From f5552edf7ec3cf0305a4be97e221ec404152579f Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:20:06 +0000 Subject: [PATCH 1/7] update last_rebase.sh --- scripts/auto-rebase/last_rebase.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 258fd5c26e..ca0c985006 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-23-224236" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-27-004356" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-27-053720" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-28-013859" From ef665af3f9b956281866ba2681d6c525b0aae7a7 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:20:12 +0000 Subject: [PATCH 2/7] update changelog --- scripts/auto-rebase/changelog.txt | 74 ++++++++++++++++++++++++++----- scripts/auto-rebase/commits.txt | 26 +++++------ 2 files changed, 76 insertions(+), 24 deletions(-) diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 00dd54e0f4..a771921240 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,7 +1,65 @@ -- oc image-arm64 994613040335f72809854babcb80b9d11a4e98d5 to a88e785e90aa96ac96da93359bacf3ea5c174733 +- api embedded-component 581cfdf7198613bd325c185eb3eac672670da633 to 9bcaa16cb258e544dd76b78ff2dc3f89af840f76 + - ffbad1d3 2026-07-24T12:14:11+01:00 Check all hypershift variants when the featuregate is not platform specific + - 3199351b 2026-07-22T14:28:51+02:00 machineconfiguration/v1: add BGPVIPPeersJSON to ControllerConfigSpec + - b0927431 2026-07-22T14:28:49+02:00 config/v1: add BGPBasedVIPManagement feature gate and VIPManagement field + - 5bd0b76d 2026-07-21T09:05:02-05:00 NodeUID in status to detect replaced node with same name + - 91ec72c6 2026-07-21T15:06:54+03:00 Align with latest beta API of Vault + - a1e80c1b 2026-07-09T10:56:50+02:00 Promote OLMLifecycleAndCompatibility feature gate to Default + +- cluster-csi-snapshot-controller-operator embedded-component ef7a4c8b7f5c5e6cba4486dcc37f50521e7bc655 to 67648d56d6b312e661714f8e7bf0e9be1d532c1c + - ab3ec5d 2026-07-21T15:24:21+02:00 Bump all deps for 5.0.0 + +- cluster-ingress-operator embedded-component b4daff58712de418c51d765a8686069a5f47e764 to d7aafd957d1c126f5241ab716ad55ad0d160c042 + - a5c99e25 2026-06-23T14:17:24+01:00 OCPBUGS-90616: Add GRPCRoute to Gateway API e2e CRD test coverage + +- cluster-kube-apiserver-operator embedded-component ea8a9c50203113ca43db98ca925ab7fcdaff7d28 to dab04ebace1a4b36bb40e8f4f87804754b69760b + - 09ea0d5 2026-07-24T16:22:19+03:00 Update openshift/* + - 8dfb4f8 2026-07-24T05:27:15-04:00 pkg/operator: add KMS plugin sidecar revision readiness check + - 050afcf 2026-07-23T15:52:02+02:00 NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 + - df010b0 2026-07-23T12:17:46+05:30 Add KMS key ID identifier + +- cluster-network-operator embedded-component 4f6fb6be829a2f6ad3e0df4ab85ecb00ef028343 to 00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63 + - e538c9c 2026-07-23T15:10:03-04:00 Register PKI controller through AddToManager + - e7e9bf0 2026-07-23T14:57:58-04:00 Bound PKI informer cache sync with a timeout + - 60cedaf 2026-07-23T13:48:45-04:00 Use keyutil.ParsePrivateKeyPEM for private key decoding + - 262103b 2026-07-23T13:11:47-04:00 Enable configurable PKI for managed certificate rotation + - dfb8dd5 2026-07-23T15:40:27Z Revert "Merge pull request #2925 from OlivierCazade/day0" + - 17f08a7 2026-07-22T11:44:23-04:00 ovn-kubernetes: Move MNP from ConfigMap to CLI flags + - 79bbb49 2026-07-15T09:43:13Z Bump frr-k8s MAX_FDS from 1024 to 65536 + - 9c178ed 2026-04-28T16:16:58+02:00 CORENET-6581: Add transport label to CUDN telemetry recording rule + +- kubernetes embedded-component 98b35193b2ac7a23a673325f5e9b830ecd5ba406 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 + - 44a83e00e 2026-07-17T15:00:07+02:00 UPSTREAM: : hack/update-featuregates.sh + - 4da08ff19 2026-07-17T08:27:41+02:00 UPSTREAM: : Store SELinuxWarningController upgrade check as a ConfigMap + - 13ace3c70 2026-07-02T02:25:02-04:00 UPSTREAM: : upkeep cpu partitioning admission webhook + +- machine-config-operator embedded-component 067b924f19a64a209796d5be5a0a63665f53b1eb to 3b4a5c7d9fa127981c57efac6fa29bc76eac019d + - 08f5b4e1 2026-07-24T11:30:29Z Thread context through syncHandler instead of storing it in Controller + - c4fb4794 2026-07-24T11:30:29Z Propagate context to InspectStreamClass for shutdown cancellation + - 92bdeffb 2026-07-24T11:30:29Z Add unit tests for validateNoRuncOnRHEL10FromOSImageURL + - 3c6b0fcd 2026-07-24T11:30:29Z Inline runcBlockedError into its callers + - a0e361e2 2026-07-24T11:30:29Z Move validateNoRuncOnRHEL10FromOSImageStream out of generateRenderedMachineConfig + - cd031001 2026-07-24T11:30:29Z Decouple validateNoRuncOnRHEL10FromOSImageURL from Controller + - 46c64391 2026-07-24T11:30:29Z Rename runc validation functions for clarity + - ec249e54 2026-07-24T11:30:29Z TBD + - b5fe45d5 2026-07-24T08:59:10Z NO-ISSUE: extended tests, restore initial maxUnavailable when modified + - bd1f9660 2026-07-23T16:08:26+05:30 Add TC 88940: Apply password only if changes exist + - 173915e5 2026-07-23T09:54:18Z NO-ISSUE: add AWS marketplace polarion ID test + - 75e3bbca 2026-07-22T14:46:03-04:00 Surface MOSB build status on paused MCPs, added e2e tests to test the behavior, and refined non-paused pool reporting + - 9278288f 2026-07-22T15:13:16+02:00 CNTRLPLANE-3840: Remove ExternalTopologyMode guard from OSImageStream bootstrap + - 54982a74 2026-07-21T19:36:43+05:30 Add unit tests for osImageStream label skip logic in boot image controller + - b68a7440 2026-07-17T08:10:43Z MCO-2184: Adapt scale extended tests to support osstreams + +- service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 + - 9ad2f83 2026-07-24T17:31:07-04:00 Bump github.com/openshift/build-machinery-go + - 11a6d83 2026-07-23T13:23:29+02:00 feat: inject centralized TLS into service-ca operand + - 843f71b 2026-07-22T14:39:22+02:00 chore: sync deps + - 195ba0b 2026-06-06T22:21:50Z Updating ose-service-ca-operator-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/7691ed4dc0b6585b358f9e73fb736ace9a48a286/images/ose-service-ca-operator.yml + +- oc image-amd64 994613040335f72809854babcb80b9d11a4e98d5 to a88e785e90aa96ac96da93359bacf3ea5c174733 - a88e785e 2026-07-23T20:40:27Z RFE-8595: must-gather: add client-side keep-alive to prevent accessTokenInactivityTimeout failures (#2288) -- router image-arm64 0c4063da30da6091765e2576efc684d0f020918d to 682319a1bb432f0203951c33336d0f55947e1099 +- router image-amd64 f5b67ebd12089170bfc47da7745fe4efb1477eb7 to 682319a1bb432f0203951c33336d0f55947e1099 - c15a20a 2026-07-25T20:02:34Z Revert "OCPBUGS-77056: Make external cert validation asynchronous (Resurrection)" - da1c969 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Use a short, unique prefix for fake-haproxy test sockets - 6f2aacc 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Update vendor to remove unused authorizationutil reference @@ -16,24 +74,18 @@ - 7b4b855 2026-07-23T10:29:40-04:00 Remove library-go replace directive and update vendor - 277913c 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Retry on write conflicts without dropping writerlease - bc97dba 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Asynchronous external certificate validation and Hybrid Informer secret monitoring - - 74b6915 2026-07-22T11:50:03-04:00 NE-2741: Align