diff --git a/Makefile.version.aarch64.var b/Makefile.version.aarch64.var index f0b33117af..6a2449cfb3 100644 --- a/Makefile.version.aarch64.var +++ b/Makefile.version.aarch64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-arm64-2026-09-09-231610 +OCP_VERSION := 5.0.0-0.nightly-arm64-2026-09-11-031005 diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index fc4debc36b..2ad92b2006 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.0.0-0.nightly-2026-09-09-111616 +OCP_VERSION := 5.0.0-0.nightly-2026-09-09-181844 diff --git a/assets/components/multus/kustomization.aarch64.yaml b/assets/components/multus/kustomization.aarch64.yaml index d6e20d77cd..4fa32a9ad2 100644 --- a/assets/components/multus/kustomization.aarch64.yaml +++ b/assets/components/multus/kustomization.aarch64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:0adf0e9e7d696932ccc4e0139d1eab86f60cb3150e7cfb93a900120b6215d73a + digest: sha256:bb1954c2f657426e2201f8f38c5ccb2912475bb36f9cb596824b5e34b6f6e2e3 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:4220205016cdbe9b0be3cd291e9a536f27fa164cf720399e9179c63077ec7981 + digest: sha256:c30b7d787fd9fc97266ec8afb79f7375b134e5a02e1ce9b465cb95ad5c70cb5b diff --git a/assets/components/multus/release-multus-aarch64.json b/assets/components/multus/release-multus-aarch64.json index a763e64d3a..870b01e9af 100644 --- a/assets/components/multus/release-multus-aarch64.json +++ b/assets/components/multus/release-multus-aarch64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-09-09-231610" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0adf0e9e7d696932ccc4e0139d1eab86f60cb3150e7cfb93a900120b6215d73a", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4220205016cdbe9b0be3cd291e9a536f27fa164cf720399e9179c63077ec7981" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:bb1954c2f657426e2201f8f38c5ccb2912475bb36f9cb596824b5e34b6f6e2e3", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c30b7d787fd9fc97266ec8afb79f7375b134e5a02e1ce9b465cb95ad5c70cb5b" } } diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index 9e3dfdcf20..ac25b22629 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-2026-09-09-111616" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6830cd83edc81c71ae3f288b9357f4cdb8329a939e71e17da4f92ce89ccbc286", diff --git a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml index f516121c12..840955ee9a 100644 --- a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificaterequests.cert-manager.io spec: group: cert-manager.io @@ -314,6 +314,10 @@ spec: type: string type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml index 4e063e0b86..74d51a799b 100644 --- a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificates.cert-manager.io spec: group: cert-manager.io @@ -453,9 +453,6 @@ spec: will be generated whenever a re-issuance occurs. Default is `Always`. The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - The new default can be disabled by setting the - `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on - the controller component. enum: - Never - Always @@ -811,6 +808,10 @@ spec: type: integer type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml index 2e33aab7f7..d7207f0013 100644 --- a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: challenges.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -285,6 +285,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -408,7 +424,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -458,8 +474,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -467,8 +483,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -557,8 +573,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -1915,9 +1931,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3126,9 +3143,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3276,6 +3294,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml index 42e8410a9e..7bb683271b 100644 --- a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: clusterissuers.cert-manager.io spec: group: cert-manager.io @@ -398,6 +398,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -521,7 +537,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -571,8 +587,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -580,8 +596,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -670,8 +686,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2028,9 +2044,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3239,9 +3256,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3498,8 +3516,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3627,16 +3645,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3654,7 +3672,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3662,13 +3680,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3676,7 +3694,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3697,7 +3715,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3711,7 +3729,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3720,8 +3738,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml index 44ddc33b35..dab8da6d11 100644 --- a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: issuers.cert-manager.io spec: group: cert-manager.io @@ -397,6 +397,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -520,7 +536,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -570,8 +586,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -579,8 +595,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -669,8 +685,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2027,9 +2043,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3238,9 +3255,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3497,8 +3515,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3626,16 +3644,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3653,7 +3671,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3661,13 +3679,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3675,7 +3693,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3696,7 +3714,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3710,7 +3728,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3719,8 +3737,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml index 1bacdf1805..015e301fda 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml @@ -289,9 +289,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -570,9 +571,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1165,9 +1167,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml index 65fb665887..7a47c4fc46 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml @@ -1335,9 +1335,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml index 74633abc4e..0a334f47d6 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml @@ -1185,9 +1185,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml index 94eddfa124..47c633abbc 100644 --- a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: orders.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -269,6 +269,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/manager/images-aarch64.yaml b/assets/optional/cert-manager/manager/images-aarch64.yaml index ec583c84d7..c028a761e5 100644 --- a/assets/optional/cert-manager/manager/images-aarch64.yaml +++ b/assets/optional/cert-manager/manager/images-aarch64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284 + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529 diff --git a/assets/optional/cert-manager/manager/images-x86_64.yaml b/assets/optional/cert-manager/manager/images-x86_64.yaml index fe3da1424f..d07286df86 100644 --- a/assets/optional/cert-manager/manager/images-x86_64.yaml +++ b/assets/optional/cert-manager/manager/images-x86_64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427 - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24 + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68 diff --git a/assets/optional/cert-manager/manager/manager.yaml b/assets/optional/cert-manager/manager/manager.yaml index a19ad2cf8b..af071a2b72 100644 --- a/assets/optional/cert-manager/manager/manager.yaml +++ b/assets/optional/cert-manager/manager/manager.yaml @@ -75,25 +75,25 @@ spec: - name: OPERATOR_NAME value: cert-manager-operator - name: RELATED_IMAGE_CERT_MANAGER_WEBHOOK - value: quay.io/jetstack/cert-manager-webhook:v1.19.4 + value: quay.io/jetstack/cert-manager-webhook:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR - value: quay.io/jetstack/cert-manager-cainjector:v1.19.4 + value: quay.io/jetstack/cert-manager-cainjector:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CONTROLLER - value: quay.io/jetstack/cert-manager-controller:v1.19.4 + value: quay.io/jetstack/cert-manager-controller:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ACMESOLVER - value: quay.io/jetstack/cert-manager-acmesolver:v1.19.4 + value: quay.io/jetstack/cert-manager-acmesolver:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ISTIOCSR value: quay.io/jetstack/cert-manager-istio-csr:v0.16.0 - name: RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER value: quay.io/jetstack/trust-manager:v0.20.3 - name: OPERAND_IMAGE_VERSION - value: 1.19.4 + value: 1.20.3 - name: ISTIOCSR_OPERAND_IMAGE_VERSION value: 0.16.0 - name: TRUSTMANAGER_OPERAND_IMAGE_VERSION value: 0.20.3 - name: OPERATOR_IMAGE_VERSION - value: 1.19.0 + value: 1.20.0 - name: OPERATOR_LOG_LEVEL value: '2' - name: TRUSTED_CA_CONFIGMAP_NAME diff --git a/assets/optional/cert-manager/rbac/role.yaml