Try with my PR

Signed-off-by: Nicolas Belouin <nicolas.belouin@suse.com>

_config

@@ -60,6 +60,7 @@ BuildFlags: onlybuild:release-manifest-image
     BuildFlags: excludebuild:endpoint-copier-operator-image
     BuildFlags: excludebuild:ironic-image
     BuildFlags: excludebuild:ironic-ipa-downloader-image
+    BuildFlags: excludebuild:kiwi-builder-image
     BuildFlags: excludebuild:kubectl-image
     BuildFlags: excludebuild:kube-rbac-proxy-image
     BuildFlags: excludebuild:metallb-controller-image
@@ -149,6 +150,10 @@ BuildFlags: onlybuild:release-manifest-image
 %else
     %if "%{sub %{reverse %_project} 1 7}" != "%{reverse :ToTest}" && "%{sub %{reverse %_project} 1 9}" != "%{reverse :Snapshot}"
       BuildFlags: excludebuild:kiwi-builder-image
+    %else
+      %ifarch aarch64
+        BuildFlags: onlybuild:kiwi-builder-image
+      %endif
     %endif
 %endif
 

akri-dashboard-extension-chart/Chart.yaml

@@ -1,4 +1,3 @@
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2
 #!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1
 #!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1-%RELEASE%
 annotations:

baremetal-operator-image/Dockerfile

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.1
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0-%RELEASE%
 #!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

baremetal-operator/0001-Allow-configuring-different-IPA-images-per-architect.patch

