Let Apache use separate IPv4 and IPv6 sockets for listening to any

Enable the use of two separate sockets for IPv4 and IPv6 when LISTEN_ALL_INTERFACES is set to true. While desirable, on Linux Apache uses IPv4-mapped IPv6 addresses by default, thus leveraging a single IPv6 socket for IPv4 connections as well. This behaviour is far from being desirable and can be disabled at compile time via the "--disable-v4-mapped" flag, so make sure both an ANY address Listen directive is present for both IPv4 and IPv6. When Apache is compiled with "--enable-v4-mapped", the IPv4 socket will be simply ignored. Please see https://httpd.apache.org/docs/2.4/bind.html for more information. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Update httpd.conf to bind to IPv4 and/or IPv6 sockets
2025-07-29 19:15:25 +00:00 · 2025-07-29 19:15:25 +00:00 · 2025-07-29 19:15:25 +00:00 · 2025-07-29 19:15:25 +00:00 · 2025-07-29 19:15:25 +00:00 · 2025-07-29 19:15:25 +00:00
331 changed files with 41138 additions and 8794 deletions
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,170 +1,15 @@
+[submodule "obs-service-set_version"]
+	path = obs-service-set_version
+	url = https://src.opensuse.org/SLFO-pool/obs-service-set_version.git
 [submodule "cri-tools"]
 	path = cri-tools
 	url = https://src.opensuse.org/pool/cri-tools.git
+[submodule "fakeroot"]
+	path = fakeroot
+	url = https://src.opensuse.org/pool/fakeroot.git
 [submodule "crudini"]
 	path = crudini
 	url = https://src.opensuse.org/pool/crudini.git
-[submodule "cni-plugins"]
-	path = cni-plugins
-	url = https://src.opensuse.org/pool/cni-plugins
-[submodule "python-kubernetes"]
-	path = python-kubernetes
-	url = https://src.opensuse.org/pool/python-kubernetes
-	branch = leap-16.0
-[submodule "python-durationpy"]
-	path = python-durationpy
-	url = https://src.opensuse.org/pool/python-durationpy
-	branch = leap-16.0
-[submodule "python-recommonmark"]
-	path = python-recommonmark
-	url = https://src.opensuse.org/pool/python-recommonmark
-	branch = leap-16.0
-[submodule "python-iniparse"]
-	path = python-iniparse
-	url = https://src.opensuse.org/pool/python-iniparse
-	branch = leap-16.0
-[submodule "python-commonmark"]
-	path = python-commonmark
-	url = https://src.opensuse.org/pool/python-commonmark
-	branch = leap-16.0
-[submodule "cni"]
-	path = cni
-	url = https://src.opensuse.org/pool/cni
-[submodule "python-tenacity"]
-	path = python-tenacity
-	url = https://src.opensuse.org/pool/python-tenacity
-[submodule "python-pint"]
-	path = python-pint
-	url = https://src.opensuse.org/pool/python-pint
-	branch = leap-16.0
-[submodule "python-flexcache"]
-	path = python-flexcache
-	url = https://src.opensuse.org/pool/python-flexcache
-	branch = leap-16.0
-[submodule "python-flexparser"]
-	path = python-flexparser
-	url = https://src.opensuse.org/pool/python-flexparser
-	branch = leap-16.0
-[submodule "python-uncertainties"]
-	path = python-uncertainties
-	url = https://src.opensuse.org/pool/python-uncertainties
-	branch = leap-16.0
-[submodule "python-dogpile.cache"]
-	path = python-dogpile.cache
-	url = https://src.opensuse.org/pool/python-dogpile.cache
-	branch = leap-16.0
-[submodule "python-pytest-mpl"]
-	path = python-pytest-mpl
-	url = https://src.opensuse.org/pool/python-pytest-mpl
-	branch = leap-16.0
-[submodule "python-zeroconf"]
-	path = python-zeroconf
-	url = https://src.opensuse.org/pool/python-zeroconf
-	branch = leap-16.0
-[submodule "python-ifaddr"]
-	path = python-ifaddr
-	url = https://src.opensuse.org/pool/python-ifaddr
-	branch = leap-16.0
-[submodule "python-yappi"]
-	path = python-yappi
-	url = https://src.opensuse.org/pool/python-yappi
-[submodule "python-routes"]
-	path = python-routes
-	url = https://src.opensuse.org/pool/python-routes
-	branch = leap-16.0
-[submodule "python-repoze.lru"]
-	path = python-repoze.lru
-	url = https://src.opensuse.org/pool/python-repoze.lru
-	branch = leap-16.0
-[submodule "ipxe"]
-	path = ipxe
-	url = https://src.opensuse.org/pool/ipxe
-	branch = leap-16.0
-[submodule "python-setproctitle"]
-	path = python-setproctitle
-	url = https://src.opensuse.org/pool/python-setproctitle
-	branch = leap-16.0
-[submodule "python-requests-kerberos"]
-	path = python-requests-kerberos
-	url = https://src.opensuse.org/pool/python-requests-kerberos
-	branch = leap-16.0
-[submodule "python-pecan"]
-	path = python-pecan
-	url = https://src.opensuse.org/pool/python-pecan
-	branch = leap-16.0
-[submodule "python-pycdlib"]
-	path = python-pycdlib
-	url = https://src.opensuse.org/pool/python-pycdlib
-[submodule "python-cliff"]
-	path = python-cliff
-	url = https://src.opensuse.org/pool/python-cliff
-[submodule "python-autopage"]
-	path = python-autopage
-	url = https://src.opensuse.org/pool/python-autopage
-[submodule "python-cmd2"]
-	path = python-cmd2
-	url = https://src.opensuse.org/pool/python-cmd2
-	branch = leap-16.0
-[submodule "uwsgi"]
-	path = uwsgi
-	url = https://src.opensuse.org/pool/uwsgi
-	branch = leap-16.0
-[submodule "python-requestsexceptions"]
-	path = python-requestsexceptions
-	url = https://src.opensuse.org/pool/python-requestsexceptions
-[submodule "python-python-memcached"]
-	path = python-python-memcached
-	url = https://src.opensuse.org/pool/python-python-memcached
-[submodule "python-kombu"]
-	path = python-kombu
-	url = https://src.opensuse.org/pool/python-kombu
-[submodule "python-amqp"]
-	path = python-amqp
-	url = https://src.opensuse.org/pool/python-amqp
-	branch = leap-16.0
-[submodule "python-statsd"]
-	path = python-statsd
-	url = https://src.opensuse.org/pool/python-statsd
-[submodule "python-warlock"]
-	path = python-warlock
-	url = https://src.opensuse.org/pool/python-warlock
-[submodule "python-case"]
-	path = python-case
-	url = https://src.opensuse.org/pool/python-case
-	branch = leap-16.0
-[submodule "python-vine"]
-	path = python-vine
-	url = https://src.opensuse.org/pool/python-vine
-	branch = leap-16.0
-[submodule "python-Pyro5"]
-	path = python-Pyro5
-	url = https://src.opensuse.org/pool/python-Pyro5
-	branch = leap-16.0
-[submodule "python-pre-commit"]
-	path = python-pre-commit
-	url = https://src.opensuse.org/pool/python-pre-commit
-[submodule "python-serpent"]
-	path = python-serpent
-	url = https://src.opensuse.org/pool/python-serpent
-	branch = leap-16.0
-[submodule "python-google-cloud-monitoring"]
-	path = python-google-cloud-monitoring
-	url = https://src.opensuse.org/pool/python-google-cloud-monitoring
-[submodule "python-google-cloud-pubsub"]
-	path = python-google-cloud-pubsub
-	url = https://src.opensuse.org/pool/python-google-cloud-pubsub
-[submodule "python-cfgv"]
-	path = python-cfgv
-	url = https://src.opensuse.org/pool/python-cfgv
-[submodule "python-identify"]
-	path = python-identify
-	url = https://src.opensuse.org/pool/python-identify
-[submodule "python-pandas"]
-	path = python-pandas
-	url = https://src.opensuse.org/pool/python-pandas
-[submodule "python-grpc-google-iam-v1"]
-	path = python-grpc-google-iam-v1
-	url = https://src.opensuse.org/pool/python-grpc-google-iam-v1
-[submodule "python-editdistance"]
-	path = python-editdistance
-	url = https://src.opensuse.org/pool/python-editdistance
+[submodule "autoconf"]
+	path = autoconf
+	url = https://src.opensuse.org/SLFO-pool/autoconf.git
--- a/.obs/wait_obs.py
+++ b/.obs/wait_obs.py
@@ -12,8 +12,6 @@ def get_buildstatus(project: str) -> ET.Element:
            output = subprocess.check_output(["osc", "pr", "--xml", project])
            return ET.fromstring(output)
        except subprocess.CalledProcessError:
-            # Don't retry immediatly just in case is a network error
-            time.sleep(5)
            continue
    print("Failed to get buildstatus from OBS")

@@ -22,12 +20,6 @@ def do_wait(project:str, commit:str) -> ET.Element:
    while True:
        time.sleep(5)
        status = get_buildstatus(project)
-
-        # Just in case the buildstatus fails
-        if status is None:
-            print("Could not retrieve status, retrying...")
-            continue
-
        if last_state == status.get("state"):
            continue
        else:
@@ -88,4 +80,4 @@ def main():
    sys.exit(print_results(status))

 if __name__ == "__main__":
-    main()
+    main()
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@ repos:
    hooks:
      - id: check-manifest
        name: "Check release-manifest"
-        entry: python3 .obs/manifest-check.py
+        entry: .obs/manifest-check.py
        language: python
        additional_dependencies: ['ruamel.yaml']
        pass_filenames: false
--- a/125
+++ b/125
@@ -1,11 +1,8 @@
-Prefer: -libqpid-proton10 -python313-urllib3_1
-Prefer: -cargo1.58 -cargo1.57 cargo1.89
-Prefer: chrony-pool-suse
-Prefer: -postgresql17-devel-mini
-
-BuildFlags: excludebuild:python-pandas:test-py313
+Prefer: -libqpid-proton10 -python311-urllib3_1
+Prefer: -cargo1.58 -cargo1.57 cargo1.88

 Macros:
+%__python3 /usr/bin/python3.11
 %registry_url %(echo %{vendor} | cut -d '/' -f 3 | sed 's/build/registry/')
 :Macros

@@ -49,42 +46,67 @@ Macros:
 :Macros
 %endif

+# Missing deps for testsuite
+BuildFlags: excludebuild:autoconf:el
+BuildFlags: excludebuild:autoconf:testsuite
+
 # Only build manifest embedding images here
 %if "%_repository" == "test_manifest_images"
 BuildFlags: onlybuild:edge-image-builder-image
 BuildFlags: onlybuild:release-manifest-image
-%else
-# Only a subset of stack is arm64 ready exclude what is not ready
+  # Exclude the images selected by the following section
+  # as the standard repository is a dependency
  %ifarch aarch64
-    # Akri
-    BuildFlags: excludebuild:akri
-    BuildFlags: excludebuild:akri-agent-image
-    BuildFlags: excludebuild:akri-controller-image
-    BuildFlags: excludebuild:akri-debug-echo-discovery-handler-image
-    BuildFlags: excludebuild:akri-onvif-discovery-handler-image
-    BuildFlags: excludebuild:akri-opcua-discovery-handler-image
-    BuildFlags: excludebuild:akri-udev-discovery-handler-image
-    BuildFlags: excludebuild:akri-webhook-configuration-image
-    BuildFlags: excludebuild:cri-tools
-
-    # FRR
-    BuildFlags: excludebuild:frr-image
-    BuildFlags: excludebuild:frr-k8s
-    BuildFlags: excludebuild:frr-k8s-image
-
-    # Upgrade controller
-    BuildFlags: excludebuild:upgrade-controller
-    BuildFlags: excludebuild:upgrade-controller-image
+    BuildFlags: excludebuild:baremetal-operator-image
+    BuildFlags: excludebuild:endpoint-copier-operator-image
+    BuildFlags: excludebuild:ironic-image
+    BuildFlags: excludebuild:ironic-ipa-downloader-image
+    BuildFlags: excludebuild:kiwi-builder-image
+    BuildFlags: excludebuild:kubectl-image
+    BuildFlags: excludebuild:kube-rbac-proxy-image
+    BuildFlags: excludebuild:metallb-controller-image
+    BuildFlags: excludebuild:metallb-speaker-image
+  %endif
+%else
+# Only a subset of stack is arm64 ready
+  %ifarch aarch64
+    BuildFlags: onlybuild:autoconf
+    BuildFlags: onlybuild:baremetal-operator
+    BuildFlags: onlybuild:baremetal-operator-image
+    BuildFlags: onlybuild:ca-certificates-suse
+    BuildFlags: onlybuild:container-build-checks
+    BuildFlags: onlybuild:crudini
+    BuildFlags: onlybuild:edge-build-checks
+    BuildFlags: onlybuild:edge-image-builder
+    BuildFlags: onlybuild:edge-image-builder-image
+    BuildFlags: onlybuild:endpoint-copier-operator
+    BuildFlags: onlybuild:endpoint-copier-operator-image
+    BuildFlags: onlybuild:fakeroot
+    BuildFlags: onlybuild:hauler
+    BuildFlags: onlybuild:ipcalc
+    BuildFlags: onlybuild:ironic-image
+    BuildFlags: onlybuild:ironic-ipa-downloader-image
+    BuildFlags: onlybuild:ironic-ipa-ramdisk
+    BuildFlags: onlybuild:kubectl
+    BuildFlags: onlybuild:kubectl-image
+    BuildFlags: onlybuild:kube-rbac-proxy
+    BuildFlags: onlybuild:kube-rbac-proxy-image
+    BuildFlags: onlybuild:metallb
+    BuildFlags: onlybuild:metallb-controller-image
+    BuildFlags: onlybuild:metallb-speaker-image
+    BuildFlags: onlybuild:nm-configurator
+    BuildFlags: onlybuild:shim-noarch
  %endif
 %endif

 %if "%_repository" == "images" || "%_repository" == "test_manifest_images"
+    Prefer: container:sles15-image
    Type: docker
    Repotype: none
    Patterntype: none
    BuildEngine: podman
-    Prefer: SLES-release
-    BuildFlags: dockerarg:SLE_VERSION=16.0
+    Prefer: sles-release
+    BuildFlags: dockerarg:SLE_VERSION=15.7

    # Publish multi-arch container images only once all archs have been built
    PublishFlags: archsync
@@ -99,6 +121,45 @@ BuildFlags: onlybuild:release-manifest-image

 %endif

+%if "%_repository" == "images_16.0"
+    Prefer: container:sles15-image
+    Type: docker
+    BuildEngine: podman
+    Repotype: none
+    Patterntype: none
+    BuildFlags: dockerarg:SLE_VERSION=16.0
+    BuildFlags: onlybuild:kiwi-builder-image
+    
+    Substitute: system-packages:podman podman buildah createrepo_c release-compare skopeo umoci
+
+    # Publish multi-arch container images only once all archs have been built
+    PublishFlags: archsync
+
+    # Exclude the images selected by the aarch64 section
+    %ifarch aarch64
+      BuildFlags: excludebuild:baremetal-operator-image
+      BuildFlags: excludebuild:edge-image-builder-image
+      BuildFlags: excludebuild:endpoint-copier-operator-image
+      BuildFlags: excludebuild:ironic-image
+      BuildFlags: excludebuild:ironic-ipa-downloader-image
+      BuildFlags: excludebuild:kubectl-image
+      BuildFlags: excludebuild:kube-rbac-proxy-image
+      BuildFlags: excludebuild:metallb-controller-image
+      BuildFlags: excludebuild:metallb-speaker-image
+    %endif
+
+%else
+    %if "%{sub %{reverse %_project} 1 7}" != "%{reverse :ToTest}" && "%{sub %{reverse %_project} 1 9}" != "%{reverse :Snapshot}"
+      BuildFlags: excludebuild:kiwi-builder-image
+    %else
+      %ifarch aarch64
+        BuildFlags: onlybuild:kiwi-builder-image
+      %endif
+    %endif
+%endif
+
+
+
 %if "%_repository" == "charts" || "%_repository" == "phantomcharts" || "%_repository" == "releasecharts"
    Type: helm
    Repotype: helm
@@ -115,16 +176,12 @@ BuildFlags: onlybuild:release-manifest-image

    # ironic-ipa-ramdisk are noarch packages that need to be availble to both archs
    ExportFilter: ^ironic-ipa-ramdisk-.*\.noarch\.rpm$ aarch64 x86_64
-    ExportFilter: ^grub2-.*-efi-.*\.noarch\.rpm$ aarch64 x86_64
 %endif

-%if "%_repository" != "standard"
-    BuildFlags: excludebuild:grub-aggregate 
-%endif
 # Enable reproducible builds
 # https://en.opensuse.org/openSUSE:Reproducible_Builds\#With_OBS
 Macros:
-%source_date_epoch_from_changelog N
+%source_date_epoch_from_changelog Y
 %clamp_mtime_to_source_date_epoch Y
 %use_source_date_epoch_as_buildtime Y
 %_buildhost reproducible
--- a/18
+++ b/18
@@ -34,15 +34,20 @@
    <arch>x86_64</arch>
  </repository>
 {%- endif %}
-{%- for repository in ["images", "test_manifest_images"] %}
+{%- for repository in ["images", "images_16.0", "test_manifest_images"] %}
  <repository name="{{ repository }}">
    {%- if release_project is defined and repository != "test_manifest_images" %}
    <releasetarget project="{{ release_project }}" repository="images" trigger="manual"/>
    {%- endif %}
    <path project="SUSE:Registry" repository="standard"/>
-    <path project="{{ ironic_base }}:Factory" repository="16.0"/>
-    <path project="SUSE:CA" repository="openSUSE_Tumbleweed"/>
-    <path project="{{ project }}" repository="standard"/>
+    {%- if repository == "images_16.0" %}
+      <path project="SUSE:CA" repository="16.0"/>
+      <path project="SUSE:SLFO:Products:SLES:16.0" repository="standard"/>
+      <path project="SUSE:SLFO:Main:Build" repository="standard"/>
+    {%- else %}
+      <path project="SUSE:CA" repository="SLE_15_SP7"/>
+      <path project="{{ project }}" repository="standard"/>
+    {%- endif %}
    <arch>x86_64</arch>
    <arch>aarch64</arch>
  </repository>
@@ -51,9 +56,8 @@
    {%- if release_project is defined and not for_release %}
    <releasetarget project="{{ release_project }}" repository="standard" trigger="manual"/>
    {%- endif %}
-    <path project="{{ ironic_base }}:Factory" repository="16.0"/>
-    <path project="SUSE:SLFO:Products:SLES:16.0" repository="standard"/>
-    <path project="SUSE:SLFO:1.2" repository="standard"/>
+    <path project="{{ ironic_base }}:2025.1" repository="15.7"/>
+    <path project="SUSE:SLE-15-SP7:Update" repository="standard"/>
    <arch>x86_64</arch>
    <arch>aarch64</arch>
  </repository>
--- a/akri-dashboard-extension-chart/Chart.yaml
+++ b/akri-dashboard-extension-chart/Chart.yaml
@@ -1,5 +1,5 @@
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.2
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.2-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1
+#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1-%RELEASE%
 annotations:
  catalog.cattle.io/certified: rancher
  catalog.cattle.io/namespace: cattle-ui-plugin-system
@@ -12,10 +12,10 @@ annotations:
  catalog.cattle.io/ui-extensions-version: '>= 3.0.2 < 4.0.0'
  catalog.cattle.io/kube-version: '>= v1.26.0-0'
 apiVersion: v2
-appVersion: 1.3.2
+appVersion: 303.0.2+up1.3.1
 description: 'SUSE Edge: Akri extension for Rancher Dashboard'
 name: akri-dashboard-extension
 type: application
-version: "%%CHART_MAJOR%%.0.4+up1.3.2"
+version: "%%CHART_MAJOR%%.0.2+up1.3.1"
 icon: >-
  https://raw.githubusercontent.com/cncf/artwork/main/projects/akri/icon/color/akri-icon-color.svg
--- a/akri-dashboard-extension-chart/templates/cr.yaml
+++ b/akri-dashboard-extension-chart/templates/cr.yaml
@@ -8,7 +8,7 @@ spec:
  plugin:
    name: {{ include "extension-server.fullname" . }}
    version: {{ (semver (default .Chart.AppVersion .Values.plugin.versionOverride)).Original }}
-    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/1.3.2
+    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/303.0.2+up1.3.1
    noCache: {{ .Values.plugin.noCache }}
    noAuth: {{ .Values.plugin.noAuth }}
    metadata: {{ include "extension-server.pluginMetadata" . | indent 6 }}
--- a/1
+++ b/1
--- a/baremetal-operator-image/Dockerfile
+++ b/baremetal-operator-image/Dockerfile
@@ -1,12 +1,12 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.1
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.1-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

 FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
 COPY --from=micro / /installroot/
-RUN zypper --installroot /installroot --non-interactive install --no-recommends baremetal-operator python3-watchdog procps iproute2 bind-utils vim shadow; zypper -n clean; rm -rf /var/log/*
+RUN zypper --installroot /installroot --non-interactive install --no-recommends baremetal-operator inotify-tools procps iproute2 bind-utils vim shadow; zypper -n clean; rm -rf /var/log/*

 FROM micro AS final
 # Define labels according to https://en.opensuse.org/Building_derived_containers
--- a/baremetal-operator-image/bmo-run
+++ b/baremetal-operator-image/bmo-run
@@ -3,11 +3,10 @@ export RESTART_CONTAINER_CERTIFICATE_UPDATED=${RESTART_CONTAINER_CERTIFICATE_UPD
 export IRONIC_CACERT_FILE=${IRONIC_CACERT_FILE:-"/opt/metal3/certs/ca/tls.crt"}

 if [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-     watchmedo shell-command \
-            --patterns="$(basename "${IRONIC_CACERT_FILE}")" \
-            --ignore-directories \
-            --command='if [[ "${watch_event_type}" == "deleted" ]]; then pkill -TERM baremetal-opera; fi' \
-            "$(dirname "${IRONIC_CACERT_FILE}")" &
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_CACERT_FILE}" | while read -r file event; do
+        kill $(pgrep baremetal-opera)
+    done &
 fi

 exec /usr/bin/baremetal-operator $@
--- a/baremetal-operator/_service
+++ b/baremetal-operator/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/metal3-io/baremetal-operator</param>
    <param name="scm">git</param>
-    <param name="revision">v0.11.2</param>
+    <param name="revision">v0.9.1</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
--- a/baremetal-operator/baremetal-operator.spec
+++ b/baremetal-operator/baremetal-operator.spec
@@ -17,15 +17,14 @@


 Name:           baremetal-operator
-Version:        0.11.2
+Version:        0.9.1
 Release:        0
 Summary:        Implements a Kubernetes API for managing bare metal hosts
 License:        Apache-2.0
 URL:            https://github.com/metal3-io/baremetal-operator
 Source:         baremetal-operator-%{version}.tar
 Source1:        vendor.tar.gz
-
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.23
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