b/assets/optional/cert-manager/rbac/role.yaml index ed4472e77d..f5d902e214 100644 --- a/assets/optional/cert-manager/rbac/role.yaml +++ b/assets/optional/cert-manager/rbac/role.yaml @@ -106,8 +106,10 @@ rules: - certificates/finalizers - certificates/status - clusterissuers + - clusterissuers/finalizers - clusterissuers/status - issuers + - issuers/finalizers - issuers/status verbs: - create @@ -153,6 +155,14 @@ rules: - sign - update - watch +- apiGroups: + - config.openshift.io + resources: + - apiservers + verbs: + - get + - list + - watch - apiGroups: - config.openshift.io resources: @@ -168,6 +178,15 @@ rules: - patch - update - watch +- apiGroups: + - console.openshift.io + resources: + - consolequickstarts + - consoleyamlsamples + verbs: + - create + - get + - update - apiGroups: - coordination.k8s.io resources: @@ -187,6 +206,8 @@ rules: - gateways/finalizers - httproutes - httproutes/finalizers + - listenersets + - listenersets/finalizers verbs: - create - delete diff --git a/assets/optional/cert-manager/release-cert-manager-aarch64.json b/assets/optional/cert-manager/release-cert-manager-aarch64.json index 3ca93137d5..765844424e 100644 --- a/assets/optional/cert-manager/release-cert-manager-aarch64.json +++ b/assets/optional/cert-manager/release-cert-manager-aarch64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70" } } diff --git a/assets/optional/cert-manager/release-cert-manager-x86_64.json b/assets/optional/cert-manager/release-cert-manager-x86_64.json index ec4fd389b9..6cc5e4ea51 100644 --- a/assets/optional/cert-manager/release-cert-manager-x86_64.json +++ b/assets/optional/cert-manager/release-cert-manager-x86_64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa" } } diff --git a/assets/optional/kube-state-metrics/01-cluster-role.yaml b/assets/optional/kube-state-metrics/01-cluster-role.yaml index 75cd4e5d26..da17d01ebb 100644 --- a/assets/optional/kube-state-metrics/01-cluster-role.yaml +++ b/assets/optional/kube-state-metrics/01-cluster-role.yaml @@ -98,6 +98,8 @@ rules: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations + - validatingadmissionpolicies + - validatingadmissionpolicybindings - validatingwebhookconfigurations verbs: - list diff --git a/assets/optional/kube-state-metrics/03-deployment.yaml b/assets/optional/kube-state-metrics/03-deployment.yaml index 37d3f657e7..adc5538666 100644 --- a/assets/optional/kube-state-metrics/03-deployment.yaml +++ b/assets/optional/kube-state-metrics/03-deployment.yaml @@ -84,7 +84,7 @@ spec: - --upstream=http://127.0.0.1:8081/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-main @@ -110,8 +110,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true - args: - --secure-listen-address=:9443 @@ -119,7 +119,7 @@ spec: - --upstream=http://127.0.0.1:8082/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-self @@ -145,8 +145,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true nodeSelector: kubernetes.io/os: linux @@ -166,6 +166,7 @@ spec: - configMap: name: kube-state-metrics-custom-resource-state-configmap name: kube-state-metrics-custom-resource-state-configmap - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca diff --git a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml index b400ac1e80..803c1e94bd 100644 --- a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:7fd7b6e0e1447843bf55c5a7579b83f7455346e8673b0c52d73daad637f6d595 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373 + digest: sha256:f6a83c4f031e6c4dcb847d39620b0ff9d20133d65b25d581a3fd159fb28ecc56 diff --git a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml index a080d292b4..41cf33e8c0 100644 --- a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:d1d3bf25904dde7857d6c054021df4191bff21071cf03d4166d75a1c53e64057 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d + digest: sha256:fac81a8f5949878c5d76d1eda40ab6ba7bb25b93e44f875a79298e40deeaafe8 diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json index da01a2f081..48a53d7566 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f6a83c4f031e6c4dcb847d39620b0ff9d20133d65b25d581a3fd159fb28ecc56" } } diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json index dfdae05ea2..7ee9ff72b3 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fac81a8f5949878c5d76d1eda40ab6ba7bb25b93e44f875a79298e40deeaafe8" } } diff --git a/assets/optional/metrics-server/kustomization.aarch64.yaml b/assets/optional/metrics-server/kustomization.aarch64.yaml index 0a79cdb357..a39ace363f 100644 --- a/assets/optional/metrics-server/kustomization.aarch64.yaml +++ b/assets/optional/metrics-server/kustomization.aarch64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec + digest: sha256:ca610227af6287dc7b6fdf5802513c8be5506d05efc5d471b5330d1aed9abb92 diff --git a/assets/optional/metrics-server/kustomization.x86_64.yaml b/assets/optional/metrics-server/kustomization.x86_64.yaml index 49529cad12..a2ddf4cba1 100644 --- a/assets/optional/metrics-server/kustomization.x86_64.yaml +++ b/assets/optional/metrics-server/kustomization.x86_64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c + digest: sha256:3f3b5520f964c35faaf9194bbb16ca2ba7abedac7dc1b41cdebd9b0e15eae01b diff --git a/assets/optional/metrics-server/release-metrics-server-aarch64.json b/assets/optional/metrics-server/release-metrics-server-aarch64.json index c12ffcbb53..f933f83cd8 100644 --- a/assets/optional/metrics-server/release-metrics-server-aarch64.json +++ b/assets/optional/metrics-server/release-metrics-server-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ca610227af6287dc7b6fdf5802513c8be5506d05efc5d471b5330d1aed9abb92" } } diff --git a/assets/optional/metrics-server/release-metrics-server-x86_64.json b/assets/optional/metrics-server/release-metrics-server-x86_64.json index 57ab6cbd6a..3adbe0eb4a 100644 --- a/assets/optional/metrics-server/release-metrics-server-x86_64.json +++ b/assets/optional/metrics-server/release-metrics-server-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3f3b5520f964c35faaf9194bbb16ca2ba7abedac7dc1b41cdebd9b0e15eae01b" } } diff --git a/assets/optional/node-exporter/01-cluster-role-binding.yaml b/assets/optional/node-exporter/01-cluster-role-binding.yaml index b6790fa9b4..1eeb01cea5 100644 --- a/assets/optional/node-exporter/01-cluster-role-binding.yaml +++ b/assets/optional/node-exporter/01-cluster-role-binding.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/optional/node-exporter/01-cluster-role.yaml b/assets/optional/node-exporter/01-cluster-role.yaml index 50d7a5e755..838a5ad733 100644 --- a/assets/optional/node-exporter/01-cluster-role.yaml +++ b/assets/optional/node-exporter/01-cluster-role.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter rules: - apiGroups: diff --git a/assets/optional/node-exporter/01-service-account.yaml b/assets/optional/node-exporter/01-service-account.yaml index c3d1dc95c9..e5210365d1 100644 --- a/assets/optional/node-exporter/01-service-account.yaml +++ b/assets/optional/node-exporter/01-service-account.yaml @@ -7,6 +7,6 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring diff --git a/assets/optional/node-exporter/03-daemonset.yaml b/assets/optional/node-exporter/03-daemonset.yaml index 8a384935f0..f098c564ff 100644 --- a/assets/optional/node-exporter/03-daemonset.yaml +++ b/assets/optional/node-exporter/03-daemonset.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: @@ -27,7 +27,7 @@ spec: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 spec: automountServiceAccountToken: true containers: @@ -66,7 +66,8 @@ spec: requests: cpu: 8m memory: 32Mi - securityContext: {} + securityContext: + readOnlyRootFilesystem: true terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /host/sys @@ -90,7 +91,7 @@ spec: - --upstream=http://127.0.0.1:9101/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml env: - name: IP @@ -126,8 +127,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: node-exporter-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true hostNetwork: true hostPID: true @@ -147,6 +148,7 @@ spec: memory: 1Mi securityContext: privileged: true + readOnlyRootFilesystem: true runAsUser: 0 terminationMessagePolicy: FallbackToLogsOnError volumeMounts: @@ -189,9 +191,10 @@ spec: path: config.yaml name: node-exporter-accelerators-collector-config name: node-exporter-accelerators-collector-config - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca updateStrategy: rollingUpdate: maxUnavailable: 10% diff --git a/assets/optional/node-exporter/04-service.yaml b/assets/optional/node-exporter/04-service.yaml index 37b420ccdb..5f570b5dc9 100644 --- a/assets/optional/node-exporter/04-service.yaml +++ b/assets/optional/node-exporter/04-service.