@@ -0,0 +1,529 @@
+From 19cbf4febbf042248266188e3629e0c88e06906a Mon Sep 17 00:00:00 2001
+From: Nicolas Belouin <nicolas.belouin@suse.com>
+Date: Thu, 26 Jun 2025 09:37:19 +0200
+Subject: [PATCH] Allow configuring different IPA images per architecture
+
+When using multiple architectures, having a way to set the Ironic
+"bootloader" (a.k.a EFI partition) accordingly is important, so this
+commit adds a new `DEPLOY_BOOTLOADER_URL` variable to set this Ironic
+option.
+
+This commit adds a set of new environment variables allowing to specify
+different URLs per target CPU architecture for the IPA image:
+ - `DEPLOY_KERNEL_URL_<ARCH>`
+ - `DEPLOY_RAMDISK_URL_<ARCH>`
+ - `DEPLOY_ISO_URL_<ARCH>`
+ - `DEPLOY_BOOTLOADER_URL_<ARCH>`
+
+Non suffixed variables are used as defaults, if there is no architecture
+specific image(s) defined for the BMH CPU architecture.
+
+Signed-off-by: Nicolas Belouin <nicolas.belouin@suse.com>
+---
+ .../metal3.io/baremetalhost_controller.go     |  1 +
+ pkg/imageprovider/imageprovider.go            |  1 +
+ pkg/provisioner/ironic/factory.go             | 61 ++++++++++----
+ pkg/provisioner/ironic/factory_test.go        | 25 ++++--
+ pkg/provisioner/ironic/ironic.go              | 46 ++++++++---
+ pkg/provisioner/ironic/ironic_test.go         | 10 ++-
+ pkg/provisioner/ironic/register_test.go       | 80 ++++++++++++-------
+ pkg/provisioner/provisioner.go                |  1 +
+ 8 files changed, 160 insertions(+), 65 deletions(-)
+
+diff --git a/internal/controller/metal3.io/baremetalhost_controller.go b/internal/controller/metal3.io/baremetalhost_controller.go
+index d04bb618..a4ea9d19 100644
+--- a/internal/controller/metal3.io/baremetalhost_controller.go
++++ b/internal/controller/metal3.io/baremetalhost_controller.go
+@@ -847,6 +847,7 @@ func (r *BareMetalHostReconciler) registerHost(prov provisioner.Provisioner, inf
+ 			PreprovisioningNetworkData: preprovisioningNetworkData,
+ 			HasCustomDeploy:            hasCustomDeploy(info.host),
+ 			DisablePowerOff:            info.host.Spec.DisablePowerOff,
++			CPUArchitecture:            getHostArchitecture(info.host),
+ 		},
+ 		credsChanged,
+ 		info.host.Status.ErrorType == metal3api.RegistrationError)
+diff --git a/pkg/imageprovider/imageprovider.go b/pkg/imageprovider/imageprovider.go
+index 459fdf2d..f307c041 100644
+--- a/pkg/imageprovider/imageprovider.go
++++ b/pkg/imageprovider/imageprovider.go
+@@ -20,6 +20,7 @@ type ImageData struct {
+ type GeneratedImage struct {
+ 	ImageURL          string
+ 	KernelURL         string
++	BootloaderURL     string
+ 	ExtraKernelParams string
+ }
+ 
+diff --git a/pkg/provisioner/ironic/factory.go b/pkg/provisioner/ironic/factory.go
+index 95cc21b4..5f4189bb 100644
+--- a/pkg/provisioner/ironic/factory.go
++++ b/pkg/provisioner/ironic/factory.go
+@@ -58,9 +58,10 @@ func (f *ironicProvisionerFactory) init(havePreprovImgBuilder bool) error {
+ 	f.log.Info("ironic settings",
+ 		"endpoint", ironicEndpoint,
+ 		"ironicAuthType", ironicAuth.Type,
+-		"deployKernelURL", f.config.deployKernelURL,
+-		"deployRamdiskURL", f.config.deployRamdiskURL,
+-		"deployISOURL", f.config.deployISOURL,
++		"defaultDeployKernelURL", f.config.defaultDeployConfig.kernelURL,
++		"defaultDeployRamdiskURL", f.config.defaultDeployConfig.ramdiskURL,
++		"defaultDeployISOURL", f.config.defaultDeployConfig.ISOURL,
++		"defaultDeployBootloaderURL", f.config.defaultDeployConfig.bootloaderURL,
+ 		"liveISOForcePersistentBootDevice", f.config.liveISOForcePersistentBootDevice,
+ 		"CACertFile", tlsConf.TrustedCAFile,
+ 		"ClientCertFile", tlsConf.ClientCertificateFile,
+@@ -105,27 +106,55 @@ func (f ironicProvisionerFactory) NewProvisioner(ctx context.Context, hostData p
+ 	return f.ironicProvisioner(ctx, hostData, publisher)
+ }
+ 
+-func loadConfigFromEnv(havePreprovImgBuilder bool) (ironicConfig, error) {
+-	c := ironicConfig{
+-		havePreprovImgBuilder: havePreprovImgBuilder,
++func loadDeployURLFromEnv(arch string, havePreprovImgBuilder bool) (ironicDeployConfig, error) {
++	c := ironicDeployConfig{}
++	var suffix string
++	if arch != "" {
++		suffix = "_" + strings.ToUpper(arch)
+ 	}
++	c.kernelURL = os.Getenv("DEPLOY_KERNEL_URL" + suffix)
++	c.ramdiskURL = os.Getenv("DEPLOY_RAMDISK_URL" + suffix)
++	c.ISOURL = os.Getenv("DEPLOY_ISO_URL" + suffix)
++	c.bootloaderURL = os.Getenv("DEPLOY_BOOTLOADER_URL" + suffix)
+ 
+-	c.deployKernelURL = os.Getenv("DEPLOY_KERNEL_URL")
+-	c.deployRamdiskURL = os.Getenv("DEPLOY_RAMDISK_URL")
+-	c.deployISOURL = os.Getenv("DEPLOY_ISO_URL")
+ 	if !havePreprovImgBuilder {
+-		if c.deployISOURL == "" &&
+-			(c.deployKernelURL == "" || c.deployRamdiskURL == "") {
+-			return c, errors.New("either DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL or DEPLOY_ISO_URL must be set")
+-		}
+-		if (c.deployKernelURL == "" && c.deployRamdiskURL != "") ||
+-			(c.deployKernelURL != "" && c.deployRamdiskURL == "") {
++		if (c.kernelURL == "" && c.ramdiskURL != "") ||
++			(c.kernelURL != "" && c.ramdiskURL == "") {
+ 			return c, errors.New("DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL can only be set together")
+ 		}
+ 	}
+-	if c.deployKernelURL == "" && c.deployRamdiskURL != "" {
++	if c.kernelURL == "" && c.ramdiskURL != "" {
+ 		return c, errors.New("DEPLOY_RAMDISK_URL requires DEPLOY_KERNEL_URL to be set also")
+ 	}
++	return c, nil
++}
++
++func loadConfigFromEnv(havePreprovImgBuilder bool) (ironicConfig, error) {
++	c := ironicConfig{
++		havePreprovImgBuilder: havePreprovImgBuilder,
++		archDeployConfig:      make(map[string]ironicDeployConfig),
++	}
++	var err error
++	c.defaultDeployConfig, err = loadDeployURLFromEnv("", havePreprovImgBuilder)
++	if err != nil {
++		return c, err
++	}
++	for _, arch := range supportedArch {
++		archDeployConfig, err := loadDeployURLFromEnv(arch, havePreprovImgBuilder)
++		// Only register valid arch specific deploy configuration
++		if archDeployConfig.ISOURL != "" || (archDeployConfig.kernelURL != "" && archDeployConfig.ramdiskURL != "") {
++			c.archDeployConfig[arch] = archDeployConfig
++		}
++		if err != nil {
++			return c, err
++		}
++	}
++	if !havePreprovImgBuilder {
++		if c.defaultDeployConfig.ISOURL == "" &&
++			(c.defaultDeployConfig.kernelURL == "" || c.defaultDeployConfig.ramdiskURL == "") {
++			return c, errors.New("either DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL or DEPLOY_ISO_URL must be set")
++		}
++	}
+ 
+ 	c.maxBusyHosts = 20
