From a1f5c353565f7cac75dd3137990d27c086bbcfbf Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:18:18 +0000 Subject: [PATCH 1/8] update last_rebase.sh --- scripts/auto-rebase/last_rebase.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 258fd5c26e..40945132a2 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-23-224236" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-27-004356" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-07-27-053720" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-07-29-013859" From ccea42935a1dcfe50f6e8e4c1956cefc3603e186 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:18:24 +0000 Subject: [PATCH 2/8] update changelog --- scripts/auto-rebase/changelog.txt | 143 +++++++++++++++++++++++++++--- scripts/auto-rebase/commits.txt | 34 +++---- 2 files changed, 149 insertions(+), 28 deletions(-) diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 00dd54e0f4..a1ffa36f65 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,7 +1,65 @@ -- oc image-arm64 994613040335f72809854babcb80b9d11a4e98d5 to a88e785e90aa96ac96da93359bacf3ea5c174733 +- api embedded-component 581cfdf7198613bd325c185eb3eac672670da633 to 9bcaa16cb258e544dd76b78ff2dc3f89af840f76 + - ffbad1d3 2026-07-24T12:14:11+01:00 Check all hypershift variants when the featuregate is not platform specific + - 3199351b 2026-07-22T14:28:51+02:00 machineconfiguration/v1: add BGPVIPPeersJSON to ControllerConfigSpec + - b0927431 2026-07-22T14:28:49+02:00 config/v1: add BGPBasedVIPManagement feature gate and VIPManagement field + - 5bd0b76d 2026-07-21T09:05:02-05:00 NodeUID in status to detect replaced node with same name + - 91ec72c6 2026-07-21T15:06:54+03:00 Align with latest beta API of Vault + - a1e80c1b 2026-07-09T10:56:50+02:00 Promote OLMLifecycleAndCompatibility feature gate to Default + +- cluster-csi-snapshot-controller-operator embedded-component ef7a4c8b7f5c5e6cba4486dcc37f50521e7bc655 to 67648d56d6b312e661714f8e7bf0e9be1d532c1c + - ab3ec5d 2026-07-21T15:24:21+02:00 Bump all deps for 5.0.0 + +- cluster-ingress-operator embedded-component b4daff58712de418c51d765a8686069a5f47e764 to d7aafd957d1c126f5241ab716ad55ad0d160c042 + - a5c99e25 2026-06-23T14:17:24+01:00 OCPBUGS-90616: Add GRPCRoute to Gateway API e2e CRD test coverage + +- cluster-kube-apiserver-operator embedded-component ea8a9c50203113ca43db98ca925ab7fcdaff7d28 to dab04ebace1a4b36bb40e8f4f87804754b69760b + - 09ea0d5 2026-07-24T16:22:19+03:00 Update openshift/* + - 8dfb4f8 2026-07-24T05:27:15-04:00 pkg/operator: add KMS plugin sidecar revision readiness check + - 050afcf 2026-07-23T15:52:02+02:00 NO-JIRA: Automatic agentic rebase: Update library-go to d8f45c2 + - df010b0 2026-07-23T12:17:46+05:30 Add KMS key ID identifier + +- cluster-network-operator embedded-component 4f6fb6be829a2f6ad3e0df4ab85ecb00ef028343 to 00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63 + - e538c9c 2026-07-23T15:10:03-04:00 Register PKI controller through AddToManager + - e7e9bf0 2026-07-23T14:57:58-04:00 Bound PKI informer cache sync with a timeout + - 60cedaf 2026-07-23T13:48:45-04:00 Use keyutil.ParsePrivateKeyPEM for private key decoding + - 262103b 2026-07-23T13:11:47-04:00 Enable configurable PKI for managed certificate rotation + - dfb8dd5 2026-07-23T15:40:27Z Revert "Merge pull request #2925 from OlivierCazade/day0" + - 17f08a7 2026-07-22T11:44:23-04:00 ovn-kubernetes: Move MNP from ConfigMap to CLI flags + - 79bbb49 2026-07-15T09:43:13Z Bump frr-k8s MAX_FDS from 1024 to 65536 + - 9c178ed 2026-04-28T16:16:58+02:00 CORENET-6581: Add transport label to CUDN telemetry recording rule + +- kubernetes embedded-component 98b35193b2ac7a23a673325f5e9b830ecd5ba406 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 + - 44a83e00e 2026-07-17T15:00:07+02:00 UPSTREAM: : hack/update-featuregates.sh + - 4da08ff19 2026-07-17T08:27:41+02:00 UPSTREAM: : Store SELinuxWarningController upgrade check as a ConfigMap + - 13ace3c70 2026-07-02T02:25:02-04:00 UPSTREAM: : upkeep cpu partitioning admission webhook + +- machine-config-operator embedded-component 067b924f19a64a209796d5be5a0a63665f53b1eb to 3b4a5c7d9fa127981c57efac6fa29bc76eac019d + - 08f5b4e1 2026-07-24T11:30:29Z Thread context through syncHandler instead of storing it in Controller + - c4fb4794 2026-07-24T11:30:29Z Propagate context to InspectStreamClass for shutdown cancellation + - 92bdeffb 2026-07-24T11:30:29Z Add unit tests for validateNoRuncOnRHEL10FromOSImageURL + - 3c6b0fcd 2026-07-24T11:30:29Z Inline runcBlockedError into its callers + - a0e361e2 2026-07-24T11:30:29Z Move validateNoRuncOnRHEL10FromOSImageStream out of generateRenderedMachineConfig + - cd031001 2026-07-24T11:30:29Z Decouple validateNoRuncOnRHEL10FromOSImageURL from Controller + - 46c64391 2026-07-24T11:30:29Z Rename runc validation functions for clarity + - ec249e54 2026-07-24T11:30:29Z TBD + - b5fe45d5 2026-07-24T08:59:10Z NO-ISSUE: extended tests, restore initial maxUnavailable when modified + - bd1f9660 2026-07-23T16:08:26+05:30 Add TC 88940: Apply password only if changes exist + - 173915e5 2026-07-23T09:54:18Z NO-ISSUE: add AWS marketplace polarion ID test + - 75e3bbca 2026-07-22T14:46:03-04:00 Surface MOSB build status on paused MCPs, added e2e tests to test the behavior, and refined non-paused pool reporting + - 9278288f 2026-07-22T15:13:16+02:00 CNTRLPLANE-3840: Remove ExternalTopologyMode guard from OSImageStream bootstrap + - 54982a74 2026-07-21T19:36:43+05:30 Add unit tests for osImageStream label skip logic in boot image controller + - b68a7440 2026-07-17T08:10:43Z MCO-2184: Adapt scale extended tests to support osstreams + +- service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 + - 9ad2f83 2026-07-24T17:31:07-04:00 Bump github.com/openshift/build-machinery-go + - 11a6d83 2026-07-23T13:23:29+02:00 feat: inject centralized TLS into service-ca operand + - 843f71b 2026-07-22T14:39:22+02:00 chore: sync deps + - 195ba0b 2026-06-06T22:21:50Z Updating ose-service-ca-operator-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/7691ed4dc0b6585b358f9e73fb736ace9a48a286/images/ose-service-ca-operator.yml + +- oc image-amd64 994613040335f72809854babcb80b9d11a4e98d5 to a88e785e90aa96ac96da93359bacf3ea5c174733 - a88e785e 2026-07-23T20:40:27Z RFE-8595: must-gather: add client-side keep-alive to prevent accessTokenInactivityTimeout failures (#2288) -- router image-arm64 0c4063da30da6091765e2576efc684d0f020918d to 682319a1bb432f0203951c33336d0f55947e1099 +- router image-amd64 f5b67ebd12089170bfc47da7745fe4efb1477eb7 to 682319a1bb432f0203951c33336d0f55947e1099 - c15a20a 2026-07-25T20:02:34Z Revert "OCPBUGS-77056: Make external cert validation asynchronous (Resurrection)" - da1c969 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Use a short, unique prefix for fake-haproxy test sockets - 6f2aacc 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Update vendor to remove unused authorizationutil reference @@ -16,26 +74,89 @@ - 7b4b855 2026-07-23T10:29:40-04:00 Remove library-go replace directive and update vendor - 277913c 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Retry on write conflicts without dropping writerlease - bc97dba 2026-07-23T10:29:40-04:00 OCPBUGS-77056: Asynchronous external certificate validation and Hybrid Informer secret monitoring - - 74b6915 2026-07-22T11:50:03-04:00 NE-2741: Align vendored openshift/api with the master branch version - - deb1d50 2026-07-22T11:21:18-04:00 NE-2741: Address PR comments on TLS curve preference parsing - - 7f33917 2026-07-22T11:21:18-04:00 Security: fail-closed on unsupported TLS curves and parse mixed delimiters - - da031dd 2026-07-22T11:21:18-04:00 Fix: shorten fake-haproxy socket path in tests to avoid length limits - - ef67e22 2026-07-22T11:21:18-04:00 NE-2741: Implement TLS Curves Support for Metrics Endpoints - 6ebff4e 2026-07-20T21:03:15-04:00 NE-2223: Bump HAProxy to 3.2.19 in the router image - 400eac8 2026-06-15T16:09:07-03:00 NO-JIRA: Add default coderabbit for the repo -- ovn-kubernetes image-arm64 8e2e1542642847da592268a0ab94a207eb8d3605 to 88e9f0f146784e8525f6304a1f6f7c986eba2319 +- ovn-kubernetes image-amd64 8e2e1542642847da592268a0ab94a207eb8d3605 to 88e9f0f146784e8525f6304a1f6f7c986eba2319 - 3f34530b 2026-07-12T10:36:43+03:00 Update OWNERS file -- kubernetes image-arm64 0f7d1a1b66af90eece8d46f6f9dc7537bf16d978 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 +- kubernetes image-amd64 98b35193b2ac7a23a673325f5e9b830ecd5ba406 to 63ee93dac28329fd9d81e91b21ea8d8c43105d01 - 44a83e00e 2026-07-17T15:00:07+02:00 UPSTREAM: : hack/update-featuregates.sh - 4da08ff19 2026-07-17T08:27:41+02:00 UPSTREAM: : Store SELinuxWarningController upgrade check as a ConfigMap - - d178a1dbb 2026-07-17T00:54:58+05:30 UPSTREAM: 140211: Promote regression-issue-74839 to 1.5 - 13ace3c70 2026-07-02T02:25:02-04:00 UPSTREAM: : upkeep cpu partitioning admission webhook -- service-ca-operator image-arm64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 +- service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 to e260be2b3710137012814ce9ca48f155f24f0b02 - 9ad2f83 2026-07-24T17:31:07-04:00 Bump github.com/openshift/build-machinery-go - 11a6d83 2026-07-23T13:23:29+02:00 feat: inject centralized TLS into service-ca operand - 843f71b 2026-07-22T14:39:22+02:00 chore: sync deps - 195ba0b 2026-06-06T22:21:50Z Updating ose-service-ca-operator-container image to be consistent with ART for 5.0 Reconciling with https://github.com/openshift-eng/ocp-build-data/tree/7691ed4dc0b6585b358f9e73fb736ace9a48a286/images/ose-service-ca-operator.yml +- oc image-arm64 a88e785e90aa96ac96da93359bacf3ea5c174733 to fcfbd7195cbc352e5fc354f255e8c9846ac42afd + - 51c19217 2026-07-27T09:55:07-04:00 OCPBUGS-99757: Include extra scopes in OIDC token cache key + +- ovn-kubernetes image-arm64 88e9f0f146784e8525f6304a1f6f7c986eba2319 to 4c92603d97181c0315e16fa9a1e2ad9f5d323344 + - 51047fae 2026-07-17T20:27:56+05:30 sync test annotations with upstream changes + - b05c351c 2026-07-17T20:27:53+05:30 Adapt OTE for E2E L3 CUDN multisubnet backward compatibility fixes + - 70a2009b 2026-07-17T10:23:14+02:00 e2e(kubevirt): deflake "with pre-copy fails" migration