diff --git a/Makefile.kube_git.var b/Makefile.kube_git.var index f4ad85c36e..ee45d001de 100644 --- a/Makefile.kube_git.var +++ b/Makefile.kube_git.var @@ -1,5 +1,5 @@ KUBE_GIT_MAJOR=1 KUBE_GIT_MINOR=36 KUBE_GIT_VERSION=v1.36.3 -KUBE_GIT_COMMIT=fb553cd105957b64651b393cb1a42f59faab190e +KUBE_GIT_COMMIT=c85a8c489d53f97824059d92f706a5e1a65f97fa KUBE_GIT_TREE_STATE=clean diff --git a/Makefile.version.x86_64.var b/Makefile.version.x86_64.var index 211a9541d3..18b22de4c7 100644 --- a/Makefile.version.x86_64.var +++ b/Makefile.version.x86_64.var @@ -1 +1 @@ -OCP_VERSION := 5.1.0-0.nightly-2026-09-09-023423 +OCP_VERSION := 5.1.0-0.nightly-2026-09-13-222843 diff --git a/assets/components/multus/kustomization.x86_64.yaml b/assets/components/multus/kustomization.x86_64.yaml index e9f787eba8..b9081b7aa4 100644 --- a/assets/components/multus/kustomization.x86_64.yaml +++ b/assets/components/multus/kustomization.x86_64.yaml @@ -2,7 +2,7 @@ images: - name: multus-cni-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:f584fbe270e24f6b3681b1e9d6de6822cabf98c4a4f380ef33b847ecb97eda3d + digest: sha256:4378f3b30129d797c146b5cd83daf144b904e74a96b8d632bd602484628448f1 - name: containernetworking-plugins-microshift newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:e1041d31b9433259ea41f158f4235be626cfa95ce3d2d2d78ca5d2290ee12a37 + digest: sha256:3881299fe6e23a481672a1cd6871ed0156ecf0b0551d76def0950c9c1195712e diff --git a/assets/components/multus/release-multus-x86_64.json b/assets/components/multus/release-multus-x86_64.json index 36a481b27c..55489cb7a3 100644 --- a/assets/components/multus/release-multus-x86_64.json +++ b/assets/components/multus/release-multus-x86_64.json @@ -1,9 +1,9 @@ { "release": { - "base": "5.1.0-0.nightly-2026-09-09-023423" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f584fbe270e24f6b3681b1e9d6de6822cabf98c4a4f380ef33b847ecb97eda3d", - "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e1041d31b9433259ea41f158f4235be626cfa95ce3d2d2d78ca5d2290ee12a37" + "multus-cni-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4378f3b30129d797c146b5cd83daf144b904e74a96b8d632bd602484628448f1", + "containernetworking-plugins-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3881299fe6e23a481672a1cd6871ed0156ecf0b0551d76def0950c9c1195712e" } } diff --git a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml index f516121c12..840955ee9a 100644 --- a/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificaterequests.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificaterequests.cert-manager.io spec: group: cert-manager.io @@ -314,6 +314,10 @@ spec: type: string type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml index 4e063e0b86..74d51a799b 100644 --- a/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/certificates.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: certificates.cert-manager.io spec: group: cert-manager.io @@ -453,9 +453,6 @@ spec: will be generated whenever a re-issuance occurs. Default is `Always`. The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - The new default can be disabled by setting the - `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on - the controller component. enum: - Never - Always @@ -811,6 +808,10 @@ spec: type: integer type: object type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml index 2e33aab7f7..d7207f0013 100644 --- a/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/challenges.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: challenges.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -285,6 +285,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -408,7 +424,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -458,8 +474,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -467,8 +483,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -557,8 +573,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -1915,9 +1931,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3126,9 +3143,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3276,6 +3294,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml index 42e8410a9e..7bb683271b 100644 --- a/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/clusterissuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: clusterissuers.cert-manager.io spec: group: cert-manager.io @@ -398,6 +398,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -521,7 +537,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -571,8 +587,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -580,8 +596,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -670,8 +686,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2028,9 +2044,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3239,9 +3256,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3498,8 +3516,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3627,16 +3645,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3654,7 +3672,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3662,13 +3680,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3676,7 +3694,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3697,7 +3715,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3711,7 +3729,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3720,8 +3738,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml index 44ddc33b35..dab8da6d11 100644 --- a/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/issuers.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: issuers.cert-manager.io spec: group: cert-manager.io @@ -397,6 +397,22 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string required: - resourceGroupName - subscriptionID @@ -520,7 +536,7 @@ spec: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string protocol: @@ -570,8 +586,8 @@ spec: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -579,8 +595,8 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -669,8 +685,8 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials properties: key: @@ -2027,9 +2043,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3238,9 +3255,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3497,8 +3515,8 @@ spec: properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string type: array @@ -3626,16 +3644,16 @@ spec: type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -3653,7 +3671,7 @@ spec: type: object url: description: |- - URL is the base URL for Venafi Cloud. + URL is the base URL for CyberArk Certificate Manager SaaS. Defaults to "https://api.venafi.cloud/". type: string required: @@ -3661,13 +3679,13 @@ spec: type: object tpp: description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. format: byte @@ -3675,7 +3693,7 @@ spec: caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. @@ -3696,7 +3714,7 @@ spec: type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. properties: @@ -3710,7 +3728,7 @@ spec: type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string required: @@ -3719,8 +3737,8 @@ spec: type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml index 1bacdf1805..015e301fda 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_certmanagers.yaml @@ -289,9 +289,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -570,9 +571,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -1165,9 +1167,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml index 65fb665887..7a47c4fc46 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_istiocsrs.yaml @@ -1335,9 +1335,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml index 74633abc4e..0a334f47d6 100644 --- a/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml +++ b/assets/optional/cert-manager/crd/bases/operator.openshift.io_trustmanagers.yaml @@ -1185,9 +1185,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- diff --git a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml index 94eddfa124..47c633abbc 100644 --- a/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml +++ b/assets/optional/cert-manager/crd/bases/orders.acme.cert-manager.io-crd.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/component: crds app.kubernetes.io/instance: cert-manager app.kubernetes.io/name: cert-manager - app.kubernetes.io/version: v1.19.4 + app.kubernetes.io/version: v1.20.3 name: orders.acme.cert-manager.io spec: group: acme.cert-manager.io @@ -269,6 +269,10 @@ spec: - metadata - spec type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: diff --git a/assets/optional/cert-manager/manager/images-aarch64.yaml b/assets/optional/cert-manager/manager/images-aarch64.yaml index ec583c84d7..c028a761e5 100644 --- a/assets/optional/cert-manager/manager/images-aarch64.yaml +++ b/assets/optional/cert-manager/manager/images-aarch64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284 + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70 + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529 diff --git a/assets/optional/cert-manager/manager/images-x86_64.yaml b/assets/optional/cert-manager/manager/images-x86_64.yaml index fe3da1424f..d07286df86 100644 --- a/assets/optional/cert-manager/manager/images-x86_64.yaml +++ b/assets/optional/cert-manager/manager/images-x86_64.yaml @@ -4,10 +4,10 @@ metadata: name: cert-manager-images namespace: cert-manager data: - cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1 - cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8 - cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427 - controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e + cert-manager-webhook: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-ca-injector: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-controller: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa + cert-manager-acmesolver: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24 + cert-manager-istiocsr: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815 + controller: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542 cert-manager-trust-manager: registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68 diff --git a/assets/optional/cert-manager/manager/manager.yaml b/assets/optional/cert-manager/manager/manager.yaml index a19ad2cf8b..af071a2b72 100644 --- a/assets/optional/cert-manager/manager/manager.yaml +++ b/assets/optional/cert-manager/manager/manager.yaml @@ -75,25 +75,25 @@ spec: - name: OPERATOR_NAME value: cert-manager-operator - name: RELATED_IMAGE_CERT_MANAGER_WEBHOOK - value: quay.io/jetstack/cert-manager-webhook:v1.19.4 + value: quay.io/jetstack/cert-manager-webhook:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR - value: quay.io/jetstack/cert-manager-cainjector:v1.19.4 + value: quay.io/jetstack/cert-manager-cainjector:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_CONTROLLER - value: quay.io/jetstack/cert-manager-controller:v1.19.4 + value: quay.io/jetstack/cert-manager-controller:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ACMESOLVER - value: quay.io/jetstack/cert-manager-acmesolver:v1.19.4 + value: quay.io/jetstack/cert-manager-acmesolver:v1.20.3 - name: RELATED_IMAGE_CERT_MANAGER_ISTIOCSR value: quay.io/jetstack/cert-manager-istio-csr:v0.16.0 - name: RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER value: quay.io/jetstack/trust-manager:v0.20.3 - name: OPERAND_IMAGE_VERSION - value: 1.19.4 + value: 1.20.3 - name: ISTIOCSR_OPERAND_IMAGE_VERSION value: 0.16.0 - name: TRUSTMANAGER_OPERAND_IMAGE_VERSION value: 0.20.3 - name: OPERATOR_IMAGE_VERSION - value: 1.19.0 + value: 1.20.0 - name: OPERATOR_LOG_LEVEL value: '2' - name: TRUSTED_CA_CONFIGMAP_NAME diff --git a/assets/optional/cert-manager/rbac/role.yaml b/assets/optional/cert-manager/rbac/role.yaml index ed4472e77d..f5d902e214 100644 --- a/assets/optional/cert-manager/rbac/role.yaml +++ b/assets/optional/cert-manager/rbac/role.yaml @@ -106,8 +106,10 @@ rules: - certificates/finalizers - certificates/status - clusterissuers + - clusterissuers/finalizers - clusterissuers/status - issuers + - issuers/finalizers - issuers/status verbs: - create @@ -153,6 +155,14 @@ rules: - sign - update - watch +- apiGroups: + - config.openshift.io + resources: + - apiservers + verbs: + - get + - list + - watch - apiGroups: - config.openshift.io resources: @@ -168,6 +178,15 @@ rules: - patch - update - watch +- apiGroups: + - console.openshift.io + resources: + - consolequickstarts + - consoleyamlsamples + verbs: + - create + - get + - update - apiGroups: - coordination.k8s.io resources: @@ -187,6 +206,8 @@ rules: - gateways/finalizers - httproutes - httproutes/finalizers + - listenersets + - listenersets/finalizers verbs: - create - delete diff --git a/assets/optional/cert-manager/release-cert-manager-aarch64.json b/assets/optional/cert-manager/release-cert-manager-aarch64.json index 3ca93137d5..765844424e 100644 --- a/assets/optional/cert-manager/release-cert-manager-aarch64.json +++ b/assets/optional/cert-manager/release-cert-manager-aarch64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:95f0078a7d626ba7dbb6ad0b081124fdf85d4cf3ae3e051a5c72e45ccd17c284", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:d2ee0d44bf8cc001f982bf9abe84d9a41852db4fe3b6cd4939db6ed6f00f3c7a", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4772792109e65d30e0a1838f1d4db6708bf34664440e62fa9f4ffc834b235802", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a0805907ffdb84f69313cc5d9673ba080737ed9150e9fdff6bcba1c8a34ca2f1", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:3f10c707305e25f91dc495b5c547a0bf8cdaeffe7ecce22acdd380a4fd5e2529", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:2fc3f09ab5195c8b1f105a871aea45fd07958adaf9a6aed9650fcc65465ed293", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:4cc93d8ef2f67bad59fbaa623e43d5ed2223169bce748adcdd242beae2d1c1bb" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c7eb92be1e699143736b0b78f79b4e49ef2621c08f7df13519a65ad79aaa641e", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:7392848d7fbd47b77d03869e60fcd86f849bb342f89d5426dbddb31af5a53b70" } } diff --git a/assets/optional/cert-manager/release-cert-manager-x86_64.json b/assets/optional/cert-manager/release-cert-manager-x86_64.json index ec4fd389b9..6cc5e4ea51 100644 --- a/assets/optional/cert-manager/release-cert-manager-x86_64.json +++ b/assets/optional/cert-manager/release-cert-manager-x86_64.json @@ -1,14 +1,14 @@ { "release": { - "base": "1.19.0" + "base": "1.20.0" }, "images": { - "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:708361988343fb0fc9c10ebdc6a05de75ed038918ece0b7a91888e2cc74f644e", - "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:a4111417451c83ddf9af3a045a10e0d39bd0f4cf8f7bcc1992d6fcbd980f0427", + "cert-manager-operator": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:9207cabe93f5133f56756aef5d72a5f588a3db96f1be8494e1b9aa139fcce542", + "cert-manager-istiocsr": "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:815517b1210632cf5e307aea4052355534b1955ce154d3cd0a637eb942fff815", "cert-manager-trust-manager": "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:c6b5e8b2779e64004c198d55750a0a0978478148ba7675f2ce9d2c5097708a68", - "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:22d0f5ed590ad447441f6cf115de3bead3b4d62dfb475622389f847664b4cde8", - "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1", - "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:67bb018311dbb0435fd3396f9132aa33db43da9cdef92e4fe17a6c55e66c8de1" + "cert-manager-acmesolver": "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:6806f7194b8d3c4d894caa1821d40a52b72a433f19f8470bcd6e5c90b8667f24", + "cert-manager-webhook": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-ca-injector": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa", + "cert-manager-controller": "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:681a5f3e02131df294a2b83933584403fe4035d43d98530a13f83a77f71171fa" } } diff --git a/assets/optional/kube-state-metrics/01-cluster-role.yaml b/assets/optional/kube-state-metrics/01-cluster-role.yaml index 75cd4e5d26..01958791a5 100644 --- a/assets/optional/kube-state-metrics/01-cluster-role.yaml +++ b/assets/optional/kube-state-metrics/01-cluster-role.yaml @@ -97,7 +97,11 @@ rules: - apiGroups: - admissionregistration.k8s.io resources: + - mutatingadmissionpolicies + - mutatingadmissionpolicybindings - mutatingwebhookconfigurations + - validatingadmissionpolicies + - validatingadmissionpolicybindings - validatingwebhookconfigurations verbs: - list diff --git a/assets/optional/kube-state-metrics/03-deployment.yaml b/assets/optional/kube-state-metrics/03-deployment.yaml index 37d3f657e7..adc5538666 100644 --- a/assets/optional/kube-state-metrics/03-deployment.yaml +++ b/assets/optional/kube-state-metrics/03-deployment.yaml @@ -84,7 +84,7 @@ spec: - --upstream=http://127.0.0.1:8081/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-main @@ -110,8 +110,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true - args: - --secure-listen-address=:9443 @@ -119,7 +119,7 @@ spec: - --upstream=http://127.0.0.1:8082/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml image: "quay.io/openshift/kube-rbac-proxy" name: kube-rbac-proxy-self @@ -145,8 +145,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: kube-state-metrics-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true nodeSelector: kubernetes.io/os: linux @@ -166,6 +166,7 @@ spec: - configMap: name: kube-state-metrics-custom-resource-state-configmap name: kube-state-metrics-custom-resource-state-configmap - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca diff --git a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml index b400ac1e80..4ce2d46ede 100644 --- a/assets/optional/kube-state-metrics/kustomization.aarch64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:ce7fa5ab7b13cdf48cc9c9322374d902dc21cf33e1e7004c333fa4cdee789464 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373 + digest: sha256:53bd7a49e65dae9c58e55384d9f6b8b8e5a69c0aa18f9473ef5855a822c35896 diff --git a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml index a080d292b4..f06f8b52b4 100644 --- a/assets/optional/kube-state-metrics/kustomization.x86_64.yaml +++ b/assets/optional/kube-state-metrics/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:2129afeaf7fe8fa15f02eb4715badf0607b2f79c7e9e13cd9537992cb357a0d9 - name: quay.io/openshift/kube-state-metrics newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d + digest: sha256:ac7ccd69ce16d68d49a2d1eb1c30d98c12735926e0810549002a855263fc407f diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json index da01a2f081..2fb436bd5f 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c01bcfe85cec4ea6a2c93f71793d292fd0f2be9d7176fa9b8b5fb63d3a773373" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:53bd7a49e65dae9c58e55384d9f6b8b8e5a69c0aa18f9473ef5855a822c35896" } } diff --git a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json index dfdae05ea2..b4c05b9485 100644 --- a/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json +++ b/assets/optional/kube-state-metrics/release-kube-state-metrics-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4a633470960127f9545b5509dafd8d423108edb74ca7013c9cddde4ff5b0332d" + "kube_state_metrics": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ac7ccd69ce16d68d49a2d1eb1c30d98c12735926e0810549002a855263fc407f" } } diff --git a/assets/optional/metrics-server/kustomization.aarch64.yaml b/assets/optional/metrics-server/kustomization.aarch64.yaml index 0a79cdb357..ec5b5286e2 100644 --- a/assets/optional/metrics-server/kustomization.aarch64.yaml +++ b/assets/optional/metrics-server/kustomization.aarch64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec + digest: sha256:6df51eb1d2ada86ab57475752ef07eabdacb4a95601ea75b18a51b954824d14e diff --git a/assets/optional/metrics-server/kustomization.x86_64.yaml b/assets/optional/metrics-server/kustomization.x86_64.yaml index 49529cad12..0ecc68b834 100644 --- a/assets/optional/metrics-server/kustomization.x86_64.yaml +++ b/assets/optional/metrics-server/kustomization.x86_64.yaml @@ -1,4 +1,4 @@ images: - name: quay.io/openshift/kube-metrics-server newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c + digest: sha256:53b38625f68715d3bb3671175ef4de90ceed0acc6b600ac3e64a97934ea1a4c9 diff --git a/assets/optional/metrics-server/release-metrics-server-aarch64.json b/assets/optional/metrics-server/release-metrics-server-aarch64.json index c12ffcbb53..d2e4bf66a6 100644 --- a/assets/optional/metrics-server/release-metrics-server-aarch64.json +++ b/assets/optional/metrics-server/release-metrics-server-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:790dcea1d4cf5eb3a989bf3d14d460148d23a743951644668a300b7fc21f29ec" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6df51eb1d2ada86ab57475752ef07eabdacb4a95601ea75b18a51b954824d14e" } } diff --git a/assets/optional/metrics-server/release-metrics-server-x86_64.json b/assets/optional/metrics-server/release-metrics-server-x86_64.json index 57ab6cbd6a..f900691be7 100644 --- a/assets/optional/metrics-server/release-metrics-server-x86_64.json +++ b/assets/optional/metrics-server/release-metrics-server-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0590e13d7955f71db964f601f5ce6c66416a1e2e5acee5c2831f41fb2b13435c" + "metrics_server": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:53b38625f68715d3bb3671175ef4de90ceed0acc6b600ac3e64a97934ea1a4c9" } } diff --git a/assets/optional/node-exporter/01-cluster-role-binding.yaml b/assets/optional/node-exporter/01-cluster-role-binding.yaml index b6790fa9b4..1eeb01cea5 100644 --- a/assets/optional/node-exporter/01-cluster-role-binding.yaml +++ b/assets/optional/node-exporter/01-cluster-role-binding.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/assets/optional/node-exporter/01-cluster-role.yaml b/assets/optional/node-exporter/01-cluster-role.yaml index 50d7a5e755..838a5ad733 100644 --- a/assets/optional/node-exporter/01-cluster-role.yaml +++ b/assets/optional/node-exporter/01-cluster-role.