+ 	if maxHostsStr := os.Getenv("PROVISIONING_LIMIT"); maxHostsStr != "" {
+diff --git a/pkg/provisioner/ironic/factory_test.go b/pkg/provisioner/ironic/factory_test.go
+index db47d8b2..acdedf1c 100644
+--- a/pkg/provisioner/ironic/factory_test.go
++++ b/pkg/provisioner/ironic/factory_test.go
+@@ -14,6 +14,11 @@ type EnvFixture struct {
+ 	kernelURL                        string
+ 	ramdiskURL                       string
+ 	isoURL                           string
++	bootloaderURL                    string
++	aarch64kernelURL                 string
++	aarch64ramdiskURL                string
++	aarch64isoURL                    string
++	aarch64bootloaderURL             string
+ 	liveISOForcePersistentBootDevice string
+ 	ironicCACertFile                 string
+ 	ironicClientCertFile             string
+@@ -49,6 +54,11 @@ func (f *EnvFixture) SetUp() {
+ 	f.replace("DEPLOY_KERNEL_URL", f.kernelURL)
+ 	f.replace("DEPLOY_RAMDISK_URL", f.ramdiskURL)
+ 	f.replace("DEPLOY_ISO_URL", f.isoURL)
++	f.replace("DEPLOY_BOOTLOADER_URL", f.bootloaderURL)
++	f.replace("DEPLOY_KERNEL_URL_AARCH64", f.aarch64kernelURL)
++	f.replace("DEPLOY_RAMDISK_URL_AARCH64", f.aarch64ramdiskURL)
++	f.replace("DEPLOY_ISO_URL_AARCH64", f.aarch64isoURL)
++	f.replace("DEPLOY_BOOTLOADER_URL_AARCH64", f.aarch64bootloaderURL)
+ 	f.replace("LIVE_ISO_FORCE_PERSISTENT_BOOT_DEVICE", f.liveISOForcePersistentBootDevice)
+ 	f.replace("IRONIC_CACERT_FILE", f.ironicCACertFile)
+ 	f.replace("IRONIC_CLIENT_CERT_FILE", f.ironicClientCertFile)
+@@ -58,9 +68,14 @@ func (f *EnvFixture) SetUp() {
+ }
+ func (f EnvFixture) VerifyConfig(t *testing.T, c ironicConfig, _ string) {
+ 	t.Helper()
+-	assert.Equal(t, f.kernelURL, c.deployKernelURL)
+-	assert.Equal(t, f.ramdiskURL, c.deployRamdiskURL)
+-	assert.Equal(t, f.isoURL, c.deployISOURL)
++	assert.Equal(t, f.kernelURL, c.defaultDeployConfig.kernelURL)
++	assert.Equal(t, f.ramdiskURL, c.defaultDeployConfig.ramdiskURL)
++	assert.Equal(t, f.isoURL, c.defaultDeployConfig.ISOURL)
++	assert.Equal(t, f.bootloaderURL, c.defaultDeployConfig.bootloaderURL)
++	assert.Equal(t, f.aarch64kernelURL, c.archDeployConfig["aarch64"].kernelURL)
++	assert.Equal(t, f.aarch64ramdiskURL, c.archDeployConfig["aarch64"].ramdiskURL)
++	assert.Equal(t, f.aarch64isoURL, c.archDeployConfig["aarch64"].ISOURL)
++	assert.Equal(t, f.aarch64bootloaderURL, c.archDeployConfig["aarch64"].bootloaderURL)
+ 	assert.Equal(t, f.liveISOForcePersistentBootDevice, c.liveISOForcePersistentBootDevice)
+ }
+ 
+@@ -108,14 +123,14 @@ func TestLoadConfigFromEnv(t *testing.T) {
+ 			env: EnvFixture{
+ 				kernelURL: "http://kernel",
+ 			},
+-			expectedError: "either DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL or DEPLOY_ISO_URL must be set",
++			expectedError: "DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL can only be set together",
+ 		},
+ 		{
+ 			name: "only ramdisk",
+ 			env: EnvFixture{
+ 				ramdiskURL: "http://ramdisk",
+ 			},
+-			expectedError:         "either DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL or DEPLOY_ISO_URL must be set",
++			expectedError:         "DEPLOY_KERNEL_URL and DEPLOY_RAMDISK_URL can only be set together",
+ 			expectedImgBuildError: "DEPLOY_RAMDISK_URL requires DEPLOY_KERNEL_URL to be set also",
+ 		},
+ 		{
+diff --git a/pkg/provisioner/ironic/ironic.go b/pkg/provisioner/ironic/ironic.go
+index 4bc753f2..52d03479 100644
+--- a/pkg/provisioner/ironic/ironic.go
++++ b/pkg/provisioner/ironic/ironic.go
+@@ -30,6 +30,7 @@ var (
+ 	subscriptionRequeueDelay  = time.Second * 10
+ 	introspectionRequeueDelay = time.Second * 15
+ 	softPowerOffTimeout       = time.Second * 180
++	supportedArch             = [...]string{"x86_64", "aarch64"}
+ )
+ 
+ const (
+@@ -41,6 +42,7 @@ const (
+ 	nameSeparator        = "~"
+ 	customDeployPriority = 80
+ 
++	bootloaderKey    = "bootloader"
+ 	deployKernelKey  = "deploy_kernel"
+ 	deployRamdiskKey = "deploy_ramdisk"
+ 	deployISOKey     = "deploy_iso"
+@@ -61,11 +63,17 @@ func NewMacAddressConflictError(address, node string) error {
+ 	return macAddressConflictError{Address: address, ExistingNode: node}
+ }
+ 
++type ironicDeployConfig struct {
++	kernelURL     string
++	ramdiskURL    string
++	bootloaderURL string
++	ISOURL        string
++}
++
+ type ironicConfig struct {
+ 	havePreprovImgBuilder            bool
+-	deployKernelURL                  string
+-	deployRamdiskURL                 string
+-	deployISOURL                     string
++	defaultDeployConfig              ironicDeployConfig
++	archDeployConfig                 map[string]ironicDeployConfig
+ 	liveISOForcePersistentBootDevice string
+ 	maxBusyHosts                     int
+ 	externalURL                      string
+@@ -318,7 +326,7 @@ func (p *ironicProvisioner) createPXEEnabledNodePort(uuid, macAddress string) er
+ func (p *ironicProvisioner) configureImages(data provisioner.ManagementAccessData, ironicNode *nodes.Node, bmcAccess bmc.AccessDetails) (result provisioner.Result, err error) {
+ 	updater := clients.UpdateOptsBuilder(p.log)
+ 
+-	deployImageInfo := setDeployImage(p.config, bmcAccess, data.PreprovisioningImage)
++	deployImageInfo := setDeployImage(p.config, bmcAccess, data.PreprovisioningImage, data.CPUArchitecture)
+ 	updater.SetDriverInfoOpts(deployImageInfo, ironicNode)
+ 
+ 	// NOTE(dtantsur): It is risky to update image information for active nodes since it may affect the ability to clean up.
+@@ -430,14 +438,20 @@ func setExternalURL(p *ironicProvisioner, driverInfo map[string]interface{}) map
+ 	return driverInfo
+ }
+ 
+-func setDeployImage(config ironicConfig, accessDetails bmc.AccessDetails, hostImage *provisioner.PreprovisioningImage) clients.UpdateOptsData {
++func setDeployImage(config ironicConfig, accessDetails bmc.AccessDetails, hostImage *provisioner.PreprovisioningImage, cpuArch string) clients.UpdateOptsData {
+ 	deployImageInfo := clients.UpdateOptsData{
++		bootloaderKey:    nil,
+ 		deployKernelKey:  nil,
+ 		deployRamdiskKey: nil,
+ 		deployISOKey:     nil,
+ 		kernelParamsKey:  nil,
+ 	}
+ 
++	deployConfig, ok := config.archDeployConfig[cpuArch]
++	if !ok {
++		deployConfig = config.defaultDeployConfig
++	}
++
+ 	allowISO := accessDetails.SupportsISOPreprovisioningImage()
+ 
+ 	if hostImage != nil {
+@@ -450,10 +464,15 @@ func setDeployImage(config ironicConfig, accessDetails bmc.AccessDetails, hostIm
+ 		case metal3api.ImageFormatInitRD:
+ 			if hostImage.KernelURL != "" {
+ 				deployImageInfo[deployKernelKey] = hostImage.KernelURL