test + - fa8e140a 2026-07-16T15:33:44+02:00 Fix traffic leak in egress IP on secondary interface + - 8bce7389 2026-07-16T10:32:40+02:00 node: use libovsdb instead of ovs-vsctl exec in checkPorts + - 7b2e6eb5 2026-07-16T00:32:34+02:00 ci: cover dynamic UDN allocation on a no-overlay shared-gateway lane + - 1b7e0ec0 2026-07-16T00:32:34+02:00 e2e: adapt advertised network isolation tests to dynamic UDN allocation + - 156b75f9 2026-07-16T00:32:34+02:00 e2e: adapt CUDN advertisement tests to dynamic UDN allocation + - 501cc079 2026-07-16T00:32:34+02:00 e2e: cover RouteAdvertisements over a dynamically allocated CUDN + - 8df86599 2026-07-16T00:32:34+02:00 routeadvertisements: advertise dynamic UDNs only from active nodes + - 677d6113 2026-07-15T10:03:52-07:00 clustermanager: rename node allocation controller + - 1fcfb18f 2026-07-14T16:09:34-04:00 no-overlay: host -> pods on other nodes via mp0 + - 4620cb6d 2026-07-14T10:29:15-07:00 licenses: refresh generated third-party licenses + - 8b0dd877 2026-07-14T10:29:15-07:00 cni: fold libovsdb and shell-out ConfigureOVS paths into one + - 0b276e27 2026-07-14T10:29:15-07:00 libovsdb/ops: consolidate ovs helper operations + - 49393a41 2026-07-14T16:52:06+01:00 docs: rename portSecurity to macSecurity in OKEP-3926 + - 7229c04d 2026-07-14T20:27:41+05:30 node: skip configureGlobalForwarding tests in CI without root access + - 40bd24a5 2026-07-13T17:27:35+02:00 zone_interconnect: add unit test for stale IC route cleanup + - 60fcdaf5 2026-07-10T18:56:40+02:00 Use new IPv6 force_forwarding sysctl if available. + - 0e3a4e06 2026-07-10T18:56:40+02:00 Don't change FORWARD table default policy for IPv4 + - 7795aba2 2026-07-10T18:56:40+02:00 Don't override FORWARD default policy when `disable-forwarding` is not set + - 92fc5160 2026-07-10T18:56:40+02:00 Update disable-gateway unit tests + - a90d60b6 2026-07-10T18:56:40+02:00 Clarify/simplify/fix "Disable Forwarding Config" docs + - bdfd82fb 2026-07-10T17:48:35+02:00 Redo the AllocateLoadBalancerNodePorts=false test cases + - dcaf6dba 2026-07-10T12:46:42+02:00 [perf] fix netpol selection for cudn-l2 job + - d447e853 2026-07-10T11:17:19+02:00 Support update of chassis-id without re-creating the node. + - 0c9edf05 2026-07-08T12:59:20-07:00 ovnkube.sh: unify gateway option loading from OVS external_ids + - 945f64d7 2026-07-08T10:33:19-07:00 test: Use proper TLS certificate validation in metrics server tests + - 98e204fe 2026-07-08T13:36:28+02:00 coderabbit: add pre-merge checks and custom validation rules + - e36fbadc 2026-07-07T20:23:30+02:00 Get pod from apiserver on retryable annotation patch failure + - 06f453b7 2026-07-07T08:13:37+02:00 e2e(kubevirt): replace echoserver with iperf3 + - 853a72fa 2026-07-06T15:06:48-07:00 libovsdb/ops: document ovs-vsctl equivalents on read wrappers + - e3e40f10 2026-07-06T15:06:48-07:00 util, libovsdb/ops: migrate NicToBridge to libovsdb + - 497f470f 2026-07-06T15:06:48-07:00 test/e2e: pin docker while importing libovsdb + - c1c5603e 2026-07-06T15:06:48-07:00 util, node: migrate nicstobridge read paths to libovsdb + - 258eb623 2026-07-06T15:06:48-07:00 node/test: migrate DPU and gateway tests to libovsdb harness + - 1a64e7db 2026-07-06T15:06:48-07:00 cni, node: migrate ConfigureOVS and delRepPort to libovsdb + - 3785f7bd 2026-07-06T15:06:48-07:00 node: move ovsClient to BaseNodeNetworkController + - a58ead15 2026-07-06T15:06:47-07:00 libovsdb/ops: add GetOVSInterface and CreateOrUpdatePodPort + - ff6d3a79 2026-07-06T15:06:47-07:00 node, controllermanager: migrate stale-port cleanup to libovsdb + - 65e3926d 2026-07-06T15:06:47-07:00 node, libovsdb/ops: migrate port-to-br shell-outs to libovsdb + - f1a554fd 2026-07-06T15:06:47-07:00 node: migrate br-exists and del-port br-int to libovsdb + - 1e4c92c6 2026-07-06T15:06:47-07:00 util, ovn-kube-util: migrate BridgeToNic to libovsdb + - 79cb19da 2026-07-06T15:06:47-07:00 libovsdb/ops: bridge-scope DeletePortWithInterfaces + - fdc69950 2026-07-06T15:06:47-07:00 node, libovsdb/ops: migrate del-br shell-outs to libovsdb + - 25b05aa5 2026-07-06T20:15:26+02:00 Only create ACCEPT rules for bypassing our own DROP rules + - fe9bd9f8 2026-07-06T20:15:26+02:00 Simplify initLocalGateway iptables/nftables setup + - 7683207e 2026-07-03T10:03:37+02:00 e2e(kubevirt): drop fedora coreos image in favor of fedora + - d9d3e374 2026-07-02T18:14:51+02:00 area-merge: prevent bot comment feedback loop + - 635a3fd7 2026-07-02T15:50:39+01:00 docs: add "future work" section to OKEP-3926 + - 69f3a5e7 2026-07-02T15:50:39+01:00 docs: simplify OKEP-3926 and add per-attachment future section + - 00e2aa81 2026-07-02T15:50:39+01:00 docs: add OKEP-3926 for disabling port security on secondary networks + - 4246d935 2026-07-02T17:56:19+08:00 docs: fix typo in OKEP 5193 CUDN spec + - e9ed7419 2026-07-01T15:50:28-07:00 OKEP-6227: Add DHCP IPAM support for localnet UDNs + - 78e42465 2026-07-01T10:34:35-04:00 config: make routing table ID start configurable + - b19a79d2 2026-06-30T10:59:13-04:00 Revert "Route DPU host no-overlay traffic through OVN" + - 6eac3a2e 2026-06-30T15:35:05+02:00 docs/e2e: clarify E2E backward compatibility requirements in OKEP template + - 585b72c2 2026-06-26T16:33:10+02:00 Allow networks to start while route advertisements settle + +- kubernetes image-arm64 63ee93dac28329fd9d81e91b21ea8d8c43105d01 to 553c4b53be635738c710cac86cef2a033baba526 + - de396e993 2026-07-16T15:20:30-06:00 UPSTREAM: 140377: e2e: storage snapshot tests should read custom timeouts from manifest + +- service-ca-operator image-arm64 e260be2b3710137012814ce9ca48f155f24f0b02 to 4c5aa6cf172006ca0ebc56c06fe0f2eebc23ec2d + - 2fc2708 2026-02-09T11:24:14+01:00 chore: add permissions on endpointslice to Prometheus Role and use serviceDiscoveryRole: EndpointSlice in ServiceMonitors + diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index d610a4f0c7..8f67e29164 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,35 +1,35 @@ -https://github.com/openshift/api embedded-component 581cfdf7198613bd325c185eb3eac672670da633 -https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component ef7a4c8b7f5c5e6cba4486dcc37f50521e7bc655 +https://github.com/openshift/api embedded-component 9bcaa16cb258e544dd76b78ff2dc3f89af840f76 +https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 67648d56d6b312e661714f8e7bf0e9be1d532c1c https://github.com/openshift/cluster-dns-operator embedded-component 4b8ae49940eefc50fa48da5179e735dd6ccd42d9 -https://github.com/openshift/cluster-ingress-operator embedded-component b4daff58712de418c51d765a8686069a5f47e764 -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component ea8a9c50203113ca43db98ca925ab7fcdaff7d28 +https://github.com/openshift/cluster-ingress-operator embedded-component d7aafd957d1c126f5241ab716ad55ad0d160c042 +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component dab04ebace1a4b36bb40e8f4f87804754b69760b https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 4e72164b8bc505033ad565ab01d57963e7c9688e https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 56fa325466a1f2a2d41435ba3a58b2bf8fdab2f3 -https://github.com/openshift/cluster-network-operator embedded-component 4f6fb6be829a2f6ad3e0df4ab85ecb00ef028343 +https://github.com/openshift/cluster-network-operator embedded-component 00e6cc59b92af5c8f73f9c3908ed3b0ef591bf63 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 34f95b07f4afbc47558e54e4fa2710fd692e615e https://github.com/openshift/cluster-policy-controller embedded-component 01afc4aac71a8e8be26383a0421bed7673391750 https://github.com/openshift/csi-external-snapshotter embedded-component b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/etcd embedded-component 64f8851a001f7e102d47bfe51ca0dac23951879a -https://github.com/openshift/kubernetes embedded-component 98b35193b2ac7a23a673325f5e9b830ecd5ba406 +https://github.com/openshift/kubernetes embedded-component 63ee93dac28329fd9d81e91b21ea8d8c43105d01 https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component 067b924f19a64a209796d5be5a0a63665f53b1eb +https://github.com/openshift/machine-config-operator embedded-component 3b4a5c7d9fa127981c57efac6fa29bc76eac019d https://github.com/openshift/openshift-controller-manager embedded-component 5631cf493b006cbc72a8600a7435813272d71940 https://github.com/openshift/operator-framework-olm embedded-component 56b3931de4636f7e0d212001f2074b9dddb45a8f https://github.com/openshift/route-controller-manager embedded-component 59697cf7af4517dd44e28179a57f7f35b6ea0e22 -https://github.com/openshift/service-ca-operator embedded-component 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 -https://github.com/openshift/oc image-amd64 994613040335f72809854babcb80b9d11a4e98d5 +https://github.com/openshift/service-ca-operator embedded-component e260be2b3710137012814ce9ca48f155f24f0b02 +https://github.com/openshift/oc image-amd64 a88e785e90aa96ac96da93359bacf3ea5c174733 https://github.com/openshift/coredns image-amd64 37aaba896e97f4b9a091aab6d36f2213b8854474 https://github.com/openshift/csi-external-snapshotter image-amd64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 -https://github.com/openshift/router image-amd64 f5b67ebd12089170bfc47da7745fe4efb1477eb7 +https://github.com/openshift/router image-amd64 682319a1bb432f0203951c33336d0f55947e1099 https://github.com/openshift/kube-rbac-proxy image-amd64 43c114bc124f59e2fc3223dea8e0a8f4cdeed18d -https://github.com/openshift/ovn-kubernetes image-amd64 8e2e1542642847da592268a0ab94a207eb8d3605 -https://github.com/openshift/kubernetes image-amd64 98b35193b2ac7a23a673325f5e9b830ecd5ba406 -https://github.com/openshift/service-ca-operator image-amd64 6391e070d2ab026324b032a6fa5fc7d6be0d2cb5 -https://github.com/openshift/oc image-arm64 a88e785e90aa96ac96da93359bacf3ea5c174733 +https://github.com/openshift/ovn-kubernetes image-amd64 88e9f0f146784e8525f6304a1f6f7c986eba2319 +https://github.com/openshift/kubernetes image-amd64 63ee93dac28329fd9d81e91b21ea8d8c43105d01 +https://github.com/openshift/service-ca-operator image-amd64 e260be2b3710137012814ce9ca48f155f24f0b02 +https://github.com/openshift/oc image-arm64 