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter rules: - apiGroups: diff --git a/assets/optional/node-exporter/01-service-account.yaml b/assets/optional/node-exporter/01-service-account.yaml index c3d1dc95c9..e5210365d1 100644 --- a/assets/optional/node-exporter/01-service-account.yaml +++ b/assets/optional/node-exporter/01-service-account.yaml @@ -7,6 +7,6 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring diff --git a/assets/optional/node-exporter/03-daemonset.yaml b/assets/optional/node-exporter/03-daemonset.yaml index 8a384935f0..f098c564ff 100644 --- a/assets/optional/node-exporter/03-daemonset.yaml +++ b/assets/optional/node-exporter/03-daemonset.yaml @@ -6,7 +6,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: @@ -27,7 +27,7 @@ spec: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 spec: automountServiceAccountToken: true containers: @@ -66,7 +66,8 @@ spec: requests: cpu: 8m memory: 32Mi - securityContext: {} + securityContext: + readOnlyRootFilesystem: true terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /host/sys @@ -90,7 +91,7 @@ spec: - --upstream=http://127.0.0.1:9101/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key - - --client-ca-file=/etc/tls/client/client-ca.crt + - --client-ca-file=/etc/tls/client-ca/ca.crt - --config-file=/etc/kube-rbac-policy/config.yaml env: - name: IP @@ -126,8 +127,8 @@ spec: - mountPath: /etc/kube-rbac-policy name: node-exporter-kube-rbac-proxy-config readOnly: true - - mountPath: /etc/tls/client - name: metrics-client-ca + - mountPath: /etc/tls/client-ca/ca.crt + name: admin-kubeconfig-signer-ca readOnly: true hostNetwork: true hostPID: true @@ -147,6 +148,7 @@ spec: memory: 1Mi securityContext: privileged: true + readOnlyRootFilesystem: true runAsUser: 0 terminationMessagePolicy: FallbackToLogsOnError volumeMounts: @@ -189,9 +191,10 @@ spec: path: config.yaml name: node-exporter-accelerators-collector-config name: node-exporter-accelerators-collector-config - - configMap: - name: metrics-client-ca - name: metrics-client-ca + - hostPath: + path: /var/lib/microshift/certs/admin-kubeconfig-signer/ca.crt + type: File + name: admin-kubeconfig-signer-ca updateStrategy: rollingUpdate: maxUnavailable: 10% diff --git a/assets/optional/node-exporter/04-service.yaml b/assets/optional/node-exporter/04-service.yaml index 37b420ccdb..5f570b5dc9 100644 --- a/assets/optional/node-exporter/04-service.yaml +++ b/assets/optional/node-exporter/04-service.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/managed-by: cluster-monitoring-operator app.kubernetes.io/name: node-exporter app.kubernetes.io/part-of: openshift-monitoring - app.kubernetes.io/version: 1.11.1 + app.kubernetes.io/version: 1.12.1 name: node-exporter namespace: openshift-monitoring spec: diff --git a/assets/optional/node-exporter/kustomization.aarch64.yaml b/assets/optional/node-exporter/kustomization.aarch64.yaml index 7686f7f2ba..34740f6680 100644 --- a/assets/optional/node-exporter/kustomization.aarch64.yaml +++ b/assets/optional/node-exporter/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:8a74d54a45421f51cfc1d50b7fca04e177c8601cec4cf5ecfdac250e36904819 + digest: sha256:ce7fa5ab7b13cdf48cc9c9322374d902dc21cf33e1e7004c333fa4cdee789464 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9 + digest: sha256:ef715f41206bd4a75b104774fb3394a9851ca8fd98763ad69a3bdaf1983c412d diff --git a/assets/optional/node-exporter/kustomization.x86_64.yaml b/assets/optional/node-exporter/kustomization.x86_64.yaml index c3c1e34433..a82fb9f820 100644 --- a/assets/optional/node-exporter/kustomization.x86_64.yaml +++ b/assets/optional/node-exporter/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:b23eabd4a8578c71398ccde56be77ded55c7cbea36e592f3800347c33ca47c55 + digest: sha256:2129afeaf7fe8fa15f02eb4715badf0607b2f79c7e9e13cd9537992cb357a0d9 - name: quay.io/openshift/node-exporter newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9 + digest: sha256:e71be142b87f066e7afb65629c6d9b2db2cb41e93adf1ac477bffafa39f21ee3 diff --git a/assets/optional/node-exporter/release-node-exporter-aarch64.json b/assets/optional/node-exporter/release-node-exporter-aarch64.json index a1e3d0ae0f..710f15fa52 100644 --- a/assets/optional/node-exporter/release-node-exporter-aarch64.json +++ b/assets/optional/node-exporter/release-node-exporter-aarch64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-arm64-2026-06-19-154904" + "base": "5.1.0-0.nightly-arm64-2026-08-25-194037" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b908cd047a093dd789377c350e13832eb8dee38964b07e2f67a8c3cf1c9a5fc9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ef715f41206bd4a75b104774fb3394a9851ca8fd98763ad69a3bdaf1983c412d" } } diff --git a/assets/optional/node-exporter/release-node-exporter-x86_64.json b/assets/optional/node-exporter/release-node-exporter-x86_64.json index 399aa1c470..274c7c33eb 100644 --- a/assets/optional/node-exporter/release-node-exporter-x86_64.json +++ b/assets/optional/node-exporter/release-node-exporter-x86_64.json @@ -1,8 +1,8 @@ { "release": { - "base": "5.0.0-0.nightly-2026-06-19-155631" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:c39c86b8b8b39ff6db9818e1a4f7dcde73d26ee427bded9c772bfe477ec020f9" + "node_exporter": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:e71be142b87f066e7afb65629c6d9b2db2cb41e93adf1ac477bffafa39f21ee3" } } diff --git a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml index 57f9c98347..a63c31dfc9 100644 --- a/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml +++ b/assets/optional/operator-lifecycle-manager/kustomization.x86_64.yaml @@ -2,13 +2,13 @@ images: - name: quay.io/operator-framework/olm newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:67d7f46aaa9c2c4cafc65ce5b97e47ab271065fbbfa647c05e4ea07d1b426e14 + digest: sha256:0ec2e9e153c603178408b67a8feb7d4dda9a1c9725eb4b11e680335516832e62 - name: quay.io/operator-framework/configmap-operator-registry newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:a7e06b28b6446aec5f61696cbae0d18ab67b867859f4d0e88c69829795111223 + digest: sha256:40b5e87d7bf997502d88f1095d4351ce597467c4d70017c482027e862b3d079e - name: quay.io/openshift/origin-kube-rbac-proxy newName: quay.io/openshift-release-dev/ocp-v5.0-art-dev - digest: sha256:bbe67adb410fa29a46c0b09ac784892cf77c5ebcb619df9ab9b8f1a4566a8af4 + digest: sha256:2129afeaf7fe8fa15f02eb4715badf0607b2f79c7e9e13cd9537992cb357a0d9 patches: - patch: |- @@ -16,12 +16,12 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: OPERATOR_REGISTRY_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a7e06b28b6446aec5f61696cbae0d18ab67b867859f4d0e88c69829795111223 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:40b5e87d7bf997502d88f1095d4351ce597467c4d70017c482027e862b3d079e - op: add path: /spec/template/spec/containers/0/env/- value: name: OLM_IMAGE - value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:67d7f46aaa9c2c4cafc65ce5b97e47ab271065fbbfa647c05e4ea07d1b426e14 + value: quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0ec2e9e153c603178408b67a8feb7d4dda9a1c9725eb4b11e680335516832e62 target: kind: Deployment labelSelector: app=catalog-operator diff --git a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json index e9f4135361..f81cf39168 100644 --- a/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json +++ b/assets/optional/operator-lifecycle-manager/release-olm-x86_64.json @@ -1,10 +1,10 @@ { "release": { - "base": "5.1.0-0.nightly-2026-09-09-023423" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:67d7f46aaa9c2c4cafc65ce5b97e47ab271065fbbfa647c05e4ea07d1b426e14", - "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:a7e06b28b6446aec5f61696cbae0d18ab67b867859f4d0e88c69829795111223", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:bbe67adb410fa29a46c0b09ac784892cf77c5ebcb619df9ab9b8f1a4566a8af4" + "operator-lifecycle-manager": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0ec2e9e153c603178408b67a8feb7d4dda9a1c9725eb4b11e680335516832e62", + "operator-registry": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:40b5e87d7bf997502d88f1095d4351ce597467c4d70017c482027e862b3d079e", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2129afeaf7fe8fa15f02eb4715badf0607b2f79c7e9e13cd9537992cb357a0d9" } } diff --git a/assets/optional/sriov/kustomization.aarch64.yaml b/assets/optional/sriov/kustomization.aarch64.yaml index 82da5afec6..1ee8c1becf 100644 --- a/assets/optional/sriov/kustomization.aarch64.yaml +++ b/assets/optional/sriov/kustomization.aarch64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:fa8842e90bdfb063a0905a6c5d4c38921a76c26c69c3e457e285ebb485d92b79 + digest: sha256:822f74437bf45bf32ba823866f8456853bfcba8355581e77a6d14989ca81779d patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:b0ef30fba338f84b7bd55263a7cfbcaa1b26d9250168d64cc070e6cb59ffb54d + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:7fd2ee3f4ac7846ac53078b7edd54ae57a53db4c257ea617fdbb4897a49b555b - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:d781b7cb9d9ff24e65bba0952b5ff3d497ef57c793a9d8f61be05280161c59df + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:6eb36e2a993d3aa6a59bf4ebb161e4c8f617774d74ac1178f5ac971ed312f0c2 - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:134a9a987d92bb096b907683eda6b11356a25f36cc250547005cd5adfac5ad58 + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:12148c42c850b4c7edf72a8e680f9e10f570e67079b93be29c7fde8eb4cedb59 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:1dc91b3f4b179238a9dd28af0ff96bcee2372334318bb993d1a7dd375d1fe604 + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:9bcdbef59453cfb23a9a095535e6fe33599489ac7dcb86a577fa7d7de90a9891 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:26c2ff752bc8ca0c6f871a011576ea37119cf6faa9ce19e5d0c09eb6793337e8 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7adcd3248e9a5c90355f6ef4aca0b79bcd775b5231a16a6a3d2cf024e83b781e - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:795b1f7e68082700afb002e64438039a2b9f7b9344ee4ce0e337c423d520bd7d + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7890b4a59a22f2f273d788fb351e359eff63f6094ed1a263460826f83edd2a73 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:235125ee33ae9ac4ea04900fe10f43dd82924d80c9a67e4e254087663e39a182 + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:2b761227d75564671d01b79c48b1a2709815f13096f0f9a548cef95ff1456895 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:558451961b85519cbfba0b18bca31252670b029f3334880fdf883bd95ae2e08f + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:e7bab22551a4d1ed82a69ef79ac8a5ece31154d4e86edc7e7fba16083bbb5f77 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:8db62f17937b3b012f07982f571cdaa6f20debd4b430cd45c9d7b1eb685218ab + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:eceecde87b67160808a94c084836f032e2189b0c4755f7a599b1c8a7f9bc20d6 target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/kustomization.x86_64.yaml b/assets/optional/sriov/kustomization.x86_64.yaml index 39456d05ed..b91a5d2535 100644 --- a/assets/optional/sriov/kustomization.x86_64.yaml +++ b/assets/optional/sriov/kustomization.x86_64.yaml @@ -1,7 +1,7 @@ images: - name: quay.io/openshift/sriov-network-operator newName: registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator - digest: sha256:6e3a47a6b981aa1098bfc9577f2952f2e8f327df98aa457eb733569d71ab0962 + digest: sha256:5560b500b236d58014148431365231ac4cab5189eb9954bc5eb267d464f9a668 patches: - patch: |- @@ -9,47 +9,47 @@ patches: path: /spec/template/spec/containers/0/env/- value: name: SRIOV_CNI_IMAGE - value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:1fbed333c800bc53482ac36bc23228f7a36e9e0cde0e3fb36a3e5e1d5ed52c93 + value: registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:a8f9543badc18942871ee031eb9bb564bd6777104a64fce3ab31a7a4121fea05 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_DEVICE_PLUGIN_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:2d05c5a47b3c338675a17ba4b094ce871b0b1543f7c33e278f34d53ee595aae9 + value: registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:1876564cfdd554ae2fb9f89e6e21f50f70b9e408283267140835497b3175c8be - op: add path: /spec/template/spec/containers/0/env/- value: name: NETWORK_RESOURCES_INJECTOR_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:f68dae14798312766c2bf6a7af24a5714ddfd15ead5609b4576c271cdd401ba7 + value: registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:6d01ac881f785e2cf9e1dde3cbd0fb1ba20a6ff9a31c719086312bc07c9bd6df - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_CONFIG_DAEMON_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:3006a70ebdb8de0923c5e180931b689c45fee332e5c636ac2cf3c0463e39f6eb + value: registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:7133373888c4fcb1811cff4d394768fb6ac2528ea261aeee4a71c88e5741955a - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_NETWORK_WEBHOOK_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:b8f1249fc9059d2468aa8ee3161479b75cf949f1c727017b5a81c07c64765bf8 + value: registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7d6e6393a1d9f0e6f890e2632c8ca99a80dba24419a513e6041d6d3046a08e32 - op: add path: /spec/template/spec/containers/0/env/- value: name: SRIOV_INFINIBAND_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:c034b3befc1e04eb7e5b2143c713ca285e8ff793b0d932560e512c71af4fb071 + value: registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:d7ec3e9927a3ecfcce368aabff983c95fc366a5eb4462b13f22208cb66e98af0 - op: add path: /spec/template/spec/containers/0/env/- value: name: RDMA_CNI_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e7e3fe749e5c978857420f1c03cf2f98cb0fc678979099d9cd8e4265f5e1688d + value: registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:ff9327664ca8dcb304b48b30f75406a7b455b23b18a28573b0c1d9c9380bb7e0 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_IMAGE - value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:19bf37bac7d9352f9afe28fe1a677e4f29952d106517f82e50ed52f181c9d250 + value: registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:9d75a6d2255323545f8f4eaa52ea4ec26901efa4f3f5271396fb789ff755cc06 - op: add path: /spec/template/spec/containers/0/env/- value: name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE - value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:2afe1e650f7a2bc2eb7ce312884b1269e46e09583911137ab152cedc3a022511 + value: registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:a2355cd4b9c7de7f92caac08b193a3f09603dc2fe46d941724c006f45e21ca08 target: kind: Deployment name: sriov-network-operator diff --git a/assets/optional/sriov/release-sriov-aarch64.json b/assets/optional/sriov/release-sriov-aarch64.json index 35af3ebb70..d06563156a 100644 --- a/assets/optional/sriov/release-sriov-aarch64.json +++ b/assets/optional/sriov/release-sriov-aarch64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202609011326" + "base": "4.21.0-202609090243" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:558451961b85519cbfba0b18bca31252670b029f3334880fdf883bd95ae2e08f", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:8db62f17937b3b012f07982f571cdaa6f20debd4b430cd45c9d7b1eb685218ab", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:134a9a987d92bb096b907683eda6b11356a25f36cc250547005cd5adfac5ad58", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:235125ee33ae9ac4ea04900fe10f43dd82924d80c9a67e4e254087663e39a182", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:b0ef30fba338f84b7bd55263a7cfbcaa1b26d9250168d64cc070e6cb59ffb54d", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:d781b7cb9d9ff24e65bba0952b5ff3d497ef57c793a9d8f61be05280161c59df", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:795b1f7e68082700afb002e64438039a2b9f7b9344ee4ce0e337c423d520bd7d", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:1dc91b3f4b179238a9dd28af0ff96bcee2372334318bb993d1a7dd375d1fe604", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:fa8842e90bdfb063a0905a6c5d4c38921a76c26c69c3e457e285ebb485d92b79", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:26c2ff752bc8ca0c6f871a011576ea37119cf6faa9ce19e5d0c09eb6793337e8" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:e7bab22551a4d1ed82a69ef79ac8a5ece31154d4e86edc7e7fba16083bbb5f77", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:eceecde87b67160808a94c084836f032e2189b0c4755f7a599b1c8a7f9bc20d6", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:12148c42c850b4c7edf72a8e680f9e10f570e67079b93be29c7fde8eb4cedb59", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:2b761227d75564671d01b79c48b1a2709815f13096f0f9a548cef95ff1456895", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:7fd2ee3f4ac7846ac53078b7edd54ae57a53db4c257ea617fdbb4897a49b555b", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:6eb36e2a993d3aa6a59bf4ebb161e4c8f617774d74ac1178f5ac971ed312f0c2", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:7890b4a59a22f2f273d788fb351e359eff63f6094ed1a263460826f83edd2a73", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:9bcdbef59453cfb23a9a095535e6fe33599489ac7dcb86a577fa7d7de90a9891", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:822f74437bf45bf32ba823866f8456853bfcba8355581e77a6d14989ca81779d", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7adcd3248e9a5c90355f6ef4aca0b79bcd775b5231a16a6a3d2cf024e83b781e" } } diff --git a/assets/optional/sriov/release-sriov-x86_64.json b/assets/optional/sriov/release-sriov-x86_64.json index 418f5232a7..849945b93a 100644 --- a/assets/optional/sriov/release-sriov-x86_64.json +++ b/assets/optional/sriov/release-sriov-x86_64.json @@ -1,17 +1,17 @@ { "release": { - "base": "4.21.0-202609011326" + "base": "4.21.0-202609090243" }, "images": { - "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:19bf37bac7d9352f9afe28fe1a677e4f29952d106517f82e50ed52f181c9d250", - "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:2afe1e650f7a2bc2eb7ce312884b1269e46e09583911137ab152cedc3a022511", - "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:f68dae14798312766c2bf6a7af24a5714ddfd15ead5609b4576c271cdd401ba7", - "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:e7e3fe749e5c978857420f1c03cf2f98cb0fc678979099d9cd8e4265f5e1688d", - "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:1fbed333c800bc53482ac36bc23228f7a36e9e0cde0e3fb36a3e5e1d5ed52c93", - "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:2d05c5a47b3c338675a17ba4b094ce871b0b1543f7c33e278f34d53ee595aae9", - "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:c034b3befc1e04eb7e5b2143c713ca285e8ff793b0d932560e512c71af4fb071", - "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:3006a70ebdb8de0923c5e180931b689c45fee332e5c636ac2cf3c0463e39f6eb", - "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:6e3a47a6b981aa1098bfc9577f2952f2e8f327df98aa457eb733569d71ab0962", - "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:b8f1249fc9059d2468aa8ee3161479b75cf949f1c727017b5a81c07c64765bf8" + "metrics-exporter-image": "registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:9d75a6d2255323545f8f4eaa52ea4ec26901efa4f3f5271396fb789ff755cc06", + "metrics-exporter-kube-rbac-proxy-image": "registry.redhat.io/openshift4/ose-kube-rbac-proxy-rhel9@sha256:a2355cd4b9c7de7f92caac08b193a3f09603dc2fe46d941724c006f45e21ca08", + "network-resources-injector-image": "registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:6d01ac881f785e2cf9e1dde3cbd0fb1ba20a6ff9a31c719086312bc07c9bd6df", + "rdma-cni-image": "registry.redhat.io/openshift4/ose-sriov-rdma-cni-rhel9@sha256:ff9327664ca8dcb304b48b30f75406a7b455b23b18a28573b0c1d9c9380bb7e0", + "sriov-cni-image": "registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:a8f9543badc18942871ee031eb9bb564bd6777104a64fce3ab31a7a4121fea05", + "sriov-device-plugin-image": "registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:1876564cfdd554ae2fb9f89e6e21f50f70b9e408283267140835497b3175c8be", + "sriov-infiniband-cni-image": "registry.redhat.io/openshift4/ose-sriov-infiniband-cni-rhel9@sha256:d7ec3e9927a3ecfcce368aabff983c95fc366a5eb4462b13f22208cb66e98af0", + "sriov-network-config-daemon-image": "registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9@sha256:7133373888c4fcb1811cff4d394768fb6ac2528ea261aeee4a71c88e5741955a", + "sriov-network-operator": "registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator@sha256:5560b500b236d58014148431365231ac4cab5189eb9954bc5eb267d464f9a668", + "sriov-network-webhook-image": "registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:7d6e6393a1d9f0e6f890e2632c8ca99a80dba24419a513e6041d6d3046a08e32" } } diff --git a/assets/release/release-x86_64.json b/assets/release/release-x86_64.json index 1e69698b7d..381d25e2ca 100644 --- a/assets/release/release-x86_64.json +++ b/assets/release/release-x86_64.json @@ -1,17 +1,17 @@ { "release": { - "base": "5.1.0-0.nightly-2026-09-09-023423" + "base": "5.1.0-0.nightly-2026-09-13-222843" }, "images": { - "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:f82f07f4c21a18e37ced5f90c8da66947c34f7096c604d217f190e2a08969c34", - "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b99fa3972319077d2f71d3ecaaa9be988bbdc67335fc3377b68610e346b82238", - "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:ee2cfac466cc2bde180ae1d3f40b23c8d1e3a688cd44a57fa4a823772d1402de", - "haproxy-router-haproxy32": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:b46dbf8e04c4d8a4213eedfd93d7520f4050c827c992d7ec78ddb202383b4d7e", - "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:bbe67adb410fa29a46c0b09ac784892cf77c5ebcb619df9ab9b8f1a4566a8af4", - "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4d8d8cfbcd14a9ba649fa7c8ffb49fd7d1d4bc091ca98a57d7b2618f568ebe93", - "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6f9b8dccbc5bcb08b052ac3cd20420a57683c30954128a07ca57d6478c5cdff4", - "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:4e3874a19df678580485110235535889546a992d9b7dc64c5972337eeb1e16aa", + "cli": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6d0b4176fc8cd0165af09aeee4f8c9317eb309723dec802d3f8deb2d119237ce", + "coredns": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:51a0dd2cffaa81b10e6613afa48077448462863395223faa9af9867096d30289", + "haproxy-router": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6ae6f67be8589c1653ba53b0bed0debc4922a07bd50bf23234599af30e8dd626", + "haproxy-router-haproxy32": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:8da7fbf6c56c550f5835a55bcc0a43dff31311cabff5c9722d9be31d907e09de", + "kube-rbac-proxy": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:2129afeaf7fe8fa15f02eb4715badf0607b2f79c7e9e13cd9537992cb357a0d9", + "ovn-kubernetes-microshift": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:9a83b98599d6e3f21fc58d3f3eaf07e61b7706b84bba088508de7277a459ec41", + "pod": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3d361a6c02fbf89f64a5618209c9af61c784e3a8642adac0c95e1c6b972f2e7f", + "service-ca-operator": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:0e351d89ac1bde63d766ef52ac5e1488ee34ae5342364b4763d647363941ea7b", "lvms_operator": "registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:10c9ccab4f2857d113b55e12cac29aed0dc97d5a4e29ed2e4ea0f77551ee55f8", - "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:dcfba136066806cf44e7450dcc03778c30a1a631dea1e668e4d8aa544a808410" + "csi-snapshot-controller": "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:facca9df95effe4143b1a753449f0a12fbd38dc58754f8647fa4a473cfdd24de" } } diff --git a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yaml b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yaml new file mode 100644 index 0000000000..a1f0b526aa --- /dev/null +++ b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotclasses.yaml @@ -0,0 +1,263 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + addonmanager.kubernetes.io/mode: Reconcile + annotations: + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/1337" + controller-gen.kubebuilder.io/version: v0.15.0 + name: volumegroupsnapshotclasses.groupsnapshot.storage.k8s.io +spec: + group: groupsnapshot.storage.k8s.io + names: + kind: VolumeGroupSnapshotClass + listKind: VolumeGroupSnapshotClassList + plural: volumegroupsnapshotclasses + shortNames: + - vgsclass + - vgsclasses + singular: volumegroupsnapshotclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .driver + name: Driver + type: string + - description: Determines whether a VolumeGroupSnapshotContent created through + the VolumeGroupSnapshotClass should be deleted when its bound VolumeGroupSnapshot + is deleted. + jsonPath: .deletionPolicy + name: DeletionPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotClass specifies parameters that a underlying storage system + uses when creating a volume group snapshot. A specific VolumeGroupSnapshotClass + is used by specifying its name in a VolumeGroupSnapshot object. + VolumeGroupSnapshotClasses are non-namespaced. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + deletionPolicy: + description: |- + DeletionPolicy determines whether a VolumeGroupSnapshotContent created + through the VolumeGroupSnapshotClass should be deleted when its bound + VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + Required. + enum: + - Delete + - Retain + type: string + x-kubernetes-validations: + - message: deletionPolicy is immutable once set + rule: self == oldSelf + driver: + description: |- + Driver is the name of the storage driver expected to handle this VolumeGroupSnapshotClass. + Required. + type: string + x-kubernetes-validations: + - message: driver is immutable once set + rule: self == oldSelf + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + parameters: + additionalProperties: + type: string + description: |- + Parameters is a key-value map with storage driver specific parameters for + creating group snapshots. + These values are opaque to Kubernetes and are passed directly to the driver. + type: object + x-kubernetes-validations: + - message: parameters are immutable once set + rule: self == oldSelf + required: + - deletionPolicy + - driver + type: object + served: true + storage: false + subresources: {} + - additionalPrinterColumns: + - jsonPath: .driver + name: Driver + type: string + - description: Determines whether a VolumeGroupSnapshotContent created through + the VolumeGroupSnapshotClass should be deleted when its bound VolumeGroupSnapshot + is deleted. + jsonPath: .deletionPolicy + name: DeletionPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotClass specifies parameters that a underlying storage system + uses when creating a volume group snapshot. A specific VolumeGroupSnapshotClass + is used by specifying its name in a VolumeGroupSnapshot object. + VolumeGroupSnapshotClasses are non-namespaced. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + deletionPolicy: + description: |- + DeletionPolicy determines whether a VolumeGroupSnapshotContent created + through the VolumeGroupSnapshotClass should be deleted when its bound + VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + Required. + enum: + - Delete + - Retain + type: string + driver: + description: |- + Driver is the name of the storage driver expected to handle this VolumeGroupSnapshotClass. + Required. + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + parameters: + additionalProperties: + type: string + description: |- + Parameters is a key-value map with storage driver specific parameters for + creating group snapshots. + These values are opaque to Kubernetes and are passed directly to the driver. + type: object + required: + - deletionPolicy + - driver + type: object + served: true + storage: false + subresources: {} + - additionalPrinterColumns: + - jsonPath: .driver + name: Driver + type: string + - description: Determines whether a VolumeGroupSnapshotContent created through + the VolumeGroupSnapshotClass should be deleted when its bound VolumeGroupSnapshot + is deleted. + jsonPath: .deletionPolicy + name: DeletionPolicy + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotClass specifies parameters that a underlying storage system + uses when creating a volume group snapshot. A specific VolumeGroupSnapshotClass + is used by specifying its name in a VolumeGroupSnapshot object. + VolumeGroupSnapshotClasses are non-namespaced. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + deletionPolicy: + description: |- + DeletionPolicy determines whether a VolumeGroupSnapshotContent created + through the VolumeGroupSnapshotClass should be deleted when its bound + VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + Required. + enum: + - Delete + - Retain + type: string + x-kubernetes-validations: + - message: deletionPolicy is immutable once set + rule: self == oldSelf + driver: + description: |- + Driver is the name of the storage driver expected to handle this VolumeGroupSnapshotClass. + Required. + type: string + x-kubernetes-validations: + - message: driver is immutable once set + rule: self == oldSelf + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + parameters: + additionalProperties: + type: string + description: |- + Parameters is a key-value map with storage driver specific parameters for + creating group snapshots. + These values are opaque to Kubernetes and are passed directly to the driver. + type: object + x-kubernetes-validations: + - message: parameters are immutable once set + rule: self == oldSelf + required: + - deletionPolicy + - driver + type: object + served: true + storage: true + subresources: {} diff --git a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yaml b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yaml new file mode 100644 index 0000000000..13b179ce55 --- /dev/null +++ b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshotcontents.yaml @@ -0,0 +1,981 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + addonmanager.kubernetes.io/mode: Reconcile + annotations: + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/1337" + controller-gen.kubebuilder.io/version: v0.15.0 + name: volumegroupsnapshotcontents.groupsnapshot.storage.k8s.io +spec: + group: groupsnapshot.storage.k8s.io + names: + kind: VolumeGroupSnapshotContent + listKind: VolumeGroupSnapshotContentList + plural: volumegroupsnapshotcontents + shortNames: + - vgsc + - vgscs + singular: volumegroupsnapshotcontent + scope: Cluster + versions: + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: Determines whether this VolumeGroupSnapshotContent and its physical + group snapshot on the underlying storage system should be deleted when its + bound VolumeGroupSnapshot is deleted. + jsonPath: .spec.deletionPolicy + name: DeletionPolicy + type: string + - description: Name of the CSI driver used to create the physical group snapshot + on the underlying storage system. + jsonPath: .spec.driver + name: Driver + type: string + - description: Name of the VolumeGroupSnapshotClass from which this group snapshot + was (or will be) created. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Namespace of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.namespace + name: VolumeGroupSnapshotNamespace + type: string + - description: Name of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.name + name: VolumeGroupSnapshot + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotContent represents the actual "on-disk" group snapshot object + in the underlying storage system + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines properties of a VolumeGroupSnapshotContent created by the underlying storage system. + Required. + properties: + deletionPolicy: + description: |- + DeletionPolicy determines whether this VolumeGroupSnapshotContent and the + physical group snapshot on the underlying storage system should be deleted + when the bound VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + For dynamically provisioned group snapshots, this field will automatically + be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field + defined in the corresponding VolumeGroupSnapshotClass. + For pre-existing snapshots, users MUST specify this field when creating the + VolumeGroupSnapshotContent object. + Required. + enum: + - Delete + - Retain + type: string + driver: + description: |- + Driver is the name of the CSI driver used to create the physical group snapshot on + the underlying storage system. + This MUST be the same as the name returned by the CSI GetPluginName() call for + that driver. + Required. + type: string + x-kubernetes-validations: + - message: driver is immutable once set + rule: self == oldSelf + source: + description: |- + Source specifies whether the snapshot is (or should be) dynamically provisioned + or already exists, and just requires a Kubernetes object representation. + This field is immutable after creation. + Required. + properties: + groupSnapshotHandles: + description: |- + GroupSnapshotHandles specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot and a list of CSI "snapshot_id" of pre-existing snapshots + on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + properties: + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + Required. + type: string + volumeSnapshotHandles: + description: |- + VolumeSnapshotHandles is a list of CSI "snapshot_id" of pre-existing + snapshots on the underlying storage system for which Kubernetes objects + representation were (or should be) created. + This field is immutable. + Required. + items: + type: string + type: array + required: + - volumeGroupSnapshotHandle + - volumeSnapshotHandles + type: object + x-kubernetes-validations: + - message: groupSnapshotHandles is immutable + rule: self == oldSelf + volumeHandles: + description: |- + VolumeHandles is a list of volume handles on the backend to be snapshotted + together. It is specified for dynamic provisioning of the VolumeGroupSnapshot. + This field is immutable. + items: + type: string + type: array + x-kubernetes-validations: + - message: volumeHandles is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: volumeHandles is required once set + rule: '!has(oldSelf.volumeHandles) || has(self.volumeHandles)' + - message: groupSnapshotHandles is required once set + rule: '!has(oldSelf.groupSnapshotHandles) || has(self.groupSnapshotHandles)' + - message: exactly one of volumeHandles and groupSnapshotHandles must + be set + rule: (has(self.volumeHandles) && !has(self.groupSnapshotHandles)) + || (!has(self.volumeHandles) && has(self.groupSnapshotHandles)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass from + which this group snapshot was (or will be) created. + Note that after provisioning, the VolumeGroupSnapshotClass may be deleted or + recreated with different set of values, and as such, should not be referenced + post-snapshot creation. + For dynamic provisioning, this field must be set. + This field may be unset for pre-provisioned snapshots. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotClassName is immutable once set + rule: self == oldSelf + volumeGroupSnapshotRef: + description: |- + VolumeGroupSnapshotRef specifies the VolumeGroupSnapshot object to which this + VolumeGroupSnapshotContent object is bound. + VolumeGroupSnapshot.Spec.VolumeGroupSnapshotContentName field must reference to + this VolumeGroupSnapshotContent's name for the bidirectional binding to be valid. + For a pre-existing VolumeGroupSnapshotContent object, name and namespace of the + VolumeGroupSnapshot object MUST be provided for binding to happen. + This field is immutable after creation. + Required. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: both volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace + must be set + rule: has(self.name) && has(self.__namespace__) + - message: volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace + are immutable + rule: self.name == oldSelf.name && self.__namespace__ == oldSelf.__namespace__ + - message: volumeGroupSnapshotRef.uid is immutable once set + rule: '!has(oldSelf.uid) || (has(self.uid) && self.uid == oldSelf.uid)' + required: + - deletionPolicy + - driver + - source + - volumeGroupSnapshotRef + type: object + status: + description: status represents the current information of a group snapshot. + properties: + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it indicates the creation time is unknown. + If not specified, it means the readiness of a group snapshot is unknown. + This field is the source for the CreationTime field in VolumeGroupSnapshotStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + Upon success after retry, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready to be + used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + type: boolean + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle is a unique id returned by the CSI driver + to identify the VolumeGroupSnapshot on the storage system. + If a storage system does not provide such an id, the + CSI driver can choose to return the VolumeGroupSnapshot name. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotHandle is immutable once set + rule: self == oldSelf + volumeSnapshotInfoList: + description: |- + This field is introduced in v1beta2 + It is replacing VolumeSnapshotHandlePairList + VolumeSnapshotInfoList is a list of snapshot information returned by + by the CSI driver to identify snapshots on the storage system. + items: + description: |- + The VolumeSnapshotInfo struct is added in v1beta2 + VolumeSnapshotInfo contains information for a snapshot + properties: + creationTime: + description: |- + creationTime is the timestamp when the point-in-time snapshot is taken + by the underlying storage system. + format: int64 + type: integer + readyToUse: + description: ReadyToUse indicates if the snapshot is ready to + be used to restore a volume. + type: boolean + restoreSize: + description: |- + RestoreSize represents the minimum size of volume required to create a volume + from this snapshot. + format: int64 + type: integer + snapshotHandle: + description: SnapshotHandle is the CSI "snapshot_id" of this + snapshot on the underlying storage system. + type: string + volumeHandle: + description: |- + VolumeHandle specifies the CSI "volume_id" of the volume from which this snapshot + was taken from. + type: string + type: object + type: array + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: Determines whether this VolumeGroupSnapshotContent and its physical + group snapshot on the underlying storage system should be deleted when its + bound VolumeGroupSnapshot is deleted. + jsonPath: .spec.deletionPolicy + name: DeletionPolicy + type: string + - description: Name of the CSI driver used to create the physical group snapshot + on the underlying storage system. + jsonPath: .spec.driver + name: Driver + type: string + - description: Name of the VolumeGroupSnapshotClass from which this group snapshot + was (or will be) created. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Namespace of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.namespace + name: VolumeGroupSnapshotNamespace + type: string + - description: Name of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.name + name: VolumeGroupSnapshot + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotContent represents the actual "on-disk" group snapshot object + in the underlying storage system + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines properties of a VolumeGroupSnapshotContent created by the underlying storage system. + Required. + properties: + deletionPolicy: + description: |- + DeletionPolicy determines whether this VolumeGroupSnapshotContent and the + physical group snapshot on the underlying storage system should be deleted + when the bound VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + For dynamically provisioned group snapshots, this field will automatically + be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field + defined in the corresponding VolumeGroupSnapshotClass. + For pre-existing snapshots, users MUST specify this field when creating the + VolumeGroupSnapshotContent object. + Required. + enum: + - Delete + - Retain + type: string + driver: + description: |- + Driver is the name of the CSI driver used to create the physical group snapshot on + the underlying storage system. + This MUST be the same as the name returned by the CSI GetPluginName() call for + that driver. + Required. + type: string + source: + description: |- + Source specifies whether the snapshot is (or should be) dynamically provisioned + or already exists, and just requires a Kubernetes object representation. + This field is immutable after creation. + Required. + properties: + groupSnapshotHandles: + description: |- + GroupSnapshotHandles specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot and a list of CSI "snapshot_id" of pre-existing snapshots + on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + properties: + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + Required. + type: string + volumeSnapshotHandles: + description: |- + VolumeSnapshotHandles is a list of CSI "snapshot_id" of pre-existing + snapshots on the underlying storage system for which Kubernetes objects + representation were (or should be) created. + This field is immutable. + Required. + items: + type: string + type: array + required: + - volumeGroupSnapshotHandle + - volumeSnapshotHandles + type: object + x-kubernetes-validations: + - message: groupSnapshotHandles is immutable + rule: self == oldSelf + volumeHandles: + description: |- + VolumeHandles is a list of volume handles on the backend to be snapshotted + together. It is specified for dynamic provisioning of the VolumeGroupSnapshot. + This field is immutable. + items: + type: string + type: array + x-kubernetes-validations: + - message: volumeHandles is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: volumeHandles is required once set + rule: '!has(oldSelf.volumeHandles) || has(self.volumeHandles)' + - message: groupSnapshotHandles is required once set + rule: '!has(oldSelf.groupSnapshotHandles) || has(self.groupSnapshotHandles)' + - message: exactly one of volumeHandles and groupSnapshotHandles must + be set + rule: (has(self.volumeHandles) && !has(self.groupSnapshotHandles)) + || (!has(self.volumeHandles) && has(self.groupSnapshotHandles)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass from + which this group snapshot was (or will be) created. + Note that after provisioning, the VolumeGroupSnapshotClass may be deleted or + recreated with different set of values, and as such, should not be referenced + post-snapshot creation. + For dynamic provisioning, this field must be set. + This field may be unset for pre-provisioned snapshots. + type: string + volumeGroupSnapshotRef: + description: |- + VolumeGroupSnapshotRef specifies the VolumeGroupSnapshot object to which this + VolumeGroupSnapshotContent object is bound. + VolumeGroupSnapshot.Spec.VolumeGroupSnapshotContentName field must reference to + this VolumeGroupSnapshotContent's name for the bidirectional binding to be valid. + For a pre-existing VolumeGroupSnapshotContent object, name and namespace of the + VolumeGroupSnapshot object MUST be provided for binding to happen. + This field is immutable after creation. + Required. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: both volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace + must be set + rule: has(self.name) && has(self.__namespace__) + required: + - deletionPolicy + - driver + - source + - volumeGroupSnapshotRef + type: object + status: + description: status represents the current information of a group snapshot. + properties: + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it indicates the creation time is unknown. + If not specified, it means the readiness of a group snapshot is unknown. + The format of this field is a Unix nanoseconds time encoded as an int64. + On Unix, the command date +%s%N returns the current time in nanoseconds + since 1970-01-01 00:00:00 UTC. + This field is the source for the CreationTime field in VolumeGroupSnapshotStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + Upon success after retry, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready to be + used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + type: boolean + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle is a unique id returned by the CSI driver + to identify the VolumeGroupSnapshot on the storage system. + If a storage system does not provide such an id, the + CSI driver can choose to return the VolumeGroupSnapshot name. + type: string + volumeSnapshotHandlePairList: + description: |- + VolumeSnapshotHandlePairList is a list of CSI "volume_id" and "snapshot_id" + pair returned by the CSI driver to identify snapshots and their source volumes + on the storage system. + items: + description: VolumeSnapshotHandlePair defines a pair of a source + volume handle and a snapshot handle + properties: + snapshotHandle: + description: |- + SnapshotHandle is a unique id returned by the CSI driver to identify a volume + snapshot on the storage system + Required. + type: string + volumeHandle: + description: |- + VolumeHandle is a unique id returned by the CSI driver to identify a volume + on the storage system + Required. + type: string + required: + - snapshotHandle + - volumeHandle + type: object + type: array + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: Determines whether this VolumeGroupSnapshotContent and its physical + group snapshot on the underlying storage system should be deleted when its + bound VolumeGroupSnapshot is deleted. + jsonPath: .spec.deletionPolicy + name: DeletionPolicy + type: string + - description: Name of the CSI driver used to create the physical group snapshot + on the underlying storage system. + jsonPath: .spec.driver + name: Driver + type: string + - description: Name of the VolumeGroupSnapshotClass from which this group snapshot + was (or will be) created. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Namespace of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.namespace + name: VolumeGroupSnapshotNamespace + type: string + - description: Name of the VolumeGroupSnapshot object to which this VolumeGroupSnapshotContent + object is bound. + jsonPath: .spec.volumeGroupSnapshotRef.name + name: VolumeGroupSnapshot + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshotContent represents the actual "on-disk" group snapshot object + in the underlying storage system + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines properties of a VolumeGroupSnapshotContent created by the underlying storage system. + Required. + properties: + deletionPolicy: + description: |- + DeletionPolicy determines whether this VolumeGroupSnapshotContent and the + physical group snapshot on the underlying storage system should be deleted + when the bound VolumeGroupSnapshot is deleted. + Supported values are "Retain" and "Delete". + "Retain" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are kept. + "Delete" means that the VolumeGroupSnapshotContent and its physical group + snapshot on underlying storage system are deleted. + For dynamically provisioned group snapshots, this field will automatically + be filled in by the CSI snapshotter sidecar with the "DeletionPolicy" field + defined in the corresponding VolumeGroupSnapshotClass. + For pre-existing snapshots, users MUST specify this field when creating the + VolumeGroupSnapshotContent object. + Required. + enum: + - Delete + - Retain + type: string + driver: + description: |- + Driver is the name of the CSI driver used to create the physical group snapshot on + the underlying storage system. + This MUST be the same as the name returned by the CSI GetPluginName() call for + that driver. + Required. + type: string + x-kubernetes-validations: + - message: driver is immutable once set + rule: self == oldSelf + source: + description: |- + Source specifies whether the snapshot is (or should be) dynamically provisioned + or already exists, and just requires a Kubernetes object representation. + This field is immutable after creation. + Required. + properties: + groupSnapshotHandles: + description: |- + GroupSnapshotHandles specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot and a list of CSI "snapshot_id" of pre-existing snapshots + on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + properties: + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle specifies the CSI "group_snapshot_id" of a pre-existing + group snapshot on the underlying storage system for which a Kubernetes object + representation was (or should be) created. + This field is immutable. + Required. + type: string + volumeSnapshotHandles: + description: |- + VolumeSnapshotHandles is a list of CSI "snapshot_id" of pre-existing + snapshots on the underlying storage system for which Kubernetes objects + representation were (or should be) created. + This field is immutable. + Required. + items: + type: string + type: array + required: + - volumeGroupSnapshotHandle + - volumeSnapshotHandles + type: object + x-kubernetes-validations: + - message: groupSnapshotHandles is immutable + rule: self == oldSelf + volumeHandles: + description: |- + VolumeHandles is a list of volume handles on the backend to be snapshotted + together. It is specified for dynamic provisioning of the VolumeGroupSnapshot. + This field is immutable. + items: + type: string + type: array + x-kubernetes-validations: + - message: volumeHandles is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: volumeHandles is required once set + rule: '!has(oldSelf.volumeHandles) || has(self.volumeHandles)' + - message: groupSnapshotHandles is required once set + rule: '!has(oldSelf.groupSnapshotHandles) || has(self.groupSnapshotHandles)' + - message: exactly one of volumeHandles and groupSnapshotHandles must + be set + rule: (has(self.volumeHandles) && !has(self.groupSnapshotHandles)) + || (!has(self.volumeHandles) && has(self.groupSnapshotHandles)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass from + which this group snapshot was (or will be) created. + Note that after provisioning, the VolumeGroupSnapshotClass may be deleted or + recreated with different set of values, and as such, should not be referenced + post-snapshot creation. + For dynamic provisioning, this field must be set. + This field may be unset for pre-provisioned snapshots. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotClassName is immutable once set + rule: self == oldSelf + volumeGroupSnapshotRef: + description: |- + VolumeGroupSnapshotRef specifies the VolumeGroupSnapshot object to which this + VolumeGroupSnapshotContent object is bound. + VolumeGroupSnapshot.Spec.VolumeGroupSnapshotContentName field must reference to + this VolumeGroupSnapshotContent's name for the bidirectional binding to be valid. + For a pre-existing VolumeGroupSnapshotContent object, name and namespace of the + VolumeGroupSnapshot object MUST be provided for binding to happen. + This field is immutable after creation. + Required. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: both volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace + must be set + rule: has(self.name) && has(self.__namespace__) + - message: volumeGroupSnapshotRef.name and volumeGroupSnapshotRef.namespace + are immutable + rule: self.name == oldSelf.name && self.__namespace__ == oldSelf.__namespace__ + - message: volumeGroupSnapshotRef.uid is immutable once set + rule: '!has(oldSelf.uid) || (has(self.uid) && self.uid == oldSelf.uid)' + required: + - deletionPolicy + - driver + - source + - volumeGroupSnapshotRef + type: object + status: + description: status represents the current information of a group snapshot. + properties: + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it indicates the creation time is unknown. + If not specified, it means the readiness of a group snapshot is unknown. + This field is the source for the CreationTime field in VolumeGroupSnapshotStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + Upon success after retry, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready to be + used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + type: boolean + volumeGroupSnapshotHandle: + description: |- + VolumeGroupSnapshotHandle is a unique id returned by the CSI driver + to identify the VolumeGroupSnapshot on the storage system. + If a storage system does not provide such an id, the + CSI driver can choose to return the VolumeGroupSnapshot name. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotHandle is immutable once set + rule: self == oldSelf + volumeSnapshotInfoList: + description: |- + This field is introduced in v1beta2 + It is replacing VolumeSnapshotHandlePairList + VolumeSnapshotInfoList is a list of snapshot information returned by + by the CSI driver to identify snapshots on the storage system. + items: + description: |- + The VolumeSnapshotInfo struct is added in v1beta2 + VolumeSnapshotInfo contains information for a snapshot + properties: + creationTime: + description: |- + creationTime is the timestamp when the point-in-time snapshot is taken + by the underlying storage system. + format: int64 + type: integer + readyToUse: + description: ReadyToUse indicates if the snapshot is ready to + be used to restore a volume. + type: boolean + restoreSize: + description: |- + RestoreSize represents the minimum size of volume required to create a volume + from this snapshot. + format: int64 + type: integer + snapshotHandle: + description: SnapshotHandle is the CSI "snapshot_id" of this + snapshot on the underlying storage system. + type: string + volumeHandle: + description: |- + VolumeHandle specifies the CSI "volume_id" of the volume from which this snapshot + was taken from. + type: string + type: object + type: array + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml new file mode 100644 index 0000000000..cdc1c3bfb5 --- /dev/null +++ b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/crd/groupsnapshot.storage.k8s.io_volumegroupsnapshots.yaml @@ -0,0 +1,682 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + addonmanager.kubernetes.io/mode: Reconcile + annotations: + api-approved.kubernetes.io: "https://github.com/kubernetes-csi/external-snapshotter/pull/1337" + controller-gen.kubebuilder.io/version: v0.15.0 + name: volumegroupsnapshots.groupsnapshot.storage.k8s.io +spec: + group: groupsnapshot.storage.k8s.io + names: + kind: VolumeGroupSnapshot + listKind: VolumeGroupSnapshotList + plural: volumegroupsnapshots + shortNames: + - vgs + singular: volumegroupsnapshot + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: The name of the VolumeGroupSnapshotClass requested by the VolumeGroupSnapshot. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Name of the VolumeGroupSnapshotContent object to which the VolumeGroupSnapshot + object intends to bind to. Please note that verification of binding actually + requires checking both VolumeGroupSnapshot and VolumeGroupSnapshotContent + to ensure both are pointing at each other. Binding MUST be verified prior + to usage of this object. + jsonPath: .status.boundVolumeGroupSnapshotContentName + name: VolumeGroupSnapshotContent + type: string + - description: Timestamp when the point-in-time group snapshot was taken by the + underlying storage system. + jsonPath: .status.creationTime + name: CreationTime + type: date + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshot is a user's request for creating either a point-in-time + group snapshot or binding to a pre-existing group snapshot. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines the desired characteristics of a group snapshot requested by a user. + Required. + properties: + source: + description: |- + Source specifies where a group snapshot will be created from. + This field is immutable after creation. + Required. + properties: + selector: + description: |- + Selector is a label query over persistent volume claims that are to be + grouped together for snapshotting. + This labelSelector will be used to match the label added to a PVC. + If the label is added or removed to a volume after a group snapshot + is created, the existing group snapshots won't be modified. + Once a VolumeGroupSnapshotContent is created and the sidecar starts to process + it, the volume list will not change with retries. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: selector is immutable + rule: self == oldSelf + volumeGroupSnapshotContentName: + description: |- + VolumeGroupSnapshotContentName specifies the name of a pre-existing VolumeGroupSnapshotContent + object representing an existing volume group snapshot. + This field should be set if the volume group snapshot already exists and + only needs a representation in Kubernetes. + This field is immutable. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotContentName is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: selector is required once set + rule: '!has(oldSelf.selector) || has(self.selector)' + - message: volumeGroupSnapshotContentName is required once set + rule: '!has(oldSelf.volumeGroupSnapshotContentName) || has(self.volumeGroupSnapshotContentName)' + - message: exactly one of selector and volumeGroupSnapshotContentName + must be set + rule: (has(self.selector) && !has(self.volumeGroupSnapshotContentName)) + || (!has(self.selector) && has(self.volumeGroupSnapshotContentName)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass + requested by the VolumeGroupSnapshot. + VolumeGroupSnapshotClassName may be left nil to indicate that the default + class will be used. + Empty string is not allowed for this field. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotClassName must not be the empty string + when set + rule: size(self) > 0 + required: + - source + type: object + status: + description: |- + Status represents the current information of a group snapshot. + Consumers must verify binding between VolumeGroupSnapshot and + VolumeGroupSnapshotContent objects is successful (by validating that both + VolumeGroupSnapshot and VolumeGroupSnapshotContent point to each other) before + using this object. + properties: + boundVolumeGroupSnapshotContentName: + description: |- + BoundVolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent + object to which this VolumeGroupSnapshot object intends to bind to. + If not specified, it indicates that the VolumeGroupSnapshot object has not + been successfully bound to a VolumeGroupSnapshotContent object yet. + NOTE: To avoid possible security issues, consumers must verify binding between + VolumeGroupSnapshot and VolumeGroupSnapshotContent objects is successful + (by validating that both VolumeGroupSnapshot and VolumeGroupSnapshotContent + point at each other) before using this object. + type: string + x-kubernetes-validations: + - message: boundVolumeGroupSnapshotContentName is immutable once set + rule: self == oldSelf + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it may indicate that the creation time of the group snapshot + is unknown. + This field is updated based on the CreationTime field in VolumeGroupSnapshotContentStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + This field could be helpful to upper level controllers (i.e., application + controller) to decide whether they should continue on waiting for the group + snapshot to be created based on the type of error reported. + The snapshot controller will keep retrying when an error occurs during the + group snapshot creation. Upon success, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + If not specified, it means the readiness of a group snapshot is unknown. + type: boolean + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: The name of the VolumeGroupSnapshotClass requested by the VolumeGroupSnapshot. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Name of the VolumeGroupSnapshotContent object to which the VolumeGroupSnapshot + object intends to bind to. Please note that verification of binding actually + requires checking both VolumeGroupSnapshot and VolumeGroupSnapshotContent + to ensure both are pointing at each other. Binding MUST be verified prior + to usage of this object. + jsonPath: .status.boundVolumeGroupSnapshotContentName + name: VolumeGroupSnapshotContent + type: string + - description: Timestamp when the point-in-time group snapshot was taken by the + underlying storage system. + jsonPath: .status.creationTime + name: CreationTime + type: date + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshot is a user's request for creating either a point-in-time + group snapshot or binding to a pre-existing group snapshot. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines the desired characteristics of a group snapshot requested by a user. + Required. + properties: + source: + description: |- + Source specifies where a group snapshot will be created from. + This field is immutable after creation. + Required. + properties: + selector: + description: |- + Selector is a label query over persistent volume claims that are to be + grouped together for snapshotting. + This labelSelector will be used to match the label added to a PVC. + If the label is added or removed to a volume after a group snapshot + is created, the existing group snapshots won't be modified. + Once a VolumeGroupSnapshotContent is created and the sidecar starts to process + it, the volume list will not change with retries. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: selector is immutable + rule: self == oldSelf + volumeGroupSnapshotContentName: + description: |- + VolumeGroupSnapshotContentName specifies the name of a pre-existing VolumeGroupSnapshotContent + object representing an existing volume group snapshot. + This field should be set if the volume group snapshot already exists and + only needs a representation in Kubernetes. + This field is immutable. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotContentName is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: selector is required once set + rule: '!has(oldSelf.selector) || has(self.selector)' + - message: volumeGroupSnapshotContentName is required once set + rule: '!has(oldSelf.volumeGroupSnapshotContentName) || has(self.volumeGroupSnapshotContentName)' + - message: exactly one of selector and volumeGroupSnapshotContentName + must be set + rule: (has(self.selector) && !has(self.volumeGroupSnapshotContentName)) + || (!has(self.selector) && has(self.volumeGroupSnapshotContentName)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass + requested by the VolumeGroupSnapshot. + VolumeGroupSnapshotClassName may be left nil to indicate that the default + class will be used. + Empty string is not allowed for this field. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotClassName must not be the empty string + when set + rule: size(self) > 0 + required: + - source + type: object + status: + description: |- + Status represents the current information of a group snapshot. + Consumers must verify binding between VolumeGroupSnapshot and + VolumeGroupSnapshotContent objects is successful (by validating that both + VolumeGroupSnapshot and VolumeGroupSnapshotContent point to each other) before + using this object. + properties: + boundVolumeGroupSnapshotContentName: + description: |- + BoundVolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent + object to which this VolumeGroupSnapshot object intends to bind to. + If not specified, it indicates that the VolumeGroupSnapshot object has not + been successfully bound to a VolumeGroupSnapshotContent object yet. + NOTE: To avoid possible security issues, consumers must verify binding between + VolumeGroupSnapshot and VolumeGroupSnapshotContent objects is successful + (by validating that both VolumeGroupSnapshot and VolumeGroupSnapshotContent + point at each other) before using this object. + type: string + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it may indicate that the creation time of the group snapshot + is unknown. + The format of this field is a Unix nanoseconds time encoded as an int64. + On Unix, the command date +%s%N returns the current time in nanoseconds + since 1970-01-01 00:00:00 UTC. + This field is updated based on the CreationTime field in VolumeGroupSnapshotContentStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + This field could be helpful to upper level controllers (i.e., application + controller) to decide whether they should continue on waiting for the group + snapshot to be created based on the type of error reported. + The snapshot controller will keep retrying when an error occurs during the + group snapshot creation. Upon success, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + If not specified, it means the readiness of a group snapshot is unknown. + type: boolean + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: Indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + jsonPath: .status.readyToUse + name: ReadyToUse + type: boolean + - description: The name of the VolumeGroupSnapshotClass requested by the VolumeGroupSnapshot. + jsonPath: .spec.volumeGroupSnapshotClassName + name: VolumeGroupSnapshotClass + type: string + - description: Name of the VolumeGroupSnapshotContent object to which the VolumeGroupSnapshot + object intends to bind to. Please note that verification of binding actually + requires checking both VolumeGroupSnapshot and VolumeGroupSnapshotContent + to ensure both are pointing at each other. Binding MUST be verified prior + to usage of this object. + jsonPath: .status.boundVolumeGroupSnapshotContentName + name: VolumeGroupSnapshotContent + type: string + - description: Timestamp when the point-in-time group snapshot was taken by the + underlying storage system. + jsonPath: .status.creationTime + name: CreationTime + type: date + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: |- + VolumeGroupSnapshot is a user's request for creating either a point-in-time + group snapshot or binding to a pre-existing group snapshot. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec defines the desired characteristics of a group snapshot requested by a user. + Required. + properties: + source: + description: |- + Source specifies where a group snapshot will be created from. + This field is immutable after creation. + Required. + properties: + selector: + description: |- + Selector is a label query over persistent volume claims that are to be + grouped together for snapshotting. + This labelSelector will be used to match the label added to a PVC. + If the label is added or removed to a volume after a group snapshot + is created, the existing group snapshots won't be modified. + Once a VolumeGroupSnapshotContent is created and the sidecar starts to process + it, the volume list will not change with retries. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: selector is immutable + rule: self == oldSelf + volumeGroupSnapshotContentName: + description: |- + VolumeGroupSnapshotContentName specifies the name of a pre-existing VolumeGroupSnapshotContent + object representing an existing volume group snapshot. + This field should be set if the volume group snapshot already exists and + only needs a representation in Kubernetes. + This field is immutable. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotContentName is immutable + rule: self == oldSelf + type: object + x-kubernetes-validations: + - message: selector is required once set + rule: '!has(oldSelf.selector) || has(self.selector)' + - message: volumeGroupSnapshotContentName is required once set + rule: '!has(oldSelf.volumeGroupSnapshotContentName) || has(self.volumeGroupSnapshotContentName)' + - message: exactly one of selector and volumeGroupSnapshotContentName + must be set + rule: (has(self.selector) && !has(self.volumeGroupSnapshotContentName)) + || (!has(self.selector) && has(self.volumeGroupSnapshotContentName)) + volumeGroupSnapshotClassName: + description: |- + VolumeGroupSnapshotClassName is the name of the VolumeGroupSnapshotClass + requested by the VolumeGroupSnapshot. + VolumeGroupSnapshotClassName may be left nil to indicate that the default + class will be used. + Empty string is not allowed for this field. + type: string + x-kubernetes-validations: + - message: volumeGroupSnapshotClassName must not be the empty string + when set + rule: size(self) > 0 + required: + - source + type: object + status: + description: |- + Status represents the current information of a group snapshot. + Consumers must verify binding between VolumeGroupSnapshot and + VolumeGroupSnapshotContent objects is successful (by validating that both + VolumeGroupSnapshot and VolumeGroupSnapshotContent point to each other) before + using this object. + properties: + boundVolumeGroupSnapshotContentName: + description: |- + BoundVolumeGroupSnapshotContentName is the name of the VolumeGroupSnapshotContent + object to which this VolumeGroupSnapshot object intends to bind to. + If not specified, it indicates that the VolumeGroupSnapshot object has not + been successfully bound to a VolumeGroupSnapshotContent object yet. + NOTE: To avoid possible security issues, consumers must verify binding between + VolumeGroupSnapshot and VolumeGroupSnapshotContent objects is successful + (by validating that both VolumeGroupSnapshot and VolumeGroupSnapshotContent + point at each other) before using this object. + type: string + x-kubernetes-validations: + - message: boundVolumeGroupSnapshotContentName is immutable once set + rule: self == oldSelf + creationTime: + description: |- + CreationTime is the timestamp when the point-in-time group snapshot is taken + by the underlying storage system. + If not specified, it may indicate that the creation time of the group snapshot + is unknown. + This field is updated based on the CreationTime field in VolumeGroupSnapshotContentStatus + format: date-time + type: string + error: + description: |- + Error is the last observed error during group snapshot creation, if any. + This field could be helpful to upper level controllers (i.e., application + controller) to decide whether they should continue on waiting for the group + snapshot to be created based on the type of error reported. + The snapshot controller will keep retrying when an error occurs during the + group snapshot creation. Upon success, this error field will be cleared. + properties: + message: + description: |- + message is a string detailing the encountered error during snapshot + creation if specified. + NOTE: message may be logged, and it should not contain sensitive + information. + type: string + time: + description: time is the timestamp when the error was encountered. + format: date-time + type: string + type: object + readyToUse: + description: |- + ReadyToUse indicates if all the individual snapshots in the group are ready + to be used to restore a group of volumes. + ReadyToUse becomes true when ReadyToUse of all individual snapshots become true. + If not specified, it means the readiness of a group snapshot is unknown. + type: boolean + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/rbac-volume-snapshot-controller.yaml b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/rbac-volume-snapshot-controller.yaml index d9c044eed6..acbfcc81a3 100644 --- a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/rbac-volume-snapshot-controller.yaml +++ b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/rbac-volume-snapshot-controller.yaml @@ -1,4 +1,6 @@ # RBAC file for the volume snapshot controller. +# Source: https://github.com/kubernetes-csi/external-snapshotter/tree/master/deploy/kubernetes/snapshot-controller + apiVersion: v1 kind: ServiceAccount metadata: @@ -24,9 +26,6 @@ rules: - apiGroups: [""] resources: ["persistentvolumeclaims"] verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["events"] verbs: ["list", "watch", "create", "update", "patch"] @@ -38,17 +37,28 @@ rules: verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshots"] - verbs: ["get", "list", "watch", "update", "patch"] + verbs: ["create", "get", "list", "watch", "update", "patch", "delete"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshots/status"] verbs: ["update", "patch"] - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotcontents/status"] verbs: ["patch"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["create", "list", "watch", "delete", "get", "update"] - + - apiGroups: ["groupsnapshot.storage.k8s.io"] + resources: ["volumegroupsnapshotclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: ["groupsnapshot.storage.k8s.io"] + resources: ["volumegroupsnapshotcontents"] + verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] + - apiGroups: ["groupsnapshot.storage.k8s.io"] + resources: ["volumegroupsnapshotcontents/status"] + verbs: ["patch"] + - apiGroups: ["groupsnapshot.storage.k8s.io"] + resources: ["volumegroupsnapshots"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["groupsnapshot.storage.k8s.io"] + resources: ["volumegroupsnapshots/status"] + verbs: ["update", "patch"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 diff --git a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/volume-snapshot-controller-deployment.yaml b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/volume-snapshot-controller-deployment.yaml index db8c11cd7c..f581549f67 100644 --- a/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/volume-snapshot-controller-deployment.yaml +++ b/deps/github.com/openshift/kubernetes/cluster/addons/volumesnapshots/volume-snapshot-controller/volume-snapshot-controller-deployment.yaml @@ -27,3 +27,4 @@ spec: - "--v=5" - "--metrics-path=/metrics" - "--http-endpoint=:9102" + - "--feature-gates=CSIVolumeGroupSnapshot=true" diff --git a/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/csi.go b/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/csi.go index d25f3a3674..f52a61dd31 100644 --- a/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/csi.go +++ b/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/csi.go @@ -164,6 +164,7 @@ func InitHostPathCSIDriver() storageframework.TestDriver { storageframework.CapReadWriteOncePod: true, storageframework.CapMultiplePVsSameID: true, storageframework.CapFSResizeFromSourceNotSupported: true, + storageframework.CapVolumeGroupSnapshot: true, // There are extensive tests that NodeStage / NodePublish are called with -o context in csimock/csi_selinux_mount.go, // but the csi-driver-hostpath can't physically make -o context to appear in the mount table that the CapSELinuxMount tests expect. storageframework.CapSELinuxMount: false, @@ -174,10 +175,6 @@ func InitHostPathCSIDriver() storageframework.TestDriver { // added when patching the deployment. storageframework.CapVolumeLimits: true, } - // TODO: It can be removed after the VolumeGroupSnapshot feature is default enabled - if os.Getenv("CSI_PROW_ENABLE_GROUP_SNAPSHOT") == "true" { - capabilities[storageframework.CapVolumeGroupSnapshot] = true - } if os.Getenv("CSI_PROW_ENABLE_SNAPSHOT_METADATA") == "true" { capabilities[storageframework.CapSnapshotMetadata] = true } @@ -305,14 +302,13 @@ func (h *hostpathCSIDriver) PrepareTest(ctx context.Context, f *framework.Framew DriverContainerArguments: []string{"--feature-gates=VolumeAttributesClass=true"}, }) - // VGS E2E FeatureGate patches - // TODO: These can be removed after the VolumeGroupSnapshot feature is default enabled - if os.Getenv("CSI_PROW_ENABLE_GROUP_SNAPSHOT") == "true" { - patches = append(patches, utils.PatchCSIOptions{ - DriverContainerName: "csi-snapshotter", - DriverContainerArguments: []string{"--feature-gates=CSIVolumeGroupSnapshot=true"}, - }) - } + // VolumeGroupSnapshot feature E2E patches + // It is GA in Kubernetes, just the feature gate is erroneously disabled by default. + // TODO: remove this after the feature gate is enabled by default. + patches = append(patches, utils.PatchCSIOptions{ + DriverContainerName: "csi-snapshotter", + DriverContainerArguments: []string{"--feature-gates=CSIVolumeGroupSnapshot=true"}, + }) // SnapshotMetadata feature E2E patches // TODO: These can be removed after the SnapshotMetadata feature is default enabled diff --git a/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go b/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go deleted file mode 100644 index 379f62d55f..0000000000 --- a/deps/github.com/openshift/kubernetes/test/e2e/storage/drivers/openshift_group_snapshot_driver.go +++ /dev/null @@ -1,300 +0,0 @@ -package drivers - -import ( - "context" - "fmt" - "time" - - "github.com/onsi/ginkgo/v2" - - appsv1 "k8s.io/api/apps/v1" - v1 "k8s.io/api/core/v1" - storagev1 "k8s.io/api/storage/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" - "k8s.io/apimachinery/pkg/util/sets" - "k8s.io/kubernetes/test/e2e/framework" - e2enode "k8s.io/kubernetes/test/e2e/framework/node" - e2epod "k8s.io/kubernetes/test/e2e/framework/pod" - e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper" - e2evolume "k8s.io/kubernetes/test/e2e/framework/volume" - storageframework "k8s.io/kubernetes/test/e2e/storage/framework" - "k8s.io/kubernetes/test/e2e/storage/utils" -) - -// Special test driver for volume group snapshots. -// -// Upstream uses a script to install csi-driver-hostpath with group snapshots enabled in its CSI sidecars. -// We can't use that in OCP, so let's create a new test driver based on [Driver: csi-hospath], -// only with the group snapshots enabled. - -// The rest of the file is a copy of Kubernete's HostPath test driver from test/e2e/storage/drivers/csi.go -// Differences: -// - the tests driver name is: [Driver: csi-hospath-groupsnapshot]. -// - enabled group snapshots in the external-snapshotter sidecar. -// - still use "csi-hostpath" as PatchCSIOptions.OldDriverName, because it's a name of a directory than needs to be replaced in the driver yaml files. - -type groupSnapshotHostpathCSIDriver struct { - driverInfo storageframework.DriverInfo - manifests []string - volumeAttributes []map[string]string -} - -func initGroupSnapshotHostpathCSIDriver(name string, capabilities map[storageframework.Capability]bool, volumeAttributes []map[string]string, manifests ...string) storageframework.TestDriver { - return &groupSnapshotHostpathCSIDriver{ - driverInfo: storageframework.DriverInfo{ - Name: name, - MaxFileSize: storageframework.FileSizeMedium, - SupportedFsType: sets.NewString( - "", // Default fsType - ), - SupportedSizeRange: e2evolume.SizeRange{ - Min: "1Mi", - }, - Capabilities: capabilities, - StressTestOptions: &storageframework.StressTestOptions{ - NumPods: 10, - NumRestarts: 10, - }, - VolumeSnapshotStressTestOptions: &storageframework.VolumeSnapshotStressTestOptions{ - NumPods: 10, - NumSnapshots: 10, - }, - PerformanceTestOptions: &storageframework.PerformanceTestOptions{ - ProvisioningOptions: &storageframework.PerformanceTestProvisioningOptions{ - VolumeSize: "1Mi", - Count: 300, - // Volume provisioning metrics are compared to a high baseline. - // Failure to pass would suggest a performance regression. - ExpectedMetrics: &storageframework.Metrics{ - AvgLatency: 2 * time.Minute, - Throughput: 0.5, - }, - }, - }, - TestTags: []interface{}{"[OCPFeatureGate:VolumeGroupSnapshot]"}, - }, - manifests: manifests, - volumeAttributes: volumeAttributes, - } -} - -var _ storageframework.TestDriver = &groupSnapshotHostpathCSIDriver{} -var _ storageframework.DynamicPVTestDriver = &groupSnapshotHostpathCSIDriver{} -var _ storageframework.SnapshottableTestDriver = &groupSnapshotHostpathCSIDriver{} -var _ storageframework.EphemeralTestDriver = &groupSnapshotHostpathCSIDriver{} - -// InitgroupSnapshotHostpathCSIDriver returns groupSnapshotHostpathCSIDriver that implements TestDriver interface -func InitGroupSnapshotHostpathCSIDriver() storageframework.TestDriver { - capabilities := map[storageframework.Capability]bool{ - storageframework.CapPersistence: true, - storageframework.CapSnapshotDataSource: true, - storageframework.CapMultiPODs: true, - storageframework.CapBlock: true, - storageframework.CapPVCDataSource: true, - storageframework.CapControllerExpansion: true, - storageframework.CapOfflineExpansion: true, - storageframework.CapOnlineExpansion: true, - storageframework.CapSingleNodeVolume: true, - storageframework.CapReadWriteOncePod: true, - storageframework.CapMultiplePVsSameID: true, - storageframework.CapFSResizeFromSourceNotSupported: true, - storageframework.CapVolumeGroupSnapshot: true, - - // This is needed for the - // testsuites/volumelimits.go `should support volume limits` - // test. --maxvolumespernode=10 gets - // added when patching the deployment. - storageframework.CapVolumeLimits: true, - } - // OCP specific code: a different driver name (csi-hostpath-groupsnapshot) - return initGroupSnapshotHostpathCSIDriver("csi-hostpath-groupsnapshot", - capabilities, - // Volume attributes don't matter, but we have to provide at least one map. - []map[string]string{ - {"foo": "bar"}, - }, - "test/e2e/testing-manifests/storage-csi/external-attacher/rbac.yaml", - "test/e2e/testing-manifests/storage-csi/external-provisioner/rbac.yaml", - "test/e2e/testing-manifests/storage-csi/external-snapshotter/csi-snapshotter/rbac-csi-snapshotter.yaml", - "test/e2e/testing-manifests/storage-csi/external-health-monitor/external-health-monitor-controller/rbac.yaml", - "test/e2e/testing-manifests/storage-csi/external-resizer/rbac.yaml", - "test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-driverinfo.yaml", - "test/e2e/testing-manifests/storage-csi/hostpath/hostpath/csi-hostpath-plugin.yaml", - "test/e2e/testing-manifests/storage-csi/hostpath/hostpath/e2e-test-rbac.yaml", - ) -} - -func (h *groupSnapshotHostpathCSIDriver) GetDriverInfo() *storageframework.DriverInfo { - return &h.driverInfo -} - -func (h *groupSnapshotHostpathCSIDriver) SkipUnsupportedTest(pattern storageframework.TestPattern) { - if pattern.VolType == storageframework.CSIInlineVolume && len(h.volumeAttributes) == 0 { - e2eskipper.Skipf("%s has no volume attributes defined, doesn't support ephemeral inline volumes", h.driverInfo.Name) - } -} - -func (h *groupSnapshotHostpathCSIDriver) GetDynamicProvisionStorageClass(ctx context.Context, config *storageframework.PerTestConfig, fsType string) *storagev1.StorageClass { - provisioner := config.GetUniqueDriverName() - parameters := map[string]string{} - ns := config.Framework.Namespace.Name - - return storageframework.GetStorageClass(provisioner, parameters, nil, ns) -} - -func (h *groupSnapshotHostpathCSIDriver) GetVolume(config *storageframework.PerTestConfig, volumeNumber int) (map[string]string, bool, bool) { - return h.volumeAttributes[volumeNumber%len(h.volumeAttributes)], false /* not shared */, false /* read-write */ -} - -func (h *groupSnapshotHostpathCSIDriver) GetCSIDriverName(config *storageframework.PerTestConfig) string { - return config.GetUniqueDriverName() -} - -func (h *groupSnapshotHostpathCSIDriver) GetSnapshotClass(ctx context.Context, config *storageframework.PerTestConfig, parameters map[string]string) *unstructured.Unstructured { - snapshotter := config.GetUniqueDriverName() - ns := config.Framework.Namespace.Name - - return utils.GenerateSnapshotClassSpec(snapshotter, parameters, ns) -} - -func (h *groupSnapshotHostpathCSIDriver) GetVolumeAttributesClass(_ context.Context, config *storageframework.PerTestConfig) *storagev1.VolumeAttributesClass { - return storageframework.CopyVolumeAttributesClass(&storagev1.VolumeAttributesClass{ - DriverName: config.GetUniqueDriverName(), - Parameters: map[string]string{ - hostpathCSIDriverMutableParameterName: hostpathCSIDriverMutableParameterValue, - }, - }, config.Framework.Namespace.Name, "e2e-vac-hostpath") -} -func (h *groupSnapshotHostpathCSIDriver) GetVolumeGroupSnapshotClass(ctx context.Context, config *storageframework.PerTestConfig, parameters map[string]string) *unstructured.Unstructured { - snapshotter := config.GetUniqueDriverName() - ns := config.Framework.Namespace.Name - - return utils.GenerateVolumeGroupSnapshotClassSpec(snapshotter, parameters, ns) -} - -func (h *groupSnapshotHostpathCSIDriver) PrepareTest(ctx context.Context, f *framework.Framework) *storageframework.PerTestConfig { - // Create secondary namespace which will be used for creating driver - driverNamespace := utils.CreateDriverNamespace(ctx, f) - driverns := driverNamespace.Name - - ginkgo.By(fmt.Sprintf("deploying %s driver", h.driverInfo.Name)) - cancelLogging := utils.StartPodLogs(ctx, f, driverNamespace) - cs := f.ClientSet - - // The hostpath CSI driver only works when everything runs on the same node. - node, err := e2enode.GetRandomReadySchedulableNode(ctx, cs) - framework.ExpectNoError(err) - config := &storageframework.PerTestConfig{ - Driver: h, - Prefix: "hostpath", - Framework: f, - ClientNodeSelection: e2epod.NodeSelection{Name: node.Name}, - DriverNamespace: driverNamespace, - } - - patches := []utils.PatchCSIOptions{} - - patches = append(patches, utils.PatchCSIOptions{ - OldDriverName: "csi-hostpath", // OCP: hardcode csi-hostpath here, it specifies directories in yaml files that need to be replaced with the unique driver name. - NewDriverName: config.GetUniqueDriverName(), - DriverContainerName: "hostpath", - DriverContainerArguments: []string{"--drivername=" + config.GetUniqueDriverName(), - // This is needed for the - // testsuites/volumelimits.go `should support volume limits` - // test. - "--maxvolumespernode=10", - // Enable volume lifecycle checks, to report failure if - // the volume is not unpublished / unstaged correctly. - "--check-volume-lifecycle=true", - }, - ProvisionerContainerName: "csi-provisioner", - SnapshotterContainerName: "csi-snapshotter", - NodeName: node.Name, - }) - - // VAC E2E HostPath patch - // Enables ModifyVolume support in the hostpath CSI driver, and adds an enabled parameter name - patches = append(patches, utils.PatchCSIOptions{ - DriverContainerName: "hostpath", - DriverContainerArguments: []string{"--enable-controller-modify-volume=true", "--accepted-mutable-parameter-names=e2eVacTest"}, - }) - - // VAC E2E FeatureGate patches - // TODO: These can be removed after the VolumeAttributesClass feature is default enabled - patches = append(patches, utils.PatchCSIOptions{ - DriverContainerName: "csi-provisioner", - DriverContainerArguments: []string{"--feature-gates=VolumeAttributesClass=true"}, - }) - patches = append(patches, utils.PatchCSIOptions{ - DriverContainerName: "csi-resizer", - DriverContainerArguments: []string{"--feature-gates=VolumeAttributesClass=true"}, - }) - - // OCP specific code: enable group snapshot - patches = append(patches, utils.PatchCSIOptions{ - DriverContainerName: "csi-snapshotter", - DriverContainerArguments: []string{"--feature-gates=CSIVolumeGroupSnapshot=true"}, - }) - - err = utils.CreateFromManifests(ctx, config.Framework, driverNamespace, func(item interface{}) error { - for _, o := range patches { - if err := utils.PatchCSIDeployment(config.Framework, o, item); err != nil { - return err - } - } - - // Remove csi-external-health-monitor-agent and - // csi-external-health-monitor-controller - // containers. The agent is obsolete. - // The controller is not needed for any of the - // tests and is causing too much overhead when - // running in a large cluster (see - // https://github.com/kubernetes/kubernetes/issues/102452#issuecomment-856991009). - switch item := item.(type) { - case *appsv1.StatefulSet: - var containers []v1.Container - var volumes []v1.Volume - for _, container := range item.Spec.Template.Spec.Containers { - switch container.Name { - case "csi-external-health-monitor-agent", "csi-external-health-monitor-controller": - // Remove these containers. - case "csi-snapshot-metadata": - // Only keep the snapshot metadata sidecar when the feature is enabled. - if h.driverInfo.Capabilities[storageframework.CapSnapshotMetadata] { - containers = append(containers, container) - } - default: - // Keep the others. - containers = append(containers, container) - } - } - for _, volume := range item.Spec.Template.Spec.Volumes { - switch volume.Name { - case "csi-snapshot-metadata-server-certs": - // Only keep the snapshot metadata volume when the feature is enabled. - if h.driverInfo.Capabilities[storageframework.CapSnapshotMetadata] { - volumes = append(volumes, volume) - } - default: - volumes = append(volumes, volume) - } - } - item.Spec.Template.Spec.Containers = containers - item.Spec.Template.Spec.Volumes = volumes - } - return nil - }, h.manifests...) - - if err != nil { - framework.Failf("deploying %s driver: %v", h.driverInfo.Name, err) - } - - cleanupFunc := generateDriverCleanupFunc( - f, - h.driverInfo.Name, - driverns, - cancelLogging) - ginkgo.DeferCleanup(cleanupFunc) - - return config -} diff --git a/deps/github.com/openshift/kubernetes/test/e2e/storage/openshift_csi_volumes.go b/deps/github.com/openshift/kubernetes/test/e2e/storage/openshift_csi_volumes.go deleted file mode 100644 index 4ebc74be6e..0000000000 --- a/deps/github.com/openshift/kubernetes/test/e2e/storage/openshift_csi_volumes.go +++ /dev/null @@ -1,45 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -// This is a copy of csi_volumes.go with OpenShift specific test driver. -// Used a copy of the file to avoid conflicts when editing the existing file. -package storage - -import ( - "k8s.io/kubernetes/test/e2e/framework" - "k8s.io/kubernetes/test/e2e/storage/drivers" - storageframework "k8s.io/kubernetes/test/e2e/storage/framework" - "k8s.io/kubernetes/test/e2e/storage/testsuites" - "k8s.io/kubernetes/test/e2e/storage/utils" -) - -// List of testDrivers to be executed in below loop -var ocpCSITestDrivers = []func() storageframework.TestDriver{ - drivers.InitGroupSnapshotHostpathCSIDriver, -} - -// This executes testSuites for csi volumes. -var _ = utils.SIGDescribe("OCP CSI Volumes", func() { - for _, initDriver := range ocpCSITestDrivers { - curDriver := initDriver() - - args := storageframework.GetDriverNameWithFeatureTags(curDriver) - args = append(args, func() { - storageframework.DefineTestSuites(curDriver, testsuites.CSISuites) - }) - framework.Context(args...) - } -}) diff --git a/etcd/go.mod b/etcd/go.mod index 73a0079eff..43ec664c50 100644 --- a/etcd/go.mod +++ b/etcd/go.mod @@ -6,7 +6,7 @@ replace github.com/openshift/microshift => ../ require ( github.com/openshift/api v0.0.0-20260901194050-81278704edb0 - github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 + github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b github.com/openshift/microshift v0.0.0-00010101000000-000000000000 github.com/spf13/cobra v1.10.2 go.etcd.io/etcd/api/v3 v3.6.13 diff --git a/etcd/go.sum b/etcd/go.sum index e1964f0ad3..3ffb9ba246 100644 --- a/etcd/go.sum +++ b/etcd/go.sum @@ -152,8 +152,8 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/openshift/api v0.0.0-20260901194050-81278704edb0 h1:9PTDE/0weDetokFkqYdHtZQDcULZhJSm5gNF3GceH4A= github.com/openshift/api v0.0.0-20260901194050-81278704edb0/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= -github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 h1:P/vZSEsUuAHMnf89gQ6FKIl9jsbPnNJ3gIBM43xn2Bg= -github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= +github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b h1:ErTc+6D1n/rpRaUYP++h0YlOzM+q7UaAdqDZrzhA0ho= +github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= github.com/openshift/etcd/api/v3 v3.5.0-alpha.0.0.20260903213007-24fb7ef2afe9 h1:DMjFxcIee4kEhAHqYqcB5WU/CZCKSCdviA2EYFCQk/c= github.com/openshift/etcd/api/v3 v3.5.0-alpha.0.0.20260903213007-24fb7ef2afe9/go.mod h1:X9+3gaKwzjlOxzo6TZ2u3b7HcHBcAL+Ph7EBPjI/VWk= github.com/openshift/etcd/client/pkg/v3 v3.0.0-20260903213007-24fb7ef2afe9 h1:jhPHtucrzE7SF1Qa/nUqpG3GLIlPrD8tkJaoWVVZWHI= diff --git a/etcd/vendor/github.com/openshift/build-machinery-go/AGENTS.md b/etcd/vendor/github.com/openshift/build-machinery-go/AGENTS.md new file mode 100644 index 0000000000..91c04f1f5c --- /dev/null +++ b/etcd/vendor/github.com/openshift/build-machinery-go/AGENTS.md @@ -0,0 +1,38 @@ +# AI Agent Instructions for build-machinery-go + +**Audience:** AI agents editing **this repository** only — not downstream repos +that vendor these fragments. Those repos should maintain their own root-level +`AGENTS.md`. + +| File | Purpose | +|------|---------| +| [ARCHITECTURE.md](ARCHITECTURE.md) | Make stack design, project layout, verification model | +| [CONTRIBUTING.md](CONTRIBUTING.md) | Development workflow, PR expectations, external guidelines | + +## What This Repo Is + +Reusable GNU Make fragments and helper scripts. Downstream repos include one +vendored entry file (`golang.mk`, `default.mk`, or `operator.mk`) in their +`Makefile`. See [ARCHITECTURE.md](ARCHITECTURE.md) for stacks, layout, and +include chains. + +## Critical Rules + +1. **Run `make verify` before considering any change complete.