vendored openshift/api with the master branch version - - deb1d50 2026-07-22T11:21:18-04:00 NE-2741: Address PR comments on TLS curve preference parsing - - 7f33917 2026-07-22T11:21:18-04:00 Security: fail-closed on unsupported TLS curves and parse mixed delimiters - - da031dd 2026-07-22T11:21:18-04:00 Fix: shorten fake-haproxy socket path in tests to avoid length limits - - ef67e22 2026-07-22T11:21:18-04:00 NE-2741: Implement TLS Curves Support for Metrics Endpoints - 6ebff4e 2026-07-20T21:03:15-04:00 NE-2223: Bump HAProxy to 3.2.19 in the router image - 400eac8 2026-06-15T16:09:07-03:00 NO-JIRA: Add default coderabbit for the repo -- ovn-kubernetes image-arm64 8e2e1542642847da592268a0ab94a207eb8d3605 to 88e9f0f146784e8525f6304a1f6f7c986eba2319 +- ovn-kubernetes image-amd64 8e2e1542642847da592268a0ab94a207eb8d3605 to 88e9f0f146784e8525f6304a1f6f7c986eba2319 - 3f34530b 2026-07-12T10:36:43+03:00 Update OWNERS file -- kubernetes image-arm64 0f7d1a1b66af90eece8d46f6f9dc7537bf16d978 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 +- kubernetes image-amd64 98b35193b2ac7a23a673325f5e9b830ecd5ba406 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 - 44a83e00e 2026-07-17T15:00:07+02:00 UPSTREAM: : hack/update-featuregates.sh - 4da08ff19 2026-07-17T08:27:41+02:00 UPSTREAM: : Store SELinuxWarningController upgrade check as a ConfigMap - - d178a1dbb 2026-07-17T00:54:58+05:30 UPSTREAM: 140211: Promote regression-issue-74839 to 1.5 - 13ace3c70 2026-07-02T02:25:02-04:00 UPSTREAM: : upkeep cpu partitioning admission webhook -- service-ca-operator image-arm64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 +- service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 - 9ad2f83 2026-07-24T17:31:07-04:00 Bump github.com/openshift/build-machinery-go - 11a6d83 2026-07-23T13:23:29+02:00 feat: inject centralized TLS into service-ca operand - 843f71b 2026-07-22T14:39:22+02:00 chore: sync deps diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index d610a4f0c7..3a3ed9d4a5 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,30 +1,30 @@ -https://github.com/openshift/api embedded-component 581cfdf7198613bd325c185eb3eac672670da633 -https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component ef7a4c8b7f5c5e6cba4486dcc37f50521e7bc655 +https://github.com/openshift/api embedded-component 9bcaa16cb258e544dd76b78ff2dc3f89af840f76 +https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 67648d56d6b312e661714f8e7bf0e9be1d532c1c https://github.com/openshift/cluster-dns-operator embedded-component 4b8ae49940eefc50fa48da5179e735dd6ccd42d9 -https://github.com/openshift/cluster-ingress-operator embedded-component b4daff58712de418c51d765a8686069a5f47e764 -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component ea8a9c50203113ca43db98ca925ab7fcdaff7d28 +https://github.com/openshift/cluster-ingress-operator embedded-component d7aafd957d1c126f5241ab716ad55ad0d160c042 +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component dab04ebace1a4b36bb40e8f4f87804754b69760b https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 4e72164b8bc505033ad565ab01d57963e7c9688e https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 56fa325466a1f2a2d41435ba3a58b2bf8fdab2f3 -https://github.com/openshift/cluster-network-operator embedded-component 4f6fb6be829a2f6ad3e0df4ab85ecb00ef028343 +https://github.com/openshift/cluster-network-operator embedded-component 00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 34f95b07f4afbc47558e54e4fa2710fd692e615e https://github.com/openshift/cluster-policy-controller embedded-component 01afc4aac71a8e8be26383a0421bed7673391750 https://github.com/openshift/csi-external-snapshotter embedded-component b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/etcd embedded-component 64f8851a001f7e102d47bfe51ca0dac23951879a -https://github.com/openshift/kubernetes embedded-component 98b35193b2ac7a23a673325f5e9b830ecd5ba406 +https://github.com/openshift/kubernetes embedded-component 63ee93dac28329fd9d81e91b21ea8d8c43105d01 https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component 067b924f19a64a209796d5be5a0a63665f53b1eb +https://github.com/openshift/machine-config-operator embedded-component 3b4a5c7d9fa127981c57efac6fa29bc76eac019d https://github.com/openshift/openshift-controller-manager embedded-component 5631cf493b006cbc72a8600a7435813272d71940 https://github.com/openshift/operator-framework-olm embedded-component 56b3931de4636f7e0d212001f2074b9dddb45a8f https://github.com/openshift/route-controller-manager embedded-component 59697cf7af4517dd44e28179a57f7f35b6ea0e22 -https://github.com/openshift/service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 -https://github.com/openshift/oc image-amd64 994613040335f72809854babcb80b9d11a4e98d5 +https://github.com/openshift/service-ca-operator embedded-component e260be2b3710137012814ce9ca48f155f24f0b02 +https://github.com/openshift/oc image-amd64 a88e785e90aa96ac96da93359bacf3ea5c174733 https://github.com/openshift/coredns image-amd64 37aaba896e97f4b9a091aab6d36f2213b8854474 https://github.com/openshift/csi-external-snapshotter image-amd64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 -https://github.com/openshift/router image-amd64 f5b67ebd12089170bfc47da7745fe4efb1477eb7 +https://github.com/openshift/router image-amd64 682319a1bb432f0203951c33336d0f55947e1099 https://github.com/openshift/kube-rbac-proxy image-amd64 43c114bc124f59e2fc3223dea8e0a8f4cdeed18d -https://github.com/openshift/ovn-kubernetes image-amd64 8e2e1542642847da592268a0ab94a207eb8d3605 -https://github.com/openshift/kubernetes image-amd64 98b35193b2ac7a23a673325f5e9b830ecd5ba406 -https://github.com/openshift/service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 +https://github.com/openshift/ovn-kubernetes image-amd64 88e9f0f146784e8525f6304a1f6f7c986eba2319 +https://github.com/openshift/kubernetes image-amd64 63ee93dac28329fd9d81e91b21ea8d8c43105d01 +https://github.com/openshift/service-ca-operator image-amd64 e260be2b3710137012814ce9ca48f155f24f0b02 https://github.com/openshift/oc image-arm64 a88e785e90aa96ac96da93359bacf3ea5c174733 https://github.com/openshift/coredns image-arm64 37aaba896e97f4b9a091aab6d36f2213b8854474 https://github.com/openshift/csi-external-snapshotter image-arm64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 From ead47eabc2dcfd9e0aa40c32b67117ecc56ab83d Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:20:31 +0000 Subject: [PATCH 3/7] update microshift/deps --- .../managementcpusoverride/admission.go | 26 +- .../managementcpusoverride/admission_test.go | 35 +- .../selinuxwarning/cache/openshift_patch.go | 18 + .../openshift_upgrade_controller.go | 102 ++++++ .../openshift_upgrade_controller_test.go | 336 ++++++++++++++++++ .../selinux_warning_controller.go | 7 + .../pkg/features/openshift_features.go | 6 + .../rbac/bootstrappolicy/controller_policy.go | 4 + .../testdata/controller-roles.yaml | 14 + .../reference/feature_list.md | 1 + 10 files changed, 503 insertions(+), 46 deletions(-) create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go diff --git a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go index 9bf0a1f8a1..530639815a 100644 --- a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go +++ b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go @@ -17,7 +17,6 @@ import ( "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission/initializer" @@ -187,16 +186,6 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return admission.NewForbidden(attr, fmt.Errorf("%s node or namespace or infra config cache not synchronized", PluginName)) } - nodes, err := a.nodeLister.List(labels.Everything()) - if err != nil { - return admission.NewForbidden(attr, err) // can happen due to informer latency - } - - // we still need to have nodes under the cluster to decide if the management resource enabled or not - if len(nodes) == 0 { - return admission.NewForbidden(attr, fmt.Errorf("%s the cluster does not have any nodes", PluginName)) - } - clusterInfra, err := a.infraConfigLister.Get(infraClusterName) if err != nil { return admission.NewForbidden(attr, err) // can happen due to informer latency @@ -215,7 +204,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri } // Check if we are in CPU Partitioning mode for AllNodes - if !isCPUPartitioning(clusterInfra.Status, nodes, workloadType) { + if !isCPUPartitioning(clusterInfra.Status) { return nil } @@ -284,18 +273,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return nil } -func isCPUPartitioning(infraStatus configv1.InfrastructureStatus, nodes []*corev1.Node, workloadType string) bool { - // If status is not for CPU partitioning and we're single node we also check nodes to support upgrade event - // TODO: This should not be needed after 4.13 as all clusters after should have this feature on at install time, or updated by migration in NTO. - if infraStatus.CPUPartitioning != configv1.CPUPartitioningAllNodes && infraStatus.ControlPlaneTopology == configv1.SingleReplicaTopologyMode { - managedResource := fmt.Sprintf("%s.%s", workloadType, containerWorkloadResourceSuffix) - for _, node := range nodes { - // We only expect a single node to exist, so we return on first hit - if _, ok := node.Status.Allocatable[corev1.ResourceName(managedResource)]; ok { - return true - } - } - } +func isCPUPartitioning(infraStatus configv1.InfrastructureStatus) bool { return infraStatus.CPUPartitioning == configv1.CPUPartitioningAllNodes } diff --git a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go index 9564bffe39..209bea8383 100644 --- a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go +++ b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go @@ -87,7 +87,7 @@ func TestAdmit(t *testing.T) { pod: testManagedPodWithWorkloadAnnotation("500m", "250m", "500Mi", "250Mi", "non-existent"), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the pod namespace %q does not allow the workload type non-existent", "managed-namespace"), }, @@ -96,7 +96,7 @@ func TestAdmit(t *testing.T) { pod: testPod("500m", "250m", "500Mi", "250Mi"), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, }, { name: "should return admission error when the pod has more than one workload annotation", @@ -112,7 +112,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the pod can not have more than one workload annotations"), }, @@ -129,7 +129,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the workload annotation key should have format %s", podWorkloadTargetAnnotationPrefix), }, @@ -146,7 +146,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf(`failed to get workload annotation effect: failed to parse "{" annotation value: unexpected end of JSON input`), }, @@ -163,7 +163,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, expectedError: fmt.Errorf(`failed to get workload annotation effect: the workload annotation value map["test":"test"] does not have "effect" key`), infra: testClusterSNOInfra(), }, @@ -183,7 +183,7 @@ func TestAdmit(t *testing.T) { workloadAdmissionWarning: "skipping pod CPUs requests modifications because the namespace namespace is not annotated with workload.openshift.io/allowed to allow workload partitioning", }, namespace: testNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -196,7 +196,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s":256}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -209,7 +209,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s": 2}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -221,7 +221,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), kubetypes.ConfigSourceAnnotationKey: kubetypes.FileSource, }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -232,7 +232,7 @@ func TestAdmit(t *testing.T) { expectedAnnotations: map[string]string{ workloadAdmissionWarning: "skip pod CPUs requests modifications because it has guaranteed QoS class", }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -245,7 +245,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s":256,"cpulimit":500}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -256,7 +256,7 @@ func TestAdmit(t *testing.T) { expectedAnnotations: map[string]string{ workloadAdmissionWarning: fmt.Sprintf("skip pod CPUs requests modifications because it will change the pod QoS class from %s to %s", corev1.PodQOSBurstable, corev1.PodQOSBestEffort), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -267,15 +267,6 @@ func TestAdmit(t *testing.T) { nodes: []*corev1.Node{testNode()}, infra: testClusterInfraWithoutWorkloadPartitioning(), }, - { - name: "should return admission error when the cluster does not have any nodes", - pod: testManagedPod("500m", "250m", "500Mi", "250Mi"), - expectedCpuRequest: resource.MustParse("250m"), - namespace: testManagedNamespace(), - nodes: []*corev1.Node{}, - infra: testClusterSNOInfra(), - expectedError: fmt.Errorf("the cluster does not have any nodes"), - }, } for _, test := range tests { diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go new file mode 100644 index 0000000000..d0c66ab8de --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go @@ -0,0 +1,18 @@ +package cache + +type ConflictCounter interface { + GetConflictCount() int +} + +var _ ConflictCounter = &volumeCache{} + +func (c *volumeCache) GetConflictCount() int { + c.mutex.RLock() + defer c.mutex.RUnlock() + + conflictCount := 0 + for _, conflicts := range c.conflicts { + conflictCount += len(conflicts) + } + return conflictCount +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go new file mode 100644 index 0000000000..39eeb9853c --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go @@ -0,0 +1,102 @@ +package selinuxwarning + +import ( + "context" + "fmt" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + utilfeature "k8s.io/apiserver/pkg/util/feature" + applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1" + clientset "k8s.io/client-go/kubernetes" + "k8s.io/klog/v2" + "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" + "k8s.io/kubernetes/pkg/features" +) + +const ( + checkInterval = 30 * time.Second + configMapNamespace = "openshift-config" + configMapName = "selinux-conflicts" + fieldManager = "selinux-conflicts-reporter" +) + +type SELinuxConflictsReporterController struct { + kubeClient clientset.Interface + conflictCounter cache.ConflictCounter + previousConflicts metav1.ConditionStatus +} + +func NewSELinuxConflictsReporterController(kubeClient clientset.Interface, volumeCache cache.VolumeCache) *SELinuxConflictsReporterController { + return &SELinuxConflictsReporterController{ + kubeClient: kubeClient, + // Ugly retype to avoid more carry patches in Kubernetes code. + // We added ConflictCounter in cache/openshift_patch.go, + // therefore we know that VolumeCache implements it. + conflictCounter: volumeCache.