--- a/cdi-chart/Chart.yaml
+++ b/cdi-chart/Chart.yaml
@@ -1,9 +1,9 @@
-#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.1_up0.6.0
-#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.1_up0.6.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.0_up0.5.0
+#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.0_up0.5.0-%RELEASE%
 apiVersion: v2
-appVersion: 1.62.0
+appVersion: 1.61.0
 description: A Helm chart for Containerized Data Importer (CDI)
 icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/kubevirt/icon/color/kubevirt-icon-color.svg
 name: cdi
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.6.0"
+version: "%%CHART_MAJOR%%.0.0+up0.5.0"
--- a/cdi-chart/crds/cdi.yaml
+++ b/cdi-chart/crds/cdi.yaml
@@ -109,9 +109,9 @@ spec:
                  description: CDIConfig at CDI level
                  properties:
                    dataVolumeTTLSeconds:
-                      description: |-
-                        DataVolumeTTLSeconds is the time in seconds after DataVolume completion it can be garbage collected. Disabled by default.
-                        Deprecated: Removed in v1.62.
+                      description: DataVolumeTTLSeconds is the time in seconds after
+                        DataVolume completion it can be garbage collected. Disabled
+                        by default.
                      format: int32
                      type: integer
                    featureGates:
@@ -2641,9 +2641,9 @@ spec:
                  description: CDIConfig at CDI level
                  properties:
                    dataVolumeTTLSeconds:
-                      description: |-
-                        DataVolumeTTLSeconds is the time in seconds after DataVolume completion it can be garbage collected. Disabled by default.
-                        Deprecated: Removed in v1.62.
+                      description: DataVolumeTTLSeconds is the time in seconds after
+                        DataVolume completion it can be garbage collected. Disabled
+                        by default.
                      format: int32
                      type: integer
                    featureGates:
--- a/cdi-chart/templates/cdi-operator.yaml
+++ b/cdi-chart/templates/cdi-operator.yaml
@@ -599,8 +599,6 @@ spec:
  strategy: {}
  template:
    metadata:
-      annotations:
-        openshift.io/required-scc: restricted-v2
      labels:
        cdi.kubevirt.io: cdi-operator
        name: cdi-operator
--- a/cdi-chart/templates/cdi.yaml
+++ b/cdi-chart/templates/cdi.yaml
@@ -18,8 +18,4 @@ spec:
  {{- with .Values.cdi.workload }}
  workload:
  {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.cdi.customizeComponents }}
-  customizeComponents:
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
+  {{- end }}
--- a/cdi-chart/values.yaml
+++ b/cdi-chart/values.yaml
@@ -1,12 +1,12 @@
 deployment:
-  version: 1.62.0-150700.9.3.1
-  operatorImage: registry.suse.com/suse/sles/15.7/cdi-operator
-  controllerImage: registry.suse.com/suse/sles/15.7/cdi-controller
-  importerImage: registry.suse.com/suse/sles/15.7/cdi-importer
-  clonerImage: registry.suse.com/suse/sles/15.7/cdi-cloner
-  apiserverImage: registry.suse.com/suse/sles/15.7/cdi-apiserver
-  uploadserverImage: registry.suse.com/suse/sles/15.7/cdi-uploadserver
-  uploadproxyImage: registry.suse.com/suse/sles/15.7/cdi-uploadproxy
+  version: 1.61.0-150600.3.12.1
+  operatorImage: registry.suse.com/suse/sles/15.6/cdi-operator
+  controllerImage: registry.suse.com/suse/sles/15.6/cdi-controller
+  importerImage: registry.suse.com/suse/sles/15.6/cdi-importer
+  clonerImage: registry.suse.com/suse/sles/15.6/cdi-cloner
+  apiserverImage: registry.suse.com/suse/sles/15.6/cdi-apiserver
+  uploadserverImage: registry.suse.com/suse/sles/15.6/cdi-uploadserver
+  uploadproxyImage: registry.suse.com/suse/sles/15.6/cdi-uploadproxy
  pullPolicy: IfNotPresent
  affinity:
    podAffinity:
@@ -30,7 +30,6 @@ cdi:
    featureGates:
      - HonorWaitForFirstConsumer
  imagePullPolicy: "IfNotPresent"
-  customizeComponents: {}
  infra:
    nodeSelector:
      kubernetes.io/os: linux
@@ -42,7 +41,7 @@ cdi:
    nodeSelector:
      kubernetes.io/os: linux

-hookImage: registry.rancher.com/rancher/kubectl:v1.33.1
+hookImage: registry.rancher.com/rancher/kubectl:v1.30.10
 hookRestartPolicy: OnFailure
 hookSecurityContext:
  seccompProfile:
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/edge-image-builder-image/Dockerfile
+++ b/edge-image-builder-image/Dockerfile
@@ -1,5 +1,5 @@
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.3.1
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.3.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.1
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.1-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-base:$SLE_VERSION
 MAINTAINER SUSE LLC (https://www.suse.com/)
@@ -7,18 +7,18 @@ MAINTAINER SUSE LLC (https://www.suse.com/)
 COPY artifacts.yaml artifacts.yaml

 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
-RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86 qemu-uefi-aarch64 cni-plugins pigz zstd cpio && zypper -n clean && rm -rf /var/log/*
+RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86 qemu-uefi-aarch64 cni-plugins; zypper -n clean; rm -rf /var/log/*

 # Define labels according to https://en.opensuse.org/Building_derived_containers
 # labelprefix=com.suse.application.edge-image-builder
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE edge-image-builder Container Image"
 LABEL org.opencontainers.image.description="edge-image-builder based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="1.3.1"
+LABEL org.opencontainers.image.version="1.2.1"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.3.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.2.1-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -32,7 +32,8 @@ LABEL com.suse.release-stage="released"
 # and also expects the boot kernel to be a portable executable (PE), not ELF.
 RUN mkdir -p /usr/share/edk2/aarch64 && \
  cp /usr/share/qemu/aavmf-aarch64-code.bin /usr/share/edk2/aarch64/QEMU_EFI-pflash.raw && \
-  cp /usr/share/qemu/aavmf-aarch64-vars.bin /usr/share/edk2/aarch64/vars-template-pflash.raw
+  cp /usr/share/qemu/aavmf-aarch64-vars.bin /usr/share/edk2/aarch64/vars-template-pflash.raw && \
+  mv /boot/vmlinux* /boot/backup-vmlinux

 ENTRYPOINT ["/usr/bin/eib"]

--- a/edge-image-builder-image/artifacts.yaml
+++ b/edge-image-builder-image/artifacts.yaml
@@ -1,7 +1,7 @@
 metallb:
  chart: metallb
  repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.1+up0.15.2"
+  version: "%%CHART_MAJOR%%.0.0+up0.14.9"
 endpoint-copier-operator:
  chart: endpoint-copier-operator
  repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
@@ -10,10 +10,6 @@ kubernetes:
  k3s:
    selinuxPackage: k3s-selinux-1.6-1.slemicro.noarch
    selinuxRepository: https://rpm.rancher.io/k3s/stable/common/slemicro/noarch
-    selinuxRepositoryPriority: 1
-    releaseURL: https://github.com/k3s-io/k3s/releases/download/
  rke2:
    selinuxPackage: rke2-selinux
    selinuxRepository: https://rpm.rancher.io/rke2/stable/common/slemicro/noarch
-    selinuxRepositoryPriority: 1
-    releaseURL: https://github.com/rancher/rke2/releases/download/
--- a/edge-image-builder/_service
+++ b/edge-image-builder/_service
@@ -3,9 +3,9 @@
    <param name="url">https://github.com/suse-edge/edge-image-builder.git</param>
    <param name="scm">git</param>
    <param name="exclude">.git</param>
-    <param name="revision">v1.3.1</param>
+    <param name="revision">v1.2.1</param>
    <!-- Uncomment and set this For Pre-Release Version -->
-    <!-- <param name="version">1.3.1</param> -->
+    <!-- <param name="version">1.2.0~rc1</param> -->
    <!-- Uncomment and this for regular version -->
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="versionrewrite-pattern">v(\d+).(\d+).(\d+)</param>
--- a/edge-image-builder/edge-image-builder.spec
+++ b/edge-image-builder/edge-image-builder.spec
@@ -17,7 +17,7 @@


 Name:           edge-image-builder
-Version:        1.3.1
+Version:        1.2.1
 Release:        0
 Summary:        Edge Image Builder
 License:        Apache-2.0
@@ -52,7 +52,7 @@ Requires: ca-certificates-suse
 Tool for creating and configuring a set of images to automate the deployment of Edge environments

 %prep
-%autosetup -a1 -n edge-image-builder-%{version} -p1
+%autosetup -a1 -n edge-image-builder-%{version}

 %build
 tar -xf %{SOURCE1}
--- a/1
+++ b/1
--- a/frr-image/Dockerfile
+++ b/frr-image/Dockerfile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MIT
-#!BuildTag: %%IMG_PREFIX%%frr:10.2.1
-#!BuildTag: %%IMG_PREFIX%%frr:10.2.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%frr:8.5.6
+#!BuildTag: %%IMG_PREFIX%%frr:8.5.6-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -14,11 +14,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="FRR Container Image"
 LABEL org.opencontainers.image.description="frr based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="10.2.1"
+LABEL org.opencontainers.image.version="8.5.6"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%frr:10.2.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%frr:8.5.6-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
--- a/frr-k8s/_service
+++ b/frr-k8s/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/metallb/frr-k8s</param>
    <param name="scm">git</param>
-    <param name="revision">v0.0.20</param>
+    <param name="revision">v0.0.16</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
@@ -18,4 +18,4 @@
  <service name="go_modules">
  </service>
  <service mode="buildtime" name="set_version" />
-</services>
+</services>
--- a/frr-k8s/frr-k8s.spec
+++ b/frr-k8s/frr-k8s.spec
@@ -17,14 +17,14 @@


 Name:           frr-k8s
-Version:        0.0.20
-Release:        0.0.20
+Version:        0.0.16
+Release:        0.0.16
 Summary:        A kubernetes based daemonset that exposes a subset of the FRR API in a kubernetes compliant manner.
 License:        Apache-2.0
 URL:            https://github.com/metallb/frr-k8s
 Source:         frr-k8s-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.22
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

@@ -63,4 +63,4 @@ install -D -m0755 frr-k8s %{buildroot}/frr-k8s
 /frr-metrics
 /frr-k8s

-%changelog
+%changelog
--- a/grub-aggregate/_aggregate
+++ b/grub-aggregate/_aggregate
@@ -1,7 +0,0 @@
-<aggregatelist>
-  <aggregate project="SUSE:SLFO:1.2" >
-    <binary>grub2-x86_64-efi</binary>
-    <binary>grub2-arm64-efi</binary>
-    <repository target="standard" source="standard" />
-  </aggregate>
-</aggregatelist>
--- a/hauler/_service
+++ b/hauler/_service
@@ -4,7 +4,7 @@
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="scm">git</param>
    <param name="exclude">.get</param>
-    <param name="revision">v1.2.5</param>
+    <param name="revision">v1.2.1</param>
    <param name="versionrewrite-pattern">v(.*)</param>
    <param name="changesgenerate">enable</param>
  </service>
--- a/hauler/hauler.spec
+++ b/hauler/hauler.spec
@@ -18,7 +18,7 @@
 %define project github.com/hauler-dev/hauler

 Name:           hauler
-Version:        1.2.5
+Version:        1.2.1
 Release:        0
 Summary:        Airgap Swiss Army Knife
 License:        Apache-2.0
--- a/ib-sriov-cni-image/Dockerfile
+++ b/ib-sriov-cni-image/Dockerfile
@@ -1,33 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ib-sriov-cni:v%%ib-sriov-cni_version%%
-#!BuildTag: %%IMG_PREFIX%%ib-sriov-cni:v%%ib-sriov-cni_version%%-%RELEASE%
-ARG SLE_VERSION
-FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
-
-FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
-COPY --from=micro / /installroot/
-RUN zypper --installroot /installroot --non-interactive install --no-recommends ib-sriov-cni gawk which; \
-    zypper -n clean; \
-    rm -rf /var/log/*
-
-FROM micro AS final
-# Define labels according to https://en.opensuse.org/Building_derived_containers
-# labelprefix=com.suse.application.ib-sriov-cni
-LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
-LABEL org.opencontainers.image.title="SLE ib-sriov-cni Container Image"
-LABEL org.opencontainers.image.description="ib-sriov-cni based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="%%ib-sriov-cni_version%%"
-LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
-LABEL org.opencontainers.image.created="%BUILDTIME%"
-LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ib-sriov-cni:%%ib-sriov-cni_version%%-%RELEASE%"
-LABEL org.openbuildservice.disturl="%DISTURL%"
-LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
-LABEL com.suse.eula="SUSE Combined EULA February 2024"
-LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle"
-LABEL com.suse.image-type="application"
-LABEL com.suse.release-stage="released"
-# endlabelprefix
-
-COPY --from=base /installroot /
-ENTRYPOINT ["/entrypoint.sh"]
--- a/ib-sriov-cni-image/_service
+++ b/ib-sriov-cni-image/_service
@@ -1,19 +0,0 @@
-<services>
-  <service name="kiwi_metainfo_helper" mode="buildtime"/>
-  <service name="docker_label_helper" mode="buildtime"/>
-  <service name="replace_using_package_version" mode="buildtime">
-    <param name="file">Dockerfile</param>
-    <param name="regex">%%ib-sriov-cni_version%%</param>
-    <param name="package">ib-sriov-cni</param>
-    <param name="parse-version">patch</param>
-  </service>
-  <service name="replace_using_env" mode="buildtime">
-    <param name="file">Dockerfile</param>
-    <param name="eval">IMG_PREFIX=$(rpm --macros=/root/.rpmmacros -E %{?img_prefix})</param>
-    <param name="var">IMG_PREFIX</param>
-    <param name="eval">IMG_REPO=$(rpm --macros=/root/.rpmmacros -E %img_repo)</param>
-    <param name="var">IMG_REPO</param>
-    <param name="eval">SUPPORT_LEVEL=$(rpm --macros=/root/.rpmmacros -E %support_level)</param>
-    <param name="var">SUPPORT_LEVEL</param>
-  </service>
-</services>
--- a/ib-sriov-cni/_service
+++ b/ib-sriov-cni/_service
@@ -1,25 +0,0 @@
-<services>
- <service name="obs_scm">
-    <param name="url">https://github.com/k8snetworkplumbingwg/ib-sriov-cni</param>
-    <param name="scm">git</param>
-    <param name="revision">v1.3.0</param>
-    <param name="version">_auto_</param>
-    <param name="versionformat">@PARENT_TAG@</param>
-    <param name="changesgenerate">enable</param>
-    <param name="changesauthor">antonio.alarcon@suse.com</param>
-    <param name="match-tag">v*</param>
-    <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param>
-    <param name="without-version">yes</param>
-    <param name="versionrewrite-replacement">\1</param>
-  </service>
-  <service mode="buildtime" name="tar">
-    <param name="obsinfo">ib-sriov-cni.obsinfo</param>
-  </service>
-  <service name="go_modules" />
-  <service mode="buildtime" name="set_version" />
-  <service name="replace_using_env" mode="buildtime">
-    <param name="file">ib-sriov-cni.spec</param>
-    <param name="var">SOURCE_COMMIT</param>
-    <param name="eval">SOURCE_COMMIT=$(grep commit ib-sriov-cni.obsinfo | cut -d" " -f2)</param>
-  </service>
-</services>
--- a/ib-sriov-cni/ib-sriov-cni.spec
+++ b/ib-sriov-cni/ib-sriov-cni.spec
@@ -1,64 +0,0 @@
-#
-# spec file for package ib-sriov-cni
-#
-# Copyright (c) 2025 SUSE LLC
-#
-# All modifications and additions to the file contributed by third parties
-# remain the property of their copyright owners, unless otherwise agreed
-# upon. The license for this file, and modifications and additions to the
-# file, is the same license as for the pristine package itself (unless the
-# license for the pristine package is not an Open Source License, in which
-# case the license is the MIT License). An "Open Source License" is a
-# license that conforms to the Open Source Definition (Version 1.9)
-# published by the Open Source Initiative.
-
-# Please submit bugfixes or comments via https://bugs.opensuse.org/
-#
-
-
-Name:           ib-sriov-cni
-Version:        0
-Release:        0
-Summary:        Implements a Kubernetes CNI plugin operator for Infiniband SRIOV VFs
-License:        Apache-2.0
-URL:            https://github.com/k8snetworkplumbingwg/ib-sriov-cni
-Source:         %{name}-%{version}.tar
-Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
-ExcludeArch:    s390
-ExcludeArch:    %{ix86}
-
-%description
-Network Interface Cards (NICs) with SR-IOV capabilities are managed through physical functions (PFs) and virtual functions (VFs).
-A PF is used by the host and usually represents a single NIC port. VF configurations are applied through the PF.
-The SR-IOV CNI allows each VF to be treated as a separate network interface, assigned to a container, and configured with its own
-MAC, VLAN, IP and more.
-
-Infiniband SR-IOV CNI plugin works with Infiniband SR-IOV device plugin for VF allocation in Kubernetes. A CNI metaplugin such as Multus
-gets the allocated VF's deviceID(PCI address) and is responsible for invoking the Infiniband SR-IOV CNI plugin with that deviceID.
-
-%prep
-%autosetup -a1 -n %{name}-%{version} -p1
-
-%build
-# CGO is disabled by default in upstream Makefile:
-%define cgoenabled "0"
-# go build constrain (aka tag) "no_openssl" is set by default in upstream Makefile
-%define gotags "no_openssl"
-%define buildtime %(date +%%Y-%%m-%%dT%%H:%%M:%%S%%z)
-%define buildcommit %%SOURCE_COMMIT%%
-%define buildldflags "-X main.version=%{version} -X main.commit=%{buildcommit}% -X main.date=%{buildtime}%"
-CGO_ENABLED=%{cgoenabled} go build -mod=vendor -buildmode=pie -tags %{gotags} -ldflags %{buildldflags} -o ib-sriov cmd/ib-sriov-cni/main.go
-
-%install
-install -D -m0755 ib-sriov %{buildroot}%{_bindir}/ib-sriov
-install -D -m0755 images/entrypoint.sh %{buildroot}/entrypoint.sh
-
-
-%files
-%license LICENSE
-%doc README.md
-%{_bindir}/ib-sriov
-/entrypoint.sh
-
-%changelog
--- a/1
+++ b/1
--- a/ironic-image/Dockerfile
+++ b/ironic-image/Dockerfile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic:32.0.0.1
-#!BuildTag: %%IMG_PREFIX%%ironic:32.0.0.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic:29.0.4.0
+#!BuildTag: %%IMG_PREFIX%%ironic:29.0.4.0-%RELEASE%

 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
@@ -17,19 +17,13 @@ RUN /bin/prepare-efi.sh
 COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf

-RUN zypper --installroot /installroot --non-interactive install --no-recommends \
-    python3-devel python3 python3-pip \
-    python313-sushy \
-    python3-watchdog python313-ironicclient \
-    git curl sles-release tar gzip vim gawk \
-    dnsmasq dosfstools apache2 ipcalc ipmitool iproute2 \
-    bind-utils procps qemu-tools sqlite3 util-linux xorriso \
-    tftp ipxe-bootimgs crudini \
-    openstack-ironic
-
 #!ArchExclusiveLine: x86_64
 RUN if [ "$(uname -m)" = "x86_64" ];then \
-      zypper --installroot /installroot --non-interactive install --no-recommends syslinux  ; \
+      zypper --installroot /installroot --non-interactive install --no-recommends syslinux python311-devel python311 python311-pip python311-sushy-oem-idrac python311-proliantutils python311-sushy python311-pyinotify python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi ipcalc ipmitool iproute2 bind-utils procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic; \
+    fi
+#!ArchExclusiveLine: aarch64
+RUN if [ "$(uname -m)" = "aarch64" ];then \
+      zypper --installroot /installroot --non-interactive install --no-recommends python311-devel python311 python311-pip python311-sushy-oem-idrac python311-proliantutils python311-sushy python311-pyinotify python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi ipcalc ipmitool iproute2 bind-utils procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic; \
    fi
    
 # DATABASE
@@ -47,8 +41,8 @@ LABEL org.opencontainers.image.description="Openstack Ironic based on the SLE Ba
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opencontainers.image.version="32.0.0.1"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:32.0.0.1-%RELEASE%"
+LABEL org.opencontainers.image.version="29.0.4.0"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:29.0.4.0-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -59,8 +53,8 @@ LABEL com.suse.release-stage="released"

 COPY --from=base /installroot /

-RUN set -euo pipefail; ln -s /usr/bin/python3.13 /usr/local/bin/python3; \
-    ln -s /usr/bin/pydoc3.13 /usr/local/bin/pydoc
+RUN set -euo pipefail; ln -s /usr/bin/python3.11 /usr/local/bin/python3; \
+    ln -s /usr/bin/pydoc3.11 /usr/local/bin/pydoc

 ENV GRUB_DIR=/tftpboot/boot/grub

@@ -81,20 +75,21 @@ RUN cp /bin/ironic-readiness /bin/ironic-liveness

 COPY ironic-config/inspector.ipxe.j2 ironic-config/httpd-ironic-api.conf.j2 \
     ironic-config/ipxe_config.template ironic-config/dnsmasq.conf.j2 \
-     /templates/
+     /tmp/

 # IRONIC #
 RUN cp /usr/share/ipxe/undionly.kpxe /tftpboot/undionly.kpxe
 #!ArchExclusiveLine: x86_64
 RUN if [ "$(uname -m)" = "x86_64" ];then \
-      cp /usr/share/ipxe/snp-x86_64.efi /tftpboot/snponly.efi ;\
+      cp /usr/share/ipxe/ipxe-x86_64.efi /tftpboot/ipxe.efi ;\
    fi
-#!ArchExclusiveLine: aarch64
-RUN if [ "$(uname -m)" = "aarch64" ]; then\
-      cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snponly.efi;\
+#!ArchExclusiveLine: aarch64 
+RUN if [ "$(uname -m)" = "aarch64" ]; then\ 
+      cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
    fi
-
-COPY --from=base /tmp/uefi_esp_*.img /templates/
+    
+COPY --from=base /tmp/esp-x86_64.img /tmp/uefi_esp-x86_64.img
+COPY --from=base /tmp/esp-aarch64.img /tmp/uefi_esp-arm64.img

 COPY ironic-config/ironic.conf.j2 ironic-config/network-data-schema-empty.json /etc/ironic/

@@ -105,8 +100,8 @@ RUN rm /etc/ironic/ironic.conf.d/010-ironic.conf
 # Custom httpd config, removes all but the bare minimum needed modules
 COPY ironic-config/httpd.conf.j2 /etc/httpd/conf/
 COPY ironic-config/httpd-modules.conf /etc/httpd/conf.modules.d/
-COPY ironic-config/apache2-vmedia.conf.j2 /templates/httpd-vmedia.conf.j2
-COPY ironic-config/apache2-ipxe.conf.j2 /templates/httpd-ipxe.conf.j2
+COPY ironic-config/apache2-vmedia.conf.j2 /tmp/httpd-vmedia.conf.j2
+COPY ironic-config/apache2-ipxe.conf.j2 /tmp/httpd-ipxe.conf.j2

 # configure non-root user and set relevant permissions
 RUN configure-nonroot.sh && rm -f /bin/configure-nonroot.sh
--- a/ironic-image/configure-nonroot.sh
+++ b/ironic-image/configure-nonroot.sh
@@ -45,10 +45,10 @@ chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /run

 # ironic and httpd related changes
 mkdir -p /etc/httpd/conf.d
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/ironic /etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf.modules.d/
-chmod 2775 /etc/ironic /etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf.modules.d/
+chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/ironic /etc/httpd/conf /etc/httpd/conf.d
+chmod 2775 /etc/ironic /etc/httpd/conf /etc/httpd/conf.d
 #chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.d/*
-chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.modules.d/*
+chmod 664 /etc/ironic/* /etc/httpd/conf/*

 chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /var/lib/ironic
 chmod 2775 /var/lib/ironic
--- a/ironic-image/ironic-config/apache2-ipxe.conf.j2
+++ b/ironic-image/ironic-config/apache2-ipxe.conf.j2
@@ -11,17 +11,26 @@ Listen [::]:{{ env.IPXE_TLS_PORT }}
    SSLCertificateFile {{ env.IPXE_CERT_FILE }}
    SSLCertificateKeyFile {{ env.IPXE_KEY_FILE }}

-    DocumentRoot "/shared/html"
    <Directory "/shared/html">
-        Options Indexes FollowSymLinks
-        Require all granted
+        Order Allow,Deny
+        Allow from all
    </Directory>
-    <Directory ~ "/shared/html/(redfish|ilo|images)/">
-        Require all denied
+    <Directory "/shared/html/(redfish|ilo|images)/">
+        Order Deny,Allow
+        Deny from all
    </Directory>
-
-    <Location ~ "^/.*">
-        SSLRequireSSL
-    </Location>
-
 </VirtualHost>
+
+<Location ~ "^/grub.*/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/pxelinux.cfg/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/.*\.conf/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/(([0-9]|[a-z]).*-){4}([0-9]|[a-z]).*/">
+    SSLRequireSSL
+</Location>
+
--- a/ironic-image/ironic-config/apache2-vmedia.conf.j2
+++ b/ironic-image/ironic-config/apache2-vmedia.conf.j2
@@ -11,29 +11,16 @@ Listen [::]:{{ env.VMEDIA_TLS_PORT }}
    SSLCertificateFile {{ env.IRONIC_VMEDIA_CERT_FILE }}
    SSLCertificateKeyFile {{ env.IRONIC_VMEDIA_KEY_FILE }}

