From 35cceed3ed8e7e24451b3e5cccee6917dfc54b46 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 04:31:08 +0000 Subject: [PATCH 1/3] update changelog --- scripts/auto-rebase/changelog.txt | 29 ----------------------------- 1 file changed, 29 deletions(-) diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 4f49d8ddbb..e69de29bb2 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,29 +0,0 @@ -- cluster-ingress-operator embedded-component 5bf72fcc4534d9ba2c4d65d29cdb8b01c83cf550 to 48b8f79897294e8701c22af8dcdddcb78fa30ff0 - - 37e7d31e 2026-09-01T13:27:57-04:00 Update the logging and add a descriptive comment - - bea6ae70 2026-09-01T17:37:11+02:00 OCPBUGS-92835: add grace period to Available condition for deployment blips - - 022ab829 2026-08-26T18:38:38-03:00 vendor files required for tests - - 6daaab20 2026-08-26T18:38:38-03:00 WAF-3: Implement extension provider capability for WAF - - 1ad981ce 2026-08-14T12:48:03-04:00 Update the unit tests - - 5edaf15a 2026-08-13T20:03:58-04:00 Add two unit tests for malformed CIDRs - - 58cc99fc 2026-08-13T19:11:45-04:00 OCPBUGS-109582: Normalize malformed CIDRs to avoid upgrade disruptions - - d896afa8 2026-08-10T15:48:35+02:00 Fix gofmt formatting in controller_test.go - - 99e8741a 2026-07-31T16:29:50+02:00 OCPBUGS-62627: Suppress cluster operator Progressing during infrastructure-driven ingress unavailability - -- cluster-kube-apiserver-operator embedded-component 2caf92bdc42acc1d71c2c1e6152b7da31b66919c to 7e0eee0325ab855d09906ba31c2ae2040bb1a7b1 - - e9a1777 2026-09-04T11:43:10+02:00 bump (*) - -- cluster-network-operator embedded-component 50609c5ab373ed5c1db508e9819afd10ea5512ec to c44c178f408a77a9d2460bae64620d2bd3200ff7 - - d25b490 2026-09-04T10:19:02+02:00 Add AGENTS.md, point CodeRabbit knowledge base at it - - 84a98ca 2026-08-31T12:24:13-07:00 Add status.vrfName and shortNames to UDN/CUDN CRDs - -- etcd embedded-component 609b11ed8fc404fb95572d7c87e3243a1206cdb7 to 24fb7ef2afe9c4e4ca179f70b101d8ac2a0daeab - - 33b1c411 2026-09-02T20:30:20-07:00 DOWNSTREAM: : CNTRLPLANE-3724: add agentic context docs for the openshift/etcd fork - -- machine-config-operator embedded-component 11fd0ff5069fa923efab9312a3cdb65e8b94fb43 to 95ada475a7d0c0928d9d3cbfbe37196196a337d8 - - 8940415e 2026-09-04T11:48:16Z NO-ISSUE: check mosb failed message in test 85980 - - 1129129d 2026-09-04T09:45:39+02:00 OCPBUGS-120711: Fix vsphere network absolute paths - - 2c4e2bc3 2026-09-03T13:12:07-04:00 operator: retry on conflict in syncMachineConfigNodes - - 8fdff133 2026-09-03T16:07:31Z OCPBUGS-116490: remove nft chains before checking the ignition config - - b8eee7e1 2026-09-02T15:22:15+05:30 OCPBUGS-109657: Assert errors in TestGetPrimaryPoolForNode - - b764fb26 2026-08-31T14:01:28-04:00 mcs: replace wildcard permissions with explicit verbs - From f0996bad80d5cf35202198dd629eceff55766d69 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 04:32:05 +0000 Subject: [PATCH 2/3] update cluster-monitoring-operator manifests and images --- ...rtificaterequests.cert-manager.io-crd.yaml | 6 +- .../certificates.cert-manager.io-crd.yaml | 9 +-- .../challenges.acme.cert-manager.io-crd.yaml | 42 ++++++++--- .../clusterissuers.cert-manager.io-crd.yaml | 70 ++++++++++++------- .../bases/issuers.cert-manager.io-crd.yaml | 70 ++++++++++++------- .../operator.openshift.io_certmanagers.yaml | 9 ++- .../operator.openshift.io_istiocsrs.yaml | 3 +- .../operator.openshift.io_trustmanagers.yaml | 3 +- .../orders.acme.cert-manager.io-crd.yaml | 6 +- .../cert-manager/manager/images-aarch64.yaml | 12 ++-- .../cert-manager/manager/images-x86_64.yaml | 12 ++-- .../cert-manager/manager/manager.yaml | 12 ++-- assets/optional/cert-manager/rbac/role.yaml | 21 ++++++ .../release-cert-manager-aarch64.json | 14 ++-- .../release-cert-manager-x86_64.json | 14 ++-- .../kube-state-metrics/01-cluster-role.yaml | 4 ++ .../kube-state-metrics/03-deployment.yaml | 19 ++--- .../kustomization.aarch64.yaml | 4 +- .../kustomization.x86_64.yaml | 4 +- .../release-kube-state-metrics-aarch64.json | 4 +- .../release-kube-state-metrics-x86_64.json | 4 +- .../metrics-server/kustomization.aarch64.yaml | 2 +- .../metrics-server/kustomization.x86_64.yaml | 2 +- .../release-metrics-server-aarch64.json | 4 +- .../release-metrics-server-x86_64.json | 4 +- .../01-cluster-role-binding.yaml | 2 +- .../node-exporter/01-cluster-role.yaml | 2 +- .../node-exporter/01-service-account.yaml | 2 +- .../optional/node-exporter/03-daemonset.yaml | 21 +++--- assets/optional/node-exporter/04-service.yaml | 2 +- .../node-exporter/kustomization.aarch64.yaml | 4 +- .../node-exporter/kustomization.x86_64.yaml | 4 +- .../release-node-exporter-aarch64.json | 4 +- .../release-node-exporter-x86_64.json | 4 +- 34 files changed, 250 insertions(+), 149 deletions(-) diff --git a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml index f516121c12..840955ee9a 100644 --- a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificaterequests.cert-manager.io spec: group: cert-manager.io @@ -314,6 +314,10 @@ spec: type: string type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml index 4e063e0b86..74d51a799b 100644 --- a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificates.cert-manager.io spec: group: cert-manager.io @@ -453,9 +453,6 @@ spec: will be generated whenever a re-issuance occurs. Default is `Always`. The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - The new default can be disabled by setting the - `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on - the controller component. enum: - Never - Always @@ -811,6 +808,10 @@ spec: type: integer type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml index 2e33aab7f7..d7207f0013 100644 --- a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: challenges.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -285,6 +285,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -408,7 +424,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -458,8 +474,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -467,8 +483,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -557,8 +573,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -1915,9 +1931,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3126,9 +3143,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3276,6 +3294,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml index 42e8410a9e..7bb683271b 100644 --- a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: clusterissuers.cert-manager.io spec: group: cert-manager.io @@ -398,6 +398,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -521,7 +537,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -571,8 +587,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -580,8 +596,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -670,8 +686,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2028,9 +2044,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3239,9 +3256,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3498,8 +3516,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3627,16 +3645,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3654,7 +3672,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3662,13 +3680,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3676,7 +3694,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3697,7 +3715,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3711,7 +3729,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3720,8 +3738,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml index 44ddc33b35..dab8da6d11 100644 --- a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: issuers.cert-manager.io spec: group: cert-manager.io @@ -397,6 +397,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -520,7 +536,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -570,8 +586,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -579,8 +595,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -669,8 +685,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2027,9 +2043,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3238,9 +3255,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3497,8 +3515,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3626,16 +3644,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3653,7 +3671,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3661,13 +3679,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3675,7 +3693,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3696,7 +3714,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3710,7 +3728,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3719,8 +3737,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml index 1bacdf1805..015e301fda 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml @@ -289,9 +289,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -570,9 +571,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1165,9 +1167,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml index 65fb665887..7a47c4fc46 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml @@ -1335,9 +1335,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml index 74633abc4e..0a334f47d6 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml @@ -1185,9 +1185,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml index 94eddfa124..47c633abbc 100644 --- a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: orders.