(cache.ConflictCounter), + previousConflicts: metav1.ConditionUnknown, + } +} + +func (c *SELinuxConflictsReporterController) Run(ctx context.Context) { + logger := klog.FromContext(ctx) + if !utilfeature.DefaultFeatureGate.Enabled(features.SELinuxMountGAReadiness) { + logger.V(2).Info("SELinuxMountGAReadiness feature gate is disabled, not starting OpenShift SELinux conflicts reporter") + return + } + logger.V(2).Info("Starting OpenShift SELinux conflicts reporter") + timer := time.NewTimer(checkInterval) + defer timer.Stop() + for { + select { + case <-ctx.Done(): + return + case <-timer.C: + c.reportSELinuxConflicts(ctx) + timer.Reset(checkInterval) + } + } +} + +func (c *SELinuxConflictsReporterController) reportSELinuxConflicts(ctx context.Context) { + logger := klog.FromContext(ctx) + logger.V(4).Info("Checking for SELinux conflicts") + + currentConflicts := c.getConflicts(logger) + if currentConflicts == c.previousConflicts { + logger.V(4).Info("SELinux conflict status did not change since last check") + return + } + logger.V(4).Info("SELinux conflict status changed, updating the config map") + if err := c.applySELinuxConflictsConfigMap(ctx, currentConflicts); err != nil { + logger.Error(err, "Error saving conflicts config map") + // To keep it simple: no exponential backoff try again in the next iteration. + return + } + logger.V(2).Info("SELinux conflict updated", "Conflicts", currentConflicts) + c.previousConflicts = currentConflicts +} + +func (c *SELinuxConflictsReporterController) getConflicts(logger klog.Logger) metav1.ConditionStatus { + conflictsCount := c.conflictCounter.GetConflictCount() + if conflictsCount > 0 { + logger.V(4).Info("Found SELinux-conflicting pods", "conflictsCount", conflictsCount) + return metav1.ConditionTrue + } + logger.V(4).Info("Found no SELinux-conflicting pods") + return metav1.ConditionFalse +} + +func (c *SELinuxConflictsReporterController) applySELinuxConflictsConfigMap(ctx context.Context, conflictsPresent metav1.ConditionStatus) error { + cm := applyconfigurationscorev1.ConfigMap(configMapName, configMapNamespace). + WithData(map[string]string{ + "conflictsPresent": string(conflictsPresent), + }).WithAnnotations(map[string]string{ + "Description": "This config map is used to report presence of SELinux conflicts from kube-controller-manager to storage Upgradeable condition in OpenShift 5.0", + }) + _, err := c.kubeClient.CoreV1().ConfigMaps(configMapNamespace).Apply(ctx, cm, metav1.ApplyOptions{FieldManager: fieldManager, Force: true}) + if err != nil { + return fmt.Errorf("error applying config map %s: %w", configMapName, err) + } + return nil +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go new file mode 100644 index 0000000000..c0a78104ac --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go @@ -0,0 +1,336 @@ +package selinuxwarning + +import ( + "context" + "testing" + + v1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes/fake" + "k8s.io/client-go/tools/cache" + "k8s.io/klog/v2/ktesting" + volumecache "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" +) + +var _ volumecache.ConflictCounter = &fakeVolumeCache{} + +func (f *fakeVolumeCache) GetConflictCount() int { + count := 0 + for _, conflicts := range f.conflictsToSend { + count += len(conflicts) + } + return count +} + +func TestReportSELinuxConflicts(t *testing.T) { + cmTrue := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "True", + }, + } + cmFalse := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "False", + }, + } + tests := []struct { + name string + conflicts map[cache.ObjectName][]volumecache.Conflict + initialConflict metav1.ConditionStatus + // If set, the ConfigMap already exists before the test runs. + existingConfigMap *v1.ConfigMap + + expectConfigMapData map[string]string + // If true, no ConfigMap write is expected (status didn't change). + expectNoWrite bool + }{ + { + name: "no conflicts, create the config map", + initialConflict: metav1.ConditionUnknown, + conflicts: nil, + expectConfigMapData: map[string]string{ + "conflictsPresent": "False", + }, + }, + { + name: "conflicts present, create the config map", + initialConflict: metav1.ConditionUnknown, + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + Pod: cache.ObjectName{Namespace: "ns1", Name: "pod1"}, + PropertyValue: ":::s0:c1,c2", + OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod2"}, + OtherPropertyValue: ":::s0:c98,c99", + }, + }, + }, + expectConfigMapData: map[string]string{ + "conflictsPresent": "True", + }, + }, + { + name: "no conflicts, status was already False", + conflicts: nil, + initialConflict: metav1.ConditionFalse, + existingConfigMap: cmFalse, + expectNoWrite: true, + }, + { + name: "conflicts present, status was already True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + }, + }, + }, + initialConflict: metav1.ConditionTrue, + existingConfigMap: cmTrue, + expectNoWrite: true, + }, + { + name: "no conflicts, status changes from True to False", + conflicts: nil, + initialConflict: metav1.ConditionTrue, + existingConfigMap: cmTrue, + expectConfigMapData: map[string]string{ + "conflictsPresent": "False", + }, + }, + { + name: "conflicts appear, status changes from False to True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + }, + }, + }, + initialConflict: metav1.ConditionFalse, + existingConfigMap: cmFalse, + expectConfigMapData: map[string]string{ + "conflictsPresent": "True", + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, ctx := ktesting.NewTestContext(t) + + var fakeClient *fake.Clientset + if tt.existingConfigMap != nil { + fakeClient = fake.NewClientset(tt.existingConfigMap) + } else { + fakeClient = fake.NewClientset() + } + + labelCache := &fakeVolumeCache{ + conflictsToSend: tt.conflicts, + } + + c := &SELinuxConflictsReporterController{ + kubeClient: fakeClient, + conflictCounter: labelCache, + previousConflicts: tt.initialConflict, + } + + c.reportSELinuxConflicts(ctx) + + if tt.expectNoWrite { + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if tt.existingConfigMap != nil { + // The ConfigMap should still exist unchanged. + if err != nil { + t.Fatalf("expected ConfigMap to exist, got error: %v", err) + } + if cm.Data["conflictsPresent"] != tt.existingConfigMap.Data["conflictsPresent"] { + t.Errorf("ConfigMap data changed unexpectedly: got %v, want %v", cm.Data, tt.existingConfigMap.Data) + } + } else { + if err == nil || !apierrors.IsNotFound(err) { + t.Fatalf("expected ConfigMap to not exist, got error: %v", err) + } + } + return + } + + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get ConfigMap: %v", err) + } + for key, expectedValue := range tt.expectConfigMapData { + if cm.Data[key] != expectedValue { + t.Errorf("ConfigMap data[%q] = %q, want %q", key, cm.Data[key], expectedValue) + } + } + }) + } +} + +func TestApplySELinuxConflictsConfigMap(t *testing.T) { + cmTrue := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "True", + }, + } + cmFalse := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "False", + }, + } + tests := []struct { + name string + existingConfigMap *v1.ConfigMap + conflictsPresent metav1.ConditionStatus + expectData map[string]string + }{ + { + name: "creates ConfigMap when it does not exist", + conflictsPresent: metav1.ConditionTrue, + expectData: map[string]string{ + "conflictsPresent": "True", + }, + }, + { + name: "patches ConfigMap when it already exists", + existingConfigMap: cmFalse, + conflictsPresent: metav1.ConditionTrue, + expectData: map[string]string{ + "conflictsPresent": string(metav1.ConditionTrue), + }, + }, + { + name: "patches ConfigMap from True to False", + existingConfigMap: cmTrue, + conflictsPresent: metav1.ConditionFalse, + expectData: map[string]string{ + "conflictsPresent": "False", + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + ctx := context.Background() + + var fakeClient *fake.Clientset + if tt.existingConfigMap != nil { + fakeClient = fake.NewClientset(tt.existingConfigMap) + } else { + fakeClient = fake.NewClientset() + } + + c := &SELinuxConflictsReporterController{ + kubeClient: fakeClient, + // the rest of the struct is not used in this test + } + + err := c.applySELinuxConflictsConfigMap(ctx, tt.conflictsPresent) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get ConfigMap: %v", err) + } + for key, expectedValue := range tt.expectData { + if cm.Data[key] != expectedValue { + t.Errorf("ConfigMap data[%q] = %q, want %q", key, cm.Data[key], expectedValue) + } + } + }) + } +} + +func TestGetConflicts(t *testing.T) { + tests := []struct { + name string + conflicts map[cache.ObjectName][]volumecache.Conflict + expected metav1.ConditionStatus + }{ + { + name: "no conflicts returns False", + conflicts: nil, + expected: metav1.ConditionFalse, + }, + { + name: "empty conflicts returns False", + conflicts: map[cache.ObjectName][]volumecache.Conflict{}, + expected: metav1.ConditionFalse, + }, + { + name: "one conflict returns True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + Pod: cache.ObjectName{Namespace: "ns1", Name: "pod1"}, + PropertyValue: ":::s0:c1,c2", + OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod2"}, + OtherPropertyValue: ":::s0:c98,c99", + }, + }, + }, + expected: metav1.ConditionTrue, + }, + { + name: "multiple conflicts returns True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + {PropertyName: "SELinuxLabel"}, + }, + {Namespace: "ns1", Name: "pod2"}: { + {PropertyName: "SELinuxLabel"}, + {PropertyName: "SELinuxChangePolicy"}, + }, + }, + expected: metav1.ConditionTrue, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, ctx := ktesting.NewTestContext(t) + logger := ktesting.NewLogger(t, ktesting.NewConfig()) + _ = ctx + + labelCache := &fakeVolumeCache{ + conflictsToSend: tt.conflicts, + } + + c := &SELinuxConflictsReporterController{ + conflictCounter: labelCache, + } + + got := c.getConflicts(logger) + if got != tt.expected { + t.Errorf("getConflicts() = %v, want %v", got, tt.expected) + } + }) + } +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go index 53c08d1f6a..488a19161d 100644 --- a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go @@ -380,6 +380,13 @@ func (c *Controller) Run(ctx context.Context, workers int) { wait.UntilWithContext(ctx, c.runWorker, time.Second) }) } + + seLinuxConflictsReporterController := NewSELinuxConflictsReporterController(c.kubeClient, c.labelCache) + wg.Go(func() { + defer utilruntime.HandleCrash() + seLinuxConflictsReporterController.Run(ctx) + }) + <-ctx.Done() } diff --git a/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go b/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go index 434781ba97..b09d7fe484 100644 --- a/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go +++ b/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go @@ -9,6 +9,7 @@ var ( RouteExternalCertificate featuregate.Feature = "RouteExternalCertificate" MinimumKubeletVersion featuregate.Feature = "MinimumKubeletVersion" StoragePerformantSecurityPolicy featuregate.Feature = "StoragePerformantSecurityPolicy" + SELinuxMountGAReadiness featuregate.Feature = "SELinuxMountGAReadiness" ) // registerOpenshiftFeatures injects openshift-specific feature gates @@ -25,8 +26,13 @@ func registerOpenshiftFeatures() { defaultVersionedKubernetesFeatureGates[StoragePerformantSecurityPolicy] = featuregate.VersionedSpecs{ {Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha}, } + // Introduced in 5.0 + defaultVersionedKubernetesFeatureGates[SELinuxMountGAReadiness] = featuregate.VersionedSpecs{ + {Version: version.MustParse("1.35"), Default: false, PreRelease: featuregate.Alpha}, + } defaultKubernetesFeatureGateDependencies[RouteExternalCertificate] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[MinimumKubeletVersion] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[StoragePerformantSecurityPolicy] = []featuregate.Feature{} + defaultKubernetesFeatureGateDependencies[SELinuxMountGAReadiness] = []featuregate.Feature{} } diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index 994e716a28..ddcafd16ae 100644 --- a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -606,6 +606,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("pods").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("csidrivers").RuleOrDie(), + // RBAC cannot restrict `create` by resourceName, so adding a generic rule to allow creation of any ConfigMap + rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), + // ... and allow patching only of the selinux-conflicts ConfigMap + rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("configmaps").Names("selinux-conflicts").RuleOrDie(), }, }) } diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml index 88459b2652..3e90cc424a 100644 --- a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml +++ b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml @@ -1465,6 +1465,20 @@ items: - get - list - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - apiGroups: + - "" + resourceNames: + - selinux-conflicts + resources: + - configmaps + verbs: + - patch - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md b/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md index 73e3761674..2605dbd3dd 100644 --- a/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md +++ b/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md @@ -184,6 +184,7 @@ | RuntimeClassInImageCriApi | | | 1.29– | | | | | [code](https://cs.k8s.io/?q=%5CbRuntimeClassInImageCriApi%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbRuntimeClassInImageCriApi%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxChangePolicy | :ballot_box_with_check: 1.33+ | :closed_lock_with_key: 1.36+ | 1.32 | 1.33–1.35 | 1.36– | | | [code](https://cs.k8s.io/?q=%5CbSELinuxChangePolicy%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxChangePolicy%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxMount | | | 1.30–1.32 | 1.33– | | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMount%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMount%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | +| SELinuxMountGAReadiness | | | 1.35– | | | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMountGAReadiness%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMountGAReadiness%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxMountReadWriteOncePod | :ballot_box_with_check: 1.28+ | :closed_lock_with_key: 1.36+ | 1.25–1.26 | 1.27–1.35 | 