fcfbd7195cbc352e5fc354f255e8c9846ac42afd https://github.com/openshift/coredns image-arm64 37aaba896e97f4b9a091aab6d36f2213b8854474 https://github.com/openshift/csi-external-snapshotter image-arm64 b5e4b73f9a761ff8a59f31b982a63e1cdbb76ed8 https://github.com/openshift/router image-arm64 682319a1bb432f0203951c33336d0f55947e1099 https://github.com/openshift/kube-rbac-proxy image-arm64 43c114bc124f59e2fc3223dea8e0a8f4cdeed18d -https://github.com/openshift/ovn-kubernetes image-arm64 88e9f0f146784e8525f6304a1f6f7c986eba2319 -https://github.com/openshift/kubernetes image-arm64 63ee93dac28329fd9d81e91b21ea8d8c43105d01 -https://github.com/openshift/service-ca-operator image-arm64 e260be2b3710137012814ce9ca48f155f24f0b02 +https://github.com/openshift/ovn-kubernetes image-arm64 4c92603d97181c0315e16fa9a1e2ad9f5d323344 +https://github.com/openshift/kubernetes image-arm64 553c4b53be635738c710cac86cef2a033baba526 +https://github.com/openshift/service-ca-operator image-arm64 4c5aa6cf172006ca0ebc56c06fe0f2eebc23ec2d From e761e323cf1e0da5c395e9853cacefbbb15ea7b8 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:18:42 +0000 Subject: [PATCH 3/8] update microshift/deps --- .../managementcpusoverride/admission.go | 26 +- .../managementcpusoverride/admission_test.go | 35 +- .../selinuxwarning/cache/openshift_patch.go | 18 + .../openshift_upgrade_controller.go | 102 ++++++ .../openshift_upgrade_controller_test.go | 336 ++++++++++++++++++ .../selinux_warning_controller.go | 7 + .../pkg/features/openshift_features.go | 6 + .../rbac/bootstrappolicy/controller_policy.go | 4 + .../testdata/controller-roles.yaml | 14 + .../reference/feature_list.md | 1 + 10 files changed, 503 insertions(+), 46 deletions(-) create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go create mode 100644 deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go diff --git a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go index 9bf0a1f8a1..530639815a 100644 --- a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go +++ b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go @@ -17,7 +17,6 @@ import ( "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission/initializer" @@ -187,16 +186,6 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return admission.NewForbidden(attr, fmt.Errorf("%s node or namespace or infra config cache not synchronized", PluginName)) } - nodes, err := a.nodeLister.List(labels.Everything()) - if err != nil { - return admission.NewForbidden(attr, err) // can happen due to informer latency - } - - // we still need to have nodes under the cluster to decide if the management resource enabled or not - if len(nodes) == 0 { - return admission.NewForbidden(attr, fmt.Errorf("%s the cluster does not have any nodes", PluginName)) - } - clusterInfra, err := a.infraConfigLister.Get(infraClusterName) if err != nil { return admission.NewForbidden(attr, err) // can happen due to informer latency @@ -215,7 +204,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri } // Check if we are in CPU Partitioning mode for AllNodes - if !isCPUPartitioning(clusterInfra.Status, nodes, workloadType) { + if !isCPUPartitioning(clusterInfra.Status) { return nil } @@ -284,18 +273,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return nil } -func isCPUPartitioning(infraStatus configv1.InfrastructureStatus, nodes []*corev1.Node, workloadType string) bool { - // If status is not for CPU partitioning and we're single node we also check nodes to support upgrade event - // TODO: This should not be needed after 4.13 as all clusters after should have this feature on at install time, or updated by migration in NTO. - if infraStatus.CPUPartitioning != configv1.CPUPartitioningAllNodes && infraStatus.ControlPlaneTopology == configv1.SingleReplicaTopologyMode { - managedResource := fmt.Sprintf("%s.%s", workloadType, containerWorkloadResourceSuffix) - for _, node := range nodes { - // We only expect a single node to exist, so we return on first hit - if _, ok := node.Status.Allocatable[corev1.ResourceName(managedResource)]; ok { - return true - } - } - } +func isCPUPartitioning(infraStatus configv1.InfrastructureStatus) bool { return infraStatus.CPUPartitioning == configv1.CPUPartitioningAllNodes } diff --git a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go index 9564bffe39..209bea8383 100644 --- a/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go +++ b/deps/github.com/openshift/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission_test.go @@ -87,7 +87,7 @@ func TestAdmit(t *testing.T) { pod: testManagedPodWithWorkloadAnnotation("500m", "250m", "500Mi", "250Mi", "non-existent"), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the pod namespace %q does not allow the workload type non-existent", "managed-namespace"), }, @@ -96,7 +96,7 @@ func TestAdmit(t *testing.T) { pod: testPod("500m", "250m", "500Mi", "250Mi"), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, }, { name: "should return admission error when the pod has more than one workload annotation", @@ -112,7 +112,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the pod can not have more than one workload annotations"), }, @@ -129,7 +129,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf("the workload annotation key should have format %s", podWorkloadTargetAnnotationPrefix), }, @@ -146,7 +146,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), expectedError: fmt.Errorf(`failed to get workload annotation effect: failed to parse "{" annotation value: unexpected end of JSON input`), }, @@ -163,7 +163,7 @@ func TestAdmit(t *testing.T) { ), expectedCpuRequest: resource.MustParse("250m"), namespace: testManagedNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, expectedError: fmt.Errorf(`failed to get workload annotation effect: the workload annotation value map["test":"test"] does not have "effect" key`), infra: testClusterSNOInfra(), }, @@ -183,7 +183,7 @@ func TestAdmit(t *testing.T) { workloadAdmissionWarning: "skipping pod CPUs requests modifications because the namespace namespace is not annotated with workload.openshift.io/allowed to allow workload partitioning", }, namespace: testNamespace(), - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -196,7 +196,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s":256}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -209,7 +209,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s": 2}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -221,7 +221,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), kubetypes.ConfigSourceAnnotationKey: kubetypes.FileSource, }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -232,7 +232,7 @@ func TestAdmit(t *testing.T) { expectedAnnotations: map[string]string{ workloadAdmissionWarning: "skip pod CPUs requests modifications because it has guaranteed QoS class", }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -245,7 +245,7 @@ func TestAdmit(t *testing.T) { fmt.Sprintf("%s%s", containerResourcesAnnotationPrefix, "initTest"): fmt.Sprintf(`{"%s":256,"cpulimit":500}`, containerResourcesAnnotationValueKeyCPUShares), fmt.Sprintf("%s%s", podWorkloadTargetAnnotationPrefix, workloadTypeManagement): fmt.Sprintf(`{"%s":"%s"}`, podWorkloadAnnotationEffect, workloadEffectPreferredDuringScheduling), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -256,7 +256,7 @@ func TestAdmit(t *testing.T) { expectedAnnotations: map[string]string{ workloadAdmissionWarning: fmt.Sprintf("skip pod CPUs requests modifications because it will change the pod QoS class from %s to %s", corev1.PodQOSBurstable, corev1.PodQOSBestEffort), }, - nodes: []*corev1.Node{testNodeWithManagementResource()}, + nodes: []*corev1.Node{testNode()}, infra: testClusterSNOInfra(), }, { @@ -267,15 +267,6 @@ func TestAdmit(t *testing.T) { nodes: []*corev1.Node{testNode()}, infra: testClusterInfraWithoutWorkloadPartitioning(), }, - { - name: "should return admission error when the cluster does not have any nodes", - pod: testManagedPod("500m", "250m", "500Mi", "250Mi"), - expectedCpuRequest: resource.MustParse("250m"), - namespace: testManagedNamespace(), - nodes: []*corev1.Node{}, - infra: testClusterSNOInfra(), - expectedError: fmt.Errorf("the cluster does not have any nodes"), - }, } for _, test := range tests { diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go new file mode 100644 index 0000000000..d0c66ab8de --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go @@ -0,0 +1,18 @@ +package cache + +type ConflictCounter interface { + GetConflictCount() int +} + +var _ ConflictCounter = &volumeCache{} + +func (c *volumeCache) GetConflictCount() int { + c.mutex.RLock() + defer c.mutex.RUnlock() + + conflictCount := 0 + for _, conflicts := range c.conflicts { + conflictCount += len(conflicts) + } + return conflictCount +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go new file mode 100644 index 0000000000..39eeb9853c --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go @@ -0,0 +1,102 @@ +package selinuxwarning + +import ( + "context" + "fmt" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + utilfeature "k8s.io/apiserver/pkg/util/feature" + applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1" + clientset "k8s.io/client-go/kubernetes" + "k8s.io/klog/v2" + "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" + "k8s.io/kubernetes/pkg/features" +) + +const ( + checkInterval = 30 * time.Second + configMapNamespace = "openshift-config" + configMapName = "selinux-conflicts" + fieldManager = "selinux-conflicts-reporter" +) + +type SELinuxConflictsReporterController struct { + kubeClient clientset.Interface + conflictCounter cache.ConflictCounter + previousConflicts metav1.ConditionStatus +} + +func NewSELinuxConflictsReporterController(kubeClient clientset.Interface, volumeCache cache.VolumeCache) *SELinuxConflictsReporterController { + return &SELinuxConflictsReporterController{ + kubeClient: kubeClient, + // Ugly retype to avoid more carry patches in Kubernetes code. + // We added ConflictCounter in cache/openshift_patch.go, + // therefore we know that VolumeCache implements it. + conflictCounter: volumeCache.