-    {% if "IRONIC_VMEDIA_TLS_12_CIPHERS" in env and env.IRONIC_VMEDIA_TLS_12_CIPHERS %}
-    SSLCipherSuite {{ env.IRONIC_VMEDIA_TLS_12_CIPHERS }}
-    {% endif %}
-    {% if "IRONIC_VMEDIA_TLS_13_CIPHERS" in env and env.IRONIC_VMEDIA_TLS_13_CIPHERS %}
-    SSLCipherSuite TLSv1.3 {{ env.IRONIC_VMEDIA_TLS_13_CIPHERS }}
-    {% endif %}
-    {% if "IRONIC_VMEDIA_CURVES" in env and env.IRONIC_VMEDIA_CURVES %}
-    SSLOpenSSLConfCmd Curves {{ env.IRONIC_VMEDIA_CURVES }}
-    {% endif %}
-    {% if env.IRONIC_VMEDIA_TLS_ENFORCE_SERVER_CIPHER_ORDER | lower == "true" %}
-    SSLHonorCipherOrder on
-    {% endif %}
-
    <Directory ~ "/shared/html">
-        Require all denied
+         Order deny,allow
+         deny from all
    </Directory>
    <Directory ~ "/shared/html/(redfish|ilo)/">
-        Require all granted
+         Order allow,deny
+         allow from all
    </Directory>
-
-    <Location ~ "^/.*">
-        SSLRequireSSL
-    </Location>
-
 </VirtualHost>

+<Location ~ "^/(redfish|ilo)/">
+    SSLRequireSSL
+</Location>
--- a/ironic-image/ironic-config/dnsmasq.conf.j2
+++ b/ironic-image/ironic-config/dnsmasq.conf.j2
@@ -11,8 +11,14 @@ port={{ env.DNS_PORT }}
 {%- if env.DHCP_RANGE | length %}
 log-dhcp
 dhcp-range={{ env.DHCP_RANGE }}
-{% endif %}

+# It can be used when setting DNS or GW variables.
+{%- if env["GATEWAY_IP"] is undefined %}
+# Disable default router(s)
+dhcp-option=3
+{% else %}
+dhcp-option=option{% if ":" in env["GATEWAY_IP"] %}6{% endif %}:router,{{ env["GATEWAY_IP"] }}
+{% endif %}
 {%- if env["DNS_IP"] is undefined %}
 # Disable DNS over provisioning network
 dhcp-option=6
@@ -20,31 +26,31 @@ dhcp-option=6
 dhcp-option=option{% if ":" in env["DNS_IP"] %}6{% endif %}:dns-server,{{ env["DNS_IP"] }}
 {% endif %}

-{# Network boot options for IPv4 and IPv6 #}
 {%- if env.IPV == "4" or env.IPV is undefined %}
 # IPv4 Configuration:
 dhcp-match=ipxe,175
-
-{# Set the router or disable it. Setting router is IPv4 specific, in v6 there #}
-{# are router advertisements that do the same thing. #}
-{%- if env["GATEWAY_IP"] is undefined %}
-# Disable default router(s)
-dhcp-option=3
+# Client is already running iPXE; move to next stage of chainloading
+{%- if env.IPXE_TLS_SETUP == "true"  %}
+# iPXE with (U)EFI
+dhcp-boot=tag:efi,tag:ipxe,{{ env.IRONIC_HTTP_URL }}/custom-ipxe/snponly.efi
+# iPXE with BIOS
+dhcp-boot=tag:ipxe,{{ env.IRONIC_HTTP_URL }}/custom-ipxe/undionly.kpxe
 {% else %}
-dhcp-option=option:router,{{ env["GATEWAY_IP"] }}
+dhcp-boot=tag:ipxe,{{ env.IRONIC_HTTP_URL }}/boot.ipxe
 {% endif %}

 # Note: Need to test EFI booting
 dhcp-match=set:efi,option:client-arch,7
 dhcp-match=set:efi,option:client-arch,9
 dhcp-match=set:efi,option:client-arch,11
-# Client is (i)PXE booting on EFI machine
-dhcp-boot=tag:efi,/snponly.efi,{{ env.IRONIC_IP }}
-# Client is running (i)PXE on BIOS machine
-dhcp-boot=tag:!efi,/undionly.kpxe,{{ env.IRONIC_IP }}
-{%- if env.IPXE_TLS_SETUP != "true" %}
-dhcp-boot=tag:ipxe,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/boot.ipxe
+# Client is PXE booting over EFI without iPXE ROM; send EFI version of iPXE chainloader do the same also if iPXE ROM boots but TLS is enabled
+{%- if env.IPXE_TLS_SETUP == "true"  %}
+dhcp-boot=tag:efi,tag:ipxe,snponly.efi
 {% endif %}
+dhcp-boot=tag:efi,tag:!ipxe,snponly.efi
+
+# Client is running PXE over BIOS; send BIOS version of iPXE chainloader
+dhcp-boot=/undionly.kpxe,{{ env.IRONIC_IP }}
 {% endif %}

 {% if env.IPV == "6" %}
@@ -54,12 +60,22 @@ ra-param={{ env.PROVISIONING_INTERFACE }},0,0

 dhcp-vendorclass=set:pxe6,enterprise:343,PXEClient
 dhcp-userclass=set:ipxe6,iPXE
-# Client is (i)PXE booting on EFI machine
-dhcp-option=tag:efi,option6:bootfile-url,{{ env.IRONIC_URL_HOST }}/snponly.efi
-# Client is running (i)PXE on BIOS machine
-dhcp-option=tag:!efi,option6:bootfile-url,{{ env.IRONIC_URL_HOST }}/undionly.kpxe
-{%- if env.IPXE_TLS_SETUP != "true" %}
+dhcp-option=tag:pxe6,option6:bootfile-url,{{ env.IRONIC_TFTP_URL }}/snponly.efi
 dhcp-option=tag:ipxe6,option6:bootfile-url,{{ env.IRONIC_HTTP_URL }}/boot.ipxe
+
+# It can be used when setting DNS or GW variables.
+{%- if env["GATEWAY_IP"] is undefined %}
+# Disable default router(s)
+dhcp-option=3
+{% else %}
+dhcp-option=3,{{ env["GATEWAY_IP"] }}
+{% endif %}
+{%- if env["DNS_IP"] is undefined %}
+# Disable DNS over provisioning network
+dhcp-option=6
+{% else %}
+dhcp-option=6,{{ env["DNS_IP"] }}
+{% endif %}
 {% endif %}
 {% endif %}

--- a/ironic-image/ironic-config/httpd-ironic-api.conf.j2
+++ b/ironic-image/ironic-config/httpd-ironic-api.conf.j2
@@ -29,20 +29,6 @@ Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
 {% endif %}
 {% endif %}

-    DocumentRoot "/shared/html"
-
-    <Directory "/shared/html">
-        Require all denied
-    </Directory>
-
-    <Directory "/shared/html/images">
-        Require all granted
-    </Directory>
-
-    # Exclude /images from proxying
-    ProxyPass        "/images" !
-    ProxyPassReverse "/images" !
-
    {% if env.IRONIC_PRIVATE_PORT == "unix" %}
    ProxyPass "/"  "unix:/shared/ironic.sock|http://127.0.0.1/"
    ProxyPassReverse "/"  "unix:/shared/ironic.sock|http://127.0.0.1/"
@@ -65,7 +51,6 @@ Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
    SSLCertificateKeyFile {{ env.IRONIC_KEY_FILE }}
 {% endif %}

-
    <Location />
         {% if "IRONIC_HTPASSWD" in env and env.IRONIC_HTPASSWD | length %}
            AuthType Basic
@@ -82,9 +67,4 @@ Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
    <Location ~ "^/(v1/)?(lookup|heartbeat|continue_inspection)" >
        Require all granted
    </Location>
-
-    <Location ~ "^/images(/.*)?$">
-        Require all granted
-    </Location>
-
 </VirtualHost>
--- a/ironic-image/ironic-config/httpd-modules.conf
+++ b/ironic-image/ironic-config/httpd-modules.conf
@@ -8,6 +8,8 @@ LoadModule authz_core_module /usr/lib64/apache2/mod_authz_core.so
 LoadModule ssl_module /usr/lib64/apache2/mod_ssl.so
 LoadModule env_module /usr/lib64/apache2/mod_env.so
 LoadModule proxy_module /usr/lib64/apache2/mod_proxy.so
+LoadModule proxy_ajp_module /usr/lib64/apache2/mod_proxy_ajp.so
+LoadModule proxy_balancer_module /usr/lib64/apache2/mod_proxy_balancer.so
 LoadModule proxy_http_module /usr/lib64/apache2/mod_proxy_http.so
 LoadModule slotmem_shm_module /usr/lib64/apache2/mod_slotmem_shm.so
 LoadModule headers_module /usr/lib64/apache2/mod_headers.so
@@ -15,4 +17,4 @@ LoadModule authn_core_module /usr/lib64/apache2/mod_authn_core.so
 LoadModule auth_basic_module /usr/lib64/apache2/mod_auth_basic.so
 LoadModule authn_file_module /usr/lib64/apache2/mod_authn_file.so
 LoadModule authz_user_module /usr/lib64/apache2/mod_authz_user.so
-#LoadModule access_compat_module /usr/lib64/apache2/mod_access_compat.so
+LoadModule access_compat_module /usr/lib64/apache2/mod_access_compat.so
--- a/ironic-image/ironic-config/httpd.conf.j2
+++ b/ironic-image/ironic-config/httpd.conf.j2
@@ -22,43 +22,18 @@ Group ironic-suse
 DocumentRoot "/shared/html"

 <Directory "/shared/html">
-{%- if env.IPXE_TLS_SETUP | lower == "true" %}
-    Options Indexes FollowSymLinks
-    Require all denied
-{%- else %}
    Options Indexes FollowSymLinks
+    AllowOverride None
    Require all granted
-{%- endif %}
 </Directory>

-<Directory ~ "/shared/html/(redfish|ilo)/">
-{%- if env.IRONIC_VMEDIA_TLS_SETUP | lower == "true" %}
-    Require all denied
-{%- else %}
-    Require all granted
-{%- endif %}
-</Directory>
-
-{%- set serve_img = env.HTTPD_SERVE_NODE_IMAGES | lower %}
-{%- set image_tls = env.IRONIC_TLS_SETUP | lower %}
+{%- if env.HTTPD_SERVE_NODE_IMAGES | lower == "true" %}
 <Directory "/shared/html/images">
    Options Indexes FollowSymLinks
    AllowOverride None
-{%- if serve_img == "true" and image_tls != "true" %}
    Require all granted
-{%- else %}
-    Require all denied
-{%- endif %}
-
-    <FilesMatch "^ironic.*">
-{%- if env.IPXE_TLS_SETUP | lower == "true" %}
-        Require all denied
-{%- else %}
-        Require all granted
-{%- endif %}
-    </FilesMatch>
 </Directory>
-
+{% endif %}

 <IfModule dir_module>
    DirectoryIndex index.html
@@ -95,7 +70,7 @@ AddDefaultCharset UTF-8
    MIMEMagicFile conf/magic
 </IfModule>

-PidFile {{ env.IRONIC_TMP_DATA_DIR }}/httpd.pid
+PidFile /var/tmp/httpd.pid

 # EnableSendfile directive could speed up deployments but it could also cause
 # issues depending on the underlying file system, to learn more:
--- a/ironic-image/ironic-config/ironic.conf.j2
+++ b/ironic-image/ironic-config/ironic.conf.j2
@@ -4,19 +4,19 @@ debug = true
 default_deploy_interface = direct
 default_inspect_interface = agent
 default_network_interface = noop
-enabled_bios_interfaces = no-bios,redfish,idrac-redfish,irmc
-enabled_boot_interfaces = ipxe,pxe,fake,redfish-virtual-media,idrac-redfish-virtual-media,redfish-https
+enabled_bios_interfaces = no-bios,redfish,idrac-redfish,irmc,ilo
+enabled_boot_interfaces = ipxe,ilo-ipxe,pxe,ilo-pxe,fake,redfish-virtual-media,idrac-redfish-virtual-media,ilo-virtual-media,redfish-https
 enabled_deploy_interfaces = direct,fake,ramdisk,custom-agent
 enabled_firmware_interfaces = no-firmware,fake,redfish
 # NOTE(dtantsur): when changing this, make sure to update the driver
 # dependencies in Dockerfile.
-enabled_hardware_types = ipmi,idrac,irmc,fake-hardware,redfish,manual-management
-enabled_inspect_interfaces = agent,irmc,fake,redfish
-enabled_management_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,noop
+enabled_hardware_types = ipmi,idrac,irmc,fake-hardware,redfish,manual-management,ilo,ilo5
+enabled_inspect_interfaces = agent,irmc,fake,redfish,ilo
+enabled_management_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,ilo,ilo5,noop
 enabled_network_interfaces = noop
-enabled_power_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish
-enabled_raid_interfaces = no-raid,irmc,agent,fake,redfish,idrac-redfish
-enabled_vendor_interfaces = no-vendor,ipmitool,idrac-redfish,redfish,fake
+enabled_power_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,ilo
+enabled_raid_interfaces = no-raid,irmc,agent,fake,redfish,idrac-redfish,ilo5
+enabled_vendor_interfaces = no-vendor,ipmitool,idrac-redfish,redfish,ilo,fake
 {% if env.IRONIC_EXPOSE_JSON_RPC | lower == "true" %}
 rpc_transport = json-rpc
 {% else %}
@@ -33,6 +33,7 @@ my_ipv6 = {{ env.IRONIC_IPV6 }}
 {% endif %}

 host = {{ env.IRONIC_CONDUCTOR_HOST }}
+tempdir = {{ env.IRONIC_TMP_DATA_DIR }}

 # If a path to a certificate is defined, use that first for webserver
 {% if env.WEBSERVER_CACERT_FILE %}
@@ -47,10 +48,6 @@ isolinux_bin = /usr/share/syslinux/isolinux.bin
 # the ESP provided in [conductor]bootloader.
 grub_config_path = EFI/BOOT/grub.cfg

-# NOTE(hroyrh): updating the default temp directory to fix device cross links
-# errors when hard linking
-tempdir = /shared/tmp
-
 [agent]
 deploy_logs_collect = always
 deploy_logs_local_path = /shared/log/ironic/deploy
@@ -89,30 +86,26 @@ network_data_schema = /etc/ironic/network-data-schema-empty.json
 automated_clean = {{ env.IRONIC_AUTOMATED_CLEAN }}
 # NOTE(dtantsur): keep aligned with [pxe]boot_retry_timeout below.
 deploy_callback_timeout = 4800
-bootloader_by_arch = {{ env.BOOTLOADER_BY_ARCH }}
+send_sensor_data = {{ env.SEND_SENSOR_DATA }}
+# NOTE(TheJulia): Do not lower this value below 120 seconds.
+# Power state is checked every 60 seconds and BMC activity should
+# be avoided more often than once every sixty seconds.
+send_sensor_data_interval = 160
+bootloader = {{ env.IRONIC_HTTP_URL }}/uefi_esp-{{ env.DEPLOY_ARCHITECTURE }}.img
 verify_step_priority_override = management.clear_job_queue:90
 # We don't use this feature, and it creates an additional load on the database
 node_history = False
 # Provide for a timeout longer than 60 seconds for certain vendor's hardware
 power_state_change_timeout = 120
-{% if env.DEPLOY_KERNEL_URL is defined %}
-deploy_kernel = {{ env.DEPLOY_KERNEL_URL }}
+{% if env.IRONIC_DEFAULT_KERNEL is defined %}
+deploy_kernel = file://{{ env.IRONIC_DEFAULT_KERNEL }}
 {% endif %}
-{% if env.DEPLOY_KERNEL_BY_ARCH is defined %}
-deploy_kernel_by_arch = {{ env.DEPLOY_KERNEL_BY_ARCH }}
-{% endif %}
-{% if env.DEPLOY_RAMDISK_URL is defined %}
-deploy_ramdisk = {{ env.DEPLOY_RAMDISK_URL }}
-{% endif %}
-{% if env.DEPLOY_RAMDISK_BY_ARCH is defined %}
-deploy_ramdisk_by_arch = {{ env.DEPLOY_RAMDISK_BY_ARCH }}
+{% if env.IRONIC_DEFAULT_RAMDISK is defined %}
+deploy_ramdisk = file://{{ env.IRONIC_DEFAULT_RAMDISK }}
 {% endif %}
 {% if env.DISABLE_DEEP_IMAGE_INSPECTION | lower == "true" %}
 disable_deep_image_inspection = True
 {% endif %}
-# Allowed path for file:// links: ipa-downloader uses /shared/html/images,
-# while the bootloader configuration above refers to /templates.
-file_url_allowed_paths = /shared/html/images,/templates

 [database]
 {% if env.IRONIC_USE_MARIADB | lower == "true" %}
@@ -130,16 +123,15 @@ default_boot_option = local
 erase_devices_metadata_priority = 10
 erase_devices_priority = 0
 http_root = /shared/html/
-http_url = {% if env.VMEDIA_TLS_PORT %}{{ env.IRONIC_HTTPS_VMEDIA_URL }}{% else %}{{ env.IRONIC_HTTP_URL }}{% endif %}
+http_url = {{ env.IRONIC_HTTP_URL }}
 fast_track = {{ env.IRONIC_FAST_TRACK }}
-iso_master_path = /shared/html/master_iso_images
 {% if env.IRONIC_BOOT_ISO_SOURCE %}
 ramdisk_image_download_source = {{ env.IRONIC_BOOT_ISO_SOURCE }}
 {% endif %}
 {% if env.IRONIC_EXTERNAL_HTTP_URL %}
 external_http_url = {{ env.IRONIC_EXTERNAL_HTTP_URL }}
-{% elif env.VMEDIA_TLS_PORT %}
-external_http_url = {{ env.IRONIC_HTTPS_VMEDIA_URL }}
+{% elif env.IRONIC_VMEDIA_TLS_SETUP == "true" %}
+external_http_url = https://{{ env.IRONIC_URL_HOST }}:{{ env.VMEDIA_TLS_PORT }}
 {% endif %}
 {% if env.IRONIC_EXTERNAL_CALLBACK_URL %}
 external_callback_url = {{ env.IRONIC_EXTERNAL_CALLBACK_URL }}
@@ -196,7 +188,6 @@ cipher_suite_versions = 3,17
 auth_strategy = http_basic
 http_basic_auth_user_file = {{ env.IRONIC_RPC_HTPASSWD_FILE }}
 host_ip = {{ env.IRONIC_HOST_IP }}
-port = {{ env.IRONIC_JSON_RPC_PORT }}
 {% if env.IRONIC_TLS_SETUP == "true" %}
 use_ssl = true
 cafile = {{ env.IRONIC_CACERT_FILE }}
@@ -207,26 +198,6 @@ insecure = {{ env.IRONIC_INSECURE }}
 [nova]
 send_power_notifications = false

-# Sections (oslo_messaging_notifications, sensor_data, metrics) required for sensor data collection using ironic-prometheus-exporter (IPE):
-{% if env.SEND_SENSOR_DATA | lower == "true" %}
-[oslo_messaging_notifications]
-driver = prometheus_exporter
-location = /shared/ironic_prometheus_exporter
-transport_url = fake://
-
-[sensor_data]
-send_sensor_data = {{ env.SEND_SENSOR_DATA }}
-# NOTE(TheJulia): Do not lower this value below 120 seconds.
-# Power state is checked every 60 seconds and BMC activity should
-# be avoided more often than once every sixty seconds.
-interval = 160
-# Additional sensor_data options can be configured via OS_ environment variables:
-# https://docs.openstack.org/ironic/latest/configuration/config.html#sensor-data
-
-[metrics]
-backend = collector
-{% endif %}
-
 [pxe]
 # NOTE(dtantsur): keep this value at least 3x lower than
 # [conductor]deploy_callback_timeout so that at least some retries happen.
@@ -236,7 +207,7 @@ images_path = /shared/html/tmp
 instance_master_path = /shared/html/master_images
 tftp_master_path = /shared/tftpboot/master_images
 tftp_root = /shared/tftpboot
-kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
+kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes
 # This makes networking boot templates generated even for nodes using local
 # boot (the default), ensuring that they boot correctly even if they start
 # netbooting for some reason (e.g. with the noop management interface).
@@ -244,22 +215,19 @@ enable_netboot_fallback = true
 # Enable the fallback path to in-band inspection
 ipxe_fallback_script = inspector.ipxe
 {% if env.IPXE_TLS_SETUP | lower == "true" %}
-ipxe_config_template = /templates/ipxe_config.template
+ipxe_config_template = /tmp/ipxe_config.template
 {% endif %}

 [redfish]
 use_swift = false
-kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
-{% if env.BMC_TLS_ENABLED == "true" %}
-# idrac uses the same options as the redfish driver
-verify_ca = {{ env.BMC_CACERT_FILE }}
-{% endif %}
+kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes
+
+[ilo]
+kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes
+use_web_server_for_images = true

 [irmc]
-kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
-{% if env.BMC_TLS_ENABLED == "true" %}
-verify_ca = {{ env.BMC_CACERT_FILE }}
-{% endif %}
+kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes

 [service_catalog]
 endpoint_override = {{ env.IRONIC_BASE_URL }}
@@ -269,8 +237,3 @@ endpoint_override = {{ env.IRONIC_BASE_URL }}
 cert_file = {{ env.IRONIC_CERT_FILE }}
 key_file = {{ env.IRONIC_KEY_FILE }}
 {% endif %}
-
-[oci]
-{% if env.IRONIC_OCI_AUTH_CONFIG is defined %}
-authentication_config = {{ env.IRONIC_OCI_AUTH_CONFIG }}
-{% endif %}
--- a/ironic-image/prepare-efi.sh
+++ b/ironic-image/prepare-efi.sh
@@ -9,7 +9,7 @@ declare -A efi_arch=(

 for arch in "${!efi_arch[@]}"; do
  
-  DEST=/tmp/uefi_esp_${arch}.img
+  DEST=/tmp/esp-${arch}.img

  dd bs=1024 count=6400 if=/dev/zero of=$DEST
  mkfs.msdos -F 12 -n 'ESP_IMAGE' $DEST
--- a/ironic-image/scripts/auth-common.sh
+++ b/ironic-image/scripts/auth-common.sh
@@ -40,10 +40,6 @@ fi

 IRONIC_CONFIG="${IRONIC_CONF_DIR}/ironic.conf"

-if [[ -z "${IRONIC_OCI_AUTH_CONFIG:-}" ]] && [[ -f "/auth/oci.json" ]]; then
-    export IRONIC_OCI_AUTH_CONFIG="/auth/oci.json"
-fi
-
 configure_json_rpc_auth()
 {
    if [[ "${IRONIC_EXPOSE_JSON_RPC}" != "true" ]]; then
--- a/ironic-image/scripts/configure-ironic.sh
+++ b/ironic-image/scripts/configure-ironic.sh
@@ -3,7 +3,6 @@
 set -euxo pipefail

 IRONIC_EXTERNAL_IP="${IRONIC_EXTERNAL_IP:-}"
-export VMEDIA_TLS_PORT="${VMEDIA_TLS_PORT:-}"

 # Define the VLAN interfaces to be included in introspection report, e.g.
 #   all - all VLANs on all interfaces using LLDP information
@@ -18,6 +17,8 @@ export IRONIC_ENABLE_VLAN_INTERFACES=${IRONIC_ENABLE_VLAN_INTERFACES:-${IRONIC_I
 # shellcheck disable=SC1091
 . /bin/auth-common.sh