+-			} else if config.deployKernelURL == "" {
++			} else if deployConfig.kernelURL == "" {
+ 				return nil
+ 			} else {
+-				deployImageInfo[deployKernelKey] = config.deployKernelURL
++				deployImageInfo[deployKernelKey] = deployConfig.kernelURL
++			}
++			if hostImage.BootloaderURL != "" {
++				deployImageInfo[bootloaderKey] = hostImage.BootloaderURL
++			} else if deployConfig.bootloaderURL != "" {
++				deployImageInfo[bootloaderKey] = deployConfig.bootloaderURL
+ 			}
+ 			deployImageInfo[deployRamdiskKey] = hostImage.ImageURL
+ 			if hostImage.ExtraKernelParams != "" {
+@@ -465,13 +484,16 @@ func setDeployImage(config ironicConfig, accessDetails bmc.AccessDetails, hostIm
+ 	}
+ 
+ 	if !config.havePreprovImgBuilder {
+-		if allowISO && config.deployISOURL != "" {
+-			deployImageInfo[deployISOKey] = config.deployISOURL
++		if allowISO && deployConfig.ISOURL != "" {
++			deployImageInfo[deployISOKey] = deployConfig.ISOURL
+ 			return deployImageInfo
+ 		}
+-		if config.deployKernelURL != "" && config.deployRamdiskURL != "" {
+-			deployImageInfo[deployKernelKey] = config.deployKernelURL
+-			deployImageInfo[deployRamdiskKey] = config.deployRamdiskURL
++		if deployConfig.kernelURL != "" && deployConfig.ramdiskURL != "" {
++			deployImageInfo[deployKernelKey] = deployConfig.kernelURL
++			deployImageInfo[deployRamdiskKey] = deployConfig.ramdiskURL
++			if deployConfig.bootloaderURL != "" {
++				deployImageInfo[bootloaderKey] = deployConfig.bootloaderURL
++			}
+ 			return deployImageInfo
+ 		}
+ 	}
+diff --git a/pkg/provisioner/ironic/ironic_test.go b/pkg/provisioner/ironic/ironic_test.go
+index a8759c44..f65592e6 100644
+--- a/pkg/provisioner/ironic/ironic_test.go
++++ b/pkg/provisioner/ironic/ironic_test.go
+@@ -27,10 +27,12 @@ func newTestProvisionerFactory() ironicProvisionerFactory {
+ 	return ironicProvisionerFactory{
+ 		log: logf.Log,
+ 		config: ironicConfig{
+-			deployKernelURL:  "http://deploy.test/ipa.kernel",
+-			deployRamdiskURL: "http://deploy.test/ipa.initramfs",
+-			deployISOURL:     "http://deploy.test/ipa.iso",
+-			maxBusyHosts:     20,
++			defaultDeployConfig: ironicDeployConfig{
++				kernelURL:  "http://deploy.test/ipa.kernel",
++				ramdiskURL: "http://deploy.test/ipa.initramfs",
++				ISOURL:     "http://deploy.test/ipa.iso",
++			},
++			maxBusyHosts: 20,
+ 		},
+ 	}
+ }
+diff --git a/pkg/provisioner/ironic/register_test.go b/pkg/provisioner/ironic/register_test.go
+index c7d6bc75..9ded5946 100644
+--- a/pkg/provisioner/ironic/register_test.go
++++ b/pkg/provisioner/ironic/register_test.go
+@@ -1112,9 +1112,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "iso no imgbuilder",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: false,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver:      isoDriver,
+ 			ExpectBuild: false,
+@@ -1125,8 +1127,10 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "no imgbuilder no iso",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: false,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++				},
+ 			},
+ 			Driver:      isoDriver,
+ 			ExpectBuild: false,
+@@ -1137,9 +1141,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe no imgbuilder",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: false,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver:      pxeDriver,
+ 			ExpectBuild: false,
+@@ -1150,9 +1156,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "iso no build",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver:    isoDriver,
+ 			ExpectISO: false,
+@@ -1162,9 +1170,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "iso build",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver: isoDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1181,9 +1191,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe build",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver: pxeDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1200,9 +1212,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe build with new kernel and kernel params",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver: pxeDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1223,9 +1237,11 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe iso build",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
+-				deployRamdiskURL:      localRamdisk,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL:  localKernel,
++					ramdiskURL: localRamdisk,
++					ISOURL:     localIso,
++				},
+ 			},
+ 			Driver: pxeDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1242,7 +1258,9 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe build no kernel",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					ISOURL: localIso,
++				},
+ 			},
+ 			Driver: pxeDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1273,7 +1291,9 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe iso build no initrd",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL: localKernel,
++				},
+ 			},
+ 			Driver: pxeDriver,
+ 			Image: &provisioner.PreprovisioningImage{
+@@ -1289,7 +1309,9 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "no build no initrd",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: true,
+-				deployKernelURL:       localKernel,
++				defaultDeployConfig: ironicDeployConfig{
++					kernelURL: localKernel,
++				},
+ 			},
+ 			Driver:    pxeDriver,
+ 			ExpectISO: false,
+@@ -1299,7 +1321,9 @@ func TestSetDeployImage(t *testing.T) {
+ 			Scenario: "pxe no imgbuilder no pxe",
+ 			Config: ironicConfig{
+ 				havePreprovImgBuilder: false,
+-				deployISOURL:          localIso,
++				defaultDeployConfig: ironicDeployConfig{
++					ISOURL: localIso,
++				},
+ 			},
+ 			Driver:    pxeDriver,
+ 			ExpectISO: false,
+@@ -1318,7 +1342,7 @@ func TestSetDeployImage(t *testing.T) {
+ 
+ 	for _, tc := range testCases {
+ 		t.Run(tc.Scenario, func(t *testing.T) {
+-			opts := setDeployImage(tc.Config, tc.Driver, tc.Image)
++			opts := setDeployImage(tc.Config, tc.Driver, tc.Image, "x86_64")
+ 
+ 			switch {
+ 			case tc.ExpectISO:
+diff --git a/pkg/provisioner/provisioner.go b/pkg/provisioner/provisioner.go
+index faddd0fd..f7f55c0d 100644
+--- a/pkg/provisioner/provisioner.go
++++ b/pkg/provisioner/provisioner.go
+@@ -82,6 +82,7 @@ type ManagementAccessData struct {
+ 	PreprovisioningNetworkData string
+ 	HasCustomDeploy            bool
+ 	DisablePowerOff            bool
++	CPUArchitecture            string
+ }
+ 
+ type AdoptData struct {
+-- 
+2.50.0
+

