
-              value: '{{ .HttpCaptureCookies }}'
-            {{- /* HttpCaptureCookies */}}
-            {{- end }}
-            {{- /* AccessLoggingEnabled */}}
-            {{- end }}
-            {{- if .HttpErrorCodePages }}
-            - name: ROUTER_ERRORFILE_503
-              value: /var/lib/haproxy/errorfiles/error-page-503.http
-            - name: ROUTER_ERRORFILE_404
-              value: /var/lib/haproxy/errorfiles/error-page-404.http
-            {{- end }}
           livenessProbe:
             failureThreshold: 3
             httpGet:
@@ -181,30 +185,20 @@ spec:
             timeoutSeconds: 1
           resources:
             requests:
-              cpu: 100m
-              memory: 256Mi
+              cpu: 25m
+              memory: 64Mi
           volumeMounts:
+            - mountPath: /var/lib/haproxy
+              name: haproxy-config
             - mountPath: /etc/pki/tls/private
               name: default-certificate
               readOnly: true
             - mountPath: /var/run/configmaps/service-ca
               name: service-ca-bundle
               readOnly: true
-            {{- if .ClientCAMapName }}
-            - mountPath: '{{ .ClientCAMountPath }}'
-              name: '{{ .ClientCAMapName}}'
+            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              name: kube-api-access
               readOnly: true
-            {{- end }}
-            {{- if .HttpErrorCodePages }}
-            - mountPath: /var/lib/haproxy/errorfiles
-              name: error-code-pages
-              readOnly: true
-            {{- end }}
-            {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }}
-            - mountPath: /var/lib/rsyslog
-              name: rsyslog-socket
-              readOnly: false
-            {{- end }}
           image: '{{ .ReleaseImage.haproxy_router }}'
           ports:
             - name: http
@@ -218,29 +212,6 @@ spec:
               protocol: TCP
           args:
             - -v=4
-        {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }}
-        - name: logs
-          imagePullPolicy: IfNotPresent
-          terminationMessagePolicy: FallbackToLogsOnError
-          image: '{{ .ReleaseImage.haproxy_router }}'
-          imagePullPolicy: IfNotPresent
-          command:
-            - /sbin/rsyslogd
-            - -n
-            - -i
-            - /tmp/rsyslogd.pid
-            - -f
-            - /etc/rsyslog/rsyslog.conf
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /var/lib/rsyslog
-              name: rsyslog-socket
-            - mountPath: /etc/rsyslog
-              name: rsyslog-config
-        {{- end}}
       tolerations:
         # Ensure the pod isn't deleted during serial NoExecuteTaintManager tests.
         # Remember that NoExecute uses Delete, not Evict, because removing the pod
@@ -254,6 +225,8 @@ spec:
           secret:
             defaultMode: 420
             secretName: '{{ .ServingCertificateSecret }}'
+        - name: haproxy-config
+          emptyDir: {}
         - name: service-ca-bundle
           configMap:
             defaultMode: 420
@@ -262,29 +235,23 @@ spec:
                 path: service-ca.crt
             name: service-ca-bundle
             optional: false
-        {{- if .ClientCAMapName }}
-        - name: '{{ .ClientCAMapName }}'
-          configMap:
-            defaultMode: 420
-            items:
-            - key: '{{ .ClientCABundleFilename }}'
-              path: '{{ .ClientCABundleFilename }}'
-            name: '{{ .ClientCAMapName }}'
-            optional: false
-        {{- end }}
-        {{- if .HttpErrorCodePages }}
-        - name: error-code-pages
-          configMap:
-            name: {{ .HttpErrorCodePages }}
-        {{- end }}
-        {{- if and .AccessLoggingEnabled (not .AccessLoggingSyslogAddress) }}
-        - name: rsyslog-socket
-          emptyDir: {}
-        - name: rsyslog-config
-          configMap:
-            name: access-logs-rsyslog-config
-            optional: false
-        {{- end }}
+        - name: kube-api-access
+          projected:
+            defaultMode: 0400
+            sources:
+              - serviceAccountToken:
+                  expirationSeconds: 3600
+                  path: token
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+              - downwardAPI:
+                  items:
+                    - path: namespace
+                      fieldRef:
+                        fieldPath: metadata.namespace
       restartPolicy: Always
       dnsPolicy: ClusterFirst
       nodeSelector:

assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml

@@ -2,10 +2,10 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e
+    digest: sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0
+    digest: sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
     digest: sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e
     target:
       kind: Deployment
       labelSelector: app=catalog-operator

assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml

@@ -2,10 +2,10 @@
 images:
   - name: quay.io/operator-framework/olm
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509
+    digest: sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958
   - name: quay.io/operator-framework/configmap-operator-registry
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
-    digest: sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0
+    digest: sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28
   - name: quay.io/openshift/origin-kube-rbac-proxy
     newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev
     digest: sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614
@@ -16,12 +16,12 @@ patches:
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OPERATOR_REGISTRY_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28
      - op: add
        path: /spec/template/spec/containers/0/env/-
        value:
          name: OLM_IMAGE
-         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509
+         value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958
     target:
       kind: Deployment
       labelSelector: app=catalog-operator

assets/optional/operator-lifecycle-manager/release-olm-aarch64.json

@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-arm64-2026-07-02-035219"
+    "base": "5.0.0-0.nightly-arm64-2026-07-06-155219"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8c9a3c865644ccb53ab37ee161616ecccba2c1fb834f79675a64ce6874f2348e",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef999a910106ae74b84cede768aeb01e2b39917a4a60ade5cc47582772a435f0",
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f52ba3e266da634d90730c115515ef55feff100ff62f2d186c3dfde9d158957e",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3034bd26838cad5987d4041e24b0910027dd258995842f1bbe11bc0e793c0576",
     "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a58d21128561488e87c8d5c9ed7a76c6406c412dc071aa5fcb9a33b1f74a3433"
   }
 }

assets/optional/operator-lifecycle-manager/release-olm-x86_64.json

@@ -1,10 +1,10 @@
 {
   "release": {
-    "base": "5.0.0-0.nightly-2026-07-01-125918"
+    "base": "5.0.0-0.nightly-2026-07-05-172708"
   },
   "images": {
-    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1c3ea72a23f0d6c653061c5bd97aaa6a3f7e588418df67e1212302d07c331509",
-    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:076958253143ca66382d5065ba8bf257e0d56c84e7fede4d2e114870f99545f0",
+    "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:31e2fe2c034f093af23939832086b85c3835b1d09dd06526152c333cbec80958",
+    "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:07afe5617fdca7401d39b7a74792c496b5b9a6ccec72fe7398cf8bc6ff184b28",
     "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:772437bdb01f7ed4523206fa6977cdd6b07bf86b1c7366b97dfc506a0d7ef614"
   }
 }