(cache.ConflictCounter), + previousConflicts: metav1.ConditionUnknown, + } +} + +func (c *SELinuxConflictsReporterController) Run(ctx context.Context) { + logger := klog.FromContext(ctx) + if !utilfeature.DefaultFeatureGate.Enabled(features.SELinuxMountGAReadiness) { + logger.V(2).Info("SELinuxMountGAReadiness feature gate is disabled, not starting OpenShift SELinux conflicts reporter") + return + } + logger.V(2).Info("Starting OpenShift SELinux conflicts reporter") + timer := time.NewTimer(checkInterval) + defer timer.Stop() + for { + select { + case <-ctx.Done(): + return + case <-timer.C: + c.reportSELinuxConflicts(ctx) + timer.Reset(checkInterval) + } + } +} + +func (c *SELinuxConflictsReporterController) reportSELinuxConflicts(ctx context.Context) { + logger := klog.FromContext(ctx) + logger.V(4).Info("Checking for SELinux conflicts") + + currentConflicts := c.getConflicts(logger) + if currentConflicts == c.previousConflicts { + logger.V(4).Info("SELinux conflict status did not change since last check") + return + } + logger.V(4).Info("SELinux conflict status changed, updating the config map") + if err := c.applySELinuxConflictsConfigMap(ctx, currentConflicts); err != nil { + logger.Error(err, "Error saving conflicts config map") + // To keep it simple: no exponential backoff try again in the next iteration. + return + } + logger.V(2).Info("SELinux conflict updated", "Conflicts", currentConflicts) + c.previousConflicts = currentConflicts +} + +func (c *SELinuxConflictsReporterController) getConflicts(logger klog.Logger) metav1.ConditionStatus { + conflictsCount := c.conflictCounter.GetConflictCount() + if conflictsCount > 0 { + logger.V(4).Info("Found SELinux-conflicting pods", "conflictsCount", conflictsCount) + return metav1.ConditionTrue + } + logger.V(4).Info("Found no SELinux-conflicting pods") + return metav1.ConditionFalse +} + +func (c *SELinuxConflictsReporterController) applySELinuxConflictsConfigMap(ctx context.Context, conflictsPresent metav1.ConditionStatus) error { + cm := applyconfigurationscorev1.ConfigMap(configMapName, configMapNamespace). + WithData(map[string]string{ + "conflictsPresent": string(conflictsPresent), + }).WithAnnotations(map[string]string{ + "Description": "This config map is used to report presence of SELinux conflicts from kube-controller-manager to storage Upgradeable condition in OpenShift 5.0", + }) + _, err := c.kubeClient.CoreV1().ConfigMaps(configMapNamespace).Apply(ctx, cm, metav1.ApplyOptions{FieldManager: fieldManager, Force: true}) + if err != nil { + return fmt.Errorf("error applying config map %s: %w", configMapName, err) + } + return nil +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go new file mode 100644 index 0000000000..c0a78104ac --- /dev/null +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller_test.go @@ -0,0 +1,336 @@ +package selinuxwarning + +import ( + "context" + "testing" + + v1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes/fake" + "k8s.io/client-go/tools/cache" + "k8s.io/klog/v2/ktesting" + volumecache "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" +) + +var _ volumecache.ConflictCounter = &fakeVolumeCache{} + +func (f *fakeVolumeCache) GetConflictCount() int { + count := 0 + for _, conflicts := range f.conflictsToSend { + count += len(conflicts) + } + return count +} + +func TestReportSELinuxConflicts(t *testing.T) { + cmTrue := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "True", + }, + } + cmFalse := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "False", + }, + } + tests := []struct { + name string + conflicts map[cache.ObjectName][]volumecache.Conflict + initialConflict metav1.ConditionStatus + // If set, the ConfigMap already exists before the test runs. + existingConfigMap *v1.ConfigMap + + expectConfigMapData map[string]string + // If true, no ConfigMap write is expected (status didn't change). + expectNoWrite bool + }{ + { + name: "no conflicts, create the config map", + initialConflict: metav1.ConditionUnknown, + conflicts: nil, + expectConfigMapData: map[string]string{ + "conflictsPresent": "False", + }, + }, + { + name: "conflicts present, create the config map", + initialConflict: metav1.ConditionUnknown, + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + Pod: cache.ObjectName{Namespace: "ns1", Name: "pod1"}, + PropertyValue: ":::s0:c1,c2", + OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod2"}, + OtherPropertyValue: ":::s0:c98,c99", + }, + }, + }, + expectConfigMapData: map[string]string{ + "conflictsPresent": "True", + }, + }, + { + name: "no conflicts, status was already False", + conflicts: nil, + initialConflict: metav1.ConditionFalse, + existingConfigMap: cmFalse, + expectNoWrite: true, + }, + { + name: "conflicts present, status was already True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + }, + }, + }, + initialConflict: metav1.ConditionTrue, + existingConfigMap: cmTrue, + expectNoWrite: true, + }, + { + name: "no conflicts, status changes from True to False", + conflicts: nil, + initialConflict: metav1.ConditionTrue, + existingConfigMap: cmTrue, + expectConfigMapData: map[string]string{ + "conflictsPresent": "False", + }, + }, + { + name: "conflicts appear, status changes from False to True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + }, + }, + }, + initialConflict: metav1.ConditionFalse, + existingConfigMap: cmFalse, + expectConfigMapData: map[string]string{ + "conflictsPresent": "True", + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, ctx := ktesting.NewTestContext(t) + + var fakeClient *fake.Clientset + if tt.existingConfigMap != nil { + fakeClient = fake.NewClientset(tt.existingConfigMap) + } else { + fakeClient = fake.NewClientset() + } + + labelCache := &fakeVolumeCache{ + conflictsToSend: tt.conflicts, + } + + c := &SELinuxConflictsReporterController{ + kubeClient: fakeClient, + conflictCounter: labelCache, + previousConflicts: tt.initialConflict, + } + + c.reportSELinuxConflicts(ctx) + + if tt.expectNoWrite { + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if tt.existingConfigMap != nil { + // The ConfigMap should still exist unchanged. + if err != nil { + t.Fatalf("expected ConfigMap to exist, got error: %v", err) + } + if cm.Data["conflictsPresent"] != tt.existingConfigMap.Data["conflictsPresent"] { + t.Errorf("ConfigMap data changed unexpectedly: got %v, want %v", cm.Data, tt.existingConfigMap.Data) + } + } else { + if err == nil || !apierrors.IsNotFound(err) { + t.Fatalf("expected ConfigMap to not exist, got error: %v", err) + } + } + return + } + + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get ConfigMap: %v", err) + } + for key, expectedValue := range tt.expectConfigMapData { + if cm.Data[key] != expectedValue { + t.Errorf("ConfigMap data[%q] = %q, want %q", key, cm.Data[key], expectedValue) + } + } + }) + } +} + +func TestApplySELinuxConflictsConfigMap(t *testing.T) { + cmTrue := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "True", + }, + } + cmFalse := &v1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: configMapName, + Namespace: configMapNamespace, + }, + Data: map[string]string{ + "conflictsPresent": "False", + }, + } + tests := []struct { + name string + existingConfigMap *v1.ConfigMap + conflictsPresent metav1.ConditionStatus + expectData map[string]string + }{ + { + name: "creates ConfigMap when it does not exist", + conflictsPresent: metav1.ConditionTrue, + expectData: map[string]string{ + "conflictsPresent": "True", + }, + }, + { + name: "patches ConfigMap when it already exists", + existingConfigMap: cmFalse, + conflictsPresent: metav1.ConditionTrue, + expectData: map[string]string{ + "conflictsPresent": string(metav1.ConditionTrue), + }, + }, + { + name: "patches ConfigMap from True to False", + existingConfigMap: cmTrue, + conflictsPresent: metav1.ConditionFalse, + expectData: map[string]string{ + "conflictsPresent": "False", + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + ctx := context.Background() + + var fakeClient *fake.Clientset + if tt.existingConfigMap != nil { + fakeClient = fake.NewClientset(tt.existingConfigMap) + } else { + fakeClient = fake.NewClientset() + } + + c := &SELinuxConflictsReporterController{ + kubeClient: fakeClient, + // the rest of the struct is not used in this test + } + + err := c.applySELinuxConflictsConfigMap(ctx, tt.conflictsPresent) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + cm, err := fakeClient.CoreV1().ConfigMaps(configMapNamespace).Get(ctx, configMapName, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get ConfigMap: %v", err) + } + for key, expectedValue := range tt.expectData { + if cm.Data[key] != expectedValue { + t.Errorf("ConfigMap data[%q] = %q, want %q", key, cm.Data[key], expectedValue) + } + } + }) + } +} + +func TestGetConflicts(t *testing.T) { + tests := []struct { + name string + conflicts map[cache.ObjectName][]volumecache.Conflict + expected metav1.ConditionStatus + }{ + { + name: "no conflicts returns False", + conflicts: nil, + expected: metav1.ConditionFalse, + }, + { + name: "empty conflicts returns False", + conflicts: map[cache.ObjectName][]volumecache.Conflict{}, + expected: metav1.ConditionFalse, + }, + { + name: "one conflict returns True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + { + PropertyName: "SELinuxLabel", + EventReason: "SELinuxLabelConflict", + Pod: cache.ObjectName{Namespace: "ns1", Name: "pod1"}, + PropertyValue: ":::s0:c1,c2", + OtherPod: cache.ObjectName{Namespace: "ns1", Name: "pod2"}, + OtherPropertyValue: ":::s0:c98,c99", + }, + }, + }, + expected: metav1.ConditionTrue, + }, + { + name: "multiple conflicts returns True", + conflicts: map[cache.ObjectName][]volumecache.Conflict{ + {Namespace: "ns1", Name: "pod1"}: { + {PropertyName: "SELinuxLabel"}, + }, + {Namespace: "ns1", Name: "pod2"}: { + {PropertyName: "SELinuxLabel"}, + {PropertyName: "SELinuxChangePolicy"}, + }, + }, + expected: metav1.ConditionTrue, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + _, ctx := ktesting.NewTestContext(t) + logger := ktesting.NewLogger(t, ktesting.NewConfig()) + _ = ctx + + labelCache := &fakeVolumeCache{ + conflictsToSend: tt.conflicts, + } + + c := &SELinuxConflictsReporterController{ + conflictCounter: labelCache, + } + + got := c.getConflicts(logger) + if got != tt.expected { + t.Errorf("getConflicts() = %v, want %v", got, tt.expected) + } + }) + } +} diff --git a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go index 53c08d1f6a..488a19161d 100644 --- a/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go +++ b/deps/github.com/openshift/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go @@ -380,6 +380,13 @@ func (c *Controller) Run(ctx context.Context, workers int) { wait.UntilWithContext(ctx, c.runWorker, time.Second) }) } + + seLinuxConflictsReporterController := NewSELinuxConflictsReporterController(c.kubeClient, c.labelCache) + wg.Go(func() { + defer utilruntime.HandleCrash() + seLinuxConflictsReporterController.Run(ctx) + }) + <-ctx.Done() } diff --git a/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go b/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go index 434781ba97..b09d7fe484 100644 --- a/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go +++ b/deps/github.com/openshift/kubernetes/pkg/features/openshift_features.go @@ -9,6 +9,7 @@ var ( RouteExternalCertificate featuregate.Feature = "RouteExternalCertificate" MinimumKubeletVersion featuregate.Feature = "MinimumKubeletVersion" StoragePerformantSecurityPolicy featuregate.Feature = "StoragePerformantSecurityPolicy" + SELinuxMountGAReadiness featuregate.Feature = "SELinuxMountGAReadiness" ) // registerOpenshiftFeatures injects openshift-specific feature gates @@ -25,8 +26,13 @@ func registerOpenshiftFeatures() { defaultVersionedKubernetesFeatureGates[StoragePerformantSecurityPolicy] = featuregate.VersionedSpecs{ {Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha}, } + // Introduced in 5.0 + defaultVersionedKubernetesFeatureGates[SELinuxMountGAReadiness] = featuregate.VersionedSpecs{ + {Version: version.MustParse("1.35"), Default: false, PreRelease: featuregate.Alpha}, + } defaultKubernetesFeatureGateDependencies[RouteExternalCertificate] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[MinimumKubeletVersion] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[StoragePerformantSecurityPolicy] = []featuregate.Feature{} + defaultKubernetesFeatureGateDependencies[SELinuxMountGAReadiness] = []featuregate.Feature{} } diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index 994e716a28..ddcafd16ae 100644 --- a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -606,6 +606,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("pods").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("csidrivers").RuleOrDie(), + // RBAC cannot restrict `create` by resourceName, so adding a generic rule to allow creation of any ConfigMap + rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), + // ... and allow patching only of the selinux-conflicts ConfigMap + rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("configmaps").Names("selinux-conflicts").RuleOrDie(), }, }) } diff --git a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml index 88459b2652..3e90cc424a 100644 --- a/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml +++ b/deps/github.com/openshift/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/testdata/controller-roles.yaml @@ -1465,6 +1465,20 @@ items: - get - list - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - apiGroups: + - "" + resourceNames: + - selinux-conflicts + resources: + - configmaps + verbs: + - patch - apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md b/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md index 73e3761674..2605dbd3dd 100644 --- a/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md +++ b/deps/github.com/openshift/kubernetes/test/compatibility_lifecycle/reference/feature_list.md @@ -184,6 +184,7 @@ | RuntimeClassInImageCriApi | | | 1.29– | | | | | [code](https://cs.k8s.io/?q=%5CbRuntimeClassInImageCriApi%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbRuntimeClassInImageCriApi%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxChangePolicy | :ballot_box_with_check: 1.33+ | :closed_lock_with_key: 1.36+ | 1.32 | 1.33–1.35 | 1.36– | | | [code](https://cs.k8s.io/?q=%5CbSELinuxChangePolicy%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxChangePolicy%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxMount | | | 1.30–1.32 | 1.33– | | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMount%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMount%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | +| SELinuxMountGAReadiness | | | 1.35– | | | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMountGAReadiness%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMountGAReadiness%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SELinuxMountReadWriteOncePod | :ballot_box_with_check: 1.28+ | :closed_lock_with_key: 1.36+ | 1.25–1.26 | 1.27–1.35 | 1.36– | | | [code](https://cs.k8s.io/?q=%5CbSELinuxMountReadWriteOncePod%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSELinuxMountReadWriteOncePod%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SchedulerAsyncAPICalls | | | | 1.34– | | | | [code](https://cs.k8s.io/?q=%5CbSchedulerAsyncAPICalls%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSchedulerAsyncAPICalls%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | | SchedulerAsyncPreemption | :ballot_box_with_check: 1.33+ | | 1.32 | 1.33– | | | | [code](https://cs.k8s.io/?q=%5CbSchedulerAsyncPreemption%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbSchedulerAsyncPreemption%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) | From 135dfe67645c6d7cb8462349561729928fabf279 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:18:55 +0000 Subject: [PATCH 4/8] update microshift/vendor --- .../managementcpusoverride/admission.go | 26 +---- .../selinuxwarning/cache/openshift_patch.go | 18 ++++ .../openshift_upgrade_controller.go | 102 ++++++++++++++++++ .../selinux_warning_controller.go | 7 ++ .../pkg/features/openshift_features.go | 6 ++ .../rbac/bootstrappolicy/controller_policy.go | 4 + 6 files changed, 139 insertions(+), 24 deletions(-) create mode 100644 vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go create mode 100644 vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go diff --git a/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go b/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go index 9bf0a1f8a1..530639815a 100644 --- a/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go +++ b/vendor/k8s.io/kubernetes/openshift-kube-apiserver/admission/autoscaling/managementcpusoverride/admission.go @@ -17,7 +17,6 @@ import ( "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/validation/field" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/admission/initializer" @@ -187,16 +186,6 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return admission.NewForbidden(attr, fmt.Errorf("%s node or namespace or infra config cache not synchronized", PluginName)) } - nodes, err := a.nodeLister.List(labels.Everything()) - if err != nil { - return admission.NewForbidden(attr, err) // can happen due to informer latency - } - - // we still need to have nodes under the cluster to decide if the management resource enabled or not - if len(nodes) == 0 { - return admission.NewForbidden(attr, fmt.Errorf("%s the cluster does not have any nodes", PluginName)) - } - clusterInfra, err := a.infraConfigLister.Get(infraClusterName) if err != nil { return admission.NewForbidden(attr, err) // can happen due to informer latency @@ -215,7 +204,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri } // Check if we are in CPU Partitioning mode for AllNodes - if !isCPUPartitioning(clusterInfra.Status, nodes, workloadType) { + if !isCPUPartitioning(clusterInfra.Status) { return nil } @@ -284,18 +273,7 @@ func (a *managementCPUsOverride) Admit(ctx context.Context, attr admission.Attri return nil } -func isCPUPartitioning(infraStatus configv1.InfrastructureStatus, nodes []*corev1.Node, workloadType string) bool { - // If status is not for CPU partitioning and we're single node we also check nodes to support upgrade event - // TODO: This should not be needed after 4.13 as all clusters after should have this feature on at install time, or updated by migration in NTO. - if infraStatus.CPUPartitioning != configv1.CPUPartitioningAllNodes && infraStatus.ControlPlaneTopology == configv1.SingleReplicaTopologyMode { - managedResource := fmt.Sprintf("%s.%s", workloadType, containerWorkloadResourceSuffix) - for _, node := range nodes { - // We only expect a single node to exist, so we return on first hit - if _, ok := node.Status.Allocatable[corev1.ResourceName(managedResource)]; ok { - return true - } - } - } +func isCPUPartitioning(infraStatus configv1.InfrastructureStatus) bool { return infraStatus.CPUPartitioning == configv1.CPUPartitioningAllNodes } diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go new file mode 100644 index 0000000000..d0c66ab8de --- /dev/null +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache/openshift_patch.go @@ -0,0 +1,18 @@ +package cache + +type ConflictCounter interface { + GetConflictCount() int +} + +var _ ConflictCounter = &volumeCache{} + +func (c *volumeCache) GetConflictCount() int { + c.mutex.RLock() + defer c.mutex.RUnlock() + + conflictCount := 0 + for _, conflicts := range c.conflicts { + conflictCount += len(conflicts) + } + return conflictCount +} diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go new file mode 100644 index 0000000000..39eeb9853c --- /dev/null +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/openshift_upgrade_controller.go @@ -0,0 +1,102 @@ +package selinuxwarning + +import ( + "context" + "fmt" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + utilfeature "k8s.io/apiserver/pkg/util/feature" + applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1" + clientset "k8s.io/client-go/kubernetes" + "k8s.io/klog/v2" + "k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/cache" + "k8s.io/kubernetes/pkg/features" +) + +const ( + checkInterval = 30 * time.Second + configMapNamespace = "openshift-config" + configMapName = "selinux-conflicts" + fieldManager = "selinux-conflicts-reporter" +) + +type SELinuxConflictsReporterController struct { + kubeClient clientset.Interface + conflictCounter cache.ConflictCounter + previousConflicts metav1.ConditionStatus +} + +func NewSELinuxConflictsReporterController(kubeClient clientset.Interface, volumeCache cache.VolumeCache) *SELinuxConflictsReporterController { + return &SELinuxConflictsReporterController{ + kubeClient: kubeClient, + // Ugly retype to avoid more carry patches in Kubernetes code. + // We added ConflictCounter in cache/openshift_patch.go, + // therefore we know that VolumeCache implements it. + conflictCounter: volumeCache.