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: diff --git a/assets/optional/node-exporter/kustomization.aarch64.yaml b/assets/optional/node-exporter/kustomization.aarch64.yaml index 7686f7f2ba..423a78c986 100644 --- a/assets/optional/node-exporter/kustomization.aarch64.yaml +++ b/assets/optional/node-exporter/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:7fd7b6e0e1447843bf55c5a7579b83f7455346e8673b0c52d73daad637f6d595 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9 + digest: sha256:5d784c66d0d7695d8f76632dd69386258f4127bcf494616e1cdebe17f757f1c3 diff --git a/assets/optional/node-exporter/kustomization.x86_64.yaml b/assets/optional/node-exporter/kustomization.x86_64.yaml index c3c1e34433..5c3721907b 100644 --- a/assets/optional/node-exporter/kustomization.x86_64.yaml +++ b/assets/optional/node-exporter/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:d1d3bf25904dde7857d6c054021df4191bff21071cf03d4166d75a1c53e64057 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9 + digest: sha256:7b7a8abf588d15b7734177ed537788ae0ebd99418ee44040abf32c0a582af19a diff --git a/assets/optional/node-exporter/release-node-exporter-aarch64.json b/assets/optional/node-exporter/release-node-exporter-aarch64.json index a1e3d0ae0f..eae05bcee6 100644 --- a/assets/optional/node-exporter/release-node-exporter-aarch64.json +++ b/assets/optional/node-exporter/release-node-exporter-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5d784c66d0d7695d8f76632dd69386258f4127bcf494616e1cdebe17f757f1c3" } } diff --git a/assets/optional/node-exporter/release-node-exporter-x86_64.json b/assets/optional/node-exporter/release-node-exporter-x86_64.json index 399aa1c470..2ca6937beb 100644 --- a/assets/optional/node-exporter/release-node-exporter-x86_64.json +++ b/assets/optional/node-exporter/release-node-exporter-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:7b7a8abf588d15b7734177ed537788ae0ebd99418ee44040abf32c0a582af19a" } } diff --git a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml index 33aa5c80b3..1c9d11f810 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.aarch64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:e6d7deb4343532698a713d84ce7116a09f6b38926eafece2c83b675cccfd4940 + digest: sha256:21552b604e00c10dd7b024044e526d4f5c01be81534d595d24c18a0b01d7d865 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:0ec3550c12fff156c756d4a27c4530cdcfaea8fc0f960f5280d829136046d227 + digest: sha256:65c73a9d14ecb9afdbd0d6267967b400a5df92373a3ba35e559c8300307bc3b1 - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:72ae455e2b805f2f09ff04c7e6b6bf1f0d52ab5cbda9cd2f1ea4cba31bc19e89 + digest: sha256:7fd7b6e0e1447843bf55c5a7579b83f7455346e8673b0c52d73daad637f6d595 patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0ec3550c12fff156c756d4a27c4530cdcfaea8fc0f960f5280d829136046d227 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:65c73a9d14ecb9afdbd0d6267967b400a5df92373a3ba35e559c8300307bc3b1 - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e6d7deb4343532698a713d84ce7116a09f6b38926eafece2c83b675cccfd4940 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:21552b604e00c10dd7b024044e526d4f5c01be81534d595d24c18a0b01d7d865 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json index 77be692cfd..02ca929e45 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-aarch64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-09-09-231610" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e6d7deb4343532698a713d84ce7116a09f6b38926eafece2c83b675cccfd4940", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0ec3550c12fff156c756d4a27c4530cdcfaea8fc0f960f5280d829136046d227", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:72ae455e2b805f2f09ff04c7e6b6bf1f0d52ab5cbda9cd2f1ea4cba31bc19e89" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:21552b604e00c10dd7b024044e526d4f5c01be81534d595d24c18a0b01d7d865", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:65c73a9d14ecb9afdbd0d6267967b400a5df92373a3ba35e559c8300307bc3b1", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:7fd7b6e0e1447843bf55c5a7579b83f7455346e8673b0c52d73daad637f6d595" } } diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index 3e62b5f229..a9e6574fc3 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-2026-09-09-111616" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:588f3763f74b57594e424c9d8cb4e049fa8b9b4388750dc651c99d4f1ad21f63", diff --git a/assets/release/release-aarch64.json b/assets/release/release-aarch64.json index 7041127f4a..898f1bca3e 100644 --- a/assets/release/release-aarch64.json +++ b/assets/release/release-aarch64.json @@ -1,17 +1,17 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-09-09-231610" + "base": "5.0.0-0.nightly-arm64-2026-09-11-031005" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:5fad3b6c283c5a07df4b38a1bc9e1efc1e0caa97955ae67b239d5df022d3d0b3", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:cd2841e4c8a680b5f53644166777cf0989905ccdc967b7200e45f86fcba4e58d", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:1d7787e2b8f407474df88e7bad6cea87880be39c689e5c0dbeab88ad5b5225a1", - "haproxy-router-haproxy32": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:eadfafe12df70f0f8f461c97d10a8a6a8b39e53452028fb63d38737bcb6debeb", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:72ae455e2b805f2f09ff04c7e6b6bf1f0d52ab5cbda9cd2f1ea4cba31