1.36– | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMountReadWriteOncePod%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMountReadWriteOncePod%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SchedulerAsyncAPICalls | | | | 1.34– | | | | [code](https://cs.k8s.io/?q=%5CbSchedulerAsyncAPICalls%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSchedulerAsyncAPICalls%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SchedulerAsyncPreemption | :ballot_box_with_check: 1.33+ | | 1.32 | 1.33– | | | | [code](https://cs.k8s.io/?q=%5CbSchedulerAsyncPreemption%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSchedulerAsyncPreemption%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | From e0397bb794f229a16abbc1223eccd9975e78d3cd Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:20:43 +0000 Subject: [PATCH 4/7] update microshift/vendor --- .../managementcpusoverride/admission.go | 26 +---- .../selinuxwarning/cache/openshift_patch.go | 18 ++++ .../openshift_upgrade_controller.go | 102 ++++++++++++++++++ .../selinux_warning_controller.go | 7 ++ .../pkg/features/openshift_features.go | 6 ++ .../rbac/bootstrappolicy/controller_policy.go | 4 + 6 files changed, 139 insertions(+), 24 deletions(-) create mode 100644 vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go create mode 100644 vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go diff --git a/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go b/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go index 9bf0a1f8a1..530639815a 100644 --- a/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go +++ b/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go @@ -17,7 +17,6 @@ import ( "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission/initializer" @@ -187,16 +186,6 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return admission.NewForbidden(attr, fmt.Errorf("%s node or namespace or infra config cache not synchronized", PluginName)) } - nodes, err := a.nodeLister.List(labels.Everything()) - if err != nil { - return admission.NewForbidden(attr, err) // can happen due to informer latency - } - - // we still need to have nodes under the cluster to decide if the management resource enabled or not - if len(nodes) == 0 { - return admission.NewForbidden(attr, fmt.Errorf("%s the cluster does not have any nodes", PluginName)) - } - clusterInfra, err := a.infraConfigLister.Get(infraClusterName) if err != nil { return admission.NewForbidden(attr, err) // can happen due to informer latency @@ -215,7 +204,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri } // Check if we are in CPU Partitioning mode for AllNodes - if !isCPUPartitioning(clusterInfra.Status, nodes, workloadType) { + if !isCPUPartitioning(clusterInfra.Status) { return nil } @@ -284,18 +273,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return nil } -func isCPUPartitioning(infraStatus configv1.InfrastructureStatus, nodes []*corev1.Node, workloadType string) bool { - // If status is not for CPU partitioning and we're single node we also check nodes to support upgrade event - // TODO: This should not be needed after 4.13 as all clusters after should have this feature on at install time, or updated by migration in NTO. - if infraStatus.CPUPartitioning != configv1.CPUPartitioningAllNodes && infraStatus.ControlPlaneTopology == configv1.SingleReplicaTopologyMode { - managedResource := fmt.Sprintf("%s.%s", workloadType, containerWorkloadResourceSuffix) - for _, node := range nodes { - // We only expect a single node to exist, so we return on first hit - if _, ok := node.Status.Allocatable[corev1.ResourceName(managedResource)]; ok { - return true - } - } - } +func isCPUPartitioning(infraStatus configv1.InfrastructureStatus) bool { return infraStatus.CPUPartitioning == configv1.CPUPartitioningAllNodes } diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go new file mode 100644 index 0000000000..d0c66ab8de --- /dev/null +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go @@ -0,0 +1,18 @@ +package cache + +type ConflictCounter interface { + GetConflictCount() int +} + +var _ ConflictCounter = &volumeCache{} + +func (c *volumeCache) GetConflictCount() int { + c.mutex.RLock() + defer c.mutex.RUnlock() + + conflictCount := 0 + for _, conflicts := range c.conflicts { + conflictCount += len(conflicts) + } + return conflictCount +} diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go new file mode 100644 index 0000000000..39eeb9853c --- /dev/null +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go @@ -0,0 +1,102 @@ +package selinuxwarning + +import ( + "context" + "fmt" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + utilfeature "k8s.io/apiserver/pkg/util/feature" + applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1" + clientset "k8s.io/client-go/kubernetes" + "k8s.io/klog/v2" + "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" + "k8s.io/kubernetes/pkg/features" +) + +const ( + checkInterval = 30 * time.Second + configMapNamespace = "openshift-config" + configMapName = "selinux-conflicts" + fieldManager = "selinux-conflicts-reporter" +) + +type SELinuxConflictsReporterController struct { + kubeClient clientset.Interface + conflictCounter cache.ConflictCounter + previousConflicts metav1.ConditionStatus +} + +func NewSELinuxConflictsReporterController(kubeClient clientset.Interface, volumeCache cache.VolumeCache) *SELinuxConflictsReporterController { + return &SELinuxConflictsReporterController{ + kubeClient: kubeClient, + // Ugly retype to avoid more carry patches in Kubernetes code. + // We added ConflictCounter in cache/openshift_patch.go, + // therefore we know that VolumeCache implements it. + conflictCounter: volumeCache.(cache.ConflictCounter), + previousConflicts: metav1.ConditionUnknown, + } +} + +func (c *SELinuxConflictsReporterController) Run(ctx context.Context) { + logger := klog.FromContext(ctx) + if !utilfeature.DefaultFeatureGate.Enabled(features.SELinuxMountGAReadiness) { + logger.V(2).Info("SELinuxMountGAReadiness feature gate is disabled, not starting OpenShift SELinux conflicts reporter") + return + } + logger.V(2).Info("Starting OpenShift SELinux conflicts reporter") + timer := time.NewTimer(checkInterval) + defer timer.Stop() + for { + select { + case <-ctx.Done(): + return + case <-timer.C: + c.reportSELinuxConflicts(ctx) + timer.Reset(checkInterval) + } + } +} + +func (c *SELinuxConflictsReporterController) reportSELinuxConflicts(ctx context.Context) { + logger := klog.FromContext(ctx) + logger.V(4).Info("Checking for SELinux conflicts") + + currentConflicts := c.getConflicts(logger) + if currentConflicts == c.previousConflicts { + logger.V(4).Info("SELinux conflict status did not change since last check") + return + } + logger.V(4).Info("SELinux conflict status changed, updating the config map") + if err := c.applySELinuxConflictsConfigMap(ctx, currentConflicts); err != nil { + logger.Error(err, "Error saving conflicts config map") + // To keep it simple: no exponential backoff try again in the next iteration. + return + } + logger.V(2).Info("SELinux conflict updated", "Conflicts", currentConflicts) + c.previousConflicts = currentConflicts +} + +func (c *SELinuxConflictsReporterController) getConflicts(logger klog.Logger) metav1.ConditionStatus { + conflictsCount := c.conflictCounter.GetConflictCount() + if conflictsCount > 0 { + logger.V(4).Info("Found SELinux-conflicting