(cache.ConflictCounter), + previousConflicts: metav1.ConditionUnknown, + } +} + +func (c *SELinuxConflictsReporterController) Run(ctx context.Context) { + logger := klog.FromContext(ctx) + if !utilfeature.DefaultFeatureGate.Enabled(features.SELinuxMountGAReadiness) { + logger.V(2).Info("SELinuxMountGAReadiness feature gate is disabled, not starting OpenShift SELinux conflicts reporter") + return + } + logger.V(2).Info("Starting OpenShift SELinux conflicts reporter") + timer := time.NewTimer(checkInterval) + defer timer.Stop() + for { + select { + case <-ctx.Done(): + return + case <-timer.C: + c.reportSELinuxConflicts(ctx) + timer.Reset(checkInterval) + } + } +} + +func (c *SELinuxConflictsReporterController) reportSELinuxConflicts(ctx context.Context) { + logger := klog.FromContext(ctx) + logger.V(4).Info("Checking for SELinux conflicts") + + currentConflicts := c.getConflicts(logger) + if currentConflicts == c.previousConflicts { + logger.V(4).Info("SELinux conflict status did not change since last check") + return + } + logger.V(4).Info("SELinux conflict status changed, updating the config map") + if err := c.applySELinuxConflictsConfigMap(ctx, currentConflicts); err != nil { + logger.Error(err, "Error saving conflicts config map") + // To keep it simple: no exponential backoff try again in the next iteration. + return + } + logger.V(2).Info("SELinux conflict updated", "Conflicts", currentConflicts) + c.previousConflicts = currentConflicts +} + +func (c *SELinuxConflictsReporterController) getConflicts(logger klog.Logger) metav1.ConditionStatus { + conflictsCount := c.conflictCounter.GetConflictCount() + if conflictsCount > 0 { + logger.V(4).Info("Found SELinux-conflicting pods", "conflictsCount", conflictsCount) + return metav1.ConditionTrue + } + logger.V(4).Info("Found no SELinux-conflicting pods") + return metav1.ConditionFalse +} + +func (c *SELinuxConflictsReporterController) applySELinuxConflictsConfigMap(ctx context.Context, conflictsPresent metav1.ConditionStatus) error { + cm := applyconfigurationscorev1.ConfigMap(configMapName, configMapNamespace). + WithData(map[string]string{ + "conflictsPresent": string(conflictsPresent), + }).WithAnnotations(map[string]string{ + "Description": "This config map is used to report presence of SELinux conflicts from kube-controller-manager to storage Upgradeable condition in OpenShift 5.0", + }) + _, err := c.kubeClient.CoreV1().ConfigMaps(configMapNamespace).Apply(ctx, cm, metav1.ApplyOptions{FieldManager: fieldManager, Force: true}) + if err != nil { + return fmt.Errorf("error applying config map %s: %w", configMapName, err) + } + return nil +} diff --git a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go index 53c08d1f6a..488a19161d 100644 --- a/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go +++ b/vendor/k8s.io/kubernetes/pkg/controller/volume/selinuxwarning/selinux_warning_controller.go @@ -380,6 +380,13 @@ func (c *Controller) Run(ctx context.Context, workers int) { wait.UntilWithContext(ctx, c.runWorker, time.Second) }) } + + seLinuxConflictsReporterController := NewSELinuxConflictsReporterController(c.kubeClient, c.labelCache) + wg.Go(func() { + defer utilruntime.HandleCrash() + seLinuxConflictsReporterController.Run(ctx) + }) + <-ctx.Done() } diff --git a/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go b/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go index 434781ba97..b09d7fe484 100644 --- a/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go +++ b/vendor/k8s.io/kubernetes/pkg/features/openshift_features.go @@ -9,6 +9,7 @@ var ( RouteExternalCertificate featuregate.Feature = "RouteExternalCertificate" MinimumKubeletVersion featuregate.Feature = "MinimumKubeletVersion" StoragePerformantSecurityPolicy featuregate.Feature = "StoragePerformantSecurityPolicy" + SELinuxMountGAReadiness featuregate.Feature = "SELinuxMountGAReadiness" ) // registerOpenshiftFeatures injects openshift-specific feature gates @@ -25,8 +26,13 @@ func registerOpenshiftFeatures() { defaultVersionedKubernetesFeatureGates[StoragePerformantSecurityPolicy] = featuregate.VersionedSpecs{ {Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha}, } + // Introduced in 5.0 + defaultVersionedKubernetesFeatureGates[SELinuxMountGAReadiness] = featuregate.VersionedSpecs{ + {Version: version.MustParse("1.35"), Default: false, PreRelease: featuregate.Alpha}, + } defaultKubernetesFeatureGateDependencies[RouteExternalCertificate] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[MinimumKubeletVersion] = []featuregate.Feature{} defaultKubernetesFeatureGateDependencies[StoragePerformantSecurityPolicy] = []featuregate.Feature{} + defaultKubernetesFeatureGateDependencies[SELinuxMountGAReadiness] = []featuregate.Feature{} } diff --git a/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go b/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go index 994e716a28..ddcafd16ae 100644 --- a/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go +++ b/vendor/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy.go @@ -606,6 +606,10 @@ func buildControllerRoles() ([]rbacv1.ClusterRole, []rbacv1.ClusterRoleBinding) rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("persistentvolumeclaims").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(legacyGroup).Resources("pods").RuleOrDie(), rbacv1helpers.NewRule("get", "list", "watch").Groups(storageGroup).Resources("csidrivers").RuleOrDie(), + // RBAC cannot restrict `create` by resourceName, so adding a generic rule to allow creation of any ConfigMap + rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("configmaps").RuleOrDie(), + // ... and allow patching only of the selinux-conflicts ConfigMap + rbacv1helpers.NewRule("patch").Groups(legacyGroup).Resources("configmaps").Names("selinux-conflicts").RuleOrDie(), }, }) } From 630a5cddd8c4950387b8e6fdf5aa4530261784f6 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:19:00 +0000 Subject: [PATCH 5/8] update component images --- packaging/crio.conf.d/10-microshift_amd64.conf | 2 +- packaging/crio.conf.d/10-microshift_arm64.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf index ae8b830aa9..fc0589f7c1 100644 --- a/packaging/crio.conf.d/10-microshift_amd64.conf +++ b/packaging/crio.conf.d/10-microshift_amd64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:046dee0e64bb32cdb9d34b43abc4c1b8f2d1700e2243e3812b759e1436677c9b" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a06e05a7c16e5c88ab85d4dba0d3f3079a88d79ab4bd56f399dc99e42d00114e" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf index 22790acdd0..0eea395c5f 100644 --- a/packaging/crio.conf.d/10-microshift_arm64.conf +++ b/packaging/crio.conf.d/10-microshift_arm64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a3aba52ab6f516a28f1423d2f71e9e3320d8486a266ca0e8430e47b77c38de9c" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b4cc1ded7bc549cb446693b25f018e56194d7d6e896c71346db5d8a3b0bf092f" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" From 5112fffc6db8615ddbe6b637a34418d4aa0d4ac4 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:19:20 +0000 Subject: [PATCH 6/8] update manifests --- .../multus/kustomization.aarch64.yaml | 4 ++-- .../multus/kustomization.x86_64.yaml | 4 ++-- .../multus/release-multus-aarch64.json | 6 +++--- .../multus/release-multus-x86_64.json | 6 +++--- assets/components/service-ca/deployment.yaml | 9 +++++++-- .../kustomization.aarch64.yaml | 10 +++++----- .../kustomization.x86_64.yaml | 10 +++++----- .../release-olm-aarch64.json | 8 ++++---- .../release-olm-x86_64.json | 8 ++++---- assets/release/release-aarch64.json | 18 +++++++++--------- assets/release/release-x86_64.json | 18 +++++++++--------- 11 files changed, 53 insertions(+), 48 deletions(-) diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml index 2df3672ef8..daed8ddfe1 100644 --- a/assets/components/multus/kustomization.aarch64.yaml +++ b/assets/components/multus/kustomization.aarch64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:a0c089dbbd138b47d7467ce50d0ea3eff60bff9674a34d429078118eeabb78a3 + digest: sha256:259801f696be8b3adc1aba369211762465301d83ee2b5138e534b9ed8f22f194 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:1557d1200e7c7c8672f9cd9fa145874d43967f61f798f27894f643d5b857b99a + digest: sha256:2221dd09a30f4348dfa71186dfacf17b5e9dfce61e61fff86a32143cde08cfb6 diff --git a/assets/components/multus/kustomization.x86_64.yaml b/assets/components/multus/kustomization.x86_64.yaml index 234e0862de..2f092b2aa3 100644 --- a/assets/components/multus/kustomization.x86_64.yaml +++ b/assets/components/multus/kustomization.x86_64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:29f31422d6d637e350f99a58001ef8929cb151497ccc4d4f128d3b408812f635 + digest: sha256:c842055e8fb0b336134f0a17a1f608407271eaa9b3eedba7019ff69a87768556 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c63df61df4155fb06d9da879bb7d0e96b5e34161e1ad78e43e87d0690fcae29a + digest: sha256:70e5da8d51a31ecf11751cd26714e8d4735c5396aa07c8e05b7e108317c7fc0f diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index da7ab1020d..e82eac01e9 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-29-013859" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a0c089dbbd138b47d7467ce50d0ea3eff60bff9674a34d429078118eeabb78a3", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1557d1200e7c7c8672f9cd9fa145874d43967f61f798f27894f643d5b857b99a" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:259801f696be8b3adc1aba369211762465301d83ee2b5138e534b9ed8f22f194", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2221dd09a30f4348dfa71186dfacf17b5e9dfce61e61fff86a32143cde08cfb6" } } diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index