+export HTTP_PORT=${HTTP_PORT:-80}
+
 if [[ "${IRONIC_USE_MARIADB}" == true ]]; then
    if [[ -z "${MARIADB_PASSWORD:-}" ]]; then
        echo "FATAL: IRONIC_USE_MARIADB requires password, mount a secret under /auth/mariadb"
@@ -52,16 +53,12 @@ wait_for_interface_or_ip

 if [[ "$(echo "$LISTEN_ALL_INTERFACES" | tr '[:upper:]' '[:lower:]')" == "true" ]]; then
 export IRONIC_HOST_IP="::"
-elif [[ -n "${ENABLE_IPV6}" ]]; then
+elif [[ -n env.ENABLE_IPV6 ]]; then
 export IRONIC_HOST_IP="$IRONIC_IPV6"
 else
 export IRONIC_HOST_IP="$IRONIC_IP"
 fi

-if [[ "${VMEDIA_TLS_PORT}" ]]; then
-   export IRONIC_HTTPS_VMEDIA_URL="https://${IRONIC_URL_HOST}:${VMEDIA_TLS_PORT}"
-fi
-
 # Hostname to use for the current conductor instance.
 export IRONIC_CONDUCTOR_HOST=${IRONIC_CONDUCTOR_HOST:-${IRONIC_URL_HOST}}

@@ -74,41 +71,10 @@ if [[ -n "$IRONIC_EXTERNAL_IP" ]]; then
    fi
 fi

-IMAGE_CACHE_PREFIX="/shared/html/images/ironic-python-agent"
-if [[ -z "${DEPLOY_KERNEL_URL:-}" ]] && [[ -z "${DEPLOY_RAMDISK_URL:-}" ]] && \
-       [[ -f "${IMAGE_CACHE_PREFIX}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}.initramfs" ]]; then
-    export DEPLOY_KERNEL_URL="file://${IMAGE_CACHE_PREFIX}.kernel"
-    export DEPLOY_RAMDISK_URL="file://${IMAGE_CACHE_PREFIX}.initramfs"
-fi
-
-declare -A detected_arch
-for var_arch in "${!DEPLOY_KERNEL_URL_@}"; do
-    IPA_ARCH="${var_arch#DEPLOY_KERNEL_URL}"
-    detected_arch["${IPA_ARCH,,}"]=1
-done
-for file_arch in "${IMAGE_CACHE_PREFIX}"_*.kernel; do
-    if [[ -f "${file_arch}" ]]; then
-        IPA_ARCH="$(basename "${file_arch#"${IMAGE_CACHE_PREFIX}"_}" .kernel)"
-        detected_arch["${IPA_ARCH}"]=1
-    fi
-done
-
-DEPLOY_KERNEL_BY_ARCH=""
-DEPLOY_RAMDISK_BY_ARCH=""
-for IPA_ARCH in "${!detected_arch[@]}"; do
-    kernel_var="DEPLOY_KERNEL_URL_${IPA_ARCH^^}"
-    ramdisk_var="DEPLOY_RAMDISK_URL_${IPA_ARCH^^}"
-    if [[ -z "${!kernel_var:-}" ]] && [[ -z "${!ramdisk_var:-}" ]] && \
-        [[ -f "${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.initramfs" ]]; then
-      export "${kernel_var}"="file://${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.kernel"
-      export "${ramdisk_var}"="file://${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.initramfs"
-    fi
-    DEPLOY_KERNEL_BY_ARCH+="${!kernel_var:+${IPA_ARCH}:${!kernel_var},}"
-    DEPLOY_RAMDISK_BY_ARCH+="${!ramdisk_var:+${IPA_ARCH}:${!ramdisk_var},}"
-done
-if [[ -n "${DEPLOY_KERNEL_BY_ARCH}" ]] && [[ -n "${DEPLOY_RAMDISK_BY_ARCH}" ]]; then
-    export DEPLOY_KERNEL_BY_ARCH="${DEPLOY_KERNEL_BY_ARCH%?}"
-    export DEPLOY_RAMDISK_BY_ARCH="${DEPLOY_RAMDISK_BY_ARCH%?}"
+IMAGE_CACHE_PREFIX="/shared/html/images/ironic-python-agent-${DEPLOY_ARCHITECTURE}"
+if [[ -f "${IMAGE_CACHE_PREFIX}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}.initramfs" ]]; then
+    export IRONIC_DEFAULT_KERNEL="${IMAGE_CACHE_PREFIX}.kernel"
+    export IRONIC_DEFAULT_RAMDISK="${IMAGE_CACHE_PREFIX}.initramfs"
 fi

 if [[ -f "${IRONIC_CONF_DIR}/ironic.conf" ]]; then
@@ -116,20 +82,11 @@ if [[ -f "${IRONIC_CONF_DIR}/ironic.conf" ]]; then
    cp "${IRONIC_CONF_DIR}/ironic.conf" "${IRONIC_CONF_DIR}/ironic.conf.orig"
 fi

-BOOTLOADER_BY_ARCH=""
-for bootloader in /templates/uefi_esp_*.img; do
-    BOOTLOADER_ARCH="$(basename "${bootloader#/templates/uefi_esp_}" .img)"
-    BOOTLOADER_BY_ARCH+="${BOOTLOADER_ARCH}:file://${bootloader},"
-done
-export BOOTLOADER_BY_ARCH="${BOOTLOADER_BY_ARCH%?}"
-
 # oslo.config also supports Config Opts From Environment, log them to stdout
 echo 'Options set from Environment variables'
 env | grep "^OS_" || true

 mkdir -p /shared/html
-mkdir -p /shared/tmp
-mkdir -p /shared/ironic_prometheus_exporter

 if [[ -f /proc/sys/crypto/fips_enabled ]]; then
    ENABLE_FIPS_IPA=$(cat /proc/sys/crypto/fips_enabled)
--- a/ironic-image/scripts/ironic-common.sh
+++ b/ironic-image/scripts/ironic-common.sh
@@ -5,7 +5,7 @@ set -euxo pipefail
 # Export IRONIC_IP to avoid needing to lean on IRONIC_URL_HOST for consumption in
 # e.g. dnsmasq configuration
 export IRONIC_IP="${IRONIC_IP:-}"
-IRONIC_IPV6="${IRONIC_IPV6:-}"
+export IRONIC_IPV6="${IRONIC_IPV6:-}"
 PROVISIONING_INTERFACE="${PROVISIONING_INTERFACE:-}"
 PROVISIONING_IP="${PROVISIONING_IP:-}"
 PROVISIONING_MACS="${PROVISIONING_MACS:-}"
@@ -25,11 +25,6 @@ export IRONIC_GEN_CERT_DIR="${CUSTOM_DATA_DIR}/auto_gen_certs"
 export IRONIC_TMP_DATA_DIR="${CUSTOM_DATA_DIR}/tmp"
 export PROBE_CONF_DIR="${CUSTOM_CONFIG_DIR}/probes"

-export HTTP_PORT=${HTTP_PORT:-80}
-# NOTE(elfosardo): the default port for json_rpc in ironic is 8089, but
-# we need to use a different port to avoid conflicts with other services
-export IRONIC_JSON_RPC_PORT=${IRONIC_JSON_RPC_PORT:-6189}
-
 mkdir -p "${IRONIC_CONF_DIR}" "${PROBE_CONF_DIR}" "${HTTPD_CONF_DIR}" \
    "${HTTPD_CONF_DIR_D}" "${DNSMASQ_CONF_DIR}" "${DNSMASQ_TEMP_DIR}" \
    "${IRONIC_DB_DIR}" "${IRONIC_GEN_CERT_DIR}" "${DNSMASQ_DATA_DIR}" \
@@ -60,7 +55,7 @@ get_ip_of_hostname()

    local HOSTNAME=$1

-    echo $(nslookup -type=${QUERY} "${HOSTNAME}" | tail -n2 | grep -w "Address:" | cut -d " " -f2)
+    echo "$(nslookup -type=${QUERY} $HOSTNAME | tail -n2 | grep -w "Address:" | cut -d " " -f2)"
 }

 get_interface_of_ip()
@@ -90,7 +85,7 @@ get_interface_of_ip()
    # For IPv6 addresses, this will give the short-form address
    IP_ADDR="$(ipcalc "${IP_ADDR}" | grep "^Address:" | awk '{print $2}')"

-    echo $(ip ${IP_VERS} -br addr show scope global | grep -i " ${IP_ADDR}/" | cut -f 1 -d ' ' | cut -f 1 -d '@')
+    echo "$(ip $IP_VERS -br addr show scope global | grep -i " ${IP_ADDR}/" | cut -f 1 -d ' ' | cut -f 1 -d '@')"
 }

 get_ip_of_interface()
@@ -116,7 +111,7 @@ get_ip_of_interface()

    local IFACE=$1

-    echo $(ip ${IP_VERS} -br addr show scope global up dev ${IFACE} | awk '{print $3}' | sed -e 's%/.*%%' | head -n 1)
+    echo "$(ip $IP_VERS -br addr show scope global up dev $IFACE | awk '{print $3}' | sed -e 's%/.*%%' | head -n 1)"
 }

 get_provisioning_interface()
@@ -155,7 +150,7 @@ wait_for_interface_or_ip()

        until [[ -n "$IFACE_OF_IP" ]]; do
            echo "Waiting for ${PROVISIONING_IP} to be configured on an interface..."
-            IFACE_OF_IP="$(get_interface_of_ip "${PROVISIONING_IP}")"
+            IFACE_OF_IP="$(get_interface_of_ip $PROVISIONING_IP)"
            sleep 1
        done

@@ -165,33 +160,25 @@ wait_for_interface_or_ip()
 	# If the IP contains a colon, then it's an IPv6 address
        if [[ "$PROVISIONING_IP" =~ .*:.* ]]; then
            export IRONIC_IPV6="$PROVISIONING_IP"
-            export IRONIC_IP=""
        else
            export IRONIC_IP="$PROVISIONING_IP"
        fi
-    elif [[ -n "${IRONIC_IP}" ]]; then
-        if [[ "$IRONIC_IP" =~ .*:.* ]]; then
-            export IRONIC_IPV6="$IRONIC_IP"
-            export IRONIC_IP=""
-        fi
    elif [[ -n "${PROVISIONING_INTERFACE}" ]]; then
        until [[ -n "$IRONIC_IPV6" ]] || [[ -n "$IRONIC_IP" ]]; do
            echo "Waiting for ${PROVISIONING_INTERFACE} interface to be configured..."

-            IRONIC_IPV6="$(get_ip_of_interface "${PROVISIONING_INTERFACE}" 6)"
+            export IRONIC_IPV6="$(get_ip_of_interface $PROVISIONING_INTERFACE 6)"
            sleep 1

-            IRONIC_IP="$(get_ip_of_interface "${PROVISIONING_INTERFACE}" 4)"
+            export IRONIC_IP="$(get_ip_of_interface $PROVISIONING_INTERFACE 4)"
            sleep 1
        done

        if [[ -n "$IRONIC_IPV6" ]]; then
            echo "Found $IRONIC_IPV6 on interface \"${PROVISIONING_INTERFACE}\"!"
-	    export IRONIC_IPV6
        fi
        if [[ -n "$IRONIC_IP" ]]; then
            echo "Found $IRONIC_IP on interface \"${PROVISIONING_INTERFACE}\"!"
-	    export IRONIC_IP
        fi
    elif [[ -n "$IRONIC_URL_HOSTNAME" ]]; then
        local IPV6_IFACE=""
@@ -202,21 +189,21 @@ wait_for_interface_or_ip()
            local IPV6_RECORD=""
            local IPV4_RECORD=""

-            IPV6_RECORD="$(get_ip_of_hostname "${IRONIC_URL_HOSTNAME}" 6)"
-            IPV4_RECORD="$(get_ip_of_hostname "${IRONIC_URL_HOSTNAME}" 4)"
+            IPV6_RECORD="$(get_ip_of_hostname $IRONIC_URL_HOSTNAME 6)"
+            IPV4_RECORD="$(get_ip_of_hostname $IRONIC_URL_HOSTNAME 4)"

            # We couldn't get any IP
            if [[ -z "$IPV4_RECORD" ]] && [[ -z "$IPV6_RECORD" ]]; then
-                echo "${FUNCNAME}: no valid IP found for hostname ${IRONIC_URL_HOSTNAME}" >&2
+                echo "${FUNCNAME}: no valid IP found for hostname $IRONIC_URL_HOSTNAME" >&2
                return 1
            fi

            echo "Waiting for ${IPV6_RECORD} to be configured on an interface"
-            IPV6_IFACE="$(get_interface_of_ip "${IPV6_RECORD}" 6)"
+            IPV6_IFACE="$(get_interface_of_ip $IPV6_RECORD 6)"
            sleep 1

            echo "Waiting for ${IPV4_RECORD} to be configured on an interface"
-            IPV4_IFACE="$(get_interface_of_ip "${IPV4_RECORD}" 4)"
+            IPV4_IFACE="$(get_interface_of_ip $IPV4_RECORD 4)"
            sleep 1
        done

@@ -249,7 +236,7 @@ wait_for_interface_or_ip()
    fi
    if [[ -n "$IRONIC_IPV6" ]]; then
        export ENABLE_IPV6=yes
-        export IRONIC_URL_HOST="[${IRONIC_IPV6}]" # The HTTP host needs surrounding with brackets
+        export IRONIC_URL_HOST="[$IRONIC_IPV6]" # The HTTP host needs surrounding with brackets
    fi

    # Once determined if we have IPv4 and/or IPv6, override the hostname if provided
@@ -267,7 +254,7 @@ wait_for_interface_or_ip()

 render_j2_config()
 {
-    python3.13 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$1" > "$2"
+    python3.11 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$1" > "$2"
 }

 run_ironic_dbsync()
--- a/ironic-image/scripts/rundnsmasq
+++ b/ironic-image/scripts/rundnsmasq
@@ -7,6 +7,7 @@ set -eux
 # shellcheck disable=SC1091
 . /bin/tls-common.sh

+export HTTP_PORT=${HTTP_PORT:-80}
 DNSMASQ_EXCEPT_INTERFACE=${DNSMASQ_EXCEPT_INTERFACE:-lo}
 export DNS_PORT=${DNS_PORT:-0}

@@ -35,7 +36,7 @@ fi
 # Template and write dnsmasq.conf
 # we template via /tmp as sed otherwise creates temp files in /etc directory
 # where we can't write
-python3.13 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' <"/templates/dnsmasq.conf.j2" >"${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"
+python3.11 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' <"/tmp/dnsmasq.conf.j2" >"${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"

 for iface in $(echo "$DNSMASQ_EXCEPT_INTERFACE" | tr ',' ' '); do
    sed -i -e "/^interface=.*/ a\except-interface=${iface}" "${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"
--- a/ironic-image/scripts/runhttpd
+++ b/ironic-image/scripts/runhttpd
@@ -5,6 +5,7 @@
 . /bin/ironic-common.sh
 . /bin/auth-common.sh

+export HTTP_PORT=${HTTP_PORT:-80}
 export VMEDIA_TLS_PORT=${VMEDIA_TLS_PORT:-8083}

 export IRONIC_REVERSE_PROXY_SETUP=${IRONIC_REVERSE_PROXY_SETUP:-false}
@@ -35,7 +36,8 @@ fi
 export INSPECTOR_EXTRA_ARGS

 # Copy files to shared mount
-render_j2_config /templates/inspector.ipxe.j2 /shared/html/inspector.ipxe
+render_j2_config /tmp/inspector.ipxe.j2 /shared/html/inspector.ipxe
+cp /tmp/uefi_esp*.img /shared/html/
 # cp -r /etc/httpd/* "${HTTPD_DIR}"
 if [[ -f "${HTTPD_CONF_DIR}/httpd.conf" ]]; then
    mv "${HTTPD_CONF_DIR}/httpd.conf" "${HTTPD_CONF_DIR}/httpd.conf.example"
@@ -47,7 +49,7 @@ render_j2_config "/etc/httpd/conf/httpd.conf.j2" \

 if [[ "$IRONIC_TLS_SETUP" == "true" ]]; then
    if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "true" ]]; then
-        render_j2_config "/templates/httpd-ironic-api.conf.j2" \
+        render_j2_config "/tmp/httpd-ironic-api.conf.j2" \
            "${HTTPD_CONF_DIR_D}/ironic.conf"
    fi
 else
@@ -58,7 +60,7 @@ write_htpasswd_files

 # Render httpd TLS configuration for /shared/html/<redifsh;ilo>
 if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]]; then
-    render_j2_config "/templates/httpd-vmedia.conf.j2" \
+    render_j2_config "/tmp/httpd-vmedia.conf.j2" \
        "${HTTPD_CONF_DIR_D}/vmedia.conf"
 fi

@@ -66,7 +68,7 @@ fi
 if [[ "$IPXE_TLS_SETUP" == "true" ]]; then
    mkdir -p /shared/html/custom-ipxe
    chmod 0777 /shared/html/custom-ipxe
-    render_j2_config "/templates/httpd-ipxe.conf.j2" "${HTTPD_CONF_DIR_D}/ipxe.conf"
+    render_j2_config "/tmp/httpd-ipxe.conf.j2" "${HTTPD_CONF_DIR_D}/ipxe.conf"
    cp "${IPXE_CUSTOM_FIRMWARE_DIR}/undionly.kpxe" \
       "${IPXE_CUSTOM_FIRMWARE_DIR}/snponly.efi" \
       "/shared/html/custom-ipxe"
--- a/ironic-image/scripts/runironic
+++ b/ironic-image/scripts/runironic
@@ -15,13 +15,4 @@ configure_restart_on_certificate_update "${IRONIC_TLS_SETUP}" ironic "${IRONIC_C

 configure_ironic_auth

-if [[ -d "${BMC_CACERTS_PATH}" ]]; then
-    # shellcheck disable=SC2034
-    watchmedo shell-command \
-        --patterns="*" \
-        --ignore-directories \
-        --command='cat "${BMC_CACERTS_PATH}"/* > "${BMC_CACERT_FILE}"' \
-        "${BMC_CACERTS_PATH}" &
-fi
-
 exec /usr/bin/ironic --config-dir "${IRONIC_CONF_DIR}"
--- a/ironic-image/scripts/runironic-exporter
+++ b/ironic-image/scripts/runironic-exporter
@@ -1,20 +0,0 @@
-#!/usr/bin/bash
-
-# Set dummy provisioning IP to avoid interface detection issues (not needed to run IPE to service `/metrics`)
-export PROVISIONING_IP="127.0.0.1"
-# Set to true since running this script implies sensor data metrics are needed
-# ironic-prometheus-exporter (IPE) needs to read from oslo_messaging_notifications.location (i.e content under /shared) where Ironic writes to
-export SEND_SENSOR_DATA=true
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-
-FLASK_RUN_HOST=${FLASK_RUN_HOST:-0.0.0.0}
-FLASK_RUN_PORT=${FLASK_RUN_PORT:-9608}
-
-export IRONIC_CONFIG="${IRONIC_CONF_DIR}/ironic.conf"
-
-exec gunicorn -b "${FLASK_RUN_HOST}:${FLASK_RUN_PORT}" -w 4 \
-    ironic_prometheus_exporter.app.wsgi:application
--- a/ironic-image/scripts/runlogwatch.sh
+++ b/ironic-image/scripts/runlogwatch.sh
@@ -1,32 +1,17 @@
 #!/usr/bin/bash

 # Ramdisk logs path
-export LOG_DIR="/shared/log/ironic/deploy"
+LOG_DIR="/shared/log/ironic/deploy"

 mkdir -p "${LOG_DIR}"

-# Function to process log files
-process_log_file() {
-    local FILEPATH="$1"
-    # shellcheck disable=SC2155
-    local FILENAME=$(basename "${FILEPATH}")
-
-    echo "************ Contents of ${LOG_DIR}/${FILENAME} ramdisk log file bundle **************"
-    tar -tzf "${FILEPATH}" | while read -r entry; do
-        echo "${FILENAME}: **** Entry: ${entry} ****"
-        tar -xOzf "${FILEPATH}" "${entry}" | sed -e "s/^/${FILENAME}: /"
-        echo
+# shellcheck disable=SC2034
+python3.11 -m pyinotify --raw-format -e IN_CLOSE_WRITE -v "${LOG_DIR}" |
+    while read -r event dir mask maskname filename filepath pathname wd; do
+        #NOTE(elfosardo): a pyinotify event looks like this:
+        # <Event dir=False mask=0x8 maskname=IN_CLOSE_WRITE name=mylogs.gzip path=/shared/log/ironic/deploy pathname=/shared/log/ironic/deploy/mylogs.gzip wd=1 >
+        FILENAME=$(echo "${filename}" | cut -d'=' -f2-)
+        echo "************ Contents of ${LOG_DIR}/${FILENAME} ramdisk log file bundle **************"
+        tar -xOzvvf "${LOG_DIR}/${FILENAME}" | sed -e "s/^/${FILENAME}: /"
+        rm -f "${LOG_DIR}/${FILENAME}"
    done
-    rm -f "${FILEPATH}"
-}
-
-# Export the function so watchmedo can use it
-export -f process_log_file
-
-# Use watchmedo to monitor for file close events
-# shellcheck disable=SC2016
-watchmedo shell-command \
-    --patterns="*" \
-    --ignore-directories \
-    --command='if [[ "${watch_event_type}" == "closed" ]]; then process_log_file "${watch_src_path}"; fi' \
-    "${LOG_DIR}"
--- a/ironic-image/scripts/tls-common.sh
+++ b/ironic-image/scripts/tls-common.sh
@@ -1,14 +1,13 @@
 #!/bin/bash

+export IRONIC_CERT_FILE=/certs/ironic/tls.crt
+export IRONIC_KEY_FILE=/certs/ironic/tls.key
+export IRONIC_CACERT_FILE=/certs/ca/ironic/tls.crt
 export IRONIC_INSECURE=${IRONIC_INSECURE:-false}
 export IRONIC_SSL_PROTOCOL=${IRONIC_SSL_PROTOCOL:-"-ALL +TLSv1.2 +TLSv1.3"}
 export IPXE_SSL_PROTOCOL=${IPXE_SSL_PROTOCOL:-"-ALL +TLSv1.2 +TLSv1.3"}
 export IRONIC_VMEDIA_SSL_PROTOCOL=${IRONIC_VMEDIA_SSL_PROTOCOL:-"ALL"}

-# Node image storage is using the same cert and port as the API
-export IRONIC_CERT_FILE=/certs/ironic/tls.crt
-export IRONIC_KEY_FILE=/certs/ironic/tls.key
-
 export IRONIC_VMEDIA_CERT_FILE=/certs/vmedia/tls.crt
 export IRONIC_VMEDIA_KEY_FILE=/certs/vmedia/tls.key

@@ -17,15 +16,15 @@ export IPXE_KEY_FILE=/certs/ipxe/tls.key

 export RESTART_CONTAINER_CERTIFICATE_UPDATED=${RESTART_CONTAINER_CERTIFICATE_UPDATED:-"false"}

-# By default every cert has to be signed with Ironic's
-# CA otherwise node image and IPA verification would fail
 export MARIADB_CACERT_FILE=/certs/ca/mariadb/tls.crt
-export BMC_CACERTS_PATH=/certs/ca/bmc
-export BMC_CACERT_FILE=/conf/bmc-tls.pem
-export IRONIC_CACERT_FILE=/certs/ca/ironic/tls.crt

 export IPXE_TLS_PORT="${IPXE_TLS_PORT:-8084}"