pods", "conflictsCount", conflictsCount) + return metav1.ConditionTrue + } + logger.V(4).Info("Found no SELinux-conflicting pods") + return metav1.ConditionFalse +} + +func (c *SELinuxConflictsReporterController) applySELinuxConflictsConfigMap(ctx context.Context, conflictsPresent metav1.ConditionStatus) error { + cm := applyconfigurationscorev1.ConfigMap(configMapName, configMapNamespace). + WithData(map[string]string{ + "conflictsPresent": string(conflictsPresent), + }).WithAnnotations(map[string]string{ + "Description": "This config map is used to report presence of SELinux conflicts from kube-controller-manager to storage Upgradeable condition in OpenShift 5.0", + }) + _, err := c.kubeClient.CoreV1().ConfigMaps(configMapNamespace).Apply(ctx, cm, metav1.ApplyOptions{FieldManager: fieldManager, Force: true}) + if err != nil { + return fmt.Errorf("error applying config map %s: %w", configMapName, err) + } + return nil +} diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go index 53c08d1f6a..488a19161d 100644 --- a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go @@ -380,6 +380,13 @@ func (c *Controller) Run(ctx context.Context, workers int) { wait.UntilWithContext(ctx, c.runWorker, time.Second) }) } + + seLinuxConflictsReporterController := NewSELinuxConflictsReporterController(c.kubeClient, c.labelCache) + wg.Go(func() { + defer utilruntime.HandleCrash() + seLinuxConflictsReporterController.Run(ctx) + }) + <-ctx.Done() } diff --git a/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go b/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go index 434781ba97..b09d7fe484 100644 --- a/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go +++ b/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go @@ -9,6 +9,7 @@ var ( RouteExternalCertificate featuregate.Feature = "RouteExternalCertificate" MinimumKubeletVersion featuregate.Feature = "MinimumKubeletVersion" StoragePerformantSecurityPolicy featuregate.Feature = "StoragePerformantSecurityPolicy" + SELinuxMountGAReadiness featuregate.Feature = "SELinuxMountGAReadiness" ) // registerOpenshiftFeatures injects openshift-specific feature gates @@ -25,8 +26,13 @@ func registerOpenshiftFeatures() { defaultVersionedKubernetesFeatureGates[StoragePerformantSecurityPolicy] = featuregate.VersionedSpecs{ {Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha}, } + // Introduced in 5.0 + defaultVersionedKubernetesFeatureGates[SELinuxMountGAReadiness] = featuregate.VersionedSpecs{ + {Version: version.MustParse("1.35"), Default: false, PreRelease: featuregate.Alpha}, + } defaultKubernetesFeatureGateDependencies[RouteExternalCertificate] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[MinimumKubeletVersion] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[StoragePerformantSecurityPolicy] = []featuregate.Feature{} + defaultKubernetesFeatureGateDependencies[SELinuxMountGAReadiness] = []featuregate.Feature{} } diff --git a/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index 994e716a28..ddcafd16ae 100644 --- a/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -606,6 +606,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("pods").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("csidrivers").RuleOrDie(), + // RBAC cannot restrict `create` by resourceName, so adding a generic rule to allow creation of any ConfigMap + rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), + // ... and allow patching only of the selinux-conflicts ConfigMap + rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("configmaps").Names("selinux-conflicts").RuleOrDie(), }, }) } From dc3d4ff3f120f00bd470ffe591ff123e1eea3256 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:20:49 +0000 Subject: [PATCH 5/7] update component images --- packaging/crio.conf.d/10-microshift_amd64.conf | 2 +- packaging/crio.conf.d/10-microshift_arm64.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf index ae8b830aa9..fc0589f7c1 100644 --- a/packaging/crio.conf.d/10-microshift_amd64.conf +++ b/packaging/crio.conf.d/10-microshift_amd64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:046dee0e64bb32cdb9d34b43abc4c1b8f2d1700e2243e3812b759e1436677c9b" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a06e05a7c16e5c88ab85d4dba0d3f3079a88d79ab4bd56f399dc99e42d00114e" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf index 22790acdd0..edd9932b20 100644 --- a/packaging/crio.conf.d/10-microshift_arm64.conf +++ b/packaging/crio.conf.d/10-microshift_arm64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a3aba52ab6f516a28f1423d2f71e9e3320d8486a266ca0e8430e47b77c38de9c" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:af7d1eda52ed6482a89beb8dbc9a2a1ace3e8d37e6ac7d702dfc9522a2ae3645" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" From 65e12177a9e1cda7051de000c1c264f77a7d0657 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:21:09 +0000 Subject: [PATCH 6/7] update manifests --- .../multus/kustomization.aarch64.yaml | 4 ++-- .../multus/kustomization.x86_64.yaml | 4 ++-- .../multus/release-multus-aarch64.json | 6 +++--- .../multus/release-multus-x86_64.json | 6 +++--- assets/components/service-ca/deployment.yaml | 9 +++++++-- .../kustomization.aarch64.yaml | 10 +++++----- .../kustomization.x86_64.yaml | 10 +++++----- .../release-olm-aarch64.json | 8 ++++---- .../release-olm-x86_64.json | 8 ++++---- assets/release/release-aarch64.json | 18 +++++++++--------- assets/release/release-x86_64.json | 18 +++++++++--------- 11 files changed, 53 insertions(+), 48 deletions(-) diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml index 2df3672ef8..8fc857565c 100644 --- a/assets/components/multus/kustomization.aarch64.yaml +++ b/assets/components/multus/kustomization.aarch64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:a0c089dbbd138b47d7467ce50d0ea3eff60bff9674a34d429078118eeabb78a3 + digest: sha256:85919fe552e926b3bb63a5bc784d96f4a000263723fe021b09d810eef6babcc9 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:1557d1200e7c7c8672f9cd9fa145874d43967f61f798f27894f643d5b857b99a + digest: sha256:2221dd09a30f4348dfa71186dfacf17b5e9dfce61e61fff86a32143cde08cfb6 diff --git a/assets/components/multus/kustomization.x86_64.yaml b/assets/components/multus/kustomization.x86_64.yaml index 234e0862de..2f092b2aa3 100644 --- a/assets/components/multus/kustomization.x86_64.yaml +++ b/assets/components/multus/kustomization.x86_64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:29f31422d6d637e350f99a58001ef8929cb151497ccc4d4f128d3b408812f635 + digest: sha256:c842055e8fb0b336134f0a17a1f608407271eaa9b3eedba7019ff69a87768556 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c63df61df4155fb06d9da879bb7d0e96b5e34161e1ad78e43e87d0690fcae29a + digest: sha256:70e5da8d51a31ecf11751cd26714e8d4735c5396aa07c8e05b7e108317c7fc0f diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index da7ab1020d..dc6dc9b74a 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-28-013859" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a0c089dbbd138b47d7467ce50d0ea3eff60bff9674a34d429078118eeabb78a3", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1557d1200e7c7c8672f9cd9fa145874d43967f61f798f27894f643d5b857b99a" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:85919fe552e926b3bb63a5bc784d96f4a000263723fe021b09d810eef6babcc9", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2221dd09a30f4348dfa71186dfacf17b5e9dfce61e61fff86a32143cde08cfb6" } } diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index