** +2. **Do not hand-edit `*.log` files** — regenerate with `make update`. +3. **Add new behavior in `make/targets/`**, not in entry files. +4. **Keep backward compatibility** — every repo that vendors this module is affected. +5. **Update examples and logs together** when changing `make/targets/`. + +## What NOT to Do + +- Hand-edit `*.example.mk.help.log` or `Makefile.test.log`. +- Change `make/targets/` without updating examples and regenerating logs. +- Edit files under `make/examples/*/vendor/`. +- Duplicate logic across entry files. +- Modify OWNERS or OWNERS_ALIASES. +- Use AI to respond to review comments. + +For workflow details (container image, branch name, commit structure), see +[CONTRIBUTING.md](CONTRIBUTING.md). For org-wide conventions, see the links in +CONTRIBUTING.md and [openshift/coderabbit](https://github.com/openshift/coderabbit). diff --git a/etcd/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md b/etcd/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md new file mode 100644 index 0000000000..b95b495452 --- /dev/null +++ b/etcd/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md @@ -0,0 +1,226 @@ +# Architecture Overview + +build-machinery-go provides reusable GNU Make fragments and helper scripts that +OpenShift Go repositories vendor and include in their own `Makefile`. This +document describes how the pieces fit together. Update it when the makefile +layout or verification model changes. + +## 1. Project Structure + +See also [AGENTS.md](AGENTS.md) for contributor-oriented rules. Layout: + +``` +build-machinery-go/ +├── Makefile # Meta-verification of example makefiles and logs +├── make/ +│ ├── golang.mk # Entry: pure Go projects +│ ├── default.mk # Entry: OpenShift Go (+ images, bindata, codegen) +│ ├── operator.mk # Entry: OpenShift operators +│ ├── *.example.mk # Copy-paste starting points for downstream repos +│ ├── *.example.mk.help.log # Checked-in `make help` output (audit trail) +│ ├── targets/ # Composable make modules +│ └── examples/ # Integration tests for makefile fragments +├── scripts/ # Shell helpers invoked by make targets +└── commitchecker/ # Small Go binary using golang.mk (dogfooding) +``` + +## 2. High-Level System Diagram + +This repository is a **library**, not a deployed service. Component repos consume +it at build time: + +``` +┌─────────────────────────┐ +│ OpenShift component │ +│ repo (operator, etc.) │ +└───────────┬─────────────┘ + │ go mod vendor + ▼ +┌─────────────────────────┐ include ┌──────────────────────────┐ +│ vendor/.../build- │ ───────────────► │ Component Makefile │ +│ machinery-go/make/*.mk │ │ (build, test, verify, │ +└─────────────────────────┘ │ images, codegen, ...) │ + ▲ └──────────────────────────┘ + │ verify via examples +┌───────────┴─────────────┐ +│ build-machinery-go │ +│ (this repo) │ +│ make verify / update │ +└─────────────────────────┘ +``` + +Data flow: makefile fragments define targets; component repos run those targets +locally and in CI. This repo validates fragment behavior through checked-in log +output from example makefiles. + +## 3. Core Components + +### 3.1. Make fragment stacks + +Three predefined stacks layer on top of each other. Downstream repos include +exactly one entry file from their vendored copy: + +| Stack | Entry file | Extends | Typical targets | +|----------|--------------------|-----------|------------------------------------------| +| Golang | `make/golang.mk` | — | `build`, `test-unit`, `verify-gofmt` | +| Default | `make/default.mk` | Golang | + `images`, `verify-codegen`, `bindata` | +| Operator | `make/operator.mk` | Default | + `test-operator-integration`, profiles | + +**Include chain:** + +``` +operator.mk + └── default.mk + ├── targets/openshift/deps.mk + ├── targets/openshift/images.mk + ├── targets/openshift/bindata.mk + ├── targets/openshift/codegen.mk + └── golang.mk + ├── targets/help.mk + └── targets/golang/*.mk + +operator.mk also includes: + └── targets/openshift/operator/*.mk +``` + +Entry files are thin wrappers that `include` modules from `make/targets/`. New +behavior belongs in `make/targets/`, not duplicated in entry files. + +### 3.2. Target modules (`make/targets/`) + +| Directory | Purpose | +|-------------------------------|---------------------------------------------------| +| `targets/golang/` | Build, test, fmt, vet, version, vulncheck | +| `targets/openshift/` | Images, bindata, codegen, deps, kustomize, yq, rpm | +| `targets/openshift/operator/` | Release, telepresence, profile manifests, MOM | + +Each `*.mk` file defines related targets and their `verify-*` / `update-*` +counterparts where applicable. + +### 3.3. Scripts (`scripts/`) + +Shell scripts hold logic too complex for inline make recipes: + +| Script | Used by | +|--------------------------------|------------------------------------| +| `update-deps.sh` | Dependency update targets | +| `test-operator-integration.sh` | Operator integration test target | +| `run-telepresence.sh` | Telepresence development workflow | +| `vulncheck.sh` | Vulnerability scanning target | + +### 3.4. commitchecker + +A minimal Go package that includes `golang.mk` from the parent directory. It +dogfoods the Golang stack to confirm fragments still work for real Go builds. +See [`commitchecker/README.md`](commitchecker/README.md) for downstream CI usage. + +## 4. Downstream Consumption + +Component repos vendor this module and include one entry file: + +```makefile +include $(addprefix vendor/github.com/openshift/build-machinery-go/make/, \ + default.mk \ +) +``` + +Paths resolve relative to the included file via +`$(dir $(lastword $(MAKEFILE_LIST)))`, so fragments work regardless of vendored +path depth. + +For a starting point, copy the matching `*.example.mk` into the component repo's +`Makefile` and adjust `GO_BUILD_PACKAGES`, image names, and codegen paths. + +## 5. Verification Model + +This repo does not build OpenShift operators. It verifies makefile fragments +through: + +1. **Example makefiles** (`make/*.example.mk`) — `make help` output captured in + checked-in `*.help.log` files. +2. **Integration examples** (`make/examples/*/Makefile.test`) — exercise + specific targets (codegen, profile manifests, golang version checks). + Output captured in `Makefile.test.log` files. +3. **Root `Makefile`** — runs all examples and diffs output via + `make verify` / `make update`. + +Log files are the audit trail: any change to makefile behavior must be visible +in regenerated log diffs. + +## 6. External Integrations + +| Integration | Purpose | How | +|-------------|---------|-----| +| OpenShift release images | CI build root; reproducible `make update` | `registry.ci.openshift.org/openshift/release` (see `.ci-operator.yaml`) | +| `govulncheck` | Dependency vulnerability scanning | Invoked by `scripts/vulncheck.sh` via `targets/golang/vulncheck.mk` | +| Codegen / image tooling | Bindata, CRD schema, controller-gen, imagebuilder | Referenced by `targets/openshift/*.mk`; run in downstream repos | +| Telepresence | Local operator development | `scripts/run-telepresence.sh` (operator stack only) | + +Downstream repos may integrate additional external tools through their own +Makefile variables; this repo provides the make targets that invoke them. + +## 7. Deployment & Infrastructure + +**Distribution:** Published as the Go module +`github.com/openshift/build-machinery-go`. Downstream repos pin a version in +`go.mod` and copy fragments into `vendor/` via `go mod vendor`. There is no +runtime deployment of this repository itself. + +**CI/CD:** OpenShift Prow via ci-operator. Build root image is defined in +[`.ci-operator.yaml`](.ci-operator.yaml) (`rhel-9-release-golang-1.23-openshift-4.19`). +The primary CI check is `make verify`, which diffs example makefile output +against checked-in logs. + +**Infrastructure owned by this repo:** None. Make targets in downstream repos may +build container images, generate manifests, or interact with clusters, but that +machinery runs in consumer repositories, not here. + +## 8. Security Considerations + +| Area | Practice | +|------|----------| +| Dependency scanning | `vulncheck` target runs `govulncheck`; fails on module vulnerabilities | +| Vendor integrity | `verify-deps` / `update-deps` targets in Default stack validate dependency state in downstream repos | +| Script execution | Helper scripts use `bash -e` and clean up temp files (`trap` in `vulncheck.sh`) | +| Secrets | No credentials or cluster access in this repo; downstream targets that need `KUBECONFIG` run in component repos | +| Supply chain | Changes to makefile fragments are auditable via checked-in `*.log` diffs in PRs | + +This repo does not implement authentication or authorization. Security-sensitive +operations (image pushes, cluster deploys) are gated by CI and credentials in +downstream repositories. + +## 9. Development & Testing Environment + +**Local setup:** Clone the repo and run `make verify`. See +[CONTRIBUTING.md](CONTRIBUTING.md) for the full workflow, including the +container command to match CI log output. + +**Testing approach:** + +| Layer | Mechanism | +|-------|-----------| +| Makefile fragments | `make/examples/*/Makefile.test` integration examples | +| Help output | `make/*.example.mk.help.log` snapshot tests | +| Golang stack | `commitchecker/` dogfooding build | + +**Code quality:** `make verify` is the gate. Downstream stacks additionally +expose `verify-gofmt`, `verify-govet`, `verify-codegen`, and related targets. + +## 10. Project Identification + +| Field | Value | +|-------|-------| +| Project name | build-machinery-go | +| Repository | https://github.com/openshift/build-machinery-go | +| Module path | `github.com/openshift/build-machinery-go` | +| Maintainers | See [OWNERS](OWNERS) (`control-plane-approvers`, `jsafrane`, `sanchezl`) | + +## 11. Glossary + +| Term | Definition | +|------|------------| +| **Stack** | One of Golang, Default, or Operator entry-file layers | +| **Fragment** | A `*.mk` file included into a downstream `Makefile` | +| **Target module** | A composable `make/targets/**/*.mk` file defining related targets | +| **Log audit** | Checked-in `*.log` files that snapshot makefile output for `git diff` verification | +| **Downstream repo** | An OpenShift component repo that vendors and includes these make fragments | diff --git a/etcd/vendor/github.com/openshift/build-machinery-go/CLAUDE.md b/etcd/vendor/github.com/openshift/build-machinery-go/CLAUDE.md new file mode 100644 index 0000000000..43c994c2d3 --- /dev/null +++ b/etcd/vendor/github.com/openshift/build-machinery-go/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md diff --git a/etcd/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md b/etcd/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md new file mode 100644 index 0000000000..5d7814832d --- /dev/null +++ b/etcd/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md @@ -0,0 +1,93 @@ +# Contributing to build-machinery-go + +build-machinery-go ships reusable GNU Make fragments consumed by many OpenShift +Go projects via `go mod vendor`. Changes here have broad downstream impact. + +Read [ARCHITECTURE.md](ARCHITECTURE.md) for how the make stacks and verification +model work. + +## Related guidelines + +This repository does not define org-wide OpenShift or Go conventions. Use these +instead: + +| Topic | Where | +|-------|-------| +| Control plane code conventions, testing, PR process, review expectations | [openshift/service-ca-operator/CONTRIBUTING.md](https://github.com/openshift/service-ca-operator/blob/main/CONTRIBUTING.md) | +| OpenShift CI / Prow / Jira integration | [docs.ci.openshift.org](https://docs.ci.openshift.org/) | +| Commit signature verification | [OpenShift contribution policy](https://docs.google.com/document/d/1184EPSGunUkcSQYUK8T4a6iyawwi6f2zxdbB2jtG9nQ/edit?usp=sharing) | +| AI code review configuration | [openshift/coderabbit](https://github.com/openshift/coderabbit) | + +For reviews, reach out via [OWNERS](OWNERS) or the control plane Slack channels +listed in the service-ca-operator contributing guide. + +## Development workflow + +1. Fork the repo and clone your fork. +2. Create a feature branch from `master`. +3. Make your changes. When makefile behavior changes, add or update examples under + `make/examples/`. +4. Run `make verify` locally before pushing. +5. Open a PR against `openshift/build-machinery-go:master`. + +Functional changes that regenerate logs should use two commits when applicable: +code first, then `update generated` for `*.log` files only. + +## Verification + +This repo validates makefile fragments through **checked-in log snapshots**, not +unit tests. See [ARCHITECTURE.md §5](ARCHITECTURE.md#5-verification-model) for +details. + +- Run `make update` after changing `make/targets/` or examples, then commit the + regenerated `*.log` files. +- Never hand-edit `*.example.mk.help.log` or `Makefile.test.log`. + +### Matching CI output + +Local `make update` output may differ across distributions. To match CI, run +update in the same build root image as Prow (defined in +[`.ci-operator.yaml`](.ci-operator.yaml)): + +```bash +podman run -it --rm --pull=always \ + -v "$(pwd)":/go/src/$(go list -m) \ + --workdir=/go/src/$(go list -m) \ + registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.23-openshift-4.19 \ + make update +``` + +## Make fragment changes + +- Add new behavior in `make/targets/`, not in entry files (`golang.mk`, + `default.mk`, `operator.mk`). +- Keep backward compatibility unless a breaking change is explicitly agreed. +- Place complex shell logic in `scripts/` — follow the + [shell styleguide](https://google.github.io/styleguide/shellguide.html). +- Do not add Go dependencies without justification in the PR description. + +## Pull requests + +Follow the linked control plane and OpenShift CI guidelines for Jira titles +(`CNTRLPLANE-XXXX:` or `NO-JIRA:`), `/lgtm`, `/approve`, `/verified`, and Prow +retests. + +Repository-specific expectations: + +- `make verify` must pass in CI. +- Changes to `make/targets/` must include updated examples and regenerated logs. +- Breaking fragment interface changes need maintainer agreement and a migration + note for downstream repos. +- Do not modify `OWNERS` or `OWNERS_ALIASES` without explicit direction. + +For makefile-only changes, `/verified by ci` is typically sufficient when +`make verify` passes. + +## Areas requiring extra care + +- Entry file changes (`golang.mk`, `default.mk`, `operator.mk`) affect every + downstream repo on that stack. +- Target module interface changes (variables, target names, defaults) must stay + backward compatible or document migration. +- Log normalization sed filters in the root `Makefile` must not hide real + behavior changes. diff --git a/etcd/vendor/github.com/openshift/build-machinery-go/README.md b/etcd/vendor/github.com/openshift/build-machinery-go/README.md index 66862f61a2..54fbed76b2 100644 --- a/etcd/vendor/github.com/openshift/build-machinery-go/README.md +++ b/etcd/vendor/github.com/openshift/build-machinery-go/README.md @@ -37,8 +37,9 @@ Extends [#Default](). `scripts` contain more complicated logic that is used in some make targets. ## Contributing -### Updating generated files -We track the log output from the makefile tests to make sure any change is visible and can be audited. Unfortunately due to subtle linux tooling differences in distributions and versions, `make update` may not get you the exact output as the CI. To avoid it, just run the command in the same container as CI: -``` -podman run -it --rm --pull=always -v $( pwd ):/go/src/$( go list -m ) --workdir=/go/src/$( go list -m ) registry.ci.openshift.org/openshift/release:rhel-8-release-golang-1.15-openshift-4.7 make update -``` + +See [CONTRIBUTING.md](CONTRIBUTING.md) for development workflow, PR guidelines, +and how to regenerate checked-in makefile logs. + +For architecture details, see [ARCHITECTURE.md](ARCHITECTURE.md). For AI agent +instructions, see [AGENTS.md](AGENTS.md) ([CLAUDE.md](CLAUDE.md) references it via `@AGENTS.md`). diff --git a/etcd/vendor/modules.txt b/etcd/vendor/modules.txt index 1a33f2cef5..c32a393876 100644 --- a/etcd/vendor/modules.txt +++ b/etcd/vendor/modules.txt @@ -198,7 +198,7 @@ github.com/oklog/run ## explicit; go 1.26.0 github.com/openshift/api/config/v1 github.com/openshift/api/operator/v1 -# github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 +# github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b ## explicit; go 1.22.0 github.com/openshift/build-machinery-go github.com/openshift/build-machinery-go/make diff --git a/go.mod b/go.mod index b3853c7110..a6d8e9a4cc 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/google/go-cmp v0.7.0 github.com/miekg/dns v1.1.63 // microshift github.com/openshift/api v0.0.0-20260715165912-72066cc9718b - github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 + github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec github.com/openshift/library-go v0.0.0-20260720185249-0595e37fe20f github.com/ovn-kubernetes/libovsdb v0.8.2-0.20260302130604-c07ce22366ac @@ -35,7 +35,7 @@ require ( github.com/gogo/protobuf v1.3.2 github.com/golang/snappy v0.0.4 github.com/openshift/cluster-policy-controller v0.0.0-20260902120314-c9e9a3482609 - github.com/openshift/route-controller-manager v0.0.0-20260722172158-59697cf7af45 + github.com/openshift/route-controller-manager v0.0.0-20260909174728-a158fff7ce38 github.com/prometheus/client_model v0.6.2 github.com/prometheus/common v0.67.5 github.com/prometheus/prometheus v0.302.1 @@ -241,7 +241,7 @@ replace ( github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d // from kubernetes k8s.io/klog/v2 => ./deps/k8s.io/klog // deps clone github.com/kubernetes/klog from kubernetes k8s.io/kubernetes => ./deps/github.com/openshift/kubernetes // deps copy - sigs.k8s.io/kube-storage-version-migrator => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260304192652-72835e43c775 // release kube-storage-version-migrator via kubernetes-kube-storage-version-migrator + sigs.k8s.io/kube-storage-version-migrator => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260913130130-fb49e56122b6 // release kube-storage-version-migrator via kubernetes-kube-storage-version-migrator ) replace ( diff --git a/go.sum b/go.sum index c8857d062a..b1efc66d78 100644 --- a/go.sum +++ b/go.sum @@ -308,20 +308,20 @@ github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43 h1:V9hWaBi9cnohNk1F0Ph6wpI0otMWqMHleJ3oj5603Bc= github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43/go.mod h1:ZuzfEq1ccZpHNx05xEUKlm2TcMHt2iXVutb79kAuTfM= -github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 h1:P/vZSEsUuAHMnf89gQ6FKIl9jsbPnNJ3gIBM43xn2Bg= -github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= +github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b h1:ErTc+6D1n/rpRaUYP++h0YlOzM+q7UaAdqDZrzhA0ho= +github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE= github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec h1:UDjX+mot5IVLpcChyBqLXG1oSB29s4UkqFmgNb0Xsqc= github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec/go.mod h1:iMHec0APKVjOH8GfL/RxddX8DuiuSvPlRe+s7KDqlyA= github.com/openshift/cluster-policy-controller v0.0.0-20260902120314-c9e9a3482609 h1:MwhDhCUKURbk47UN/jNqaivpbqJ601Cj5+THG/5IA2A= github.com/openshift/cluster-policy-controller v0.0.0-20260902120314-c9e9a3482609/go.mod h1:ujufpXCwp5BBm/OseRiag45V2v7SOhow/O6EoMrVfWg= -github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260304192652-72835e43c775 h1:4gZibdvRUsxsQ55Tp+HFRjVzkYh+bcRezmYqhiCMk4U= -github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260304192652-72835e43c775/go.mod h1:o5cKv/pQ+exEYKq97WapNa5cxSPxuwBezHZHNW5RNRo= +github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260913130130-fb49e56122b6 h1:bfFp5uG5Gxl4wpqrEeDjaHrTmKP0Qhl+jkXZ8i1Kza8= +github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260913130130-fb49e56122b6/go.mod h1:VCEhrDaKKWEti2zVSo9C5DV0A1EYfGrvSWnZJ6m+4Do= github.com/openshift/library-go v0.0.0-20260720185249-0595e37fe20f h1:NdSEtKB+vvHlGELA+jX/c+TALNwe8iSsJAQYvMabgHQ= github.com/openshift/library-go v0.0.0-20260720185249-0595e37fe20f/go.mod h1:iWcB6wgeOhsByZAZGhmzBtEnrLQzABL0s3aeou8AmSI= github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d h1:t+XyaZL4LpQx/AY2SETlMCQPLc9vd05ZZ7WXvD9doME= github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= -github.com/openshift/route-controller-manager v0.0.0-20260722172158-59697cf7af45 h1:3qzWn9Ckvznqgwu4MaWNB3bNsAhp1EF4nSNEHF/tJhQ= -github.com/openshift/route-controller-manager v0.0.0-20260722172158-59697cf7af45/go.mod h1:iYHV170TF42UdYYm7JfEV/atiUanhE5NPnog6syG898= +github.com/openshift/route-controller-manager v0.0.0-20260909174728-a158fff7ce38 h1:fwfj89uebvh25Goqh1H2uEI57UGsC7EjuZYnW8AtXDk= +github.com/openshift/route-controller-manager v0.0.0-20260909174728-a158fff7ce38/go.mod h1:iYHV170TF42UdYYm7JfEV/atiUanhE5NPnog6syG898= github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0= github.com/ovn-kubernetes/libovsdb v0.8.2-0.20260302130604-c07ce22366ac h1:D7Ex9/u5HMz+xvqel1RCCO1AxVG7XRAx9AcP02/nyzk= github.com/ovn-kubernetes/libovsdb v0.8.2-0.20260302130604-c07ce22366ac/go.mod h1:x2keWyG0K1WmZeZLRh+z4fWwcqp99Yu9/HAiMucj5D0= diff --git a/packaging/crio.conf.d/10-microshift_amd64.conf b/packaging/crio.conf.d/10-microshift_amd64.conf index 42b1b75adf..b09b930240 100644 --- a/packaging/crio.conf.d/10-microshift_amd64.conf +++ b/packaging/crio.conf.d/10-microshift_amd64.conf @@ -2,6 +2,6 @@ # for community builds on top of OKD, this setting has no effect [crio.image] global_auth_file="/etc/crio/openshift-pull-secret" -pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:6f9b8dccbc5bcb08b052ac3cd20420a57683c30954128a07ca57d6478c5cdff4" +pause_image = "quay.io/openshift-release-dev/ocp-v5.0-art-dev@sha256:3d361a6c02fbf89f64a5618209c9af61c784e3a8642adac0c95e1c6b972f2e7f" pause_image_auth_file = "/etc/crio/openshift-pull-secret" pause_command = "/usr/bin/pod" diff --git a/scripts/auto-rebase/changelog.txt b/scripts/auto-rebase/changelog.txt index 4f49d8ddbb..c92584b78b 100644 --- a/scripts/auto-rebase/changelog.txt +++ b/scripts/auto-rebase/changelog.txt @@ -1,29 +1,145 @@ -- cluster-ingress-operator embedded-component 5bf72fcc4534d9ba2c4d65d29cdb8b01c83cf550 to 48b8f79897294e8701c22af8dcdddcb78fa30ff0 - - 37e7d31e 2026-09-01T13:27:57-04:00 Update the logging and add a descriptive comment - - bea6ae70 2026-09-01T17:37:11+02:00 OCPBUGS-92835: add grace period to Available condition for deployment blips - - 022ab829 2026-08-26T18:38:38-03:00 vendor files required for tests - - 6daaab20 2026-08-26T18:38:38-03:00 WAF-3: Implement extension provider capability for WAF - - 1ad981ce 2026-08-14T12:48:03-04:00 Update the unit tests - - 5edaf15a 2026-08-13T20:03:58-04:00 Add two unit tests for malformed CIDRs - - 58cc99fc 2026-08-13T19:11:45-04:00 OCPBUGS-109582: Normalize malformed CIDRs to avoid upgrade disruptions - - d896afa8 2026-08-10T15:48:35+02:00 Fix gofmt formatting in controller_test.go - - 99e8741a 2026-07-31T16:29:50+02:00 OCPBUGS-62627: Suppress cluster operator Progressing during infrastructure-driven ingress unavailability - -- cluster-kube-apiserver-operator embedded-component 2caf92bdc42acc1d71c2c1e6152b7da31b66919c to 7e0eee0325ab855d09906ba31c2ae2040bb1a7b1 - - e9a1777 2026-09-04T11:43:10+02:00 bump (*) - -- cluster-network-operator embedded-component 50609c5ab373ed5c1db508e9819afd10ea5512ec to c44c178f408a77a9d2460bae64620d2bd3200ff7 - - d25b490 2026-09-04T10:19:02+02:00 Add AGENTS.md, point CodeRabbit knowledge base at it - - 84a98ca 2026-08-31T12:24:13-07:00 Add status.vrfName and shortNames to UDN/CUDN CRDs - -- etcd embedded-component 609b11ed8fc404fb95572d7c87e3243a1206cdb7 to 24fb7ef2afe9c4e4ca179f70b101d8ac2a0daeab - - 33b1c411 2026-09-02T20:30:20-07:00 DOWNSTREAM: : CNTRLPLANE-3724: add agentic context docs for the openshift/etcd fork - -- machine-config-operator embedded-component 11fd0ff5069fa923efab9312a3cdb65e8b94fb43 to 95ada475a7d0c0928d9d3cbfbe37196196a337d8 - - 8940415e 2026-09-04T11:48:16Z NO-ISSUE: check mosb failed message in test 85980 - - 1129129d 2026-09-04T09:45:39+02:00 OCPBUGS-120711: Fix vsphere network absolute paths - - 2c4e2bc3 2026-09-03T13:12:07-04:00 operator: retry on conflict in syncMachineConfigNodes - - 8fdff133 2026-09-03T16:07:31Z OCPBUGS-116490: remove nft chains before checking the ignition config - - b8eee7e1 2026-09-02T15:22:15+05:30 OCPBUGS-109657: Assert errors in TestGetPrimaryPoolForNode - - b764fb26 2026-08-31T14:01:28-04:00 mcs: replace wildcard permissions with explicit verbs +- api embedded-component 81278704edb0a6c2e7c456431778acad4cd352fc to c1fd4253d254ab35366d0e41ca077715e40d5cae + - 1ce44c8b 2026-09-10T14:34:54+02:00 Add EgressIPNodeSelector feature gate + - 1fdf621c 2026-09-01T14:22:38-04:00 SPLAT-2874: Add VSpherePerComponentCredOverrides feature gate + +- cluster-csi-snapshot-controller-operator embedded-component 35ec0224eb0e5219d5eae012fb703223a6f3e1f7 to 03b68fd87ae423f78b2a31174d6c432acad47eb5 + - 265006b 2026-09-09T09:57:04+02:00 Remove VolumeGroupSnapshot feature gate + +- cluster-ingress-operator embedded-component 48b8f79897294e8701c22af8dcdddcb78fa30ff0 to 663473a1f787b5441c0ccb210de713f3be175b9c + - 9937b5e2 2026-09-09T21:59:56Z OCPBUGS-6718: Add regression test for RBAC wildcard elimination + - 6c4b90bc 2026-09-09T05:03:25Z OCPBUGS-6718: Add patch verb to core resources ClusterRole rule + - 3e2f8c5f 2026-09-08T20:25:43Z OCPBUGS-6718: Add patch verb to apps deployments ClusterRole rule + - 602e9e61 2026-09-05T04:36:52Z OCPBUGS-6718: Tighten pods and events verbs in RBAC Role + - b98efed0 2026-09-05T04:14:25Z OCPBUGS-6718: Add ingresscontrollers/finalizers to RBAC Role + - d902f72e 2026-09-04T19:15:16Z OCPBUGS-6718: Add list and watch verbs to events ClusterRole rule + - 48dced3d 2026-09-04T18:55:07Z OCPBUGS-6718: Replace wildcard verbs in RBAC manifests with explicit permissions + - 823f9d5c 2026-09-03T11:18:46+02:00 refactor: remove Azure workload identity feature gate + - baf9f26b 2026-08-01T04:01:20Z Delete the CRL controller + +- cluster-kube-apiserver-operator embedded-component 7e0eee0325ab855d09906ba31c2ae2040bb1a7b1 to 04815ee59019750b027a547785fb20b654991c1b + - 70c0200 2026-09-10T22:22:04Z OCPBUGS-114428: Update build-machinery-go vendor dependency + - 15db4f3 2026-09-09T15:50:26+02:00 bump (*) + +- cluster-kube-controller-manager-operator embedded-component 330fe4a6ed1a15ae1c2b572138d596fd5780d318 to 416af3a20bd39d33d7506f04a6c483528aa9e6dc + - a885cc8 2026-09-10T22:20:13Z OCPBUGS-114428: Update build-machinery-go vendor dependency + +- cluster-kube-scheduler-operator embedded-component 6a750a9fd626675a2bc35b43b75dbc182ce3d8e9 to 7d896ecefe171028a01f6b7cfdbf30bc5828b414 + - 0b5505c 2026-09-10T22:21:28Z OCPBUGS-114428: Update build-machinery-go vendor dependency + +- cluster-network-operator embedded-component c44c178f408a77a9d2460bae64620d2bd3200ff7 to 61de77e4d4c4f65cd5b3d73e00308bfe837c1066 + - b9e781b 2026-09-10T11:16:17+02:00 fix(ovn-kubernetes): disable local DB probes + +- kubernetes embedded-component fb553cd105957b64651b393cb1a42f59faab190e to c85a8c489d53f97824059d92f706a5e1a65f97fa + - c659f228b 2026-09-09T09:41:42+02:00 UPSTREAM: revert: d974e69b84b Add volume group snapshot test driver + - a708b025e 2026-09-09T09:41:42+02:00 UPSTREAM: 141358: Enable group snapshot tests in all configurations + +- kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 to fb49e56122b670121136c76177e2af2977b37682 + - 80455ad 2026-09-12T23:11:54Z UPSTREAM: : OCPBUGS-114428: Update build-machinery-go vendor dependency + +- machine-config-operator embedded-component 95ada475a7d0c0928d9d3cbfbe37196196a337d8 to aca585a4be883cb387fb78137f2a8dd742759ff3 + - 24cc51d3 2026-09-10T08:53:25Z Fix IsBootImageUpdateSupported to include vSphere and Azure platforms + - 3eb5fc05 2026-09-02T09:20:26+02:00 OCBPUGS-105283: Mount /etc/container in mosb + - 9dbb2d40 2026-08-31T23:03:30-04:00 updateLayeredOS deploy-from-self when skopeo < 1.22.2 + - ee5a2278 2026-08-31T14:16:40-05:00 Fix CVE-2026-15792: Upgrade BuildKit to v0.31.2 and gRPC to v1.82.1 + - e93ebc4c 2026-08-18T10:34:55+02:00 MCO-2468: Dump compact cache to CM for persistence + +- route-controller-manager embedded-component 59697cf7af4517dd44e28179a57f7f35b6ea0e22 to a158fff7ce3826058bd2d7338b206cdd600d0d40 + - 6111c6d 2026-08-20T21:36:25-03:00 OCPBUGS-104856: clear unmanaged-route metric when the route is removed + +- oc image-amd64 e0e4c04430bf649f08f524f3a61ebffd2df1c6bc to 876e245c77f9daa471592fd6dd827a24c0d5814a + - cab7b76a 2026-09-10T14:58:11+12:00 Document search order for images when --idms-file specified + - 7418e085 2026-09-10T14:40:28+12:00 OCPBUGS-122005: Add --idms-file option to oc image info + +- router image-amd64 3381229146657d2e6bd94115dda0885f25cb3bed to d5cf9f2aa0bdd024f51a208f12558da9bac5ed38 + - 46d38f6 2026-09-04T11:24:46-04:00 OCPBUGS-77056: Lock DeleteFunc to stop SARCompleted overwriting rejection + +- router image-amd64 3381229146657d2e6bd94115dda0885f25cb3bed to d5cf9f2aa0bdd024f51a208f12558da9bac5ed38 + - 46d38f6 2026-09-04T11:24:46-04:00 OCPBUGS-77056: Lock DeleteFunc to stop SARCompleted overwriting rejection + +- ovn-kubernetes image-amd64 2f9add8106687de6dba052689b97a189f92439f9 to fe886495f2f706c1912d1417daa768c2d78c0597 + - ea4b9c61 2026-09-09T16:32:51+05:30 sync test annotations with upstream changes + - 72c64c0c 2026-08-31T18:26:24-07:00 tests-ext: run OTE tests only in ovn-kubernetes conformance suites + - 1d21dae8 2026-08-28T09:21:55-07:00 docs: document multi-subnets for primary UDNs + - f6d58726 2026-08-27T23:38:03+05:30 Remove legacy moveACLsToNamespacedPortGroups function + - da3ada61 2026-08-27T19:15:50+05:30 Handle GetActiveNetworkForNamespace NotFound across callers + - 302f0fa8 2026-08-27T19:15:47+05:30 Handle GetPrimaryNADForNamespace NotFound across callers + - a2551e5f 2026-08-27T19:13:51+05:30 Fix wrong infrastructure-locked role when namespace is missing + - d9eda100 2026-08-27T12:56:31+05:30 evpn: fix nil dereference in shouldDeleteNeighbors + - ebef4f30 2026-08-26T10:02:32-07:00 routeadvertisements: identify DPU hosts by annotation + - a0ad99bf 2026-08-26T10:06:41+02:00 e2e: cover the published VRF name of primary UDNs and CUDNs + - 438306eb 2026-08-26T10:06:41+02:00 udn: publish the derived VRF name of primary networks + - 418d3eed 2026-08-26T10:06:41+02:00 udn API: add status.vrfName for the derived VRF device name + - 907b8fa1 2026-08-26T10:06:41+02:00 e2e: cover the published VRF name of Uplink-attached CUDNs + - 22b86333 2026-08-26T10:06:41+02:00 cudn: publish the derived VRF name of primary networks + - e0ae49b4 2026-08-26T10:06:41+02:00 cudn API: add status.vrfName for the derived VRF device name + - e3ab3cc7 2026-08-26T08:58:58+05:30 Register test images using tests extension + - 25c581be 2026-08-25T17:26:57-04:00 egressip: fix nondeterministic failover unit test + - d224c2c7 2026-08-25T12:04:15-04:00 e2e: activate dynamic CUDNs for route preservation + - 3b08c224 2026-08-25T12:04:14-04:00 e2e: make Uplink NodePort services dual-stack + - 013eb192 2026-08-25T12:04:14-04:00 ci: select DPU Uplink tests by feature label + - 5db253d0 2026-08-25T19:09:14+05:30 Prevent duplicate MAC responses during egress IP failover with nftables + - 12b2bbca 2026-08-25T18:43:39+05:30 docs: add EgressIP design document + - d255ff59 2026-08-24T17:37:21-04:00 e2e: fix Uplink route checks for Dynamic UDNs + - 7920c7a1 2026-08-24T11:18:55+02:00 kind: write image archives under a unique temporary directory + - f08029b2 2026-08-24T11:02:30+02:00 kind: load single-platform image archives with docker + - e59eb55c 2026-08-24T09:44:18+02:00 kind: preload multus image instead of pulling it on every node + - 6a8019b5 2026-08-24T00:09:14-07:00 OKEP-6224 code changes: Add DHCP IPAM support for localnet UDNs + - 1f025268 2026-08-24T00:09:14-07:00 Add Vendored file changes for DHCP IPAM support for localnet CUDN + - 2baf225d 2026-08-21T15:27:58-04:00 Fix hybrid overlay node retry test race + - f878a1a9 2026-08-21T17:44:41+02:00 e2e: accept link-local IPv6 BGP next hops in route checks + - 4bec0960 2026-08-21T17:44:41+02:00 Uplink: report host-side gateway programming on HostGatewayReady + - a4fdfdc8 2026-08-21T17:44:41+02:00 e2e: cover Uplink route preservation across VRF enslavement + - 4ec2e4d7 2026-08-21T17:44:41+02:00 vrfmanager: preserve slave interface routes across enslavement + - 7bc78c9d 2026-08-21T16:45:05+02:00 release-note: add a section to PR description and a coderabbit rule + - e45e59af 2026-08-21T15:57:35+02:00 metrics: bound the /metrics scrape with a total collection budget + - 3e6a2620 2026-08-21T15:57:12+02:00 metrics: bound ovs/ovn appctl subprocesses on the scrape path + - 73a68b34 2026-08-21T15:44:50+02:00 [config] Add zone flag back to avoid breaking existing users. + - d5fd178e 2026-08-21T15:42:00+02:00 Uplink API: add the HostGatewayReady UplinkState condition + - 9e19db69 2026-08-21T14:55:16+02:00 [kind] don't update fs.inotify if the limits are already correct + - 4133e538 2026-08-21T11:48:02+02:00 Contributing guide: add info on incremental changes during review + - 0548e7a1 2026-08-21T09:18:25+05:30 Remove isEmptyStatusManagedField restriction from startup cleanup + - d16d3f73 2026-08-20T16:42:47+02:00 [OKEP] Add an OVNObservability API enhancement + - 25ffe53b 2026-08-20T05:25:11-07:00 test: remove obsolete OVN_HA mode + - 84d0a875 2026-08-20T05:25:11-07:00 config, tools: remove central-mode remnants + - 44672b06 2026-08-20T05:25:11-07:00 test: drop removed DB recovery skips + - dc34f545 2026-08-20T05:25:11-07:00 libovsdb, metrics: remove obsolete Raft support + - 79c813bb 2026-08-20T05:25:11-07:00 util: remove unused raft readiness probes + - c948dda8 2026-08-19T18:11:03+02:00 e2e: move DPU-sim BGP server network off the ipvrf allocator range + - 84dbd13d 2026-08-19T19:01:41+05:30 egressip: skip nodes with unusable host-cidrs annotation + - 1174da43 2026-08-19T07:57:23-04:00 add fixes to overlapping cases + - a98391ee 2026-08-19T07:57:23-04:00 e2e(evpn): add overlapping CUDN isolation tests to existing EVPN test table + - 65b34606 2026-08-19T07:57:23-04:00 e2e(evpn): add macVRFUseProxyDockerNetwork flag to runEVPNNetworkAndServers + - e2e0aeef 2026-08-19T13:24:10+02:00 egressip: fix e2e IFA_PROTO check for Linux address cases + - 8cc12c2f 2026-08-19T13:24:10+02:00 egressip: extend e2e tests to verify IFA_PROTO on EgressIP addresses + - e3b903ca 2026-08-19T13:24:10+02:00 egressip: set IFA_PROTO on EgressIP addresses + - 3d4ce441 2026-08-18T11:20:59Z deps: bump go.opentelemetry.io/otel to v1.44.0 + - e1ea00f7 2026-08-18T15:36:15+05:30 egressip: fix typo and capitalization in error message + - bb45fc9e 2026-08-18T15:31:34+05:30 docs: fix mike version dropdown sticky header layout on scroll/mobile + - c41d04de 2026-08-18T15:05:06+05:30 docs: add section index landing pages using Kubernetes-style approach + - 85b39a14 2026-08-18T10:04:16+02:00 e2e: cover both Uplink DPU bridge resolution methods + - 53b4843d 2026-08-18T10:02:40+02:00 uplink: resolve DPU bridge from published host function + - 3d038c0c 2026-08-18T10:02:40+02:00 crd/uplink: add hostFunction to UplinkState status + - f439208c 2026-08-14T14:30:25-07:00 ci: restore no-uplink gateway coverage + - 41f539cb 2026-08-13T18:15:29-07:00 ovn: remove obsolete node zone annotation + - 46ed93df 2026-08-13T18:15:29-07:00 networkmanager: remove obsolete zone mode + - c8f6eba2 2026-08-13T18:15:29-07:00 ovn: complete node identity cleanup + - 558c325d 2026-08-13T18:10:30-07:00 test: keep network connect locality node-scoped + - c139d030 2026-08-13T18:10:29-07:00 test: use node identity in controller fixtures + - 4a15fdff 2026-08-13T18:10:29-07:00 ovn: use node identity for controller locality + - c7ec9183 2026-08-13T18:10:29-07:00 test: align zone fixtures with node-name zones + - 4242b3e9 2026-08-13T18:10:29-07:00 test: update egressip expectations for node-name zones + - 92dfb462 2026-08-13T18:10:29-07:00 ovn: treat missing node zone as unknown + - 98324ea8 2026-08-13T18:10:29-07:00 ovn: remove legacy default zone configuration + - 6b287d95 2026-08-10T16:23:37-07:00 e2e: fix egress IP traffic-monitor pod startup race + - 68deba90 2026-07-23T13:13:57-04:00 ci: aggregate coredump traces after e2e + - c2a2b225 2026-07-23T13:13:57-04:00 ci: make coredump reporting best effort + - aaf22bcc 2026-07-23T13:13:57-04:00 ci: post coredump traces to pull requests + - aa715ad3 2026-07-23T13:13:57-04:00 ci: print coredump stack traces in e2e jobs + - ae9bdc90 2026-07-23T13:13:57-04:00 contrib: support Go and FRR coredump traces + - 3941376e 2026-07-22T15:51:17-04:00 contrib: extract Fedora OVN coredump traces + - 6b89af49 2026-06-30T13:01:34+02:00 Add maintenance doc explaining what kinds of tasks exist + +- kubernetes image-amd64 fb553cd105957b64651b393cb1a42f59faab190e to c85a8c489d53f97824059d92f706a5e1a65f97fa + - c659f228b 2026-09-09T09:41:42+02:00 UPSTREAM: revert: d974e69b84b Add volume group snapshot test driver + - a708b025e 2026-09-09T09:41:42+02:00 UPSTREAM: 141358: Enable group snapshot tests in all configurations diff --git a/scripts/auto-rebase/commits.txt b/scripts/auto-rebase/commits.txt index cdc8ad2867..3c645532ad 100644 --- a/scripts/auto-rebase/commits.txt +++ b/scripts/auto-rebase/commits.txt @@ -1,30 +1,30 @@ -https://github.com/openshift/api embedded-component 81278704edb0a6c2e7c456431778acad4cd352fc -https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 35ec0224eb0e5219d5eae012fb703223a6f3e1f7 +https://github.com/openshift/api embedded-component c1fd4253d254ab35366d0e41ca077715e40d5cae +https://github.com/openshift/cluster-csi-snapshot-controller-operator embedded-component 03b68fd87ae423f78b2a31174d6c432acad47eb5 https://github.com/openshift/cluster-dns-operator embedded-component c0ed09e329e9001629518604a58205e3fbe8284a -https://github.com/openshift/cluster-ingress-operator embedded-component 48b8f79897294e8701c22af8dcdddcb78fa30ff0 -https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 7e0eee0325ab855d09906ba31c2ae2040bb1a7b1 -https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 330fe4a6ed1a15ae1c2b572138d596fd5780d318 -https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 6a750a9fd626675a2bc35b43b75dbc182ce3d8e9 -https://github.com/openshift/cluster-network-operator embedded-component c44c178f408a77a9d2460bae64620d2bd3200ff7 +https://github.com/openshift/cluster-ingress-operator embedded-component 663473a1f787b5441c0ccb210de713f3be175b9c +https://github.com/openshift/cluster-kube-apiserver-operator embedded-component 04815ee59019750b027a547785fb20b654991c1b +https://github.com/openshift/cluster-kube-controller-manager-operator embedded-component 416af3a20bd39d33d7506f04a6c483528aa9e6dc +https://github.com/openshift/cluster-kube-scheduler-operator embedded-component 7d896ecefe171028a01f6b7cfdbf30bc5828b414 +https://github.com/openshift/cluster-network-operator embedded-component 61de77e4d4c4f65cd5b3d73e00308bfe837c1066 https://github.com/openshift/cluster-openshift-controller-manager-operator embedded-component 8da2f1fcb1e76e8b1b97b16ca7bbfa7116287eb8 https://github.com/openshift/cluster-policy-controller embedded-component c9e9a348260921c9e788e33a51e904502cbe2d13 https://github.com/openshift/csi-external-snapshotter embedded-component a019d1a9d9e1d26ffd0b2e0d911733180fa608b2 https://github.com/openshift/etcd embedded-component 24fb7ef2afe9c4e4ca179f70b101d8ac2a0daeab -https://github.com/openshift/kubernetes embedded-component fb553cd105957b64651b393cb1a42f59faab190e -https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component 72835e43c7754356645e41031f3a99926b4d42e6 -https://github.com/openshift/machine-config-operator embedded-component 95ada475a7d0c0928d9d3cbfbe37196196a337d8 +https://github.com/openshift/kubernetes embedded-component c85a8c489d53f97824059d92f706a5e1a65f97fa +https://github.com/openshift/kubernetes-kube-storage-version-migrator embedded-component fb49e56122b670121136c76177e2af2977b37682 +https://github.com/openshift/machine-config-operator embedded-component aca585a4be883cb387fb78137f2a8dd742759ff3 https://github.com/openshift/openshift-controller-manager embedded-component 5235418de7c86e6fae1004f84e55a2fbc1d3ac1c https://github.com/openshift/operator-framework-olm embedded-component cfe91e367d56b3bd96331942e3c7c7d434fd9c0d -https://github.com/openshift/route-controller-manager embedded-component 59697cf7af4517dd44e28179a57f7f35b6ea0e22 +https://github.com/openshift/route-controller-manager embedded-component a158fff7ce3826058bd2d7338b206cdd600d0d40 https://github.com/openshift/service-ca-operator embedded-component ed872ba14b615ca5726ae90e987268877a0b0b20 -https://github.com/openshift/oc image-amd64 e0e4c04430bf649f08f524f3a61ebffd2df1c6bc +https://github.com/openshift/oc image-amd64 876e245c77f9daa471592fd6dd827a24c0d5814a https://github.com/openshift/coredns image-amd64 37aaba896e97f4b9a091aab6d36f2213b8854474 https://github.com/openshift/csi-external-snapshotter image-amd64 a019d1a9d9e1d26ffd0b2e0d911733180fa608b2 -https://github.com/openshift/router image-amd64 3381229146657d2e6bd94115dda0885f25cb3bed -https://github.com/openshift/router image-amd64 3381229146657d2e6bd94115dda0885f25cb3bed +https://github.com/openshift/router image-amd64 d5cf9f2aa0bdd024f51a208f12558da9bac5ed38 +https://github.com/openshift/router image-amd64 d5cf9f2aa0bdd024f51a208f12558da9bac5ed38 https://github.com/openshift/kube-rbac-proxy image-amd64 15f06dc655748d92897ba0d37cb8a0c40fb5d6fa -https://github.com/openshift/ovn-kubernetes image-amd64 2f9add8106687de6dba052689b97a189f92439f9 -https://github.com/openshift/kubernetes image-amd64 fb553cd105957b64651b393cb1a42f59faab190e +https://github.com/openshift/ovn-kubernetes image-amd64 fe886495f2f706c1912d1417daa768c2d78c0597 +https://github.com/openshift/kubernetes image-amd64 c85a8c489d53f97824059d92f706a5e1a65f97fa https://github.com/openshift/service-ca-operator image-amd64 ed872ba14b615ca5726ae90e987268877a0b0b20 https://github.com/openshift/oc image-arm64 2902632b849a20d312215e16f2058233f1713553 https://github.com/openshift/coredns image-arm64 37aaba896e97f4b9a091aab6d36f2213b8854474 diff --git a/scripts/auto-rebase/last_rebase.sh b/scripts/auto-rebase/last_rebase.sh index 4aa2b571d1..0d5c544678 100755 --- a/scripts/auto-rebase/last_rebase.sh +++ b/scripts/auto-rebase/last_rebase.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.1.0-0.nightly-2026-09-09-023423" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.1.0-0.nightly-arm64-2026-08-25-194037" +./scripts/auto-rebase/rebase.sh to "registry.ci.openshift.org/ocp/release-5:5.1.0-0.nightly-2026-09-13-222843" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.1.0-0.nightly-arm64-2026-08-25-194037" diff --git a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh index f61200df82..7ccaf9a6b6 100755 --- a/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh +++ b/scripts/auto-rebase/last_rebase_cluster_monitoring_operator.sh @@ -1,2 +1,2 @@ #!/bin/bash -x -./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.0.0-0.nightly-2026-06-19-155631" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.0.0-0.nightly-arm64-2026-06-19-154904" +./scripts/auto-rebase/rebase_cluster_monitoring_operator.sh to "registry.ci.openshift.org/ocp/release-5:5.1.0-0.nightly-2026-09-13-222843" "registry.ci.openshift.org/ocp-arm64/release-5-arm64:5.1.0-0.nightly-arm64-2026-08-25-194037" diff --git a/vendor/github.com/openshift/build-machinery-go/AGENTS.md b/vendor/github.com/openshift/build-machinery-go/AGENTS.md new file mode 100644 index 0000000000..91c04f1f5c --- /dev/null +++ b/vendor/github.com/openshift/build-machinery-go/AGENTS.md @@ -0,0 +1,38 @@ +# AI Agent Instructions for build-machinery-go + +**Audience:** AI agents editing **this repository** only — not downstream repos +that vendor these fragments. Those repos should maintain their own root-level +`AGENTS.md`. + +| File | Purpose | +|------|---------| +| [ARCHITECTURE.md](ARCHITECTURE.md) | Make stack design, project layout, verification model | +| [CONTRIBUTING.md](CONTRIBUTING.md) | Development workflow, PR expectations, external guidelines | + +## What This Repo Is + +Reusable GNU Make fragments and helper scripts. Downstream repos include one +vendored entry file (`golang.mk`, `default.mk`, or `operator.mk`) in their +`Makefile`. See [ARCHITECTURE.md](ARCHITECTURE.md) for stacks, layout, and +include chains. + +## Critical Rules + +1. **Run `make verify` before considering any change complete.