bc19e89", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:fa7e41851eb31fa7ed5810b6247e006f2ea0941b8a9efcab61c7a419e514f502", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2b1ccfea63c535c34a60da842edb4b6f69ec461ec4eecb3ec916a71455609119", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9e27d999f756618bed6237c834f962189840ec074609bdfad590dcf22e3cea33", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:eb94e1253138aae58fc0d3b5f171b17651241b0fa12db30508b0ce61141c7f8a", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ec4835611cb0352bb1a6808cedbe97fcfcbb7d0a02182e222eb3b66281e30155", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e61c5c16899252f333d303916cc818ad6516e7858fd477a02a1d1929d0b2ed36", + "haproxy-router-haproxy32": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f776508464a2017ce7ff74068a0dc19c62955b97c7690dd22abf09865c70eba8", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:7fd7b6e0e1447843bf55c5a7579b83f7455346e8673b0c52d73daad637f6d595", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:332a8e8caa01aa64272855a23fec0aa53955be4b2fb6d03a7586d42e047de3e9", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4ba79132f6714feb2ac8a7c4f487750840678d69551de2d99fabfff5081ca8a2", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:40c657f622d1218feeb34d9c10eda9174f1e281972e355b9662c2725ea136a80", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:e77365e44676fbd8ab9e4ce53f3a406856bbdfef3467c545a7df1197d84477af", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8ed906d4caac90b0ab0e751398ea21baebd739cc06c9bc26eba2bed8e7391ab5" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:85dbcab19a4f2fdebd1562b3c66e77e13ddd4ddb6f7deeface01d9ad99766617" } } diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index 6dcd862105..f21d80b722 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,6 +1,6 @@ { "release": { - "base": "5.0.0-0.nightly-2026-09-09-111616" + "base": "5.0.0-0.nightly-2026-09-09-181844" }, "images": { "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:13a20b423eef5e5f66223dd8a9efaa6f0d65b0b9ca5840d9ace52766e254cf29", diff --git a/packaging/crio.conf.d/10-microshift_arm64.conf b/packaging/crio.conf.d/10-microshift_arm64.conf index 623a6a25b1..89b406081e 100644 --- a/packaging/crio.conf.d/10-microshift_arm64.conf +++ b/packaging/crio.conf.d/10-microshift_arm64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2b1ccfea63c535c34a60da842edb4b6f69ec461ec4eecb3ec916a71455609119" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4ba79132f6714feb2ac8a7c4f487750840678d69551de2d99fabfff5081ca8a2" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 0910b9fbce..e69de29bb2 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,15 +0,0 @@ -- cluster-network-operator embedded-component 769a2ade112bd4b775ef007024559fe83a592ede to 1b9a053663d46a789d8c500314cdfae3f879c060 - - 2041a24 2026-08-26T22:48:00Z Install NOO using OLMv0 instead of OLMv1 - -- kubernetes embedded-component 7b29fb077260554429dcef8234272e9fd25fcfbd to 306002d4cb7d5621b4b9d1871d1d029682f8f824 - - 802eb2441 2026-08-27T22:02:31Z UPSTREAM: : make graceful-termination-duration flag required for the watch-termination command - -- machine-config-operator embedded-component 56e40012677752f23a6736afae2ed082934fba37 to 3400a9c1429cce50d3a097f11e1a770e028e30d4 - - cd959d15 2026-09-08T13:01:16Z OCPBUGS-120711: Fix vsphere network absolute paths - -- kubernetes image-amd64 7b29fb077260554429dcef8234272e9fd25fcfbd to 306002d4cb7d5621b4b9d1871d1d029682f8f824 - - 802eb2441 2026-08-27T22:02:31Z UPSTREAM: : make graceful-termination-duration flag required for the watch-termination command - -- kubernetes image-arm64 7b29fb077260554429dcef8234272e9fd25fcfbd to 306002d4cb7d5621b4b9d1871d1d029682f8f824 - - 802eb2441 2026-08-27T22:02:31Z UPSTREAM: : make graceful-termination-duration flag required for the watch-termination command - diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 3495423ccf..073e6590d1 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-09-09-111616" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-09-09-231610" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-09-09-181844" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-09-11-031005" diff --git a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh index f61200df82..c3069a1045 100755 --- a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh +++ b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-06-19-155631" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-06-19-154904" +./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-09-09-181844" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-09-11-031005"