eee6612c5f..75b9e9dae6 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:29f31422d6d637e350f99a58001ef8929cb151497ccc4d4f128d3b408812f635", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c63df61df4155fb06d9da879bb7d0e96b5e34161e1ad78e43e87d0690fcae29a" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c842055e8fb0b336134f0a17a1f608407271eaa9b3eedba7019ff69a87768556", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:70e5da8d51a31ecf11751cd26714e8d4735c5396aa07c8e05b7e108317c7fc0f" } } diff --git a/assets/components/service-ca/deployment.yaml b/assets/components/service-ca/deployment.yaml index f51d49b47d..a9dfd43a7a 100644 --- a/assets/components/service-ca/deployment.yaml +++ b/assets/components/service-ca/deployment.yaml @@ -29,6 +29,8 @@ spec: image: '{{ .ReleaseImage.service_ca_operator }}' imagePullPolicy: IfNotPresent command: ["service-ca-operator", "controller"] + args: + - -v=2 ports: - containerPort: 8443 securityContext: @@ -45,8 +47,8 @@ spec: name: signing-key - mountPath: /var/run/configmaps/signing-cabundle name: signing-cabundle - args: - - -v=2 + - mountPath: /var/run/configmaps/config + name: config volumes: - name: signing-key secret: @@ -54,6 +56,9 @@ spec: - name: signing-cabundle configMap: name: '{{.CAConfigMap}}' + - name: config + configMap: + name: service-ca-controller-config nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: "system-cluster-critical" diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml index cec9490c75..f26177f3d3 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684 + digest: sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c + digest: sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5 + digest: sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4 patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index 139b453dee..cd15c1bbe5 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5 + digest: sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd + digest: sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb + digest: sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index fbad187d45..e6c62c9ea4 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-28-013859" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4" } } diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index 2e22dd7e93..33e477a8b8 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d" } } diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 3c4ef3df31..382a979147 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,16 +1,16 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-28-013859" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:aa5ae933124990ac8342023e51870cf4d07884243e09afaf62417a0363a9729d", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3bd36df30411a20a17e54c90ccf9d993832da0ada367da6e0c3f28a83216f879", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:15e8952c1875922024db7b12af4990488d129afb1c25b7c5a653e830e0ec28f3", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:38885d2ed82f8089323768d6afffd298e8779dc440d88e91a97fab1d9310d486", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a3aba52ab6f516a28f1423d2f71e9e3320d8486a266ca0e8430e47b77c38de9c", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:648ad75c87d184155041dcd9cc76e135aea9050c07779edb473e26bd87342f19", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f7cb5d87e0b826160edc35a0ed813551a463b9cda619f88c52030d9af15cb9ad", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6026964193896041f8082e1bc52163f6cd4e5defaa4649065fdf9f57d3d242cf", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:84f7478bcdb2b51c86de69c32f331548c2954ea0a8e74a354170c7b7a9905595", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:acd76168e5bb8ca2e440c094635f3fa6a76adf88b4851deb1bd0a5e8ec2a631d", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:af7d1eda52ed6482a89beb8dbc9a2a1ace3e8d37e6ac7d702dfc9522a2ae3645", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3ac6a8f8b3a19e5f8c3bd5cc5baba88ab995126fa85f47fb0e270231a7972572", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:94fbbcfffd5a5503f3ea5ab43f13c325c3765c33db2b4e5d040c07ded10f8c6e" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ed566ae901111b0024ea140b465fd8bee3a715b076158d1dca8f7fef021c01ac" } } diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index f2adf17ca3..fbf9c008d7 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,16 +1,16 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:45188944bb589e9b3fd88bd175a18b9414a2ba070e2a08a3964e22ceedaf2955", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f8333c52e3b4ec5d1575a31276b9600f173ddda7d6f1a0cb11f0d364fe5be29a", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9d40caf7c3a21b802c6632cf968b8c17f5bb756b6ff0564b77ee2dc9898e38f3", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e05f31e81de47bfb323c9015b117bf2dcf34abb56d7effcd43513378ef45aae6", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:046dee0e64bb32cdb9d34b43abc4c1b8f2d1700e2243e3812b759e1436677c9b", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:dcdfe8696ab6c9c7098e3ea2d297af47b68e91eac931364e13e46edd28b2a479", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:373c5709b7eac974fefd22d89cda216ce4b30f868c98fb9b26351d42851e4010", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f54a97c16dd55b83327995023af7904ed514b323cab568e553f432c1bebc7032", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:166dfd0bc984dc8ee691c5b440709334b83e0f62bfce1b7f8d60b150b9ea1130", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ff75b5440fc26ced06555c6ccbabe8f87afad4cdf3cff3961fea54c6f4912140", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a06e05a7c16e5c88ab85d4dba0d3f3079a88d79ab4bd56f399dc99e42d00114e", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:beec432b521d8612c03ea2ad1ab0267d3364f548f9340d7cd33e36d26d4dbe1f", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f0631a7e1e3aa1cf6ac01df7a7b0b8ce5f5ad333e2efc8f4599b4428a6d54c22" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:de20dccefd1015990c54cdd990f73c876dc03222adf777c871965a46dd840f0a" } } From d994337c5ee88c50e7cc6b7f7f530b78b1f20e3e Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 04:21:17 +0000 Subject: [PATCH 7/7] update buildfiles --- Makefile.kube_git.var | 2 +- Makefile.version.aarch64.var | 2 +- Makefile.version.x86_64.var | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile.kube_git.var b/Makefile.kube_git.var index 64a966edca..c2fb5b4650 100644 --- a/Makefile.kube_git.var +++ b/Makefile.kube_git.var @@ -1,5 +1,5 @@ KUBE_GIT_MAJOR=1 KUBE_GIT_MINOR=36 KUBE_GIT_VERSION=v1.36.2 -KUBE_GIT_COMMIT=98b35193b2ac7a23a673325f5e9b830ecd5ba406 +KUBE_GIT_COMMIT=63ee93dac28329fd9d81e91b21ea8d8c43105d01 KUBE_GIT_TREE_STATE=clean diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index 1b287e6e86..2e233a2d99 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-27-004356 +OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-28-013859 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index cf840335be..d33cd31d5f 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-2026-07-23-224236 +OCP_VERSION := 5.0.0-0.nightly-2026-07-27-053720