** +2. **Do not hand-edit `*.log` files** — regenerate with `make update`. +3. **Add new behavior in `make/targets/`**, not in entry files. +4. **Keep backward compatibility** — every repo that vendors this module is affected. +5. **Update examples and logs together** when changing `make/targets/`. + +## What NOT to Do + +- Hand-edit `*.example.mk.help.log` or `Makefile.test.log`. +- Change `make/targets/` without updating examples and regenerating logs. +- Edit files under `make/examples/*/vendor/`. +- Duplicate logic across entry files. +- Modify OWNERS or OWNERS_ALIASES. +- Use AI to respond to review comments. + +For workflow details (container image, branch name, commit structure), see +[CONTRIBUTING.md](CONTRIBUTING.md). For org-wide conventions, see the links in +CONTRIBUTING.md and [openshift/coderabbit](https://github.com/openshift/coderabbit). diff --git a/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md b/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md new file mode 100644 index 0000000000..b95b495452 --- /dev/null +++ b/vendor/github.com/openshift/build-machinery-go/ARCHITECTURE.md @@ -0,0 +1,226 @@ +# Architecture Overview + +build-machinery-go provides reusable GNU Make fragments and helper scripts that +OpenShift Go repositories vendor and include in their own `Makefile`. This +document describes how the pieces fit together. Update it when the makefile +layout or verification model changes. + +## 1. Project Structure + +See also [AGENTS.md](AGENTS.md) for contributor-oriented rules. Layout: + +``` +build-machinery-go/ +├── Makefile # Meta-verification of example makefiles and logs +├── make/ +│ ├── golang.mk # Entry: pure Go projects +│ ├── default.mk # Entry: OpenShift Go (+ images, bindata, codegen) +│ ├── operator.mk # Entry: OpenShift operators +│ ├── *.example.mk # Copy-paste starting points for downstream repos +│ ├── *.example.mk.help.log # Checked-in `make help` output (audit trail) +│ ├── targets/ # Composable make modules +│ └── examples/ # Integration tests for makefile fragments +├── scripts/ # Shell helpers invoked by make targets +└── commitchecker/ # Small Go binary using golang.mk (dogfooding) +``` + +## 2. High-Level System Diagram + +This repository is a **library**, not a deployed service. Component repos consume +it at build time: + +``` +┌─────────────────────────┐ +│ OpenShift component │ +│ repo (operator, etc.) │ +└───────────┬─────────────┘ + │ go mod vendor + ▼ +┌─────────────────────────┐ include ┌──────────────────────────┐ +│ vendor/.../build- │ ───────────────► │ Component Makefile │ +│ machinery-go/make/*.mk │ │ (build, test, verify, │ +└─────────────────────────┘ │ images, codegen, ...) │ + ▲ └──────────────────────────┘ + │ verify via examples +┌───────────┴─────────────┐ +│ build-machinery-go │ +│ (this repo) │ +│ make verify / update │ +└─────────────────────────┘ +``` + +Data flow: makefile fragments define targets; component repos run those targets +locally and in CI. This repo validates fragment behavior through checked-in log +output from example makefiles. + +## 3. Core Components + +### 3.1. Make fragment stacks + +Three predefined stacks layer on top of each other. Downstream repos include +exactly one entry file from their vendored copy: + +| Stack | Entry file | Extends | Typical targets | +|----------|--------------------|-----------|------------------------------------------| +| Golang | `make/golang.mk` | — | `build`, `test-unit`, `verify-gofmt` | +| Default | `make/default.mk` | Golang | + `images`, `verify-codegen`, `bindata` | +| Operator | `make/operator.mk` | Default | + `test-operator-integration`, profiles | + +**Include chain:** + +``` +operator.mk + └── default.mk + ├── targets/openshift/deps.mk + ├── targets/openshift/images.mk + ├── targets/openshift/bindata.mk + ├── targets/openshift/codegen.mk + └── golang.mk + ├── targets/help.mk + └── targets/golang/*.mk + +operator.mk also includes: + └── targets/openshift/operator/*.mk +``` + +Entry files are thin wrappers that `include` modules from `make/targets/`. New +behavior belongs in `make/targets/`, not duplicated in entry files. + +### 3.2. Target modules (`make/targets/`) + +| Directory | Purpose | +|-------------------------------|---------------------------------------------------| +| `targets/golang/` | Build, test, fmt, vet, version, vulncheck | +| `targets/openshift/` | Images, bindata, codegen, deps, kustomize, yq, rpm | +| `targets/openshift/operator/` | Release, telepresence, profile manifests, MOM | + +Each `*.mk` file defines related targets and their `verify-*` / `update-*` +counterparts where applicable. + +### 3.3. Scripts (`scripts/`) + +Shell scripts hold logic too complex for inline make recipes: + +| Script | Used by | +|--------------------------------|------------------------------------| +| `update-deps.sh` | Dependency update targets | +| `test-operator-integration.sh` | Operator integration test target | +| `run-telepresence.sh` | Telepresence development workflow | +| `vulncheck.sh` | Vulnerability scanning target | + +### 3.4. commitchecker + +A minimal Go package that includes `golang.mk` from the parent directory. It +dogfoods the Golang stack to confirm fragments still work for real Go builds. +See [`commitchecker/README.md`](commitchecker/README.md) for downstream CI usage. + +## 4. Downstream Consumption + +Component repos vendor this module and include one entry file: + +```makefile +include $(addprefix vendor/github.com/openshift/build-machinery-go/make/, \ + default.mk \ +) +``` + +Paths resolve relative to the included file via +`$(dir $(lastword $(MAKEFILE_LIST)))`, so fragments work regardless of vendored +path depth. + +For a starting point, copy the matching `*.example.mk` into the component repo's +`Makefile` and adjust `GO_BUILD_PACKAGES`, image names, and codegen paths. + +## 5. Verification Model + +This repo does not build OpenShift operators. It verifies makefile fragments +through: + +1. **Example makefiles** (`make/*.example.mk`) — `make help` output captured in + checked-in `*.help.log` files. +2. **Integration examples** (`make/examples/*/Makefile.test`) — exercise + specific targets (codegen, profile manifests, golang version checks). + Output captured in `Makefile.test.log` files. +3. **Root `Makefile`** — runs all examples and diffs output via + `make verify` / `make update`. + +Log files are the audit trail: any change to makefile behavior must be visible +in regenerated log diffs. + +## 6. External Integrations + +| Integration | Purpose | How | +|-------------|---------|-----| +| OpenShift release images | CI build root; reproducible `make update` | `registry.ci.openshift.org/openshift/release` (see `.ci-operator.yaml`) | +| `govulncheck` | Dependency vulnerability scanning | Invoked by `scripts/vulncheck.sh` via `targets/golang/vulncheck.mk` | +| Codegen / image tooling | Bindata, CRD schema, controller-gen, imagebuilder | Referenced by `targets/openshift/*.mk`; run in downstream repos | +| Telepresence | Local operator development | `scripts/run-telepresence.sh` (operator stack only) | + +Downstream repos may integrate additional external tools through their own +Makefile variables; this repo provides the make targets that invoke them. + +## 7. Deployment & Infrastructure + +**Distribution:** Published as the Go module +`github.com/openshift/build-machinery-go`. Downstream repos pin a version in +`go.mod` and copy fragments into `vendor/` via `go mod vendor`. There is no +runtime deployment of this repository itself. + +**CI/CD:** OpenShift Prow via ci-operator. Build root image is defined in +[`.ci-operator.yaml`](.ci-operator.yaml) (`rhel-9-release-golang-1.23-openshift-4.19`). +The primary CI check is `make verify`, which diffs example makefile output +against checked-in logs. + +**Infrastructure owned by this repo:** None. Make targets in downstream repos may +build container images, generate manifests, or interact with clusters, but that +machinery runs in consumer repositories, not here. + +## 8. Security Considerations + +| Area | Practice | +|------|----------| +| Dependency scanning | `vulncheck` target runs `govulncheck`; fails on module vulnerabilities | +| Vendor integrity | `verify-deps` / `update-deps` targets in Default stack validate dependency state in downstream repos | +| Script execution | Helper scripts use `bash -e` and clean up temp files (`trap` in `vulncheck.sh`) | +| Secrets | No credentials or cluster access in this repo; downstream targets that need `KUBECONFIG` run in component repos | +| Supply chain | Changes to makefile fragments are auditable via checked-in `*.log` diffs in PRs | + +This repo does not implement authentication or authorization. Security-sensitive +operations (image pushes, cluster deploys) are gated by CI and credentials in +downstream repositories. + +## 9. Development & Testing Environment + +**Local setup:** Clone the repo and run `make verify`. See +[CONTRIBUTING.md](CONTRIBUTING.md) for the full workflow, including the +container command to match CI log output. + +**Testing approach:** + +| Layer | Mechanism | +|-------|-----------| +| Makefile fragments | `make/examples/*/Makefile.test` integration examples | +| Help output | `make/*.example.mk.help.log` snapshot tests | +| Golang stack | `commitchecker/` dogfooding build | + +**Code quality:** `make verify` is the gate. Downstream stacks additionally +expose `verify-gofmt`, `verify-govet`, `verify-codegen`, and related targets. + +## 10. Project Identification + +| Field | Value | +|-------|-------| +| Project name | build-machinery-go | +| Repository | https://github.com/openshift/build-machinery-go | +| Module path | `github.com/openshift/build-machinery-go` | +| Maintainers | See [OWNERS](OWNERS) (`control-plane-approvers`, `jsafrane`, `sanchezl`) | + +## 11. Glossary + +| Term | Definition | +|------|------------| +| **Stack** | One of Golang, Default, or Operator entry-file layers | +| **Fragment** | A `*.mk` file included into a downstream `Makefile` | +| **Target module** | A composable `make/targets/**/*.mk` file defining related targets | +| **Log audit** | Checked-in `*.log` files that snapshot makefile output for `git diff` verification | +| **Downstream repo** | An OpenShift component repo that vendors and includes these make fragments | diff --git a/vendor/github.com/openshift/build-machinery-go/CLAUDE.md b/vendor/github.com/openshift/build-machinery-go/CLAUDE.md new file mode 100644 index 0000000000..43c994c2d3 --- /dev/null +++ b/vendor/github.com/openshift/build-machinery-go/CLAUDE.md @@ -0,0 +1 @@ +@AGENTS.md diff --git a/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md b/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md new file mode 100644 index 0000000000..5d7814832d --- /dev/null +++ b/vendor/github.com/openshift/build-machinery-go/CONTRIBUTING.md @@ -0,0 +1,93 @@ +# Contributing to build-machinery-go + +build-machinery-go ships reusable GNU Make fragments consumed by many OpenShift +Go projects via `go mod vendor`. Changes here have broad downstream impact. + +Read [ARCHITECTURE.md](ARCHITECTURE.md) for how the make stacks and verification +model work. + +## Related guidelines + +This repository does not define org-wide OpenShift or Go conventions. Use these +instead: + +| Topic | Where | +|-------|-------| +| Control plane code conventions, testing, PR process, review expectations | [openshift/service-ca-operator/CONTRIBUTING.md](https://github.com/openshift/service-ca-operator/blob/main/CONTRIBUTING.md) | +| OpenShift CI / Prow / Jira integration | [docs.ci.openshift.org](https://docs.ci.openshift.org/) | +| Commit signature verification | [OpenShift contribution policy](https://docs.google.com/document/d/1184EPSGunUkcSQYUK8T4a6iyawwi6f2zxdbB2jtG9nQ/edit?usp=sharing) | +| AI code review configuration | [openshift/coderabbit](https://github.com/openshift/coderabbit) | + +For reviews, reach out via [OWNERS](OWNERS) or the control plane Slack channels +listed in the service-ca-operator contributing guide. + +## Development workflow + +1. Fork the repo and clone your fork. +2. Create a feature branch from `master`. +3. Make your changes. When makefile behavior changes, add or update examples under + `make/examples/`. +4. Run `make verify` locally before pushing. +5. Open a PR against `openshift/build-machinery-go:master`. + +Functional changes that regenerate logs should use two commits when applicable: +code first, then `update generated` for `*.log` files only. + +## Verification + +This repo validates makefile fragments through **checked-in log snapshots**, not +unit tests. See [ARCHITECTURE.md §5](ARCHITECTURE.md#5-verification-model) for +details. + +- Run `make update` after changing `make/targets/` or examples, then commit the + regenerated `*.log` files. +- Never hand-edit `*.example.mk.help.log` or `Makefile.test.log`. + +### Matching CI output + +Local `make update` output may differ across distributions. To match CI, run +update in the same build root image as Prow (defined in +[`.ci-operator.yaml`](.ci-operator.yaml)): + +```bash +podman run -it --rm --pull=always \ + -v "$(pwd)":/go/src/$(go list -m) \ + --workdir=/go/src/$(go list -m) \ + registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.23-openshift-4.19 \ + make update +``` + +## Make fragment changes + +- Add new behavior in `make/targets/`, not in entry files (`golang.mk`, + `default.mk`, `operator.mk`). +- Keep backward compatibility unless a breaking change is explicitly agreed. +- Place complex shell logic in `scripts/` — follow the + [shell styleguide](https://google.github.io/styleguide/shellguide.html). +- Do not add Go dependencies without justification in the PR description. + +## Pull requests + +Follow the linked control plane and OpenShift CI guidelines for Jira titles +(`CNTRLPLANE-XXXX:` or `NO-JIRA:`), `/lgtm`, `/approve`, `/verified`, and Prow +retests. + +Repository-specific expectations: + +- `make verify` must pass in CI. +- Changes to `make/targets/` must include updated examples and regenerated logs. +- Breaking fragment interface changes need maintainer agreement and a migration + note for downstream repos. +- Do not modify `OWNERS` or `OWNERS_ALIASES` without explicit direction. + +For makefile-only changes, `/verified by ci` is typically sufficient when +`make verify` passes. + +## Areas requiring extra care + +- Entry file changes (`golang.mk`, `default.mk`, `operator.mk`) affect every + downstream repo on that stack. +- Target module interface changes (variables, target names, defaults) must stay + backward compatible or document migration. +- Log normalization sed filters in the root `Makefile` must not hide real + behavior changes. diff --git a/vendor/github.com/openshift/build-machinery-go/README.md b/vendor/github.com/openshift/build-machinery-go/README.md index 66862f61a2..54fbed76b2 100644 --- a/vendor/github.com/openshift/build-machinery-go/README.md +++ b/vendor/github.com/openshift/build-machinery-go/README.md @@ -37,8 +37,9 @@ Extends [#Default](). `scripts` contain more complicated logic that is used in some make targets. ## Contributing -### Updating generated files -We track the log output from the makefile tests to make sure any change is visible and can be audited. Unfortunately due to subtle linux tooling differences in distributions and versions, `make update` may not get you the exact output as the CI. To avoid it, just run the command in the same container as CI: -``` -podman run -it --rm --pull=always -v $( pwd ):/go/src/$( go list -m ) --workdir=/go/src/$( go list -m ) registry.ci.openshift.org/openshift/release:rhel-8-release-golang-1.15-openshift-4.7 make update -``` + +See [CONTRIBUTING.md](CONTRIBUTING.md) for development workflow, PR guidelines, +and how to regenerate checked-in makefile logs. + +For architecture details, see [ARCHITECTURE.md](ARCHITECTURE.md). For AI agent +instructions, see [AGENTS.md](AGENTS.md) ([CLAUDE.md](CLAUDE.md) references it via `@AGENTS.md`). diff --git a/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/ingress.go b/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/ingress.go index 4177fd1166..d85464a7fe 100644 --- a/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/ingress.go +++ b/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/ingress.go @@ -103,6 +103,12 @@ type Controller struct { metricsCreated bool metricsCreateOnce sync.Once metricsCreateLock sync.RWMutex + + // flaggedUnmanagedRoutes is the set of route metrics flagged as unmanaged. + // This set is used to clear the metric when the route is removed from the + // apiserver. + flaggedUnmanagedRoutes sets.Set[routeMetricLabels] + flaggedUnmanagedRoutesLock sync.Mutex } // expectations track an upcoming change to a named resource related @@ -113,6 +119,13 @@ type expectations struct { expect map[queueKey]sets.String } +// routeMetricLabels defines the route metric labels as a comparable type +type routeMetricLabels struct { + name string + namespace string + host string +} + // newExpectations returns a tracking object for upcoming events // that the controller may expect to happen. func newExpectations() *expectations { @@ -195,6 +208,8 @@ func NewController(eventsClient kv1core.EventsGetter, routeClient routeclient.Ro routeLister: routes.Lister(), serviceLister: services.Lister(), + flaggedUnmanagedRoutes: sets.New[routeMetricLabels](), + syncs: []cache.InformerSynced{ ingresses.Informer().HasSynced, secrets.Informer().HasSynced, @@ -387,7 +402,7 @@ func (c *Controller) sync(key queueKey) error { ingress, err := c.ingressLister.Ingresses(key.namespace).Get(key.name) if kerrors.IsNotFound(err) { - c.ResetIngressMetrics(key.namespace, key.name) + c.resetIngressMetrics(key.namespace, key.name) return nil } if err != nil { diff --git a/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/metrics.go b/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/metrics.go index 7c383c8467..ec6eb7ecb6 100644 --- a/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/metrics.go +++ b/vendor/github.com/openshift/route-controller-manager/pkg/route/ingress/metrics.go @@ -5,6 +5,7 @@ import ( "github.com/prometheus/client_golang/prometheus" "k8s.io/apimachinery/pkg/labels" utilruntime "k8s.io/apimachinery/pkg/util/runtime" + "k8s.io/apimachinery/pkg/util/sets" "github.com/openshift/route-controller-manager/pkg/routecontroller" ) @@ -76,6 +77,7 @@ func (c *Controller) Collect(ch chan<- prometheus.Metric) { return } + currentUnmanagedRoutes := sets.New[routeMetricLabels]() for _, routeInstance := range routeInstances { labelVal := 0 if owner, have := hasIngressOwnerRef(routeInstance.OwnerReferences); have { @@ -97,16 +99,37 @@ func (c *Controller) Collect(ch chan<- prometheus.Metric) { } } unmanagedRoutes.WithLabelValues(routeInstance.Name, routeInstance.Namespace, routeInstance.Spec.Host).Set(float64(labelVal)) + if labelVal > 0 { + currentUnmanagedRoutes.Insert(routeMetricLabels{ + name: routeInstance.Name, + namespace: routeInstance.Namespace, + host: routeInstance.Spec.Host, + }) + } } + c.resetUnusedUnmanagedRoutesMetrics(currentUnmanagedRoutes) unmanagedRoutes.Collect(ch) } -// ResetIngressMetrics clears metrics for the specified ingress by setting its +// resetIngressMetrics clears metrics for the specified ingress by setting its // series data to 0. This is appropriate to do when an ingress object is // deleted to prevent stale metrics from triggering alerts. As Collect only // updates metrics for ingresses that exist at the time when Collect is called, // it does not clear metrics for deleted routes. -func (c *Controller) ResetIngressMetrics(namespace, ingressName string) { +func (c *Controller) resetIngressMetrics(namespace, ingressName string) { ingressesWithoutClassName.WithLabelValues(ingressName, namespace).Set(0.0) } + +// resetUnusedUnmanagedRoutesMetrics zeroes the metric for routes that were flagged +// unmanaged in a previous Collect call but aren't in the current flaggedRoutes set, +// e.g. because the route was deleted or its owner became managed again. +func (c *Controller) resetUnusedUnmanagedRoutesMetrics(currentUnmanagedRoutes sets.Set[routeMetricLabels]) { + c.flaggedUnmanagedRoutesLock.Lock() + defer c.flaggedUnmanagedRoutesLock.Unlock() + + for route := range c.flaggedUnmanagedRoutes.Difference(currentUnmanagedRoutes) { + unmanagedRoutes.WithLabelValues(route.name, route.namespace, route.host).Set(0.0) + } + c.flaggedUnmanagedRoutes = currentUnmanagedRoutes +} diff --git a/vendor/modules.txt b/vendor/modules.txt index c4181aa9e7..b51fd3fa3c 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -580,7 +580,7 @@ github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/sysctl github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/user github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/util github.com/openshift/apiserver-library-go/pkg/securitycontextconstraints/util/sort -# github.com/openshift/build-machinery-go v0.0.0-20260629141115-154a2b810491 +# github.com/openshift/build-machinery-go v0.0.0-20260902143904-520f675c892b ## explicit; go 1.22.0 github.com/openshift/build-machinery-go github.com/openshift/build-machinery-go/make @@ -794,7 +794,7 @@ github.com/openshift/library-go/pkg/route/validation github.com/openshift/library-go/pkg/security/ldaputil github.com/openshift/library-go/pkg/security/uid github.com/openshift/library-go/pkg/serviceability -# github.com/openshift/route-controller-manager v0.0.0-20260722172158-59697cf7af45 +# github.com/openshift/route-controller-manager v0.0.0-20260909174728-a158fff7ce38 ## explicit; go 1.26.3 github.com/openshift/route-controller-manager/pkg/cmd/controller github.com/openshift/route-controller-manager/pkg/cmd/route-controller-manager @@ -3300,7 +3300,7 @@ sigs.k8s.io/json/internal/golang/encoding/json # sigs.k8s.io/knftables v0.0.21 ## explicit; go 1.20 sigs.k8s.io/knftables -# sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260304192652-72835e43c775 +# sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260913130130-fb49e56122b6 ## explicit; go 1.24.0 sigs.k8s.io/kube-storage-version-migrator/pkg/apis/migration/v1alpha1 sigs.k8s.io/kube-storage-version-migrator/pkg/clients/clientset @@ -3408,7 +3408,7 @@ sigs.k8s.io/yaml/kyaml # github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d # k8s.io/klog/v2 => ./deps/k8s.io/klog # k8s.io/kubernetes => ./deps/github.com/openshift/kubernetes -# sigs.k8s.io/kube-storage-version-migrator => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260304192652-72835e43c775 +# sigs.k8s.io/kube-storage-version-migrator => github.com/openshift/kubernetes-kube-storage-version-migrator v0.0.3-0.20260913130130-fb49e56122b6 # k8s.io/api => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/api # k8s.io/apiextensions-apiserver => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver # k8s.io/apimachinery => ./deps/github.com/openshift/kubernetes/staging/src/k8s.io/apimachinery