+mkdir -p /certs/ironic
+mkdir -p /certs/ca/ironic
+mkdir -p /certs/ipxe
+mkdir -p /certs/vmedia
+
 if [[ -f "$IRONIC_CERT_FILE" ]] && [[ ! -f "$IRONIC_KEY_FILE" ]]; then
    echo "Missing TLS Certificate key file $IRONIC_KEY_FILE"
    exit 1
@@ -70,7 +69,6 @@ if [[ -f "$IRONIC_CERT_FILE" ]] || [[ -f "$IRONIC_CACERT_FILE" ]]; then
    export IRONIC_TLS_SETUP="true"
    export IRONIC_SCHEME="https"
    if [[ ! -f "$IRONIC_CACERT_FILE" ]]; then
-        mkdir -p "$(dirname "${IRONIC_CACERT_FILE}")"
        copy_atomic "$IRONIC_CERT_FILE" "$IRONIC_CACERT_FILE"
    fi
 else
@@ -107,23 +105,11 @@ configure_restart_on_certificate_update()

    if [[ "${enabled}" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
        if [[ "${service}" == httpd ]]; then
-            # shellcheck disable=SC2034
            signal="WINCH"
        fi
-
-        # Use watchmedo to monitor certificate file deletion
-        # shellcheck disable=SC2016
-        watchmedo shell-command \
-            --patterns="$(basename "${cert_file}")" \
-            --ignore-directories \
-            --command='if [[ "${watch_event_type}" == "deleted" ]]; then pkill -'"${signal}"' '"${service}"'; fi' \
-            "$(dirname "${cert_file}")" &
+        python3 -m pyinotify --raw-format -e IN_DELETE_SELF -v "${cert_file}" |
+            while read -r; do
+                pkill "-${signal}" "${service}"
+            done &
    fi
 }
-
-if [ -d "${BMC_CACERTS_PATH}" ]; then
-    export BMC_TLS_ENABLED="true"
-    cat "${BMC_CACERTS_PATH}"/* > "${BMC_CACERT_FILE}"
-else
-    export BMC_TLS_ENABLED="false"
-fi
--- a/ironic-ipa-downloader-image/Dockerfile
+++ b/ironic-ipa-downloader-image/Dockerfile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.8
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -9,6 +9,8 @@ COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
 RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 ironic-ipa-ramdisk-aarch64 tar gawk curl xz zstd shadow cpio findutils

+RUN cp /usr/bin/getopt /installroot/
+
 FROM micro AS final

 # Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -16,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -30,6 +32,7 @@ LABEL com.suse.release-stage="released"
 # endlabelprefix

 COPY --from=base /installroot /
+RUN cp /getopt /usr/bin/
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/
--- a/ironic-ipa-downloader-image/Dockerfile.aarch64
+++ b/ironic-ipa-downloader-image/Dockerfile.aarch64
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.10-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.8
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -9,6 +9,8 @@ COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
 RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-aarch64 tar gawk curl xz zstd shadow cpio findutils

+RUN cp /usr/bin/getopt /installroot/
+
 FROM micro AS final

 # Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -16,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -30,6 +32,7 @@ LABEL com.suse.release-stage="released"
 # endlabelprefix

 COPY --from=base /installroot /
+RUN cp /getopt /usr/bin/
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/
--- a/ironic-ipa-downloader-image/Dockerfile.x86_64
+++ b/ironic-ipa-downloader-image/Dockerfile.x86_64
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.10-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.8
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -9,6 +9,8 @@ COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
 RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 tar gawk curl xz zstd shadow cpio findutils

+RUN cp /usr/bin/getopt /installroot/
+
 FROM micro AS final

 # Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -16,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -30,6 +32,7 @@ LABEL com.suse.release-stage="released"
 # endlabelprefix

 COPY --from=base /installroot /
+RUN cp /getopt /usr/bin/
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/
--- a/ironic-ipa-downloader-image/get-resource.sh
+++ b/ironic-ipa-downloader-image/get-resource.sh
@@ -29,12 +29,13 @@ if [ -z "${IPA_BASEURI}" ]; then
  # SLES BASED IPA - ironic-ipa-ramdisk-x86_64 and ironic-ipa-ramdisk-aarch64 packages
  mkdir -p /shared/html/images
  if [ -f ${IMAGES_BASE_PATH}/initrd-x86_64.zst ]; then
-    cp ${IMAGES_BASE_PATH}/initrd-x86_64.zst /shared/html/images/ironic-python-agent_x86_64.initramfs
-    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent_x86_64.kernel
+    cp ${IMAGES_BASE_PATH}/initrd-x86_64.zst /shared/html/images/ironic-python-agent-x86_64.initramfs
+    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent-x86_64.kernel
  fi
+  # Use arm64 as destination for iPXE compatibility
  if [ -f ${IMAGES_BASE_PATH}/initrd-aarch64.zst ]; then
-    cp ${IMAGES_BASE_PATH}/initrd-aarch64.zst /shared/html/images/ironic-python-agent_aarch64.initramfs
-    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent_aarch64.kernel
+    cp ${IMAGES_BASE_PATH}/initrd-aarch64.zst /shared/html/images/ironic-python-agent-arm64.initramfs
+    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent-arm64.kernel
  fi

  cp /tmp/images.sha256 /shared/images.sha256
@@ -86,8 +87,8 @@ else
      chmod 755 "$TMPDIR"
      mv "$TMPDIR" "$FILENAME-$ETAG"
      ln -sf "$FILENAME-$ETAG/$FFILENAME.headers" "$FFILENAME.headers"
-      ln -sf "$FILENAME-$ETAG/$FILENAME.initramfs" "${FILENAME}_${ARCH,,}.initramfs"
-      ln -sf "$FILENAME-$ETAG/$FILENAME.kernel" "${FILENAME}_${ARCH,,}.kernel"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.initramfs" "$FILENAME-${ARCH,,}.initramfs"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.kernel" "$FILENAME-${ARCH,,}.kernel"
      
      IMAGE_CHANGED=1
  else
@@ -99,7 +100,7 @@ if [ "${CERTS_CHANGED:-0}" = "1" ] || [ "${IMAGE_CHANGED:-0}" = "1" ]; then
  mkdir -p /tmp/ca/tmp-initrd && cd /tmp/ca/tmp-initrd
  mkdir -p etc/ironic-python-agent.d/ca-certs
  cp /tmp/ironic-certificates/* etc/ironic-python-agent.d/ca-certs/
-  for initramfs in /shared/html/images/ironic-python-agent_*.initramfs; do
+  for initramfs in /shared/html/images/ironic-python-agent-*.initramfs; do
    find . | cpio -o -H newc --reproducible | zstd -c >> "${initramfs}"
  done
  cp /tmp/certificates.sha256 /shared/certificates.sha256
--- a/ironic-ipa-ramdisk/config.sh
+++ b/ironic-ipa-ramdisk/config.sh
@@ -16,7 +16,7 @@ baseSetupBuildDay
 #==========================================
 # remove unneded kernel files
 #------------------------------------------
-#suseStripKernel
+suseStripKernel
 baseStripLocales en_US.utf-8 C.utf8

 #======================================
--- a/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
+++ b/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
@@ -28,6 +28,68 @@
      <source path="dir:///.build.binaries"/>
    </repository>

+    <drivers>
+        <file name="crypto/*"/>
+        <file name="drivers/acpi/*"/>
+        <file name="drivers/acpi/dock.ko"/>
+        <file name="drivers/ata/*"/>
+        <file name="drivers/block/brd.ko"/>
+        <file name="drivers/block/cciss.ko"/>
+        <file name="drivers/block/loop.ko"/>
+        <file name="drivers/block/virtio_blk.ko"/>
+        <file name="drivers/cdrom/*"/>
+        <file name="drivers/char/hw_random/virtio-rng.ko"/>
+        <file name="drivers/char/lp.ko"/>
+        <file name="drivers/char/ipmi/*"/>
+        <file name="drivers/firmware/iscsi_ibft.ko"/>
+        <file name="drivers/firmware/edd.ko"/>
+        <file name="drivers/gpu/drm/*"/>
+        <file name="drivers/hid/*"/>
+        <file name="drivers/hv/*"/>
+        <file name="drivers/hwmon/*"/>
+        <file name="drivers/ide/*"/>
+        <file name="drivers/input/keyboard/*"/>
+        <file name="drivers/input/mouse/*"/>
+        <file name="drivers/md/*"/>
+        <file name="drivers/message/fusion/*"/>
+        <file name="drivers/misc/hpilo.ko"/>
+        <file name="drivers/net/*"/>
+        <file name="drivers/parport/*"/>
+        <file name="drivers/scsi/*"/>
+        <file name="drivers/staging/hv/*"/>
+        <file name="drivers/target/*"/>
+        <file name="drivers/thermal/*"/>
+        <file name="drivers/usb/*"/>
+        <file name="drivers/virtio/*"/>
+        <file name="fs/binfmt_aout.ko"/>
+        <file name="fs/binfmt_misc.ko"/>
+        <file name="fs/overlayfs/*"/>
+        <file name="fs/btrfs/*"/>
+        <file name="fs/exportfs/*"/>
+        <file name="fs/ext4/*"/>
+        <file name="fs/fat/*"/>
+        <file name="fs/fuse/*"/>
+        <file name="fs/hfs/*"/>
+        <file name="fs/jbd2/*"/>
+        <file name="fs/nfs/*"/>
+        <file name="fs/mbcache.ko"/>
+        <file name="fs/nls/nls_cp437.ko"/>
+        <file name="fs/nls/nls_iso8859-1.ko"/>
+        <file name="fs/nls/nls_utf8.ko"/>
+        <file name="fs/quota_v1.ko"/>
+        <file name="fs/quota_v2.ko"/>
+        <file name="fs/squashfs/*"/>
+        <file name="fs/udf/*"/>
+        <file name="fs/vfat/*"/>
+        <file name="fs/xfs/*"/>
+        <file name="fs/isofs/*"/>
+        <file name="lib/crc-t10dif.ko"/>
+        <file name="lib/crc16.ko"/>
+        <file name="lib/libcrc32c.ko"/>
+        <file name="lib/zlib_deflate/zlib_deflate.ko"/>
+        <file name="net/packet/*"/>
+    </drivers>
+
    <packages type="delete">
        <package name="gpg2"/>
        <package name="libcairo2"/>
@@ -76,7 +138,6 @@
        <package name="grub2-i386-pc" arch="x86_64"/>
        <package name="grub2-x86_64-efi" arch="x86_64"/>
        <package name="grub2"/>
-        <package name="gettext-runtime"/>
        <package name="iproute2"/>
        <package name="iputils"/>
        <package name="kernel-default"/>
@@ -88,7 +149,6 @@
        <package name="timezone"/>
        <package name="which"/>
        <!-- ironic-python-agent specific -->
-        <package name="chrony"/>
        <package name="dmidecode"/>
        <package name="efibootmgr"/>
        <package name="gptfdisk"/>
@@ -97,14 +157,15 @@
        <package name="ipmitool"/>
        <package name="iputils"/>
        <package name="kbd"/>
-        <package name="krb5"/>
        <package name="lshw"/>
        <package name="lvm2"/>
        <package name="net-tools"/>
+        <package name="ntp"/>
        <package name="open-iscsi"/>
        <package name="openstack-ironic-python-agent"/>
        <package name="parted"/>
        <package name="psmisc"/>
+        <package name="python311-proliantutils"/>
        <package name="qemu-tools"/>
        <package name="timezone"/>
        <package name="which"/>
--- a/ironic-ipa-ramdisk/ironic-ipa-ramdisk.spec
+++ b/ironic-ipa-ramdisk/ironic-ipa-ramdisk.spec
@@ -19,7 +19,7 @@


 Name:           ironic-ipa-ramdisk
-Version:        3.0.8
+Version:        3.0.7
 Release:        0
 Summary:        Kernel and ramdisk image for OpenStack Ironic
 License:        SUSE-EULA
@@ -29,12 +29,12 @@ Source0:        config.sh
 Source10:       ironic-ipa-ramdisk.kiwi
 Source20:       root

-#!BuildIgnore:  systemd-mini
-BuildRequires: systemd
 BuildRequires:  -post-build-checks
 BuildRequires:  bash
 BuildRequires:  kiwi
+BuildRequires:  kiwi-tools
 BuildRequires:  zypper
+BuildArch:      noarch

 BuildRequires:  checkmedia
 BuildRequires:  acl
@@ -55,6 +55,7 @@ BuildRequires:  grub2-x86_64-efi
 %ifarch aarch64
 BuildRequires:  grub2-arm64-efi
 %endif
+BuildRequires:  haveged
 BuildRequires:  hdparm
 BuildRequires:  hwinfo
 BuildRequires:  ipmitool
@@ -64,7 +65,7 @@ BuildRequires:  kernel-default
 BuildRequires:  kernel-firmware-all
 BuildRequires:  lvm2
 BuildRequires:  net-tools
-BuildRequires:  chrony
+BuildRequires:  ntp
 BuildRequires:  open-iscsi
 BuildRequires:  openssh
 BuildRequires:  openstack-ironic-python-agent
@@ -76,6 +77,7 @@ BuildRequires:  pkgconfig
 BuildRequires:  Mesa-gallium
 BuildRequires:  plymouth
 BuildRequires:  plymouth-scripts
+BuildRequires:  python311-proliantutils
 BuildRequires:  psmisc
 BuildRequires:  qemu-tools
 BuildRequires:  sg3_utils
@@ -103,9 +105,6 @@ BuildRequires:  lshw
 BuildRequires:  kbd
 BuildRequires:  dmidecode
 BuildRequires:  efibootmgr
-BuildRequires:  glibc-locale
-BuildRequires:  krb5
-BuildRequires:  gettext-runtime
 %ifarch x86_64
 BuildRequires:  syslinux
 %endif
@@ -114,9 +113,10 @@ BuildRequires:  syslinux
 Kernel and ramdisk image for use with Metal3

 %package %{_arch}
-BuildArch:      noarch
 Summary:        Kernel and ramdisk image for Metal3
 Group:          System/Management
+Provides:       openstack-ironic-python-agent = %{version}
+Obsoletes:      openstack-ironic-python-agent < %{version}

 %description %{_arch}
 Kernel and ramdisk image for use with Metal3
--- a/kiwi-builder-image/Dockerfile
+++ b/kiwi-builder-image/Dockerfile
@@ -1,8 +1,8 @@
-#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.2.29.1-%RELEASE%
-#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.2.29.1
+#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.2.12.0-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.2.12.0

 # Base image version, should match the tag above
-ARG KIWIVERSION="10.2.29"
+ARG KIWIVERSION="10.2.12"
 FROM registry.suse.com/bci/kiwi:${KIWIVERSION}
 ARG KIWIVERSION

@@ -33,6 +33,4 @@ RUN mkdir -p /micro-sdk/defs
 ADD SL-Micro.kiwi /micro-sdk/defs
 ADD SL-Micro.kiwi.4096 /micro-sdk/defs
 ADD config.sh /micro-sdk/defs
-ADD disk.sh /micro-sdk/defs
 ADD editbootinstall_rpi.sh /micro-sdk/defs
-ADD editbootinstall_pine64.sh /micro-sdk/defs
--- a/kiwi-builder-image/README.build.md
+++ b/kiwi-builder-image/README.build.md
@@ -1,28 +0,0 @@
-The following files are coming from _upstream_ https://build.opensuse.org/package/show/SUSE:SLFO:Products:SL-Micro:6.2/SL-Micro :
-
-* SL-Micro.kiwi
-* disk.sh
-* config.sh
-* editbootinstall_pine64.sh
-* editbootinstall_rpi.sh
-
-Those can be downloaded as:
-
-```
-curl -LO https://src.suse.de/products/SL-Micro/raw/branch/6.2/SL-Micro/SL-Micro.kiwi
-```
-
-The SL-Micro.kiwi file needs to be modified to append a few packages on the bootstrap stanza to be able to generate images with no SSL errors:
-
-```
-     <packages type="bootstrap">
-         <package name="filesystem"/>
-+        <package name="coreutils"/>
-+        <package name="ca-certificates"/>
-+        <package name="ca-certificates-mozilla"/>
-     </packages>
-```
-
-The SL-Micro.kiwi.4096 file needs to be modified to modify the `target_blocksize="4096"` where appropiate.
-
-All the other files are used verbatim.
--- a/kiwi-builder-image/SL-Micro.kiwi
+++ b/kiwi-builder-image/SL-Micro.kiwi
@@ -30,13 +30,16 @@
        <profile name="x86-self_install" description="Raw disk for x86_64 - uEFI" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="aarch64" description="Raw disk for aarch64 - uEFI" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
        <profile name="aarch64-self_install" description="Raw disk for aarch64" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
        <profile name="aarch64-rt" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
-        <profile name="aarch64-rt-encrypted" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+        <profile name="aarch64-rt-rpi" description="Raw disk for aarch64 with RT kernel on Raspberry Pi" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
        <profile name="aarch64-rt-self_install" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
@@ -57,15 +60,6 @@
        <profile name="rpi" description="Raw disk for Raspberry Pi" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
-        <profile name="rpi-self_install" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-        <profile name="aarch64" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-        <profile name="aarch64-encrypted" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
        <profile name="x86-qcow" description="qcow2 for x86_64 - uEFI" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
@@ -95,15 +89,6 @@
        </profile>
        <profile name="ppc64le-4096ss-self_install" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
            <requires profile="bootloader"/>
-        </profile> 
-       	<profile name="aarch64-64kb" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-       	<profile name="aarch64-64kb-encrypted" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-       	<profile name="aarch64-64kb-self_install" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
        </profile>
        <!-- Images (flavor + platform) -->
        <profile name="Default" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="x86_64">
@@ -169,10 +154,18 @@
            <requires profile="full"/>
            <requires profile="aarch64"/>
        </profile>
+        <profile name="Default-RPi" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="aarch64">
+            <requires profile="full"/>
+            <requires profile="rpi"/>
+        </profile>
        <profile name="Base" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
            <requires profile="container-host"/>
            <requires profile="aarch64"/>
        </profile>
+        <profile name="Base-RPi" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="rpi"/>
+        </profile>
        <profile name="Base-RT" description="SL Micro with Podman as raw image with uEFI boot" arch="x86_64">
            <requires profile="container-host"/>
            <requires profile="x86-rt"/>
@@ -186,6 +179,10 @@
            <requires profile="container-host"/>
            <requires profile="aarch64-rt"/>
        </profile>
+        <profile name="Base-RT-RPi" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt-rpi"/>
+        </profile>
        <profile name="Base-RT-SelfInstall" description="SL Micro with Podman as raw image with uEFI boot - SelfInstall" arch="aarch64">
            <requires profile="container-host"/>
            <requires profile="aarch64-rt-self_install"/>
@@ -280,42 +277,10 @@
            <requires profile="ppc64le-4096ss-self_install"/>
            <requires profile="self_install"/>
        </profile>
-	<profile name="Default-64kb-SelfInstall" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb-self_install"/>
-        </profile>
-	<profile name="Base-64kb-SelfInstall" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb-self_install"/>
-        </profile>
-	<profile name="Default-64kb" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb"/>
-        </profile>
-	<profile name="Base-64kb" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb"/>
-        </profile>
-	<profile name="Default-64kb-encrypted" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb-encrypted"/>
-        </profile>
-	<profile name="Base-64kb-encrypted" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb-encrypted"/>
-        </profile>
-	<profile name="RaspberryPi-SelfInstall" description="SL Micro for Rapsberry Pi" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="rpi-self_install"/>
-        </profile>
-	<profile name="RaspberryPi" description="SL Micro for Raspberry Pi" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="rpi"/>
-        </profile>
    </profiles>

    <preferences profiles="x86-encrypted,x86-rt-encrypted">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -326,8 +291,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 rd.kiwi.oem.luks.reencrypt rd.kiwi.oem.luks.reencrypt_randompass quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -359,7 +323,7 @@
        </type>
    </preferences>
    <preferences profiles="x86,x86-rt">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -370,8 +334,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -396,7 +359,7 @@
    </preferences>

    <preferences profiles="x86-self_install,x86-rt-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -411,8 +374,7 @@
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -435,8 +397,9 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64,aarch64-rt,aarch64-64kb">
-        <version>6.2</version>
+
+    <preferences profiles="rpi,aarch64-rt-rpi">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -451,96 +414,11 @@
            install_continue_on_timeout="false"
            fsmountoptions="noatime"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1"
-            bootpartition="false"
-            devicepersistency="by-uuid"
-            btrfs_root_is_snapshot="true"
-            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="false"
-            disk_start_sector="8192"
-        >
-            <bootloader name="grub2" console="gfxterm" timeout="3" />
-            <systemdisk>
-                <volume name="home"/>
-                <volume name="root"/>
-                <!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
-                <volume name="opt"/>
-                <volume name="srv"/>
-                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
-                <volume name="boot/writable"/>
-                <volume name="usr/local"/>
-                <volume name="var" copy_on_write="false"/>
-            </systemdisk>
-        </type>
-    </preferences>
-    <preferences profiles="aarch64-encrypted,aarch64-rt-encrypted,aarch64-64kb-encrypted">
-        <version>6.2</version>
-        <packagemanager>zypper</packagemanager>
-        <bootsplash-theme>SLE</bootsplash-theme>
-        <bootloader-theme>SLE</bootloader-theme>
-        <rpm-excludedocs>true</rpm-excludedocs>
-        <locale>en_US</locale>
-        <type
-            image="oem"
-            initrd_system="dracut"
-            installiso="true"
-            filesystem="btrfs"
-            installboot="install"
-            install_continue_on_timeout="false"
-            fsmountoptions="noatime"
-            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 rd.kiwi.oem.luks.reencrypt rd.kiwi.oem.luks.reencrypt_randompass quiet systemd.show_status=1"
-            bootpartition="false"
-            devicepersistency="by-uuid"
-            btrfs_root_is_snapshot="true"
-            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="false"
-            disk_start_sector="8192"
-            luks_version="luks2"
-            luks="1234"
-	    luks_randomize="false"
-	    luks_pbkdf="pbkdf2"
-        >
-            <luksformat>
-                <option name="--cipher" value="aes-xts-plain64"/>
-            </luksformat>
-            <bootloader name="grub2" console="gfxterm" use_disk_password="true" timeout="3" />
-            <systemdisk>
-                <volume name="home"/>
-                <volume name="root"/>
-                <!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
-                <volume name="opt"/>
-                <volume name="srv"/>
-                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
-                <volume name="boot/writable"/>
-                <volume name="usr/local"/>
-                <volume name="var" copy_on_write="false"/>
-            </systemdisk>
-        </type>
-    </preferences>
-    <preferences profiles="rpi">
-        <version>6.2</version>
-        <packagemanager>zypper</packagemanager>
-        <bootsplash-theme>SLE</bootsplash-theme>
-        <bootloader-theme>SLE</bootloader-theme>
-        <rpm-excludedocs>true</rpm-excludedocs>
-        <locale>en_US</locale>
-        <type
-            image="oem"
-            initrd_system="dracut"
-            installiso="true"
-            filesystem="btrfs"
-            installboot="install"
-            install_continue_on_timeout="false"
-            fsmountoptions="noatime"
-            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
+            efipartsize="128"
            editbootinstall="editbootinstall_rpi.sh"
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="false"
@@ -560,8 +438,9 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64-self_install,aarch64-rt-self_install,aarch64-64kb-self_install">
-        <version>6.2</version>
+
+    <preferences profiles="aarch64,aarch64-rt">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -571,20 +450,19 @@
            image="oem"
            initrd_system="dracut"
            installiso="true"
-            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
+            fsmountoptions="noatime"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
-            bootkernel="custom"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
+            efipartsize="128"
            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="true"
-            disk_start_sector="8192"
+            btrfs_quota_groups="false"
+            disk_start_sector="4096"
        >
            <bootloader name="grub2" console="gfxterm" timeout="3" />
            <systemdisk>
@@ -600,8 +478,8 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="rpi-self_install">
-        <version>6.2</version>
+    <preferences profiles="aarch64-self_install,aarch64-rt-self_install">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -616,14 +494,13 @@
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            efipartsize="128"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
            btrfs_root_is_readonly_snapshot="true"
-            editbootinstall="editbootinstall_rpi.sh"
            btrfs_quota_groups="true"
            disk_start_sector="4096"
        >
@@ -643,7 +520,7 @@
    </preferences>

    <preferences profiles="s390-kvm">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -681,7 +558,7 @@


    <preferences profiles="s390-dasd">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -719,7 +596,7 @@


    <preferences profiles="s390-fba">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -754,7 +631,7 @@
    </preferences>

    <preferences profiles="s390-fcp">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -793,7 +670,7 @@
    </preferences>