baremetal-operator/_service

@@ -2,7 +2,7 @@
  <service name="obs_scm">
     <param name="url">https://github.com/metal3-io/baremetal-operator</param>
     <param name="scm">git</param>
-    <param name="revision">v0.9.1</param>
+    <param name="revision">v0.10.2</param>
     <param name="version">_auto_</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>

baremetal-operator/baremetal-operator.spec

@@ -17,14 +17,15 @@
 
 
 Name:           baremetal-operator
-Version:        0.9.1
+Version:        0.10.2
 Release:        0
 Summary:        Implements a Kubernetes API for managing bare metal hosts
 License:        Apache-2.0
 URL:            https://github.com/metal3-io/baremetal-operator
+Patch0:         0001-Allow-configuring-different-IPA-images-per-architect.patch
 Source:         baremetal-operator-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.23
+BuildRequires:  golang(API) = 1.24
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}
 

edge-image-builder-image/Dockerfile

@@ -1,5 +1,5 @@
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.0.1
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.1
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.0.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.2.1-%RELEASE%
 #!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-base:$SLE_VERSION
@@ -15,11 +15,11 @@ RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE edge-image-builder Container Image"
 LABEL org.opencontainers.image.description="edge-image-builder based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="1.2.0"
+LABEL org.opencontainers.image.version="1.2.1"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.2.0.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.2.1-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"

edge-image-builder-image/artifacts.yaml

@@ -5,7 +5,7 @@ metallb:
 endpoint-copier-operator:
   chart: endpoint-copier-operator
   repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.0+up0.2.1"
+  version: "%%CHART_MAJOR%%.0.1+up0.3.0"
 kubernetes:
   k3s:
     selinuxPackage: k3s-selinux-1.6-1.slemicro.noarch

edge-image-builder/_service

@@ -3,7 +3,7 @@
     <param name="url">https://github.com/suse-edge/edge-image-builder.git</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">v1.2.0</param>
+    <param name="revision">v1.2.1</param>
     <!-- Uncomment and set this For Pre-Release Version -->
     <!-- <param name="version">1.2.0~rc1</param> -->
     <!-- Uncomment and this for regular version -->

edge-image-builder/edge-image-builder.spec

@@ -17,7 +17,7 @@
 
 
 Name:           edge-image-builder
-Version:        1.2.0
+Version:        1.2.1
 Release:        0
 Summary:        Edge Image Builder
 License:        Apache-2.0

endpoint-copier-operator-chart/Chart.yaml

@@ -1,8 +1,8 @@
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0-%RELEASE%
 apiVersion: v2
-appVersion: v0.2.0
+appVersion: v0.3.0
 description: A Helm chart for Kubernetes
 name: endpoint-copier-operator
 type: application
-version: "%%CHART_MAJOR%%.0.0+up0.2.1"
+version: "%%CHART_MAJOR%%.0.1+up0.3.0"

endpoint-copier-operator-chart/templates/deployment.yaml

@@ -20,8 +20,23 @@ spec:
       labels:
         {{- include "endpoint-copier-operator.selectorLabels" . | nindent 8 }}
     spec:
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - command:
         - /manager

endpoint-copier-operator-chart/templates/rbac/role.yaml

@@ -7,9 +7,9 @@ metadata:
   name: {{ include "endpoint-copier-operator.fullname" . }}
 rules:
 - apiGroups:
-  - ""
+  - "discovery.k8s.io"
   resources:
-  - endpoints
+  - endpointslices
   verbs:
   - create
   - delete

endpoint-copier-operator-chart/values.yaml

@@ -8,7 +8,7 @@ image:
   repository: %%IMG_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: "0.2.0"
+  tag: "0.3.0"
 
 nameOverride: "endpoint-copier-operator"
 fullnameOverride: "endpoint-copier-operator"
@@ -29,6 +29,8 @@ podSecurityContext:
   seccompProfile:
     type: RuntimeDefault
 
+priorityClassName: "system-cluster-critical"
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -37,11 +39,11 @@ securityContext:
 
 resources:
   limits:
-    cpu: 500m
+    cpu: 100m
-    memory: 128Mi
-  requests:
-    cpu: 10m
     memory: 64Mi
+  requests:
+    cpu: 5m
+    memory: 32Mi
 
 autoscaling:
   enabled: false

endpoint-copier-operator/_service

@@ -2,7 +2,7 @@
  <service name="obs_scm">
     <param name="url">https://github.com/suse-edge/endpoint-copier-operator</param>
     <param name="scm">git</param>
-    <param name="revision">v0.2.0</param>
+    <param name="revision">v0.3.0</param>
     <param name="version">_auto_</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>

endpoint-copier-operator/endpoint-copier-operator.spec

@@ -17,14 +17,14 @@
 
 
 Name:           endpoint-copier-operator
-Version:        0.2.0
+Version:        0.3.0
-Release:        0.2.0
+Release:        0.3.0
 Summary:        Implements a Kubernetes API for copying endpoint resources
 License:        Apache-2.0
 URL:            https://github.com/suse-edge/endpoint-copier-operator
 Source:         endpoint-copier-operator-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.20
+BuildRequires:  golang(API) = 1.24
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}
 

ironic-image/inspector-apache.conf.j2

@@ -1,57 +0,0 @@
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-
-{% if env.LISTEN_ALL_INTERFACES | lower == "true" %}
-Listen {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
- <VirtualHost *:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
-{% else %}
-Listen {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
- <VirtualHost {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
-{% endif %}
-    {% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
-    ProxyPass "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
-    ProxyPassReverse "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
-    {% else %}
-    ProxyPass "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
-    ProxyPassReverse "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
-    {% endif %}
-
-    SetEnv APACHE_RUN_USER ironic-suse
-    SetEnv APACHE_RUN_GROUP ironic-suse
-
-    ErrorLog /dev/stdout
-    LogLevel debug
-    CustomLog /dev/stdout combined
-
-    SSLEngine On
-    SSLProtocol {{ env.IRONIC_SSL_PROTOCOL }}
-    SSLCertificateFile {{ env.IRONIC_INSPECTOR_CERT_FILE }} 
-    SSLCertificateKeyFile {{ env.IRONIC_INSPECTOR_KEY_FILE }}
-
-    {% if "INSPECTOR_HTPASSWD" in env and env.INSPECTOR_HTPASSWD | length %}
-    <Location / >
-        AuthType Basic
-        AuthName "Restricted area"
-        AuthUserFile "/etc/ironic-inspector/htpasswd"
-        Require valid-user
-    </Location>
-
-    <Location ~ "^/(v1/?)?$" >
-        Require all granted
-    </Location>
-
-    <Location /v1/continue >
-        Require all granted
-    </Location>
-    {% endif %}
-</VirtualHost>