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -269,6 +269,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/manager/images-aarch64.yaml b/assets/optional/cert-manager/manager/images-aarch64.yaml index ec583c84d7..c028a761e5 100644 --- a/assets/optional/cert-manager/manager/images-aarch64.yaml +++ b/assets/optional/cert-manager/manager/images-aarch64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284 + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529 diff --git a/assets/optional/cert-manager/manager/images-x86_64.yaml b/assets/optional/cert-manager/manager/images-x86_64.yaml index fe3da1424f..d07286df86 100644 --- a/assets/optional/cert-manager/manager/images-x86_64.yaml +++ b/assets/optional/cert-manager/manager/images-x86_64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427 - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24 + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68 diff --git a/assets/optional/cert-manager/manager/manager.yaml b/assets/optional/cert-manager/manager/manager.yaml index a19ad2cf8b..af071a2b72 100644 --- a/assets/optional/cert-manager/manager/manager.yaml +++ b/assets/optional/cert-manager/manager/manager.yaml @@ -75,25 +75,25 @@ spec: - name: OPERATOR_NAME value: cert-manager-operator - name: RELATED_IMAGE_CERT_MANAGER_WEBHOOK - value: quay.io/jetstack/cert-manager-webhook:v1.19.4 + value: quay.io/jetstack/cert-manager-webhook:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR - value: quay.io/jetstack/cert-manager-cainjector:v1.19.4 + value: quay.io/jetstack/cert-manager-cainjector:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CONTROLLER - value: quay.io/jetstack/cert-manager-controller:v1.19.4 + value: quay.io/jetstack/cert-manager-controller:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ACMESOLVER - value: quay.io/jetstack/cert-manager-acmesolver:v1.19.4 + value: quay.io/jetstack/cert-manager-acmesolver:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ISTIOCSR value: quay.io/jetstack/cert-manager-istio-csr:v0.16.0 - name: RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER value: quay.io/jetstack/trust-manager:v0.20.3 - name: OPERAND_IMAGE_VERSION - value: 1.19.4 + value: 1.20.3 - name: ISTIOCSR_OPERAND_IMAGE_VERSION value: 0.16.0 - name: TRUSTMANAGER_OPERAND_IMAGE_VERSION value: 0.20.3 - name: OPERATOR_IMAGE_VERSION - value: 1.19.0 + value: 1.20.0 - name: OPERATOR_LOG_LEVEL value: '2' - name: TRUSTED_CA_CONFIGMAP_NAME diff --git a/assets/optional/cert-manager/rbac/role.yaml b/assets/optional/cert-manager/rbac/role.yaml index ed4472e77d..f5d902e214 100644 --- a/assets/optional/cert-manager/rbac/role.yaml +++ b/assets/optional/cert-manager/rbac/role.yaml @@ -106,8 +106,10 @@ rules: - certificates/finalizers - certificates/status - clusterissuers + - clusterissuers/finalizers - clusterissuers/status - issuers + - issuers/finalizers - issuers/status verbs: - create @@ -153,6 +155,14 @@ rules: - sign - update - watch +- apiGroups: + - config.openshift.io + resources: + - apiservers + verbs: + - get + - list + - watch - apiGroups: - config.openshift.io resources: @@ -168,6 +178,15 @@ rules: - patch - update - watch +- apiGroups: + - console.openshift.io + resources: + - consolequickstarts + - consoleyamlsamples + verbs: + - create + - get + - update - apiGroups: - coordination.k8s.io resources: @@ -187,6 +206,8 @@ rules: - gateways/finalizers - httproutes - httproutes/finalizers + - listenersets + - listenersets/finalizers verbs: - create - delete diff --git a/assets/optional/cert-manager/release-cert-manager-aarch64.json b/assets/optional/cert-manager/release-cert-manager-aarch64.json index 3ca93137d5..765844424e 100644 --- a/assets/optional/cert-manager/release-cert-manager-aarch64.json +++ b/assets/optional/cert-manager/release-cert-manager-aarch64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70" } } diff --git a/assets/optional/cert-manager/release-cert-manager-x86_64.json b/assets/optional/cert-manager/release-cert-manager-x86_64.json index ec4fd389b9..6cc5e4ea51 100644 --- a/assets/optional/cert-manager/release-cert-manager-x86_64.json +++ b/assets/optional/cert-manager/release-cert-manager-x86_64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa" } } diff --git a/assets/optional/kube-state-metrics/01-cluster-role.yaml b/assets/optional/kube-state-metrics/01-cluster-role.yaml index 75cd4e5d26..01958791a5 100644 --- a/assets/optional/kube-state-metrics/01-cluster-role.yaml +++ b/assets/optional/kube-state-metrics/01-cluster-role.yaml @@ -97,7 +97,11 @@ rules: - apiGroups: - admissionregistration.k8s.io resources: + - mutatingadmissionpolicies + - mutatingadmissionpolicybindings - mutatingwebhookconfigurations + - validatingadmissionpolicies + - validatingadmissionpolicybindings - validatingwebhookconfigurations verbs: - list diff --git a/assets/optional/kube-state-metrics/03-deployment.yaml b/assets/optional/kube-state-metrics/03-deployment.yaml index 37d3f657e7..adc5538666 100644 --- a/assets/optional/kube-state-metrics/03-deployment.yaml +++ b/assets/optional/kube-state-metrics/03-deployment.yaml @@ -84,7 +84,7 @@ spec: - --upstream=http://127.0.0.1:8081/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-main @@ -110,8 +110,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true - args: - --secure-listen-address=:9443 @@ -119,7 +119,7 @@ spec: - --upstream=http://127.0.0.1:8082/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-self @@ -145,8 +145,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true nodeSelector: kubernetes.io/os: linux @@ -166,6 +166,7 @@ spec: - configMap: name: kube-state-metrics-custom-resource-state-configmap name: kube-state-metrics-custom-resource-state-configmap - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca diff --git a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml index b400ac1e80..4ce2d46ede 100644 --- a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:ce7fa5ab7b13cdf48cc9c9322374d902dc21cf33e1e7004c333fa4cdee789464 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373 + digest: sha256:53bd7a49e65dae9c58e55384d9f6b8b8e5a69c0aa18f9473ef5855a822c35896 diff --git a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml index a080d292b4..ad14034acd 100644 --- a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:bbe67adb410fa29a46c0b09ac784892cf77c5ebcb619df9ab9b8f1a4566a8af4 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d + digest: sha256:df70f7b41e64d230d6532bd290ff0017dc1adbeedc2e940b3a55ad8872cf53d5 diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json index da01a2f081..2fb436bd5f 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:53bd7a49e65dae9c58e55384d9f6b8b8e5a69c0aa18f9473ef5855a822c35896" } } diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json index dfdae05ea2..d0c18f761e 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-09-023423" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:df70f7b41e64d230d6532bd290ff0017dc1adbeedc2e940b3a55ad8872cf53d5" } } diff --git a/assets/optional/metrics-server/kustomization.aarch64.yaml b/assets/optional/metrics-server/kustomization.aarch64.yaml index 0a79cdb357..ec5b5286e2 100644 --- a/assets/optional/metrics-server/kustomization.aarch64.yaml +++ b/assets/optional/metrics-server/kustomization.aarch64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec + digest: sha256:6df51eb1d2ada86ab57475752ef07eabdacb4a95601ea75b18a51b954824d14e diff --git a/assets/optional/metrics-server/kustomization.x86_64.yaml b/assets/optional/metrics-server/kustomization.x86_64.yaml index 49529cad12..6e7f771d1e 100644 --- a/assets/optional/metrics-server/kustomization.x86_64.yaml +++ b/assets/optional/metrics-server/kustomization.x86_64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c + digest: sha256:0c1090dc9507edb3b08fedc5a066441871504245f2156c2ca22f602bfd2b269a diff --git a/assets/optional/metrics-server/release-metrics-server-aarch64.json b/assets/optional/metrics-server/release-metrics-server-aarch64.json index c12ffcbb53..d2e4bf66a6 100644 --- a/assets/optional/metrics-server/release-metrics-server-aarch64.json +++ b/assets/optional/metrics-server/release-metrics-server-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6df51eb1d2ada86ab57475752ef07eabdacb4a95601ea75b18a51b954824d14e" } } diff --git a/assets/optional/metrics-server/release-metrics-server-x86_64.json b/assets/optional/metrics-server/release-metrics-server-x86_64.json index 57ab6cbd6a..25564763f1 100644 --- a/assets/optional/metrics-server/release-metrics-server-x86_64.json +++ b/assets/optional/metrics-server/release-metrics-server-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-09-023423" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0c1090dc9507edb3b08fedc5a066441871504245f2156c2ca22f602bfd2b269a" } } diff --git a/assets/optional/node-exporter/01-cluster-role-binding.yaml b/assets/optional/node-exporter/01-cluster-role-binding.yaml index b6790fa9b4..1eeb01cea5 100644 --- a/assets/optional/node-exporter/01-cluster-role-binding.yaml +++ b/assets/optional/node-exporter/01-cluster-role-binding.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/optional/node-exporter/01-cluster-role.yaml b/assets/optional/node-exporter/01-cluster-role.yaml index 50d7a5e755..838a5ad733 100644 --- a/assets/optional/node-exporter/01-cluster-role.yaml +++ b/assets/optional/node-exporter/01-cluster-role.