    <preferences profiles="x86-vmware">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -804,7 +681,6 @@
            filesystem="btrfs"
            format="vmdk"
            firmware="uefi"
-            efipartsize="512"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -825,11 +701,11 @@
                <volume name="var" copy_on_write="false"/>
            </systemdisk>
            <size unit="G">24</size>
-            <machine memory="1024" HWversion="17" guestOS="suse-64"/>
+            <machine memory="1024" HWversion="10" guestOS="suse-64"/>
        </type>
    </preferences>
    <preferences profiles="x86-qcow">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -840,8 +716,7 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=qemu"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -865,9 +740,9 @@
            <size unit="G">32</size>
        </type>
    </preferences>
- 
+
    <preferences profiles="aarch64-qcow">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -878,8 +753,8 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"     
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=qemu"
+            efipartsize="128"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -890,7 +765,7 @@
            <systemdisk>
                <volume name="home"/>
                <volume name="root"/>
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
                <volume name="boot/writable"/>
@@ -902,7 +777,7 @@
    </preferences>

    <preferences profiles="ppc64le-512ss">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -913,7 +788,7 @@
            image="oem"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -925,7 +800,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -935,7 +810,7 @@
        </type>
    </preferences>
    <preferences profiles="ppc64le-4096ss">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -949,7 +824,7 @@
            target_blocksize="4096"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -961,7 +836,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -972,7 +847,7 @@
    </preferences>

    <preferences profiles="ppc64le-512ss-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -985,7 +860,7 @@
            installpxe="true"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -1002,7 +877,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -1012,7 +887,7 @@
        </type>
    </preferences>
    <preferences profiles="ppc64le-4096ss-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -1028,7 +903,7 @@
            target_blocksize="4096"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -1045,7 +920,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -1061,17 +936,20 @@
    </repository>

    <packages type="image" profiles="full">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
+        <namedCollection name="salt_minion"/>
+	<package name="patterns-base-salt_minion"/>
        <namedCollection name="kvm_host"/>
-	<package name="patterns-micro-kvm_host"/>
+	<package name="patterns-base-kvm_host"/>
 	<package name="lzop"/>
        <namedCollection name="container_runtime_podman"/>
-        <package name="patterns-container-runtime_podman"/> 
+        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="cockpit"/>
-        <package name="patterns-cockpit"/>
+        <package name="patterns-base-cockpit"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
+        <package name="policycoreutils-python-utils"/>
        <package name="suseconnect-ng"/>
        <package name="SL-Micro-release"/>
        <package name="grub2-branding-SLE" arch="x86_64,aarch64"/>
@@ -1081,7 +959,7 @@
 	<package name="libpwquality-tools"/>
    </packages>

-    <packages type="image" profiles="x86-encrypted,x86-rt-encrypted,aarch64-encrypted,aarch64-rt-encrypted,aarch64-64kb-encrypted">
+    <packages type="image" profiles="x86-encrypted,x86-rt-encrypted">
        <!-- full disk encryption stuff -->
        <package name="device-mapper"/>
        <package name="cryptsetup"/>
@@ -1094,12 +972,13 @@
    </packages>

    <packages type="image" profiles="container-host">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
        <namedCollection name="container_runtime_podman"/>
        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
+        <package name="policycoreutils-python-utils"/>
        <package name="suseconnect-ng"/>
        <package name="SL-Micro-release"/>
        <package name="grub2-branding-SLE" arch="x86_64,aarch64"/>
@@ -1123,16 +1002,16 @@
 	<package name="jeos-firstboot"/>
    </packages>

-    <packages type="image" profiles="x86-qcow,x86-vmware,aarch64-qcow,ppc64le-512ss,ppc64le-4096ss,s390-dasd,s390-fcp">
+    <packages type="image" profiles="x86-qcow,x86-vmware,aarch64-qcow">
        <package name="cloud-init"/>
        <package name="cloud-init-config-suse"/>
    </packages>

    <packages type="image">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
        <namedCollection name="hardware"/>
-        <package name="patterns-micro-hardware"/>
+        <package name="patterns-base-hardware"/>
        <package name="grub2"/>
        <package name="glibc-locale-base"/>
        <package name="ca-certificates"/>
@@ -1151,10 +1030,9 @@
        <package name="NetworkManager"/>
        <package name="NetworkManager-branding-SLE"/>
 	<package name="ModemManager"/>
-	<!-- FIXME does not build without control file which is obsolete 
+	<!-- FIXME does not build without control file which is obsolete
 	<package name="live-add-yast-repos"/> -->
 	<package name="parted"/> <!-- seems missing to deploy the image -->
-	<package name="iptables"/> <!-- needed by RKE2 -->
    </packages>

    <packages type="image" profiles="bootloader">
@@ -1171,18 +1049,14 @@
 	    <package name="kpartx" arch="s390x"/>--> <!-- previous releases picked it always, now kiwi picks partx instead -->
    </packages>
    <!-- rpi kernel-default-base does not provide all necessary drivers -->
-    <packages type="image" profiles="aarch64,rpi,rpi-self_install,aarch64-self_install,x86,x86-encrypted,aarch64-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="kernel-default"/>
        <package name="kernel-firmware-all"/>
    </packages>
-    <packages type="image" profiles="aarch64-64kb,aarch64-64kb-encrypted,aarch64-64kb-self_install">
-        <package name="kernel-64kb"/>
-        <package name="kernel-firmware-all"/>
-    </packages>
-    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-encrypted,aarch64-rt-self_install">
+    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install">
        <package name="kernel-rt"/>
        <package name="kernel-firmware-all"/>
-	<!-- FIXME intentionally removed from ALP code stream 
+	<!-- FIXME intentionally removed from ALP code stream
        <package name="cpuset"/> -->
    </packages>
    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba,s390-fcp">
@@ -1194,18 +1068,17 @@
    <packages type="image" profiles="s390-fcp">
        <package name="multipath-tools"/>
    </packages>
-    <!-- "oem" images uses kiwi for partition/fs resize (-repart) and SelfInstall images in addition for deployment (-dump). -->
-    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,aarch64,aarch64-encrypted,aarch64-64kb-encrypted,rpi,rpi-self_install,aarch64-self_install,aarch64-64kb,aarch64-64kb-self_install,aarch64-rt,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
+    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64,aarch64-qcow,rpi,aarch64-self_install,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="dracut-kiwi-oem-dump"/>
    </packages>
-    <packages type="image" profiles="rpi,rpi-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install">
        <package name="raspberrypi-firmware" arch="aarch64"/>
        <package name="raspberrypi-firmware-config" arch="aarch64"/>
        <package name="raspberrypi-firmware-dt" arch="aarch64"/>
        <package name="u-boot-rpiarm64" arch="aarch64"/>
    </packages>
-    <packages type="image" profiles="aarch64,rpi,rpi-self_install,aarch64-self_install,aarch64-rt,aarch64-64kb,aarch64-rt-self_install,aarch64-encrypted,aarch64-rt-encrypted,aarchte-64kb-encrypted">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="bcm43xx-firmware"/>
        <package name="wireless-regdb"/>
@@ -1213,7 +1086,6 @@
        <package name="wpa_supplicant"/>
        <package name="grub2-arm64-efi"/>
    </packages>
-    <!-- NOTE(edge): Added coreutils, ca-certificates and ca-certificates-mozilla to prevent SSL errors when building the images -->
    <packages type="bootstrap">
        <package name="filesystem"/>
        <package name="coreutils"/>
@@ -1230,15 +1102,14 @@
    <packages type="image" profiles="x86-qcow,aarch64-qcow">
        <package name="qemu-guest-agent"/>
    </packages>
-    
+
    <!-- jsc#PED-8599 -->
-    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096,Base-64kb-encrypted,Default-64kb-encrypted">
+    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096">
        <package name="usbguard"/>
    </packages>

    <!-- jsc#PED-8788 -->
-    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-encrypted,aarch64-rt-self_install">
+    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="stalld"/>
    </packages>
 </image>
-
--- a/kiwi-builder-image/SL-Micro.kiwi.4096
+++ b/kiwi-builder-image/SL-Micro.kiwi.4096
@@ -30,13 +30,16 @@
        <profile name="x86-self_install" description="Raw disk for x86_64 - uEFI" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="aarch64" description="Raw disk for aarch64 - uEFI" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
        <profile name="aarch64-self_install" description="Raw disk for aarch64" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
        <profile name="aarch64-rt" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
-        <profile name="aarch64-rt-encrypted" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+        <profile name="aarch64-rt-rpi" description="Raw disk for aarch64 with RT kernel on Raspberry Pi" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
        <profile name="aarch64-rt-self_install" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
@@ -57,15 +60,6 @@
        <profile name="rpi" description="Raw disk for Raspberry Pi" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
-        <profile name="rpi-self_install" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-        <profile name="aarch64" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-        <profile name="aarch64-encrypted" description="Raw disk for Raspberry Pi" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
        <profile name="x86-qcow" description="qcow2 for x86_64 - uEFI" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
@@ -95,15 +89,6 @@
        </profile>
        <profile name="ppc64le-4096ss-self_install" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
            <requires profile="bootloader"/>
-        </profile> 
-       	<profile name="aarch64-64kb" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-       	<profile name="aarch64-64kb-encrypted" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
-        </profile>
-       	<profile name="aarch64-64kb-self_install" description="Build 64K page size aarch64 images" arch="aarch64">
-            <requires profile="bootloader"/>
        </profile>
        <!-- Images (flavor + platform) -->
        <profile name="Default" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="x86_64">
@@ -169,10 +154,18 @@
            <requires profile="full"/>
            <requires profile="aarch64"/>
        </profile>
+        <profile name="Default-RPi" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="aarch64">
+            <requires profile="full"/>
+            <requires profile="rpi"/>
+        </profile>
        <profile name="Base" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
            <requires profile="container-host"/>
            <requires profile="aarch64"/>
        </profile>
+        <profile name="Base-RPi" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="rpi"/>
+        </profile>
        <profile name="Base-RT" description="SL Micro with Podman as raw image with uEFI boot" arch="x86_64">
            <requires profile="container-host"/>
            <requires profile="x86-rt"/>
@@ -186,6 +179,10 @@
            <requires profile="container-host"/>
            <requires profile="aarch64-rt"/>
        </profile>
+        <profile name="Base-RT-RPi" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt-rpi"/>
+        </profile>
        <profile name="Base-RT-SelfInstall" description="SL Micro with Podman as raw image with uEFI boot - SelfInstall" arch="aarch64">
            <requires profile="container-host"/>
            <requires profile="aarch64-rt-self_install"/>
@@ -280,55 +277,21 @@
            <requires profile="ppc64le-4096ss-self_install"/>
            <requires profile="self_install"/>
        </profile>
-	<profile name="Default-64kb-SelfInstall" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb-self_install"/>
-        </profile>
-	<profile name="Base-64kb-SelfInstall" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb-self_install"/>
-        </profile>
-	<profile name="Default-64kb" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb"/>
-        </profile>
-	<profile name="Base-64kb" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb"/>
-        </profile>
-	<profile name="Default-64kb-encrypted" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="aarch64-64kb-encrypted"/>
-        </profile>
-	<profile name="Base-64kb-encrypted" description="SL Micro with 64K page size images" arch="aarch64">
-            <requires profile="container-host"/>
-            <requires profile="aarch64-64kb-encrypted"/>
-        </profile>
-	<profile name="RaspberryPi-SelfInstall" description="SL Micro for Rapsberry Pi" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="rpi-self_install"/>
-        </profile>
-	<profile name="RaspberryPi" description="SL Micro for Raspberry Pi" arch="aarch64">
-            <requires profile="full"/>
-            <requires profile="rpi"/>
-        </profile>
    </profiles>

    <preferences profiles="x86-encrypted,x86-rt-encrypted">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
        <type
            image="oem"
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 rd.kiwi.oem.luks.reencrypt rd.kiwi.oem.luks.reencrypt_randompass quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -338,8 +301,9 @@
            luks_version="luks2"
            luks="1234"
 	    luks_randomize="false"
-			luks_pbkdf="pbkdf2"
+	    luks_pbkdf="pbkdf2"
            target_blocksize="4096"
+            efipartsize="200"
        >
            <luksformat>
                <option name="--cipher" value="aes-xts-plain64"/>
@@ -361,20 +325,18 @@
        </type>
    </preferences>
    <preferences profiles="x86,x86-rt">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
        <type
            image="oem"
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -382,6 +344,7 @@
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="true"
            target_blocksize="4096"
+            efipartsize="200"
        >
    	    <bootloader name="grub2" console="gfxterm" timeout="3"/>
            <systemdisk>
@@ -400,13 +363,12 @@
    </preferences>

    <preferences profiles="x86-self_install,x86-rt-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
        <type
            image="oem"
            initrd_system="dracut"
@@ -416,8 +378,7 @@
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -425,6 +386,7 @@
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="true"
            target_blocksize="4096"
+            efipartsize="200"
        >
            <bootloader name="grub2" console="gfxterm" timeout="3" />
            <systemdisk>
@@ -441,97 +403,9 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64,aarch64-rt,aarch64-64kb">
-        <version>6.2</version>
-        <packagemanager>zypper</packagemanager>
-        <bootsplash-theme>SLE</bootsplash-theme>
-        <bootloader-theme>SLE</bootloader-theme>
-        <rpm-excludedocs>true</rpm-excludedocs>
-        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
-        <type
-            image="oem"
-            initrd_system="dracut"
-            installiso="true"
-            filesystem="btrfs"
-            installboot="install"
-            install_continue_on_timeout="false"
-            fsmountoptions="noatime"
-            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1"
-            bootpartition="false"
-            devicepersistency="by-uuid"
-            btrfs_root_is_snapshot="true"
-            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="false"
-            disk_start_sector="8192"
-            target_blocksize="4096"
-        >
-            <bootloader name="grub2" console="gfxterm" timeout="3" />
-            <systemdisk>
-                <volume name="home"/>
-                <volume name="root"/>
-                <!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
-                <volume name="opt"/>
-                <volume name="srv"/>
-                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
-                <volume name="boot/writable"/>
-                <volume name="usr/local"/>
-                <volume name="var" copy_on_write="false"/>
-            </systemdisk>
-        </type>
-    </preferences>
-    <preferences profiles="aarch64-encrypted,aarch64-rt-encrypted,aarch64-64kb-encrypted">
-        <version>6.2</version>
-        <packagemanager>zypper</packagemanager>
-        <bootsplash-theme>SLE</bootsplash-theme>
-        <bootloader-theme>SLE</bootloader-theme>
-        <rpm-excludedocs>true</rpm-excludedocs>
-        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
-        <type
-            image="oem"
-            initrd_system="dracut"
-            installiso="true"
-            filesystem="btrfs"
-            installboot="install"
-            install_continue_on_timeout="false"
-            fsmountoptions="noatime"
-            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 rd.kiwi.oem.luks.reencrypt rd.kiwi.oem.luks.reencrypt_randompass quiet systemd.show_status=1"
-            bootpartition="false"
-            devicepersistency="by-uuid"
-            btrfs_root_is_snapshot="true"
-            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="false"
-            disk_start_sector="8192"
-            luks_version="luks2"
-            luks="1234"
-	    luks_randomize="false"
-	    luks_pbkdf="pbkdf2"
-            target_blocksize="4096"
-        >
-            <luksformat>
-                <option name="--cipher" value="aes-xts-plain64"/>
-            </luksformat>
-            <bootloader name="grub2" console="gfxterm" use_disk_password="true" timeout="3" />
-            <systemdisk>
-                <volume name="home"/>
-                <volume name="root"/>
-                <!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
-                <volume name="opt"/>
-                <volume name="srv"/>
-                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
-                <volume name="boot/writable"/>
-                <volume name="usr/local"/>
-                <volume name="var" copy_on_write="false"/>
-            </systemdisk>
-        </type>
-    </preferences>
-    <preferences profiles="rpi">
-        <version>6.2</version>
+
+    <preferences profiles="rpi,aarch64-rt-rpi">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -546,11 +420,11 @@
            install_continue_on_timeout="false"
            fsmountoptions="noatime"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
+            efipartsize="128"
            editbootinstall="editbootinstall_rpi.sh"
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="false"
@@ -570,33 +444,31 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64-self_install,aarch64-rt-self_install,aarch64-64kb-self_install">
-        <version>6.2</version>
+
+    <preferences profiles="aarch64,aarch64-rt">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-        <!--  NOTE: Added 4096 support here -->
        <type
            image="oem"
            initrd_system="dracut"
            installiso="true"
-            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
+            fsmountoptions="noatime"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
-            bootkernel="custom"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
+            efipartsize="128"
            btrfs_root_is_readonly_snapshot="true"
-            btrfs_quota_groups="true"
-            disk_start_sector="8192"
-            target_blocksize="4096"
+            btrfs_quota_groups="false"
+            disk_start_sector="4096"
        >
            <bootloader name="grub2" console="gfxterm" timeout="3" />
            <systemdisk>
@@ -612,8 +484,8 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="rpi-self_install">
-        <version>6.2</version>
+    <preferences profiles="aarch64-self_install,aarch64-rt-self_install">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -628,14 +500,13 @@
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1"
+            efipartsize="128"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
            btrfs_root_is_readonly_snapshot="true"
-            editbootinstall="editbootinstall_rpi.sh"
            btrfs_quota_groups="true"
            disk_start_sector="4096"
        >
@@ -655,7 +526,7 @@
    </preferences>

    <preferences profiles="s390-kvm">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -693,7 +564,7 @@


    <preferences profiles="s390-dasd">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -731,7 +602,7 @@


    <preferences profiles="s390-fba">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -766,7 +637,7 @@
    </preferences>

    <preferences profiles="s390-fcp">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -805,7 +676,7 @@
    </preferences>

    <preferences profiles="x86-vmware">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -816,7 +687,6 @@
            filesystem="btrfs"
            format="vmdk"
            firmware="uefi"
-            efipartsize="512"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -837,11 +707,11 @@
                <volume name="var" copy_on_write="false"/>
            </systemdisk>
            <size unit="G">24</size>
-            <machine memory="1024" HWversion="17" guestOS="suse-64"/>
+            <machine memory="1024" HWversion="10" guestOS="suse-64"/>
        </type>
    </preferences>
    <preferences profiles="x86-qcow">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -852,14 +722,15 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=qemu"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="true"
+            target_blocksize="4096"
+            efipartsize="200"
        >
            <bootloader name="grub2" console="gfxterm" timeout="3" />
            <systemdisk>
@@ -877,9 +748,9 @@
            <size unit="G">32</size>
        </type>
    </preferences>
- 
+
    <preferences profiles="aarch64-qcow">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -890,8 +761,8 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="512"     
-            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=qemu"
+            efipartsize="128"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -902,7 +773,7 @@
            <systemdisk>
                <volume name="home"/>
                <volume name="root"/>
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
                <volume name="boot/writable"/>
@@ -914,7 +785,7 @@
    </preferences>

    <preferences profiles="ppc64le-512ss">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -925,7 +796,7 @@
            image="oem"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -937,7 +808,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -947,7 +818,7 @@
        </type>
    </preferences>
    <preferences profiles="ppc64le-4096ss">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -961,7 +832,7 @@
            target_blocksize="4096"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -973,7 +844,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -984,7 +855,7 @@
    </preferences>

    <preferences profiles="ppc64le-512ss-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -997,7 +868,7 @@
            installpxe="true"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -1014,7 +885,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -1024,7 +895,7 @@
        </type>
    </preferences>
    <preferences profiles="ppc64le-4096ss-self_install">
-        <version>6.2</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -1040,7 +911,7 @@
            target_blocksize="4096"
            filesystem="btrfs"
            firmware="ofw"
-            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -1057,7 +928,7 @@
                <volume name="home"/>
                <volume name="root"/>
 		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/powerpc-ieee1275"/>
                <volume name="boot/writable"/>
@@ -1073,17 +944,20 @@
    </repository>

    <packages type="image" profiles="full">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
+        <namedCollection name="salt_minion"/>
+	<package name="patterns-base-salt_minion"/>
        <namedCollection name="kvm_host"/>
-	<package name="patterns-micro-kvm_host"/>
+	<package name="patterns-base-kvm_host"/>
 	<package name="lzop"/>
        <namedCollection name="container_runtime_podman"/>
-        <package name="patterns-container-runtime_podman"/> 
+        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="cockpit"/>
-        <package name="patterns-cockpit"/>
+        <package name="patterns-base-cockpit"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
+        <package name="policycoreutils-python-utils"/>
        <package name="suseconnect-ng"/>
        <package name="SL-Micro-release"/>
        <package name="grub2-branding-SLE" arch="x86_64,aarch64"/>
@@ -1093,7 +967,7 @@
 	<package name="libpwquality-tools"/>
    </packages>

-    <packages type="image" profiles="x86-encrypted,x86-rt-encrypted,aarch64-encrypted,aarch64-rt-encrypted,aarch64-64kb-encrypted">
+    <packages type="image" profiles="x86-encrypted,x86-rt-encrypted">
        <!-- full disk encryption stuff -->
        <package name="device-mapper"/>
        <package name="cryptsetup"/>
@@ -1106,12 +980,13 @@
    </packages>

    <packages type="image" profiles="container-host">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
        <namedCollection name="container_runtime_podman"/>
        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
+        <package name="policycoreutils-python-utils"/>
        <package name="suseconnect-ng"/>
        <package name="SL-Micro-release"/>
        <package name="grub2-branding-SLE" arch="x86_64,aarch64"/>
@@ -1135,16 +1010,16 @@
 	<package name="jeos-firstboot"/>
    </packages>

-    <packages type="image" profiles="x86-qcow,x86-vmware,aarch64-qcow,ppc64le-512ss,ppc64le-4096ss,s390-dasd,s390-fcp">
+    <packages type="image" profiles="x86-qcow,x86-vmware,aarch64-qcow">
        <package name="cloud-init"/>
        <package name="cloud-init-config-suse"/>
    </packages>

    <packages type="image">
-        <namedCollection name="transactional_base"/>
-        <package name="patterns-base-transactional_base"/>
+        <namedCollection name="base_transactional"/>
+        <package name="patterns-base-transactional"/>
        <namedCollection name="hardware"/>
-        <package name="patterns-micro-hardware"/>
+        <package name="patterns-base-hardware"/>
        <package name="grub2"/>
        <package name="glibc-locale-base"/>
        <package name="ca-certificates"/>
@@ -1163,10 +1038,9 @@
        <package name="NetworkManager"/>
        <package name="NetworkManager-branding-SLE"/>
 	<package name="ModemManager"/>
-	<!-- FIXME does not build without control file which is obsolete 
+	<!-- FIXME does not build without control file which is obsolete
 	<package name="live-add-yast-repos"/> -->
 	<package name="parted"/> <!-- seems missing to deploy the image -->
-	<package name="iptables"/> <!-- needed by RKE2 -->
    </packages>

    <packages type="image" profiles="bootloader">
@@ -1183,18 +1057,14 @@
 	    <package name="kpartx" arch="s390x"/>--> <!-- previous releases picked it always, now kiwi picks partx instead -->
    </packages>
    <!-- rpi kernel-default-base does not provide all necessary drivers -->
-    <packages type="image" profiles="aarch64,rpi,rpi-self_install,aarch64-self_install,x86,x86-encrypted,aarch64-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="kernel-default"/>
        <package name="kernel-firmware-all"/>
    </packages>
-    <packages type="image" profiles="aarch64-64kb,aarch64-64kb-encrypted,aarch64-64kb-self_install">
-        <package name="kernel-64kb"/>
-        <package name="kernel-firmware-all"/>
-    </packages>
-    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-encrypted,aarch64-rt-self_install">
+    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install">
        <package name="kernel-rt"/>
        <package name="kernel-firmware-all"/>
-	<!-- FIXME intentionally removed from ALP code stream 
+	<!-- FIXME intentionally removed from ALP code stream
        <package name="cpuset"/> -->
    </packages>
    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba,s390-fcp">
@@ -1206,18 +1076,17 @@
    <packages type="image" profiles="s390-fcp">
        <package name="multipath-tools"/>
    </packages>
-    <!-- "oem" images uses kiwi for partition/fs resize (-repart) and SelfInstall images in addition for deployment (-dump). -->
-    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,aarch64,aarch64-encrypted,aarch64-64kb-encrypted,rpi,rpi-self_install,aarch64-self_install,aarch64-64kb,aarch64-64kb-self_install,aarch64-rt,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
+    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64,aarch64-qcow,rpi,aarch64-self_install,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="dracut-kiwi-oem-dump"/>
    </packages>
-    <packages type="image" profiles="rpi,rpi-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-rpi,aarch64-rt-self_install">
        <package name="raspberrypi-firmware" arch="aarch64"/>
        <package name="raspberrypi-firmware-config" arch="aarch64"/>
        <package name="raspberrypi-firmware-dt" arch="aarch64"/>
        <package name="u-boot-rpiarm64" arch="aarch64"/>
    </packages>
-    <packages type="image" profiles="aarch64,rpi,rpi-self_install,aarch64-self_install,aarch64-rt,aarch64-64kb,aarch64-rt-self_install,aarch64-encrypted,aarch64-rt-encrypted,aarchte-64kb-encrypted">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="bcm43xx-firmware"/>
        <package name="wireless-regdb"/>
@@ -1225,7 +1094,6 @@
        <package name="wpa_supplicant"/>
        <package name="grub2-arm64-efi"/>
    </packages>
-    <!-- NOTE(edge): Added coreutils, ca-certificates and ca-certificates-mozilla to prevent SSL errors when building the images -->
    <packages type="bootstrap">
        <package name="filesystem"/>
        <package name="coreutils"/>
@@ -1242,15 +1110,14 @@
    <packages type="image" profiles="x86-qcow,aarch64-qcow">
        <package name="qemu-guest-agent"/>
    </packages>
-    
+
    <!-- jsc#PED-8599 -->
-    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096,Base-64kb-encrypted,Default-64kb-encrypted">
+    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096">
        <package name="usbguard"/>
    </packages>