ironic-image/ironic-inspector.conf.j2

@@ -1,68 +0,0 @@
-[DEFAULT]
-auth_strategy = noauth
-debug = true
-transport_url = fake://
-use_stderr = true
-{% if env.INSPECTOR_REVERSE_PROXY_SETUP == "true" %}
-{% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
-listen_unix_socket = /shared/inspector.sock
-# NOTE(dtantsur): this is not ideal, but since the socket is accessed from
-# another container, we need to make it world-writeable.
-listen_unix_socket_mode = 0666
-{% else %}
-listen_port = {{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}
-listen_address = 127.0.0.1
-{% endif %}
-{% elif env.LISTEN_ALL_INTERFACES | lower == "true" %}
-listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
-listen_address = ::
-{% else %}
-listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
-listen_address = {{ env.IRONIC_IP }}
-{% endif %}
-host = {{ env.IRONIC_IP }}
-{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
-use_ssl = true
-{% endif %}
-
-[database]
-connection = sqlite:////var/lib/ironic-inspector/ironic-inspector.db
-
-{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
-[discovery]
-enroll_node_driver = ipmi
-{% endif %}
-
-[ironic]
-auth_type = none
-endpoint_override = {{ env.IRONIC_BASE_URL }}
-{% if env.IRONIC_TLS_SETUP == "true" %}
-cafile = {{ env.IRONIC_CACERT_FILE }}
-insecure = {{ env.IRONIC_INSECURE }}
-{% endif %}
-
-[processing]
-add_ports = all
-always_store_ramdisk_logs = true
-keep_ports = present
-{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
-node_not_found_hook = enroll
-{% endif %}
-permit_active_introspection = true
-power_off = false
-processing_hooks = $default_processing_hooks,lldp_basic
-ramdisk_logs_dir = /shared/log/ironic-inspector/ramdisk
-store_data = database
-
-[pxe_filter]
-driver = noop
-
-[service_catalog]
-auth_type = none
-endpoint_override = {{ env.IRONIC_INSPECTOR_BASE_URL }}
-
-{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
-[ssl]
-cert_file = {{ env.IRONIC_INSPECTOR_CERT_FILE }}
-key_file = {{ env.IRONIC_INSPECTOR_KEY_FILE }}
-{% endif %}

ironic-image/runironic-api

@@ -1,13 +0,0 @@
-#!/usr/bin/bash
-
-export IRONIC_DEPLOYMENT="API"
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-export IRONIC_REVERSE_PROXY_SETUP=false
-
-python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < /tmp/httpd-ironic-api.conf.j2 > /etc/httpd/conf.d/ironic.conf
-
-# shellcheck disable=SC1091
-. /bin/runhttpd

ironic-image/runironic-conductor

@@ -1,20 +0,0 @@
-#!/usr/bin/bash
-
-export IRONIC_DEPLOYMENT="Conductor"
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-# Ramdisk logs
-mkdir -p /shared/log/ironic/deploy
-
-run_ironic_dbsync
-
-if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-    # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
-        kill $(pgrep ironic)
-    done &
-fi
-
-exec /usr/bin/ironic-conductor

ironic-image/runironic-inspector

@@ -1,62 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-CONFIG=/etc/ironic-inspector/ironic-inspector.conf
-
-export IRONIC_INSPECTOR_ENABLE_DISCOVERY=${IRONIC_INSPECTOR_ENABLE_DISCOVERY:-false}
-export INSPECTOR_REVERSE_PROXY_SETUP=${INSPECTOR_REVERSE_PROXY_SETUP:-false}
-
-# shellcheck disable=SC1091
-. /bin/tls-common.sh
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-# shellcheck disable=SC1091
-. /bin/auth-common.sh
-
-if [[ "$USE_IRONIC_INSPECTOR" == "false" ]]; then
-    echo "FATAL: ironic-inspector is disabled via USE_IRONIC_INSPECTOR"
-    exit 1
-fi
-
-wait_for_interface_or_ip
-
-IRONIC_INSPECTOR_PORT=${IRONIC_INSPECTOR_ACCESS_PORT}
-if [[ "$IRONIC_INSPECTOR_TLS_SETUP" == "true" ]]; then
-    if [[ "${INSPECTOR_REVERSE_PROXY_SETUP}" == "true" ]] && [[ "${IRONIC_INSPECTOR_PRIVATE_PORT}" != "unix" ]]; then
-        IRONIC_INSPECTOR_PORT=$IRONIC_INSPECTOR_PRIVATE_PORT
-    fi
-else
-    export INSPECTOR_REVERSE_PROXY_SETUP="false" # If TLS is not used, we have no reason to use the reverse proxy
-fi
-
-export IRONIC_INSPECTOR_BASE_URL="${IRONIC_INSPECTOR_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_INSPECTOR_PORT}"
-export IRONIC_BASE_URL="${IRONIC_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_ACCESS_PORT}"
-
-build_j2_config()
-{
-    local CONFIG_FILE="$1"
-    python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$CONFIG_FILE.j2"
-}
-
-# Merge with the original configuration file from the package.
-build_j2_config "$CONFIG" | crudini --merge "$CONFIG"
-
-configure_inspector_auth
-
-configure_client_basic_auth ironic "${CONFIG}"
-
-ironic-inspector-dbsync --config-file "${CONFIG}" upgrade
-
-if [[ "$INSPECTOR_REVERSE_PROXY_SETUP" == "false" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-    # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_INSPECTOR_CERT_FILE}" | while read -r file event; do
-        kill $(pgrep ironic)
-    done &
-fi
-
-# Make sure ironic traffic bypasses any proxies
-export NO_PROXY="${NO_PROXY:-},$IRONIC_IP"
-
-# shellcheck disable=SC2086
-exec /usr/bin/ironic-inspector