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter rules: - apiGroups: diff --git a/assets/optional/node-exporter/01-service-account.yaml b/assets/optional/node-exporter/01-service-account.yaml index c3d1dc95c9..e5210365d1 100644 --- a/assets/optional/node-exporter/01-service-account.yaml +++ b/assets/optional/node-exporter/01-service-account.yaml @@ -7,6 +7,6 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring diff --git a/assets/optional/node-exporter/03-daemonset.yaml b/assets/optional/node-exporter/03-daemonset.yaml index 8a384935f0..f098c564ff 100644 --- a/assets/optional/node-exporter/03-daemonset.yaml +++ b/assets/optional/node-exporter/03-daemonset.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: @@ -27,7 +27,7 @@ spec: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 spec: automountServiceAccountToken: true containers: @@ -66,7 +66,8 @@ spec: requests: cpu: 8m memory: 32Mi - securityContext: {} + securityContext: + readOnlyRootFilesystem: true terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /host/sys @@ -90,7 +91,7 @@ spec: - --upstream=http://127.0.0.1:9101/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml env: - name: IP @@ -126,8 +127,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: node-exporter-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true hostNetwork: true hostPID: true @@ -147,6 +148,7 @@ spec: memory: 1Mi securityContext: privileged: true + readOnlyRootFilesystem: true runAsUser: 0 terminationMessagePolicy: FallbackToLogsOnError volumeMounts: @@ -189,9 +191,10 @@ spec: path: config.yaml name: node-exporter-accelerators-collector-config name: node-exporter-accelerators-collector-config - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca updateStrategy: rollingUpdate: maxUnavailable: 10% diff --git a/assets/optional/node-exporter/04-service.yaml b/assets/optional/node-exporter/04-service.yaml index 37b420ccdb..5f570b5dc9 100644 --- a/assets/optional/node-exporter/04-service.yaml +++ b/assets/optional/node-exporter/04-service.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: diff --git a/assets/optional/node-exporter/kustomization.aarch64.yaml b/assets/optional/node-exporter/kustomization.aarch64.yaml index 7686f7f2ba..34740f6680 100644 --- a/assets/optional/node-exporter/kustomization.aarch64.yaml +++ b/assets/optional/node-exporter/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:ce7fa5ab7b13cdf48cc9c9322374d902dc21cf33e1e7004c333fa4cdee789464 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9 + digest: sha256:ef715f41206bd4a75b104774fb3394a9851ca8fd98763ad69a3bdaf1983c412d diff --git a/assets/optional/node-exporter/kustomization.x86_64.yaml b/assets/optional/node-exporter/kustomization.x86_64.yaml index c3c1e34433..7a782b21dc 100644 --- a/assets/optional/node-exporter/kustomization.x86_64.yaml +++ b/assets/optional/node-exporter/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:bbe67adb410fa29a46c0b09ac784892cf77c5ebcb619df9ab9b8f1a4566a8af4 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9 + digest: sha256:c0158f3407caf586a687f176127cfd072aeecb8b4b1db7485fc7668dd8660989 diff --git a/assets/optional/node-exporter/release-node-exporter-aarch64.json b/assets/optional/node-exporter/release-node-exporter-aarch64.json index a1e3d0ae0f..710f15fa52 100644 --- a/assets/optional/node-exporter/release-node-exporter-aarch64.json +++ b/assets/optional/node-exporter/release-node-exporter-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef715f41206bd4a75b104774fb3394a9851ca8fd98763ad69a3bdaf1983c412d" } } diff --git a/assets/optional/node-exporter/release-node-exporter-x86_64.json b/assets/optional/node-exporter/release-node-exporter-x86_64.json index 399aa1c470..7f55536368 100644 --- a/assets/optional/node-exporter/release-node-exporter-x86_64.json +++ b/assets/optional/node-exporter/release-node-exporter-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-09-023423" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c0158f3407caf586a687f176127cfd072aeecb8b4b1db7485fc7668dd8660989" } } From 51744a8ffd3db93cd2b70b513684de256b0f7274 Mon Sep 17 00:00:00 2001 From: "microshift-rebase-script[bot]" <114237296+microshift-rebase-script[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 04:32:09 +0000 Subject: [PATCH 3/3] update last_rebase_cluster_monitoring_operator.sh --- scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh index f61200df82..bed407ddc3 100755 --- a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh +++ b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-06-19-155631" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-06-19-154904" +./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.1.0-0.nightly-2026-09-09-023423" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.1.0-0.nightly-arm64-2026-08-25-194037"