    <!-- jsc#PED-8788 -->
-    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-encrypted,aarch64-rt-self_install">
+    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="stalld"/>
    </packages>
 </image>
-
--- a/kiwi-builder-image/build-image.sh
+++ b/kiwi-builder-image/build-image.sh
@@ -28,7 +28,7 @@ LARGEBLOCK=false
 usage(){
  cat <<-EOF
  =====================================
-  SUSE Linux Micro 6.2 Kiwi SDK Builder
+  SUSE Linux Micro 6.1 Kiwi SDK Builder
  =====================================

  Usage: ${0} [-p <profile>] [-b]
@@ -36,12 +36,13 @@ usage(){
  Profile Options (-p):
  * Default: RAW Disk Image with default packages (incl. Podman & KVM)
  * Default-SelfInstall: SelfInstall ISO with default packages
+  * Default-RPi: RAW Disk Image for Raspberry Pi (aarch64 only with MBR)
  * Base: RAW Disk Image with reduced package set (no KVM)
  * Base-SelfInstall: SelfInstall ISO with reduced packages
  * Base-RT: RAW Disk Image with reduced packages and kernel-rt
  * Base-RT-SelfInstall: SelfInstall ISO with reduced packages and kernel-rt
-  * RaspberryPi: RAW Disk Image for Raspberry Pi with default packages (aarch64 only with MBR)
-  * RaspberryPi-SelfInstall: SelfInstall ISO for Raspberry Pi with default packages (aarch64 only with MBR)
+  * Base-RT-RPi: RAW Disk image for Raspberry Pi with kernel-rt (aarch64 only with MBR)
+  * Base-RPi: RAW Disk Image for Raspberry Pi with reduced packages (aarch64 only with MBR)

  4096 Blocksize (-b): If specified, use a 4096 blocksize (rather than 512) when generating the image.

@@ -82,34 +83,14 @@ if $LARGEBLOCK; then
  mv /micro-sdk/defs/SL-Micro.kiwi.4096 /micro-sdk/defs/SL-Micro.kiwi
 fi

-# Create temporary directory that supports seclabel
-dir=$(mktemp -d)
-mkdir -p /tmp/output/tmp-dir
-mount -t tmpfs $dir /tmp/output/tmp-dir
-
 # Build the image
-kiwi-ng --temp-dir /tmp/output/tmp-dir --debug --profile $PROFILE \
-    system build --description /micro-sdk/defs --target-dir /tmp/output \
-    --ignore-repos-used-for-build $REPOS
+kiwi-ng --debug --profile $PROFILE system build \
+    --description /micro-sdk/defs --target-dir /tmp/output --ignore-repos-used-for-build $REPOS

 # Print output
 RESULT=$?
 if [ $RESULT -eq 0 ]; then
  echo -e "\n\nINFO: Image build successful, generated images are available in the 'output' directory."
-  # The -n flag is being used to avoid the \n at the end of the line
-  echo -n "INFO: Generating sha256 checksum file... " && {
-  # This returns the iso or raw image from the kiwi.result.json file, preferring iso
-  FILE_PATH=$(python3 -c 'import json, sys; data = json.load(sys.stdin); iso = data.get("installation_image", {}).get("filename"); raw = data.get("disk_image", {}).get("filename"); print(iso if iso else raw)' < /tmp/output/kiwi.result.json)
-  # Generate the checksum if the file path was successfully extracted
-  if [ -n "$FILE_PATH" ]; then
-    # The sed trims the full path to just the filename (e.g., "sum filename")
-    sha256sum "$FILE_PATH" | sed -E 's/\s+.*\/([^/]+)$/  \1/' > "$FILE_PATH.sha256" && echo "done"
-  else
-    # Or fail if it is not there
-    echo "ERROR: Neither ISO nor RAW file path found in JSON."
-  fi
-  # Catch-all just in case something fails inside the block
-  } || echo "ERROR: Command failed during processing."
 else
  echo -e "\n\nERROR: Failed to build the image, please see above logs."
 fi
--- a/kiwi-builder-image/config.sh
+++ b/kiwi-builder-image/config.sh
@@ -188,6 +188,7 @@ cat >/etc/fstab.script <<"EOF"
 #!/bin/sh
 set -eux

+/usr/sbin/setup-fstab-for-overlayfs
 # If /var is on a different partition than /...
 if [ "$(findmnt -snT / -o SOURCE)" != "$(findmnt -snT /var -o SOURCE)" ]; then
 	# ... set options for autoexpanding /var
--- a/kiwi-builder-image/disk.sh
+++ b/kiwi-builder-image/disk.sh
@@ -1,24 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2025 SUSE LLC
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-# 
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-# 
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-
-set -euxo pipefail
-
-/usr/libexec/setup-etc-subvol
--- a/kiwi-builder-image/editbootinstall_pine64.sh
+++ b/kiwi-builder-image/editbootinstall_pine64.sh
@@ -1,40 +0,0 @@
-#!/bin/bash
-set -euxo pipefail
-
-diskname=$1
-devname="$2"
-loopname="${devname%*p?}"
-loopdev=/dev/${loopname#/dev/mapper/*}
-
-#==========================================
-# The GPT spans the first 33 sectors, but we need to write our
-# at sector 16. Shrink the GPT to only span 5 sectors
-# (16 partitions) to give us some space.
-#------------------------------------------
-# echo -e 'x\ns\n16\nw\ny' > gdisk.tmp
-# Shrink GPT does not work anymore, so let's use legacy MBR for now
-cat > gdisk.tmp <<-'EOF'
-		x
-		r
-		g
-		t
-		1
-		c
-		w
-		y
-	EOF
-dd if=$loopdev of=mbrid.bin bs=1 skip=440 count=4
-gdisk $loopdev < gdisk.tmp
-dd of=$loopdev if=mbrid.bin bs=1 seek=440 count=4
-rm -f mbrid.bin
-rm -f gdisk.tmp
-
-#==========================================
-# Installing All-in-one U-Boot/SPL
-#------------------------------------------
-echo "Installing All-in-one U-Boot/SPL..."
-if ! dd if=boot/u-boot-sunxi-with-spl.bin of=$diskname bs=1024 seek=8 conv=notrunc; then
-	echo "Couldn't install SPL on $diskname"
-	exit 1
-fi
-
--- a/kiwi-builder-image/editbootinstall_rpi.sh
+++ b/kiwi-builder-image/editbootinstall_rpi.sh
@@ -3,9 +3,12 @@ set -euxo pipefail

 diskname=$1
 devname="$2"
+
 loopname="${devname%*p?}"
 loopdev=/dev/${loopname#/dev/*}

+if [ ! -f $loopdev ]; then loopdev=/dev/${loopdev#/dev/mapper/}; fi
+
 #==========================================
 # copy Raspberry Pi firmware to EFI partition
 #------------------------------------------
--- a/kube-rbac-proxy/_service
+++ b/kube-rbac-proxy/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/brancz/kube-rbac-proxy</param>
    <param name="scm">git</param>
-    <param name="revision">v0.19.1</param>
+    <param name="revision">v0.18.1</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
--- a/kube-rbac-proxy/kube-rbac-proxy.spec
+++ b/kube-rbac-proxy/kube-rbac-proxy.spec
@@ -17,14 +17,14 @@


 Name:           kube-rbac-proxy
-Version:        0.19.1
-Release:        0.19.1
+Version:        0.18.1
+Release:        0.18.1
 Summary:        The kube-rbac-proxy is a small HTTP proxy for a single upstream
 License:        Apache-2.0
 URL:            https://github.com/brancz/kube-rbac-proxy
 Source:         kube-rbac-proxy-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.23
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

--- a/kubectl-image/Dockerfile
+++ b/kubectl-image/Dockerfile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%kubectl:1.34.2
-#!BuildTag: %%IMG_PREFIX%%kubectl:1.34.2-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%kubectl:1.32.4
+#!BuildTag: %%IMG_PREFIX%%kubectl:1.32.4-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -15,11 +15,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE kubectl image"
 LABEL org.opencontainers.image.description="kubectl on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="1.34.2"
+LABEL org.opencontainers.image.version="1.32.4"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%kubectl:1.34.2-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%kubectl:1.32.4-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
--- a/kubectl/kubectl.spec
+++ b/kubectl/kubectl.spec
@@ -1,7 +1,7 @@
 %global debug_package %{nil}

 Name: kubectl
-Version: 1.34.2
+Version: 1.32.4
 Release: 0
 Summary: Command-line utility for interacting with a Kubernetes cluster

--- a/kubectl/kubectl_1.32.4.orig.tar.gz
+++ b/kubectl/kubectl_1.32.4.orig.tar.gz
--- a/kubectl/kubectl_1.34.2.orig.tar.gz
+++ b/kubectl/kubectl_1.34.2.orig.tar.gz
--- a/kubevirt-chart/Chart.yaml
+++ b/kubevirt-chart/Chart.yaml
@@ -1,9 +1,9 @@
-#!BuildTag: %%CHART_PREFIX%%kubevirt:%%CHART_MAJOR%%.0.1_up0.6.0-%RELEASE%
-#!BuildTag: %%CHART_PREFIX%%kubevirt:%%CHART_MAJOR%%.0.1_up0.6.0
+#!BuildTag: %%CHART_PREFIX%%kubevirt:%%CHART_MAJOR%%.0.0_up0.5.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%kubevirt:%%CHART_MAJOR%%.0.0_up0.5.0
 apiVersion: v2
-appVersion: 1.5.2
+appVersion: 1.4.0
 description: A Helm chart for KubeVirt
 icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/kubevirt/icon/color/kubevirt-icon-color.svg
 name: kubevirt
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.6.0"
+version: "%%CHART_MAJOR%%.0.0+up0.5.0"
--- a/kubevirt-chart/crds/kubevirt.yaml
+++ b/kubevirt-chart/crds/kubevirt.yaml
@@ -593,13 +593,6 @@ spec:
                            If set to true, migrations will still start in pre-copy, but switch to post-copy when
                            CompletionTimeoutPerGiB triggers. Defaults to false
                          type: boolean
-                        allowWorkloadDisruption:
-                          description: |-
-                            AllowWorkloadDisruption indicates that the migration shouldn't be
-                            canceled after acceptableCompletionTime is exceeded. Instead, if
-                            permitted, migration will be switched to post-copy or the VMI will be
-                            paused to allow the migration to complete
-                          type: boolean
                        bandwidthPerMigration:
                          anyOf:
                            - type: integer
@@ -612,8 +605,8 @@ spec:
                        completionTimeoutPerGiB:
                          description: |-
                            CompletionTimeoutPerGiB is the maximum number of seconds per GiB a migration is allowed to take.
-                            If the timeout is reached, the migration will be either paused, switched
-                            to post-copy or cancelled depending on other settings. Defaults to 150
+                            If a live-migration takes longer to migrate than this value multiplied by the size of the VMI,
+                            the migration will be cancelled, unless AllowPostCopy is true. Defaults to 150
                          format: int64
                          type: integer
                        disableTLS:
@@ -971,17 +964,17 @@ spec:
                          type: object
                      type: object
                    vmRolloutStrategy:
-                      description: |-
-                        VMRolloutStrategy defines how live-updatable fields, like CPU sockets, memory,
-                        tolerations, and affinity, are propagated from a VM to its VMI.
+                      description: VMRolloutStrategy defines how changes to a VM object
+                        propagate to its VMI
                      enum:
                        - Stage
                        - LiveUpdate
                      nullable: true
                      type: string
                    vmStateStorageClass:
-                      description: VMStateStorageClass is the name of the storage class
-                        to use for the PVCs created to preserve VM state, like TPM.
+                      description: |-
+                        VMStateStorageClass is the name of the storage class to use for the PVCs created to preserve VM state, like TPM.
+                        The storage class must support RWX in filesystem mode.
                      type: string
                    webhookConfiguration:
                      description: |-
@@ -3857,13 +3850,6 @@ spec:
                            If set to true, migrations will still start in pre-copy, but switch to post-copy when
                            CompletionTimeoutPerGiB triggers. Defaults to false
                          type: boolean
-                        allowWorkloadDisruption:
-                          description: |-
-                            AllowWorkloadDisruption indicates that the migration shouldn't be
-                            canceled after acceptableCompletionTime is exceeded. Instead, if
-                            permitted, migration will be switched to post-copy or the VMI will be
-                            paused to allow the migration to complete
-                          type: boolean
                        bandwidthPerMigration:
                          anyOf:
                            - type: integer
@@ -3876,8 +3862,8 @@ spec:
                        completionTimeoutPerGiB:
                          description: |-
                            CompletionTimeoutPerGiB is the maximum number of seconds per GiB a migration is allowed to take.
-                            If the timeout is reached, the migration will be either paused, switched
-                            to post-copy or cancelled depending on other settings. Defaults to 150
+                            If a live-migration takes longer to migrate than this value multiplied by the size of the VMI,
+                            the migration will be cancelled, unless AllowPostCopy is true. Defaults to 150
                          format: int64
                          type: integer
                        disableTLS:
@@ -4235,17 +4221,17 @@ spec:
                          type: object
                      type: object
                    vmRolloutStrategy:
-                      description: |-
-                        VMRolloutStrategy defines how live-updatable fields, like CPU sockets, memory,
-                        tolerations, and affinity, are propagated from a VM to its VMI.
+                      description: VMRolloutStrategy defines how changes to a VM object
+                        propagate to its VMI
                      enum:
                        - Stage
                        - LiveUpdate
                      nullable: true
                      type: string
                    vmStateStorageClass:
-                      description: VMStateStorageClass is the name of the storage class
-                        to use for the PVCs created to preserve VM state, like TPM.
+                      description: |-
+                        VMStateStorageClass is the name of the storage class to use for the PVCs created to preserve VM state, like TPM.
+                        The storage class must support RWX in filesystem mode.
                      type: string
                    webhookConfiguration:
                      description: |-
--- a/kubevirt-chart/templates/kubevirt-operator.yaml
+++ b/kubevirt-chart/templates/kubevirt-operator.yaml
@@ -608,7 +608,6 @@ rules:
    resources:
      - virtualmachinesnapshots
      - virtualmachinesnapshots/status
-      - virtualmachinesnapshots/finalizers
      - virtualmachinesnapshotcontents
      - virtualmachinesnapshotcontents/status
      - virtualmachinesnapshotcontents/finalizers
@@ -661,18 +660,15 @@ rules:
      - kubevirt.io
    resources:
      - virtualmachines/finalizers
-      - virtualmachineinstances/finalizers
    verbs:
      - update
  - apiGroups:
      - subresources.kubevirt.io
    resources:
-      - virtualmachines/stop
      - virtualmachineinstances/addvolume
      - virtualmachineinstances/removevolume
      - virtualmachineinstances/freeze
      - virtualmachineinstances/unfreeze
-      - virtualmachineinstances/reset
      - virtualmachineinstances/softreboot
      - virtualmachineinstances/sev/setupsession
      - virtualmachineinstances/sev/injectlaunchsecret
@@ -776,14 +772,6 @@ rules:
    verbs:
      - list
      - watch
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - create
-      - get
-      - delete
  - apiGroups:
      - kubevirt.io
    resources:
@@ -895,7 +883,6 @@ rules:
      - virtualmachineinstances/freeze
      - virtualmachineinstances/unfreeze
      - virtualmachineinstances/softreboot
-      - virtualmachineinstances/reset
      - virtualmachineinstances/sev/setupsession
      - virtualmachineinstances/sev/injectlaunchsecret
    verbs:
@@ -915,6 +902,7 @@ rules:
      - virtualmachines/restart
      - virtualmachines/addvolume
      - virtualmachines/removevolume
+      - virtualmachines/migrate
      - virtualmachines/memorydump
    verbs:
      - update
@@ -931,6 +919,7 @@ rules:
      - virtualmachineinstances
      - virtualmachineinstancepresets
      - virtualmachineinstancereplicasets
+      - virtualmachineinstancemigrations
    verbs:
      - get
      - delete
@@ -940,14 +929,6 @@ rules:
      - list
      - watch
      - deletecollection
-  - apiGroups:
-      - kubevirt.io
-    resources:
-      - virtualmachineinstancemigrations
-    verbs:
-      - get
-      - list
-      - watch
  - apiGroups:
      - snapshot.kubevirt.io
    resources:
@@ -1051,7 +1032,6 @@ rules:
      - virtualmachineinstances/freeze
      - virtualmachineinstances/unfreeze
      - virtualmachineinstances/softreboot
-      - virtualmachineinstances/reset
      - virtualmachineinstances/sev/setupsession
      - virtualmachineinstances/sev/injectlaunchsecret
    verbs:
@@ -1071,6 +1051,7 @@ rules:
      - virtualmachines/restart
      - virtualmachines/addvolume
      - virtualmachines/removevolume
+      - virtualmachines/migrate
      - virtualmachines/memorydump
    verbs:
      - update
@@ -1087,6 +1068,7 @@ rules:
      - virtualmachineinstances
      - virtualmachineinstancepresets
      - virtualmachineinstancereplicasets
+      - virtualmachineinstancemigrations
    verbs:
      - get
      - delete
@@ -1095,14 +1077,6 @@ rules:
      - patch
      - list
      - watch
-  - apiGroups:
-      - kubevirt.io
-    resources:
-      - virtualmachineinstancemigrations
-    verbs:
-      - get
-      - list
-      - watch
  - apiGroups:
      - snapshot.kubevirt.io
    resources:
@@ -1281,25 +1255,6 @@ rules:
      - get
      - list
      - watch
-  - apiGroups:
-      - subresources.kubevirt.io
-    resources:
-      - virtualmachines/migrate
-    verbs:
-      - update
-  - apiGroups:
-      - kubevirt.io
-    resources:
-      - virtualmachineinstancemigrations
-    verbs:
-      - get
-      - delete
-      - create
-      - update
-      - patch
-      - list
-      - watch
-      - deletecollection
  - apiGroups:
      - authentication.k8s.io
    resources:
@@ -1345,8 +1300,6 @@ spec:
    type: RollingUpdate
  template:
    metadata:
-      annotations:
-        openshift.io/required-scc: restricted-v2
      labels:
        kubevirt.io: virt-operator
        name: virt-operator
--- a/kubevirt-chart/values.yaml
+++ b/kubevirt-chart/values.yaml
@@ -1,6 +1,6 @@
 operator:
-  image: registry.suse.com/suse/sles/15.7/virt-operator
-  version: 1.5.2-150700.3.5.2
+  image: registry.suse.com/suse/sles/15.6/virt-operator
+  version: 1.4.0-150600.5.15.1
  replicas: 2
  pullPolicy: IfNotPresent
  affinity:
@@ -40,7 +40,7 @@ kubevirt:
  monitorAccount: ""
  monitorNamespace: ""