kubevirt-dashboard-extension-chart/Chart.yaml

@@ -1,4 +1,3 @@
-#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2
 #!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2
 #!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2-%RELEASE%
 annotations:

metal3-chart/Chart.yaml

@@ -1,7 +1,7 @@
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.7_up0.11.5
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.8_up0.11.6
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.7_up0.11.5-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.8_up0.11.6-%RELEASE%
 apiVersion: v2
-appVersion: 0.11.5
+appVersion: 0.11.6
 dependencies:
 - alias: metal3-baremetal-operator
   name: baremetal-operator
@@ -15,7 +15,7 @@ dependencies:
   condition: global.enable_mariadb
   name: mariadb
   repository: file://./charts/mariadb
-  version: 0.5.4
+  version: 0.6.0
 - alias: metal3-media
   condition: global.enable_metal3_media_server
   name: media
@@ -25,4 +25,4 @@ description: A Helm chart that installs all of the dependencies needed for Metal
 icon: https://github.com/cncf/artwork/raw/master/projects/metal3/icon/color/metal3-icon-color.svg
 name: metal3
 type: application
-version: "%%CHART_MAJOR%%.0.7+up0.11.5"
+version: "%%CHART_MAJOR%%.0.8+up0.11.6"

metal3-chart/charts/baremetal-operator/templates/configmap-ironic.yaml

@@ -23,6 +23,12 @@ data:
   CACHEURL: "{{ $protocol }}://{{ $ironicCacheHost }}/images"
   DEPLOY_KERNEL_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.kernel"
   DEPLOY_RAMDISK_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.initramfs"
+  DEPLOY_KERNEL_URL_X86_64: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-x86_64.kernel"
+  DEPLOY_RAMDISK_URL_X86_64: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-x86_64.initramfs"
+  DEPLOY_BOOTLOADER_URL_X86_64: "{{ $protocol }}://{{ $ironicBootHost }}/uefi_esp-x86_64.img"
+  DEPLOY_KERNEL_URL_AARCH64: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-arm64.kernel"
+  DEPLOY_RAMDISK_URL_AARCH64: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-arm64.initramfs"
+  DEPLOY_BOOTLOADER_URL_AARCH64: "{{ $protocol }}://{{ $ironicBootHost }}/uefi_esp-arm64.img"
   DEPLOY_ARCHITECTURE: "{{ $deployArch }}"
 kind: ConfigMap
 metadata:

metal3-chart/charts/baremetal-operator/values.yaml

@@ -28,7 +28,7 @@ images:
   baremetalOperator:
     repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/baremetal-operator
     pullPolicy: IfNotPresent
-    tag: "0.9.1.1"
+    tag: "0.10.2.0"
 
 imagePullSecrets: []
 nameOverride: "manger"

metal3-chart/charts/mariadb/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: 10.6.7
+appVersion: "10.11"
 description: A Helm chart for MariaDB, used by Metal3
 name: mariadb
 type: application
-version: 0.5.4
+version: 0.6.0

metal3-chart/charts/mariadb/templates/configmap-mariadb.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap 
+metadata:
+  name: mariadb-config
+  labels:
+    {{- include "mariadb.labels" . | nindent 4 }}
+data:
+  ironic.conf: |
+    [mariadb]
+    max_connections 64
+    max_heap_table_size 1M
+    innodb_buffer_pool_size 5M
+    innodb_log_buffer_size 512K

metal3-chart/charts/mariadb/templates/configmap.yaml

@@ -5,4 +5,7 @@ metadata:
   labels:
     {{- include "mariadb.labels" . | nindent 4 }}
 data:
-  RESTART_CONTAINER_CERTIFICATE_UPDATED: "false"
+  MARIADB_USER: ironic
+  MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+  MARIADB_DATABASE: ironic
+  MARIADB_AUTO_UPGRADE: "yes"

metal3-chart/charts/mariadb/templates/deployment.yaml

@@ -25,23 +25,50 @@ spec:
       serviceAccountName: {{ include "mariadb.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+      # This would run during entrypoint if run as root
+      - name: set-volume-owners
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop:
+              - ALL
+              add:
+              - CHOWN
+              - FOWNER
+              - DAC_OVERRIDE
+            seccompProfile:
+              type: RuntimeDefault
+        volumeMounts:
+          - name: mariadb-conf
+            mountPath: /etc/mysql/conf.d
+          - name: mariadb-run
+            mountPath: /run/mysql
+          {{- $volmounts }}
+        command: ['bash', '-c', 'source /usr/local/bin/docker-entrypoint.sh && docker_create_db_directories']
+        env:
+          - name: DATADIR
+            value: /var/lib/mysql
+          - name: SOCKET
+            value: /run/mysql/mysql.sock
       containers:
       - name: mariadb
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
+        envFrom:
+          - configMapRef:
+              name: mariadb-cm
         env:
           - name: MARIADB_PASSWORD
             valueFrom:
               secretKeyRef:
                 key: password
                 name: ironic-mariadb
-          - name: RESTART_CONTAINER_CERTIFICATE_UPDATED
-            valueFrom:
-              configMapKeyRef:
-                name: mariadb-cm
-                key: RESTART_CONTAINER_CERTIFICATE_UPDATED
         lifecycle:
           preStop:
             exec:
@@ -52,9 +79,9 @@ spec:
         livenessProbe:
           exec:
             command:
-              - sh
+              - healthcheck.sh
-              - -c
+              - --connect
-              - mysqladmin status -uironic -p$(printenv MARIADB_PASSWORD)
+              - --innodb_initialized
           failureThreshold: 10
           initialDelaySeconds: 30
           periodSeconds: 30
@@ -67,19 +94,29 @@ spec:
         readinessProbe:
           exec:
             command:
-              - sh
+              - healthcheck.sh
-              - -c
+              - --connect
-              - mysqladmin status -uironic -p$(printenv MARIADB_PASSWORD)
+              - --innodb_initialized
           failureThreshold: 10
           initialDelaySeconds: 30
           periodSeconds: 30
           successThreshold: 1
           timeoutSeconds: 10
         volumeMounts:
+            - name: mariadb-conf
+              mountPath: /etc/mysql/conf.d
+            - name: mariadb-run
+              mountPath: /run/mysql
             {{- $volmounts }}
       {{- with .Values.global.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
+        - name: mariadb-conf
+          configMap:
+            name: mariadb-config
+        - name: mariadb-run
+          emptyDir:
+            sizeLimit: 20Mi
         {{- $volumes }}