eee6612c5f..75b9e9dae6 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:29f31422d6d637e350f99a58001ef8929cb151497ccc4d4f128d3b408812f635", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c63df61df4155fb06d9da879bb7d0e96b5e34161e1ad78e43e87d0690fcae29a" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c842055e8fb0b336134f0a17a1f608407271eaa9b3eedba7019ff69a87768556", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:70e5da8d51a31ecf11751cd26714e8d4735c5396aa07c8e05b7e108317c7fc0f" } } diff --git a/assets/components/service-ca/deployment.yaml b/assets/components/service-ca/deployment.yaml index f51d49b47d..a9dfd43a7a 100644 --- a/assets/components/service-ca/deployment.yaml +++ b/assets/components/service-ca/deployment.yaml @@ -29,6 +29,8 @@ spec: image: '{{ .ReleaseImage.service_ca_operator }}' imagePullPolicy: IfNotPresent command: ["service-ca-operator", "controller"] + args: + - -v=2 ports: - containerPort: 8443 securityContext: @@ -45,8 +47,8 @@ spec: name: signing-key - mountPath: /var/run/configmaps/signing-cabundle name: signing-cabundle - args: - - -v=2 + - mountPath: /var/run/configmaps/config + name: config volumes: - name: signing-key secret: @@ -54,6 +56,9 @@ spec: - name: signing-cabundle configMap: name: '{{.CAConfigMap}}' + - name: config + configMap: + name: service-ca-controller-config nodeSelector: node-role.kubernetes.io/master: "" priorityClassName: "system-cluster-critical" diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml index cec9490c75..f26177f3d3 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684 + digest: sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c + digest: sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5 + digest: sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4 patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index 139b453dee..cd15c1bbe5 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5 + digest: sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd + digest: sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb + digest: sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index fbad187d45..e1246f5f9f 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-29-013859" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c8eebdd593891b886d0fb2fc554b2cbcf39c77c57c8582b72c9647cf9e0f8684", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:823e379c09c3e2c566efe5c95f91134eb4170643fe2ba5633bcd382738cc841c", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5c784520b30b6c73ee5dcb9609daa718cf3bca454a3672ba0ceafec7f08efa30", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:616b80177a517b0e555ec8a67d5a884cc511b280581ce0addc7ca7293433558a", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4" } } diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index 2e22dd7e93..33e477a8b8 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:18957bcdaaa13c8c028b3742805b66d30d82fab2273dbeb71938844c44c5d5c5", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:714be6db62abadfce860b3ace30d35e63e087d9bf07ac3e667578d91e8659fcd", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2f8a8be0708cc94a1f5e65ede8fdb87f04474c84f116767ab69bfd76609e2352", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5023f98f4811619505361236cf6f7207970ca280c41301f9ade0843cbe6bb765", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d" } } diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 3c4ef3df31..ca727ce86c 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,16 +1,16 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-07-27-004356" + "base": "5.0.0-0.nightly-arm64-2026-07-29-013859" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:aa5ae933124990ac8342023e51870cf4d07884243e09afaf62417a0363a9729d", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3bd36df30411a20a17e54c90ccf9d993832da0ada367da6e0c3f28a83216f879", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:15e8952c1875922024db7b12af4990488d129afb1c25b7c5a653e830e0ec28f3", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fc51b97845de29e7a245f185d31ff8adb2c7b7a5350686876a700104499ae2f5", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:38885d2ed82f8089323768d6afffd298e8779dc440d88e91a97fab1d9310d486", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a3aba52ab6f516a28f1423d2f71e9e3320d8486a266ca0e8430e47b77c38de9c", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:648ad75c87d184155041dcd9cc76e135aea9050c07779edb473e26bd87342f19", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:af6d4ff9c11ebe892790865758f6ab50dcf614b90ac8ac9aa59f4933d5294793", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6026964193896041f8082e1bc52163f6cd4e5defaa4649065fdf9f57d3d242cf", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:84f7478bcdb2b51c86de69c32f331548c2954ea0a8e74a354170c7b7a9905595", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9e2ea30797381e916254735ae3fe98233a2b83f2d9b76388a40c700ec1bface4", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:84360c2cdb92c2d1ad8e10eab13422af4a92a7d018b43b0c9cf79f23c5f3c0b0", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b4cc1ded7bc549cb446693b25f018e56194d7d6e896c71346db5d8a3b0bf092f", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:11c81f3abc23ec38bcd575463363b4b7598ee6eaada3375f842f80883c4d8555", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:94fbbcfffd5a5503f3ea5ab43f13c325c3765c33db2b4e5d040c07ded10f8c6e" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ed566ae901111b0024ea140b465fd8bee3a715b076158d1dca8f7fef021c01ac" } } diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index f2adf17ca3..fbf9c008d7 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,16 +1,16 @@ { "release": { - "base": "5.0.0-0.nightly-2026-07-23-224236" + "base": "5.0.0-0.nightly-2026-07-27-053720" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:45188944bb589e9b3fd88bd175a18b9414a2ba070e2a08a3964e22ceedaf2955", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f8333c52e3b4ec5d1575a31276b9600f173ddda7d6f1a0cb11f0d364fe5be29a", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9d40caf7c3a21b802c6632cf968b8c17f5bb756b6ff0564b77ee2dc9898e38f3", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:849ba7d8ef4add8ef5841c14276f97cf9920b33bebf26ee021d72f08064e7abb", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e05f31e81de47bfb323c9015b117bf2dcf34abb56d7effcd43513378ef45aae6", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:046dee0e64bb32cdb9d34b43abc4c1b8f2d1700e2243e3812b759e1436677c9b", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:dcdfe8696ab6c9c7098e3ea2d297af47b68e91eac931364e13e46edd28b2a479", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:373c5709b7eac974fefd22d89cda216ce4b30f868c98fb9b26351d42851e4010", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f54a97c16dd55b83327995023af7904ed514b323cab568e553f432c1bebc7032", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:166dfd0bc984dc8ee691c5b440709334b83e0f62bfce1b7f8d60b150b9ea1130", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0b50fbd1cf4e77ca472342c2a810b6ea318c5d80cdee2327d317ef48e22d048d", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ff75b5440fc26ced06555c6ccbabe8f87afad4cdf3cff3961fea54c6f4912140", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a06e05a7c16e5c88ab85d4dba0d3f3079a88d79ab4bd56f399dc99e42d00114e", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:beec432b521d8612c03ea2ad1ab0267d3364f548f9340d7cd33e36d26d4dbe1f", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f0631a7e1e3aa1cf6ac01df7a7b0b8ce5f5ad333e2efc8f4599b4428a6d54c22" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:de20dccefd1015990c54cdd990f73c876dc03222adf777c871965a46dd840f0a" } } From ae020afc8bc1e08945a58b49c551e0dd52fb3745 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:19:28 +0000 Subject: [PATCH 7/8] update buildfiles --- Makefile.kube_git.var | 2 +- Makefile.version.aarch64.var | 2 +- Makefile.version.x86_64.var | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile.kube_git.var b/Makefile.kube_git.var index 64a966edca..c2fb5b4650 100644 --- a/Makefile.kube_git.var +++ b/Makefile.kube_git.var @@ -1,5 +1,5 @@ KUBE_GIT_MAJOR=1 KUBE_GIT_MINOR=36 KUBE_GIT_VERSION=v1.36.2 -KUBE_GIT_COMMIT=98b35193b2ac7a23a673325f5e9b830ecd5ba406 +KUBE_GIT_COMMIT=63ee93dac28329fd9d81e91b21ea8d8c43105d01 KUBE_GIT_TREE_STATE=clean diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index 1b287e6e86..98b8d2fa76 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-27-004356 +OCP_VERSION := 5.0.0-0.nightly-arm64-2026-07-29-013859 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index cf840335be..d33cd31d5f 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-2026-07-23-224236 +OCP_VERSION := 5.0.0-0.nightly-2026-07-27-053720 From 32e11c4790105c011039636f32776a98cc7903d2 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:19:37 +0000 Subject: [PATCH 8/8] Update SR-IOV for MicroShift --- .../optional/sriov/kustomization.aarch64.yaml | 20 ++++++++--------- .../optional/sriov/kustomization.x86_64.yaml | 20 ++++++++--------- .../optional/sriov/release-sriov-aarch64.json | 22 +++++++++---------- .../optional/sriov/release-sriov-x86_64.json | 22 +++++++++---------- 4 files changed, 42 insertions(+), 42 deletions(-) diff --git a/assets/optional/sriov/kustomization.aarch64.yaml b/assets/optional/sriov/kustomization.aarch64.yaml index a1cb7e606b..93ece8487a 100644 --- a/assets/optional/sriov/kustomization.aarch64.yaml +++ b/assets/optional/sriov/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:885ae30c9915b997e8d374ed7bed3c2e1258660b92186b04cf53b105beafeb74 + digest: sha256:66f8d28454f1be08310e80c65b0c28e506d360162bfd8e5d2b193cdf3ceca528 patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:2bfab11571c1f20621fc0de872b1bba42b568a660eb4763e35f7aecffd2b8da8 + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ed5664adb3308e56ac126b331e0b7484b914dbaf0ca9b72da412f2315b0e2737 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:92228bbea421a820bc2dfa1b126415c83f2773bc94694dc078c65824c333155d + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:5afa02b3391b40988c27f74689fc6c25c7cc942e1e2dca39872e8e40fa651db6 - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:8f9b9d6bd1cd32574e2add548e5cf74f43b19818b204f90925792a516d5be4fd + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:346b53358fb3f0bc3946f7fc7abec663b26fd76bf5801d654ef897f31ac084d4 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:5ea8bb5b1c3aac7bf59a3893d1d5a3152a0f8949a7e2999f6b958b1b2523ecd1 + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:169298358118309200f88efec6e120aa099d7021a4d4eb214c31148080894942 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7081b836f20158c5514749439f0d5d04818fb16eac6e7111ffe5fca4026e0772 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7578a38f86b5d29cb6969bdfa0b1451915bc6932d70b22e2361802a3b9912c2b - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:c6e0e49baea7bc2fd7a485c03db00e625610a250f5266f54ca58af1b8d71271a + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:76ccea0292fb1b214713573fd1a2618c27e5397f3b7d297fd60adf64ab2c47c8 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:870d98955d99b3df5f00149f750797c25149cea29dd25bfa883763779f521e8e + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:1f621015e170aa7756c09b794565ef363d2b77b4d06871062adc9cae4d5cf768 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:178fd1cdfb3d56cf59fb4ba952f16cb7e5bdde7cccebd6ac9845438f4f71eb62 + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:48522355fe76cd01399c29f3f9537bbdb8d6d01efe76b2c6795e61a891e3a6fe - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:d1ad461cadefdbd635f6137f5217bf41d5eba437251af05574bcbe61c74ddb63 + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:5469a1aa4585fdfe967a68836a4a1405c268279fdc30e91966bc10f5bde8e5a4 target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/kustomization.x86_64.yaml b/assets/optional/sriov/kustomization.x86_64.yaml index 40f8a2b17b..a29ef3ac3e 100644 --- a/assets/optional/sriov/kustomization.x86_64.yaml +++ b/assets/optional/sriov/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:d809810f02f63fd95f4587dadadf180cbd4f0397f6078567ffb63eeb52c12da9 + digest: sha256:a7f709e5588a287b5de677d3fb12bf5e72b2e4c93f30244ef992e101d462dbf0 patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:32c884e1281ccf417a7f67afc830f0b8e9ae05f41235978a2ab81b693408dae8 + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ece1ff2e5db874b597d92a3558237f3b2d108135d23887cc2621d8dcbd959181 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:c91d6b38c80b660258e0701bdd25f33d308b3d3aef1ba0707c5e655bfc79eec4 + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:73cf53b1624e23d2ce7226260a794a135865b3332003cf260384fc7de50b0698 - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:65fb69486d1fbc6ee69b22d02f0d0ee5b642bfa1b6e3758fe8ed8fc17346bf4f + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:6d646cf1b4fb97973a7a381410ccc6e2efb349559c5e5730ff9a93988b0d72fd - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:0c3a9ab3011969810aab65b5d35048397ef4561decd473d103405d9b7d4e241d + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:9ab34b6ee44656a6449ce4c5f8e18afaa309ab5829506883cafa1b8f60b95fe1 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:41143d95412e12b1b614c87d1c1dfce9df6f498eb70425e5a91e3ff54636b0a5 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5ebfbb9475604f973005743f2da5b21bdeefaa4ddd1182339b01f1e0308d9a5d - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:52e81b9fac3aef83040d6d3399ce407aa0af351d79697a62312f1c81707986d6 + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:40fb1c4b24a483e29f6ba6062e95581d438f7e833921a4c4470909acf9bebf52 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:2122463d6cbb4fb4cd5162018e96e588dc2f517f205da09529c4daf04746cbfb + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:a99ebf0c07d2583fba553fd90f3e58572457d71f0ac0e74fc0938b39f1a188b4 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:a124b5a6402c62cee0c0d0311d60c9bee4ba66f3fc0d98d30ff203cd6d2f21ea + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:eba420a0a661e03401b1e624711ca0cbb564dce7668518d52add405665dc3479 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:d27efc617a0eef867916bd2e37ac5c9d2f80346b9596a583ff2675bcd1567bfb + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:373a63186d156b4ce0ae2d8560e108441d17b09be34e6d6db2b3486bc43f7dfd target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/release-sriov-aarch64.json b/assets/optional/sriov/release-sriov-aarch64.json index 4762525e44..c9e2e27834 100644 --- a/assets/optional/sriov/release-sriov-aarch64.json +++ b/assets/optional/sriov/release-sriov-aarch64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202607141717" + "base": "4.21.0-202607180127" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:178fd1cdfb3d56cf59fb4ba952f16cb7e5bdde7cccebd6ac9845438f4f71eb62", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:d1ad461cadefdbd635f6137f5217bf41d5eba437251af05574bcbe61c74ddb63", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:8f9b9d6bd1cd32574e2add548e5cf74f43b19818b204f90925792a516d5be4fd", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:870d98955d99b3df5f00149f750797c25149cea29dd25bfa883763779f521e8e", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:2bfab11571c1f20621fc0de872b1bba42b568a660eb4763e35f7aecffd2b8da8", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:92228bbea421a820bc2dfa1b126415c83f2773bc94694dc078c65824c333155d", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:c6e0e49baea7bc2fd7a485c03db00e625610a250f5266f54ca58af1b8d71271a", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:5ea8bb5b1c3aac7bf59a3893d1d5a3152a0f8949a7e2999f6b958b1b2523ecd1", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:885ae30c9915b997e8d374ed7bed3c2e1258660b92186b04cf53b105beafeb74", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7081b836f20158c5514749439f0d5d04818fb16eac6e7111ffe5fca4026e0772" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:48522355fe76cd01399c29f3f9537bbdb8d6d01efe76b2c6795e61a891e3a6fe", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:5469a1aa4585fdfe967a68836a4a1405c268279fdc30e91966bc10f5bde8e5a4", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:346b53358fb3f0bc3946f7fc7abec663b26fd76bf5801d654ef897f31ac084d4", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:1f621015e170aa7756c09b794565ef363d2b77b4d06871062adc9cae4d5cf768", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ed5664adb3308e56ac126b331e0b7484b914dbaf0ca9b72da412f2315b0e2737", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:5afa02b3391b40988c27f74689fc6c25c7cc942e1e2dca39872e8e40fa651db6", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:76ccea0292fb1b214713573fd1a2618c27e5397f3b7d297fd60adf64ab2c47c8", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:169298358118309200f88efec6e120aa099d7021a4d4eb214c31148080894942", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:66f8d28454f1be08310e80c65b0c28e506d360162bfd8e5d2b193cdf3ceca528", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7578a38f86b5d29cb6969bdfa0b1451915bc6932d70b22e2361802a3b9912c2b" } } diff --git a/assets/optional/sriov/release-sriov-x86_64.json b/assets/optional/sriov/release-sriov-x86_64.json index e0cfccd91a..ebf50805af 100644 --- a/assets/optional/sriov/release-sriov-x86_64.json +++ b/assets/optional/sriov/release-sriov-x86_64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202607141717" + "base": "4.21.0-202607180127" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:a124b5a6402c62cee0c0d0311d60c9bee4ba66f3fc0d98d30ff203cd6d2f21ea", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:d27efc617a0eef867916bd2e37ac5c9d2f80346b9596a583ff2675bcd1567bfb", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:65fb69486d1fbc6ee69b22d02f0d0ee5b642bfa1b6e3758fe8ed8fc17346bf4f", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:2122463d6cbb4fb4cd5162018e96e588dc2f517f205da09529c4daf04746cbfb", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:32c884e1281ccf417a7f67afc830f0b8e9ae05f41235978a2ab81b693408dae8", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:c91d6b38c80b660258e0701bdd25f33d308b3d3aef1ba0707c5e655bfc79eec4", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:52e81b9fac3aef83040d6d3399ce407aa0af351d79697a62312f1c81707986d6", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:0c3a9ab3011969810aab65b5d35048397ef4561decd473d103405d9b7d4e241d", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:d809810f02f63fd95f4587dadadf180cbd4f0397f6078567ffb63eeb52c12da9", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:41143d95412e12b1b614c87d1c1dfce9df6f498eb70425e5a91e3ff54636b0a5" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:eba420a0a661e03401b1e624711ca0cbb564dce7668518d52add405665dc3479", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:373a63186d156b4ce0ae2d8560e108441d17b09be34e6d6db2b3486bc43f7dfd", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:6d646cf1b4fb97973a7a381410ccc6e2efb349559c5e5730ff9a93988b0d72fd", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:a99ebf0c07d2583fba553fd90f3e58572457d71f0ac0e74fc0938b39f1a188b4", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ece1ff2e5db874b597d92a3558237f3b2d108135d23887cc2621d8dcbd959181", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:73cf53b1624e23d2ce7226260a794a135865b3332003cf260384fc7de50b0698", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:40fb1c4b24a483e29f6ba6062e95581d438f7e833921a4c4470909acf9bebf52", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:9ab34b6ee44656a6449ce4c5f8e18afaa309ab5829506883cafa1b8f60b95fe1", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:a7f709e5588a287b5de677d3fb12bf5e72b2e4c93f30244ef992e101d462dbf0", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:5ebfbb9475604f973005743f2da5b21bdeefaa4ddd1182339b01f1e0308d9a5d" } }