-hookImage: registry.rancher.com/rancher/kubectl:v1.33.1
+hookImage: registry.rancher.com/rancher/kubectl:v1.30.10
 hookRestartPolicy: OnFailure
 hookSecurityContext:
  seccompProfile:
--- a/kubevirt-dashboard-extension-chart/Chart.yaml
+++ b/kubevirt-dashboard-extension-chart/Chart.yaml
@@ -1,5 +1,5 @@
-#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.3
-#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.3-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2
+#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2-%RELEASE%
 annotations:
  catalog.cattle.io/certified: rancher
  catalog.cattle.io/namespace: cattle-ui-plugin-system
@@ -12,10 +12,10 @@ annotations:
  catalog.cattle.io/ui-extensions-version: '>= 3.0.2 < 4.0.0'
  catalog.cattle.io/kube-version: '>= v1.26.0-0'
 apiVersion: v2
-appVersion: 1.3.3
+appVersion: 303.0.2+up1.3.2
 description: 'SUSE Edge: KubeVirt extension for Rancher Dashboard'
 name: kubevirt-dashboard-extension
 type: application
-version: "%%CHART_MAJOR%%.0.4+up1.3.3"
+version: "%%CHART_MAJOR%%.0.2+up1.3.2"
 icon: >-
  https://raw.githubusercontent.com/cncf/artwork/master/projects/kubevirt/icon/color/kubevirt-icon-color.svg
--- a/kubevirt-dashboard-extension-chart/templates/cr.yaml
+++ b/kubevirt-dashboard-extension-chart/templates/cr.yaml
@@ -8,7 +8,7 @@ spec:
  plugin:
    name: {{ include "extension-server.fullname" . }}
    version: {{ (semver (default .Chart.AppVersion .Values.plugin.versionOverride)).Original }}
-    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/kubevirt-dashboard-extension/1.3.3
+    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/kubevirt-dashboard-extension/303.0.2+up1.3.2
    noCache: {{ .Values.plugin.noCache }}
    noAuth: {{ .Values.plugin.noAuth }}
    metadata: {{ include "extension-server.pluginMetadata" . | indent 6 }}
--- a/metal3-chart/Chart.yaml
+++ b/metal3-chart/Chart.yaml
@@ -1,28 +1,28 @@
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.21_up0.13.0
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.21_up0.13.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.10_up0.12.0
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.10_up0.12.0-%RELEASE%
 apiVersion: v2
-appVersion: 0.13.0
+appVersion: 0.12.0
 dependencies:
 - alias: metal3-baremetal-operator
  name: baremetal-operator
  repository: file://./charts/baremetal-operator
-  version: 0.11.2
+  version: 0.9.2
 - alias: metal3-ironic
  name: ironic
  repository: file://./charts/ironic
-  version: 0.12.1
+  version: 0.11.0
 - alias: metal3-mariadb
  condition: global.enable_mariadb
  name: mariadb
  repository: file://./charts/mariadb
-  version: 0.6.2
+  version: 0.6.0
 - alias: metal3-media
  condition: global.enable_metal3_media_server
  name: media
  repository: file://./charts/media
-  version: 0.7.1
+  version: 0.6.4
 description: A Helm chart that installs all of the dependencies needed for Metal3
 icon: https://github.com/cncf/artwork/raw/master/projects/metal3/icon/color/metal3-icon-color.svg
 name: metal3
 type: application
-version: "%%CHART_MAJOR%%.0.21+up0.13.0"
+version: "%%CHART_MAJOR%%.0.10+up0.12.0"
--- a/metal3-chart/charts/baremetal-operator/Chart.yaml
+++ b/metal3-chart/charts/baremetal-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: 0.11.2
+appVersion: 0.9.1
 description: A Helm chart for baremetal-operator, used by Metal3
 name: baremetal-operator
 type: application
-version: 0.11.2
+version: 0.9.2
--- a/metal3-chart/charts/baremetal-operator/crds/customresource-baremetalhosts.yaml
+++ b/metal3-chart/charts/baremetal-operator/crds/customresource-baremetalhosts.yaml
@@ -202,11 +202,6 @@ spec:
                description: Description is a human-entered text used to help identify
                  the host.
                type: string
-              disablePowerOff:
-                description: |-
-                  When set to true, power off of the node will be disabled,
-                  instead, a reboot will be used in place of power on/off
-                type: boolean
              externallyProvisioned:
                description: |-
                  ExternallyProvisioned means something else has provisioned the
@@ -291,15 +286,6 @@ spec:
                required:
                - url
                type: object
-              inspectionMode:
-                description: |-
-                  Specifies the mode for host inspection.
-                  "disabled" - no inspection will be performed
-                  "agent" - normal agent-based inspection will run
-                enum:
-                - disabled
-                - agent
-                type: string
              metaData:
                description: |-
                  MetaData holds the reference to the Secret containing host metadata
@@ -587,8 +573,9 @@ spec:
                      description: Required. The taint key to be applied to a node.
                      type: string
                    timeAdded:
-                      description: TimeAdded represents the time at which the taint
-                        was added.
+                      description: |-
+                        TimeAdded represents the time at which the taint was added.
+                        It is only written for NoExecute taints.
                      format: date-time
                      type: string
                    value:
@@ -718,19 +705,6 @@ spec:
                            if one is present.  If both IPv4 and IPv6 addresses are present in a
                            dual-stack environment, two nics will be output, one with each IP.
                          type: string
-                        lldp:
-                          description: LLDP data for this interface
-                          properties:
-                            portID:
-                              description: The switch port ID from LLDP
-                              type: string
-                            switchID:
-                              description: The switch chassis ID from LLDP
-                              type: string
-                            switchSystemName:
-                              description: The switch system name from LLDP
-                              type: string
-                          type: object
                        mac:
                          description: The device MAC address
                          pattern: '[0-9a-fA-F]{2}(:[0-9a-fA-F]{2}){5}'
--- a/metal3-chart/charts/baremetal-operator/crds/customresource-hardwaredata.yaml
+++ b/metal3-chart/charts/baremetal-operator/crds/customresource-hardwaredata.yaml
@@ -99,19 +99,6 @@ spec:
                            if one is present.  If both IPv4 and IPv6 addresses are present in a
                            dual-stack environment, two nics will be output, one with each IP.
                          type: string
-                        lldp:
-                          description: LLDP data for this interface
-                          properties:
-                            portID:
-                              description: The switch port ID from LLDP
-                              type: string
-                            switchID:
-                              description: The switch chassis ID from LLDP
-                              type: string
-                            switchSystemName:
-                              description: The switch system name from LLDP
-                              type: string
-                          type: object
                        mac:
                          description: The device MAC address
                          pattern: '[0-9a-fA-F]{2}(:[0-9a-fA-F]{2}){5}'
--- a/metal3-chart/charts/baremetal-operator/templates/_helpers.tpl
+++ b/metal3-chart/charts/baremetal-operator/templates/_helpers.tpl
@@ -61,19 +61,3 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
-
-{{/*
-Create the URL to use for connecting to the Ironic servers (e.g. API, cache)
-*/}}
-{{- define "baremetal-operator.ironicHttpHost" -}}
-{{- $hostIP := include "metal3.hostIP" . -}}
-{{- with .Values.global }}
-{{- if .provisioningHostname }}
-{{- .provisioningHostname }}
-{{- else if regexMatch ".*:.*" $hostIP}}
-{{- print "[" $hostIP "]" }}
-{{- else }}
-{{- $hostIP }}
-{{- end }}
-{{- end }}
-{{- end }}
--- a/metal3-chart/charts/baremetal-operator/templates/configmap-ironic.yaml
+++ b/metal3-chart/charts/baremetal-operator/templates/configmap-ironic.yaml
@@ -1,18 +1,19 @@
  {{- $enableTLS := .Values.global.enable_tls }}
  {{- $enableVMediaTLS := .Values.global.enable_vmedia_tls }}
  {{- $protocol := ternary "https" "http" $enableTLS }}
-  {{- $ironicHost := include "baremetal-operator.ironicHttpHost" . | required "Missing host information for BMO to connect to Ironic" }}
-  {{- $ironicApiHost := print $ironicHost ":6385" }}
-  {{- $ironicBootHost := print $ironicHost ":6180" }}
-  {{- $ironicCacheHost := print $ironicHost ":6180" }}
+  {{- $ironicIP := .Values.global.ironicIP | default "" }}
+  {{- $ironicApiHost := print $ironicIP ":6385" }}
+  {{- $ironicBootHost := print $ironicIP ":6180" }}
+  {{- $ironicCacheHost := print $ironicIP ":6180" }}
+  {{- $deployArch := .Values.global.deployArchitecture }}

 apiVersion: v1
 data:
  IRONIC_ENDPOINT: "{{ $protocol }}://{{ $ironicApiHost }}/v1/"
  # Switch VMedia to HTTP if enable_vmedia_tls is false
  {{- if and $enableTLS $enableVMediaTLS }}
-    {{- $ironicBootHost = print $ironicHost ":" .Values.global.vmediaTLSPort }}
-    {{- $ironicCacheHost = print $ironicHost ":" .Values.global.vmediaTLSPort }}
+    {{- $ironicBootHost = print $ironicIP ":" .Values.global.vmediaTLSPort }}
+    {{- $ironicCacheHost = print $ironicIP ":" .Values.global.vmediaTLSPort }}
    {{- $protocol = "https" }}
  RESTART_CONTAINER_CERTIFICATE_UPDATED: "true"
  {{- else }}
@@ -20,10 +21,9 @@ data:
  RESTART_CONTAINER_CERTIFICATE_UPDATED: "false"
  {{- end }}
  CACHEURL: "{{ $protocol }}://{{ $ironicCacheHost }}/images"
-  {{- if .Values.baremetaloperator.externalHttpIPv6 }}
-  {{- $port := ternary .Values.global.vmediaTLSPort .Values.baremetaloperator.httpPort $enableVMediaTLS }}
-  IRONIC_EXTERNAL_URL_V6: "{{ $protocol }}://[{{ .Values.baremetaloperator.externalHttpIPv6 }}]:{{ $port }}"
-  {{- end }}
+  DEPLOY_KERNEL_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.kernel"
+  DEPLOY_RAMDISK_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.initramfs"
+  DEPLOY_ARCHITECTURE: "{{ $deployArch }}"
 kind: ConfigMap
 metadata:
  name: baremetal-operator-ironic
--- a/metal3-chart/charts/baremetal-operator/templates/metrics_service.yaml
+++ b/metal3-chart/charts/baremetal-operator/templates/metrics_service.yaml
@@ -6,7 +6,6 @@ metadata:
    control-plane: controller-manager
  name: {{ include "baremetal-operator.fullname" . }}-controller-manager-metrics-service
 spec:
-  ipFamilyPolicy: PreferDualStack
  ports:
  - name: https
    port: 8443
--- a/metal3-chart/charts/baremetal-operator/templates/service-webhook.yaml
+++ b/metal3-chart/charts/baremetal-operator/templates/service-webhook.yaml
@@ -5,7 +5,6 @@ metadata:
    {{- include "baremetal-operator.labels" . | nindent 4 }}
  name: {{ include "baremetal-operator.fullname" . }}-webhook-service
 spec:
-  ipFamilyPolicy: PreferDualStack
  ports:
  - port: 443
    targetPort: 9443
--- a/metal3-chart/charts/baremetal-operator/values.yaml
+++ b/metal3-chart/charts/baremetal-operator/values.yaml
@@ -28,7 +28,7 @@ images:
  baremetalOperator:
    repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/baremetal-operator
    pullPolicy: IfNotPresent
-    tag: "0.11.2.0"
+    tag: "0.9.1.1"

 imagePullSecrets: []
 nameOverride: "manger"
@@ -84,8 +84,3 @@ affinity: {}

 baremetaloperator:
  httpPort: "6180"
-
-  # IPv6 used for accessing the Ironic HTTP server for BMCs with an IPv6 only address.
-  # It should not be used in conjunction with 'provisioningHostname' unless BMCs do not
-  # support hostnames.
-  externalHttpIPv6: ""
--- a/metal3-chart/charts/ironic/Chart.yaml
+++ b/metal3-chart/charts/ironic/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: 32.0.0
+appVersion: 29.0.4
 description: A Helm chart for Ironic, used by Metal3
 name: ironic
 type: application
-version: 0.12.1
+version: 0.11.0
--- a/metal3-chart/charts/ironic/templates/_helpers.tpl
+++ b/metal3-chart/charts/ironic/templates/_helpers.tpl
@@ -83,50 +83,3 @@ Get ironic CA volumeMounts
  readOnly: true
 {{- end }}
 {{- end }}
-
-{{/*
-Get the formatted "External" hostname or IP based URL
-*/}}
-{{- define "ironic.externalHttpUrl" }}
-{{- $host := ternary (include "metal3.hostIP" .) .Values.global.externalHttpHost (empty .Values.global.externalHttpHost) }}
-{{- if regexMatch ".*:.*" $host }}
-{{- $host = print "[" $host "]" }}
-{{- end }}
-{{- $protocol := "http" }}
-{{- $port := "6180" }}
-{{- if .Values.global.enable_vmedia_tls }}
-{{- $protocol = "https" }}
-{{- $port = .Values.global.vmediaTLSPort | default "6185" }}
-{{- end }}
-{{- print $protocol "://" $host ":" $port }}
-{{- end }}
-
-{{/*
-Get the command to use for Liveness and Readiness probes
-*/}}
-{{- define "ironic.probeCommand" }}
-{{- $host := "127.0.0.1" }}
-{{- if eq .Values.listenOnAll false }}
-{{- $host = coalesce .Values.global.provisioningIP .Values.global.ironicIP .Values.global.provisioningHostname }}
-{{- if regexMatch ".*:.*" $host }}
-{{- $host = print "[" $host "]" }}
-{{- end }}
-{{- end }}
-{{- print "curl -sSfk https://" $host ":6385" }}
-{{- end }}
-
-{{/*
-Create the subjectAltNames section to be set on the Certificate
-*/}}
-{{- define "ironic.subjectAltNames" -}}
-{{- with .Values.global }}
-{{- if .provisioningHostname }}
-dnsNames:
- {{ .provisioningHostname }}
-{{- end -}}
-{{- if or .ironicIP .provisioningIP }}
-ipAddresses:
-  - {{ coalesce .provisioningIP .ironicIP }}
-{{- end }}
-{{- end }}
-{{- end }}
--- a/metal3-chart/charts/ironic/templates/certificates.yaml
+++ b/metal3-chart/charts/ironic/templates/certificates.yaml
@@ -6,7 +6,8 @@ metadata:
 spec:
  commonName: ironic-ca
  isCA: true
-  {{- include "ironic.subjectAltNames" . | indent 2 }}
+  ipAddresses:
+  - {{ .Values.global.ironicIP }}
  issuerRef:
    kind: Issuer
    name: selfsigned-issuer
@@ -18,7 +19,8 @@ metadata:
  name: ironic-cert
 spec:
  commonName: ironic-cert
-  {{- include "ironic.subjectAltNames" . | indent 2 }}
+  ipAddresses:
+  - {{ .Values.global.ironicIP }}
  issuerRef:
    kind: Issuer
    name: ca-issuer
@@ -31,7 +33,8 @@ metadata:
  name: ironic-vmedia-cert
 spec:
  commonName: ironic-vmedia-cert
-  {{- include "ironic.subjectAltNames" . | indent 2 }}
+  ipAddresses:
+  - {{ .Values.global.ironicIP }}
  issuerRef:
    kind: Issuer
    name: ca-issuer
--- a/metal3-chart/charts/ironic/templates/configmap.yaml
+++ b/metal3-chart/charts/ironic/templates/configmap.yaml
@@ -5,7 +5,16 @@ metadata:
  labels:
    {{- include "ironic.labels" . | nindent 4 }}
 data:
+  {{- $enableTLS := .Values.global.enable_tls }}
+  {{- $enableVMediaTLS := .Values.global.enable_vmedia_tls }}
+  {{- $protocol := ternary "https" "http" $enableTLS }}
+  {{- $ironicIP := .Values.global.ironicIP | default "" }}
+  {{- $ironicBootHost := print $ironicIP ":6180" }}
+  {{- $ironicCacheHost := print $ironicIP ":6180" }}
+  {{- $deployArch := .Values.global.deployArchitecture }}
+
  {{- if  ( .Values.global.enable_dnsmasq ) }}
+  DNSMASQ_BOOT_SERVER_ADDRESS: {{ $ironicBootHost }}
  DNSMASQ_DNS_SERVER_ADDRESS: {{ .Values.global.dnsmasqDNSServer }}
  DNSMASQ_DEFAULT_ROUTER: {{ .Values.global.dnsmasqDefaultRouter }}
  DHCP_RANGE: {{ .Values.global.dhcpRange }}
@@ -15,20 +24,29 @@ data:
  {{- end }}
  HTTP_PORT: "6180"
  PREDICTABLE_NIC_NAMES: "{{ .Values.global.predictableNicNames }}"
-  IRONIC_EXTERNAL_HTTP_URL: {{ include "ironic.externalHttpUrl" . }}
+  # Switch VMedia to HTTP if enable_vmedia_tls is false
+  {{- if and $enableTLS $enableVMediaTLS }}
+    {{- $ironicBootHost = print $ironicIP ":" .Values.global.vmediaTLSPort }}
+    {{- $ironicCacheHost = print $ironicIP ":" .Values.global.vmediaTLSPort }}
+    {{- $protocol = "https" }}
+  {{- else }}
+    {{- $protocol = "http" }}
+  {{- end }}
+  IRONIC_EXTERNAL_HTTP_URL: {{ $protocol }}://{{ $ironicCacheHost }}
+  DEPLOY_ARCHITECTURE: {{ $deployArch }}
+  IRONIC_BOOT_BASE_URL: {{ $protocol }}://{{ $ironicBootHost }}
  ENABLE_PXE_BOOT: "{{ .Values.global.enable_pxe_boot }}"
  {{- if .Values.global.provisioningInterface }}
  PROVISIONING_INTERFACE: {{ .Values.global.provisioningInterface }}
  {{- end }}
  {{- if .Values.global.provisioningIP }}
-  PROVISIONING_IP: {{ include "metal3.hostIP" . }}
-  {{- else if .Values.global.ironicIP }}
-  IRONIC_IP: {{ include "metal3.hostIP" . }}
-  {{- else if .Values.global.provisioningHostname }}
-  IRONIC_URL_HOSTNAME: {{ .Values.global.provisioningHostname }}
+  PROVISIONING_IP: {{ .Values.global.provisioningIP }}
  {{- end }}
  IRONIC_FAST_TRACK: "true"
-  LISTEN_ALL_INTERFACES: "{{ .Values.listenOnAll }}"
+  LISTEN_ALL_INTERFACES: "true"
+  {{- if .Values.global.ironicIP }}
+  IRONIC_IP: {{ .Values.global.ironicIP }}
+  {{- end }}
  {{- if  ( .Values.global.enable_tls ) }}
  RESTART_CONTAINER_CERTIFICATE_UPDATED: "true"
  IRONIC_KERNEL_PARAMS: {{ .Values.global.ironicKernelParams }} tls.enabled=true
@@ -52,6 +70,3 @@ data:
  {{- else }}
  IRONIC_USE_MARIADB: "false"
  {{- end }}
-  {{- with .Values.ironicExtraEnv -}}
-  {{ toYaml . | nindent 2 }}
-  {{- end -}}
--- a/metal3-chart/charts/ironic/templates/deployment.yaml
+++ b/metal3-chart/charts/ironic/templates/deployment.yaml
@@ -42,7 +42,7 @@ spec:
            name: ironic
        livenessProbe:
          exec:
-            command: ["sh", "-c", "{{ include "ironic.probeCommand" . }}"]
+            command: ["sh", "-c", "curl -sSfk https://127.0.0.1:6385"]
          failureThreshold: 10
          initialDelaySeconds: 30
          periodSeconds: 30
@@ -60,7 +60,7 @@ spec:
        {{- end }}
        readinessProbe:
          exec:
-            command: ["sh", "-c", "{{ include "ironic.probeCommand" . }}"]
+            command: ["sh", "-c", "curl -sSfk https://127.0.0.1:6385"]
          failureThreshold: 10
          initialDelaySeconds: 30
          periodSeconds: 30
@@ -160,7 +160,12 @@ spec:
        image: {{ .Values.images.ironic.repository }}:{{ .Values.images.ironic.tag }}
        imagePullPolicy: {{ .Values.images.ironic.pullPolicy }}
        securityContext:
-          {{- merge .Values.securityContext .Values.dnsmasqSecurityContext | toYaml | nindent 10 }}
+          {{- toYaml .Values.securityContext | nindent 10 }}
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - NET_RAW
        command:
        - /bin/rundnsmasq
        envFrom:
--- a/metal3-chart/charts/ironic/templates/service.yaml
+++ b/metal3-chart/charts/ironic/templates/service.yaml
@@ -10,7 +10,6 @@ metadata:
  {{- end }}
 spec:
  type: {{ .Values.service.type }}
-  ipFamilyPolicy: PreferDualStack
  ports:
  {{- $enableTLS := .Values.global.enable_tls }}
  {{- $enableVMediaTLS := .Values.global.enable_vmedia_tls }}
--- a/metal3-chart/charts/ironic/values.yaml
+++ b/metal3-chart/charts/ironic/values.yaml
@@ -32,12 +32,6 @@ global:
  # IP Address assigned to network interface on provisioning network
  provisioningIP: ""

-  # Fully Qualified Domain Name used by Ironic for both binding (to the
-  # associated IPv4 and/or IPv6 addresses) and exposing the API, dnsmask and
-  # media, also used by BMO. Note, this is the only way to enable a fully
-  # working dual-stack configuration.
-  provisioningHostname: ""
-
  # Whether the NIC names should be predictable or not
  predictableNicNames: "true"

@@ -58,17 +52,15 @@ global:

 replicaCount: 1

-listenOnAll: true
-
 images:
  ironic:
    repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic
    pullPolicy: IfNotPresent
-    tag: 32.0.0.1
+    tag: 29.0.4.0
  ironicIPADownloader:
    repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic-ipa-downloader
    pullPolicy: IfNotPresent
-    tag: 3.0.10
+    tag: 3.0.8

 nameOverride: ""
 fullnameOverride: ""
@@ -97,12 +89,6 @@ securityContext:
    type: RuntimeDefault
  runAsNonRoot: true

-dnsmasqSecurityContext:
-  capabilities:
-    add:
-    - NET_ADMIN
-    - NET_RAW
-
 service:
  type: LoadBalancer
  annotations: {}
@@ -144,8 +130,6 @@ baremetaloperator:
 debug:
  ironicRamdiskSshKey: ""

-ironicExtraEnv: {}
-
 tlscerts:
  cacert: ""
  key: ""
--- a/Show More
+++ b/Show More
Author	SHA256	Message	Date
Marco Chiappero	e5f765ec69	Let Apache use separate IPv4 and IPv6 sockets for listening to any Enable the use of two separate sockets for IPv4 and IPv6 when LISTEN_ALL_INTERFACES is set to true. While desirable, on Linux Apache uses IPv4-mapped IPv6 addresses by default, thus leveraging a single IPv6 socket for IPv4 connections as well. This behaviour is far from being desirable and can be disabled at compile time via the "--disable-v4-mapped" flag, so make sure both an ANY address Listen directive is present for both IPv4 and IPv6. When Apache is compiled with "--enable-v4-mapped", the IPv4 socket will be simply ignored. Please see https://httpd.apache.org/docs/2.4/bind.html for more information. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	2d83191e53	Update httpd.conf to bind to IPv4 and/or IPv6 sockets Enable the use of individual IPv4 and IPv6 sockets when the respective IP is detected and LISTEN_ALL_INTERFACES is not set to true. This allows to correctly bind to both the IPv4 and IPv6 addresses found and not just one of them. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	11cd6f8ebe	Let Ironic API use IPv4 and IPv6 sockets when possible When LISTEN_ALL_INTERFACES is not set, Apache should make Ironic API avaiable on either or both IPv4 and IPv6 sockets, depending on the addresses requested or found on the system. Make sure to set the "Listen" directive according to ENABLE_IPV4 and ENABLE_IPV4, and the VirtualHost when IRONIC_URL_HOSTNAME is present. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	ad68f891f5	Set host_ip to an IPv6 address when found Prioritize IPv6 over IPv4 when available to set host_ip in ironic.conf when LISTEN_ALL_INTERFACES is not set to true. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	e155a809b8	Use my_ipv6 when IRONIC_IPV6 is defined in ironic.conf As per the Ironic documentation: "This field [my_ip] does accept an IPv6 address as an override for templates and URLs, however it is recommended that [DEFAULT]my_ipv6 is used along with DNS names for service URLs for dual-stack environments." Fill my_ipv6 when an IPv6 address has been found for binding. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	8b6d7e409c	Allow binding on the provisioning network via a hostname In a dual-stack scenario, especially when deploying in direct mode via virtual media, it might be useful to 1) use a hostname to enable "dual IP" URLs 2) have ironic bind to those two addresses, if found on the system. To make this possible, this commit introduces: - a new user environment variable named IRONIC_URL_HOSTNAME, to be used as immutable external only input, to derive IRONIC_URL_HOST and the IP addresses to bind on - a new utility function named "get_ip_of_hostname" to help look up the A and AAAA records - additional logic to look for the returned address on the system, for binding the processes; this new logic has lower priority than PROVISIONING_IP (which can then be used to enforce one specific IP version) and PROVISIONING_INTERFACE Note, while IRONIC_URL_HOSTNAME and PROVISIONING_IP are considered to be mutually exclusive, IRONIC_URL_HOSTNAME and PROVISIONING_INTERFACE are not. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	e6700bd732	Introduce IRONIC_IPV6 to bind on IPv6 sockets The ironic scripts either use PROVISIONING_IP as an input or try to determine an IP address to bind the sockets to. This results in IRONIC_IP being defined once the process is complete, and it can carry either an IPv4 or an IPv6 address. Likely, the assumption is that on Linux, by default, IPv4-mapped IPv6 addresses can be leveraged to serve both IPv4 and IPv6 through a single socket. However this is not a good practice and two separate sockets should be used instead, whenever possible. This change modifies such logic by - introducing the variable IRONIC_IPV6 alongside the existing - matching IRONIC_IP and attempting to populate both variables Please note that hostname based URLs, with both A and AAAA records, are also required for a fully working dual-stack configuration. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	a1ee32b951	Revert 2742439 being now redundant Commit 2742439 added logic to tentatively identify the interface name in get_provisioning_interface if the PROVISIONING_IP is provided. However the same process in then repeated in wait_for_interface_or_ip. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	250635e51c	Leverage get_interface_of_ip to look PROVISIONING_IP up Use the previously introduced get_interface_of_ip, to determine if the PROVISIONING_IP address is actually present on a network interface. This improves the code readability and enables additional debugging output. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:25 +00:00
Marco Chiappero	f5676b293c	Add two new utility functions for later refactoring The way the ironic-image processes are bound to internet sockets is mainly by PROVISIONING_IP or PROVISIONING_INTERFACE, that is, by looking up a specific address on an interface, or a specific interface for a workable address. Introduce two new utility functions in ironic-common.sh for these two purposes: get_interface_of_ip: returns the name of the interface where the IP address provided as argument is found get_ip_of_interface: returns the first IP associated to the interface provided as argument These two functions will be put into use in subsequent commits. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 19:15:23 +00:00
Marco Chiappero	1f98a15d26	Remove PROVISIONING_INTERFACE default for better validation Whenever PROVISIONING_INTERFACE is not set by the user, function get_provisioning_interface attempts to determine one, or provide "provisionign" as default value. However this can cause confusing errors down the line. Remove this default value and fail gracefully, with proper logging, if the PROVISIONING_INTERFACE value is not detected. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 17:38:30 +00:00
Marco Chiappero	783a3fd5c2	Simplify the setting of host_ip in ironic.conf The value of host_ip is determined twice within the ironic.conf.j2 template file, by means of a relatively hard to read set of conditions. Avoid this duplication and improve readability by exporting the correct value once in scripts/configure-ironic.sh. This also leave more room for more complex evaluations should these be needed in the future. Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>	2025-07-29 17:38:30 +00:00