metal3-chart/charts/mariadb/values.yaml

@@ -12,9 +12,9 @@ service:
     targetPort: 3306
 
 image:
-  repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/suse/mariadb
+  repository: registry.suse.com/suse/mariadb
   pullPolicy: IfNotPresent
-  tag: 10.6.15.1
+  tag: 10.11
 
 nameOverride: ""
 fullnameOverride: ""
@@ -31,8 +31,8 @@ serviceAccount:
 podAnnotations: {}
 
 podSecurityContext:
-  runAsUser: 10060
+  runAsUser: 60
-  fsGroup: 10060
+  fsGroup: 60
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -60,6 +60,7 @@ persistence:
 volumeMounts:
   - name: mariadb-data-volume
     mountPath: /var/lib/mysql
+    subPath: data
 
 volumes:
   - name: mariadb-data-volume

metal3-chart/values.yaml

@@ -115,8 +115,8 @@ metal3-mariadb:
   persistence:
     storageClass: ""
   image:
-    repository: "registry.suse.com/edge/mariadb"
+    repository: "registry.suse.com/suse/mariadb"
-    tag: "10.6.15.1"
+    tag: "10.11"
 
 #
 # Baremetal Operator

rancher-turtles-airgap-resources-chart/Chart.yaml

@@ -1,5 +1,5 @@
-#!BuildTag: %%CHART_PREFIX%%rancher-turtles-airgap-resources:%%CHART_MAJOR%%.0.3_up0.20.0
+#!BuildTag: %%CHART_PREFIX%%rancher-turtles-airgap-resources:%%CHART_MAJOR%%.0.4_up0.20.0
-#!BuildTag: %%CHART_PREFIX%%rancher-turtles-airgap-resources:%%CHART_MAJOR%%.0.3_up0.20.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%rancher-turtles-airgap-resources:%%CHART_MAJOR%%.0.4_up0.20.0-%RELEASE%
 apiVersion: v2
 appVersion: 0.20.0
 description: Rancher Turtles utility chart for airgap scenarios
@@ -7,4 +7,4 @@ home: https://github.com/rancher/turtles/
 icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg
 name: rancher-turtles-airgap-resources
 type: application
-version: "%%CHART_MAJOR%%.0.3+up0.20.0"
+version: "%%CHART_MAJOR%%.0.4+up0.20.0"

rancher-turtles-chart/Chart.yaml

@@ -1,5 +1,5 @@
-#!BuildTag: %%CHART_PREFIX%%rancher-turtles:%%CHART_MAJOR%%.0.3_up0.20.0
+#!BuildTag: %%CHART_PREFIX%%rancher-turtles:%%CHART_MAJOR%%.0.4_up0.20.0
-#!BuildTag: %%CHART_PREFIX%%rancher-turtles:%%CHART_MAJOR%%.0.3_up0.20.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%rancher-turtles:%%CHART_MAJOR%%.0.4_up0.20.0-%RELEASE%
 annotations:
   catalog.cattle.io/certified: rancher
   catalog.cattle.io/display-name: Rancher Turtles - the Cluster API Extension
@@ -29,4 +29,4 @@ keywords:
 - provisioning
 name: rancher-turtles
 type: application
-version: "%%CHART_MAJOR%%.0.3+up0.20.0"
+version: "%%CHART_MAJOR%%.0.4+up0.20.0"

release-manifest-image/release_manifest.yaml

@@ -138,7 +138,7 @@ spec:
         - prettyName: EndpointCopierOperator
           releaseName: endpoint-copier-operator
           chart: "%%CHART_REPO%%/%%CHART_PREFIX%%endpoint-copier-operator"
-          version: "%%CHART_MAJOR%%.0.0+up0.2.1"
+          version: "%%CHART_MAJOR%%.0.1+up0.3.0"
         - prettyName: Elemental
           releaseName: elemental-operator
           chart: oci://registry.suse.com/rancher/elemental-operator-chart
@@ -171,8 +171,8 @@ spec:
         - prettyName: Metal3
           releaseName: metal3
           chart: "%%CHART_REPO%%/%%CHART_PREFIX%%metal3"
-          version: "%%CHART_MAJOR%%.0.7+up0.11.5"
+          version: "%%CHART_MAJOR%%.0.8+up0.11.6"
         - prettyName: RancherTurtles
           releaseName: rancher-turtles
           chart: "%%CHART_REPO%%/%%CHART_PREFIX%%rancher-turtles"
-          version: "%%CHART_MAJOR%%.0.3+up0.20.0"
+          version: "%%CHART_MAJOR%%.0.4+up0.20.0"

upgrade-controller-chart/Chart.yaml

@@ -1,5 +1,5 @@
-#!BuildTag: %%CHART_PREFIX%%upgrade-controller:%%CHART_MAJOR%%.0.0_up0.1.1
+#!BuildTag: %%CHART_PREFIX%%upgrade-controller:%%CHART_MAJOR%%.0.1_up0.1.1
-#!BuildTag: %%CHART_PREFIX%%upgrade-controller:%%CHART_MAJOR%%.0.0_up0.1.1-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%upgrade-controller:%%CHART_MAJOR%%.0.1_up0.1.1-%RELEASE%
 apiVersion: v2
 appVersion: 0.1.1
 dependencies:
@@ -10,4 +10,4 @@ dependencies:
 description: A Helm chart for Upgrade Controller
 name: upgrade-controller
 type: application
-version: "%%CHART_MAJOR%%.0.0+up0.1.1"
+version: "%%CHART_MAJOR%%.0.1+up0.1.1"