Install both ramdisks in the ipa downloader

- Make the different ipa-ramdisk packages installable side by side - Clean the ipa-downloader Dockerfile from what seems to be unneeded - Get both images in - Use zstd instead of xz for better speed - Check sums before redoing certs integration - Add value to metal3 chart to select between architectures - Get the two ESP available as well Signed-off-by: Nicolas Belouin <nicolas.belouin@suse.com>
Merge pull request 'Ironic dependency is located in different project when in internal obs' (#82 ) from nbelouin/Factory:ironic-meta into main
2025-03-05 15:00:19 +01:00 · 2025-02-28 12:36:10 +01:00 · 2025-02-26 10:36:10 +01:00 · 2025-02-25 15:31:46 +01:00 · 2025-02-25 15:31:46 +01:00 · 2025-02-25 15:08:57 +01:00
71 changed files with 3266 additions and 1710 deletions
--- a/.gitea/workflows/check_manifest.yaml
+++ b/.gitea/workflows/check_manifest.yaml
@@ -1,23 +0,0 @@
-name: Check Release Manifest Local Charts Versions
-on:
-  pull_request:
-      branches-ignore:
-      - "devel"
-
-
-jobs:
-  sync-pr-project:
-    name: "Check Release Manifest Local Charts Versions"
-    runs-on: tumbleweed
-    steps:
-        # Waiting on PR to get merged for support in upstream action/checkout action
-      - uses: 'https://github.com/yangskyboxlabs/action-checkout@sha256'
-        name: Checkout repository
-        with:
-          object-format: 'sha256'
-      - name: Setup dependencies
-        run: |
-          zypper in -y python3-ruamel.yaml
-      - name: Check release manifest
-        run: |
-          python3 .obs/manifest-check.py --check
--- a/.gitea/workflows/trigger_devel.yaml
+++ b/.gitea/workflows/trigger_devel.yaml
@@ -0,0 +1,30 @@
+name: Trigger Devel Packages
+on:
+  schedule:
+    - cron: "@daily"
+
+jobs:
+  sync-pr-project:
+    name: "Trigger source services for devel packages that changed"
+    runs-on: tumbleweed
+    steps:
+      - name: Setup OSC
+        run: |
+          mkdir -p ~/.config/osc
+          cat >~/.config/osc/oscrc <<'EOF'
+          [general]
+          apiurl = https://api.opensuse.org
+
+          [https://api.opensuse.org]
+          user=${{ vars.OBS_USERNAME }}
+          pass=${{ secrets.OBS_PASSWORD }}
+          EOF
+    # Waiting on PR to get merged for support in upstream action/checkout action
+      - uses: 'https://github.com/yangskyboxlabs/action-checkout@sha256'
+        name: Checkout repository
+        with:
+          object-format: 'sha256'
+          ref: 'devel'
+      - name: "Trigger packages"
+        run: |
+          python3 .obs/trigger_package.py
--- a/.obs/common.py
+++ b/.obs/common.py
@@ -1,3 +1,3 @@
-PROJECT = "isv:SUSE:Edge:3.2"
+PROJECT = "isv:SUSE:Edge:Factory"
 REPOSITORY = "https://src.opensuse.org/suse-edge/Factory"
-BRANCH = "3.2"
+BRANCH = "main"
--- a/.obs/manifest-check.py
+++ b/.obs/manifest-check.py
@@ -1,84 +0,0 @@
-#!/usr/bin/python3
-
-import ruamel.yaml
-import pathlib
-import argparse
-import sys
-
-yaml = ruamel.yaml.YAML()
-
-def get_chart_version(chart_name: str) -> str:
-    with open(f"./{chart_name}/Chart.yaml") as f:
-        chart = yaml.load(f)
-        return chart["version"]
-
-def get_charts(chart):
-    if not chart["chart"].startswith("%%CHART_REPO%%"):
-        # Not a locally managed chart
-        return {}
-
-    chart_name = chart["chart"][len("%%CHART_REPO%%/%%IMG_PREFIX%%"):]
-    charts = { chart_name: chart["version"] }
-    for child_chart in chart.get("dependencyCharts", []) + chart.get("addonCharts", []):
-        charts.update(get_charts(child_chart))
-    return charts
-
-def get_charts_list():
-    with open("./release-manifest-image/release_manifest.yaml") as f:
-        manifest = yaml.load(f)
-    charts = {}
-    for chart in manifest["spec"]["components"]["workloads"]["helm"]:
-        charts.update(get_charts(chart))
-    return charts
-
-def check_charts(fix: bool) -> bool:
-    success = True
-    charts = get_charts_list()
-    to_fix = {}
-    for chart in charts:
-        expected_version = get_chart_version(chart)
-        if expected_version != charts[chart]:
-            success = False
-            to_fix[f'%%CHART_REPO%%/%%IMG_PREFIX%%{chart}'] = expected_version
-            print(f"{chart}: Expected: {expected_version}, Got: {charts[chart]}")
-    if fix and not success:
-        fix_charts(to_fix)
-        return True
-    return success
-
-def fix_charts(to_fix):
-    manifest_path = pathlib.Path("./release-manifest-image/release_manifest.yaml")
-    manifest = yaml.load(manifest_path)
-    yaml.indent(mapping=2, sequence=4, offset=2)
-    yaml.width = 4096
-    for chart_index, chart in enumerate(manifest["spec"]["components"]["workloads"]["helm"]):
-        changed = False
-        if chart["chart"] in to_fix.keys():
-            changed = True
-            chart["version"] = to_fix[chart["chart"]]
-        for subchart_index, subchart in enumerate(chart.get("addonCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["addonCharts"][subchart_index] = subchart
-        for subchart_index, subchart in enumerate(chart.get("dependencyCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["dependencyCharts"][subchart_index] = subchart
-        if changed:
-            manifest["spec"]["components"]["workloads"]["helm"][chart_index] = chart
-    yaml.dump(manifest, manifest_path)
-
-def main():
-    print("Checking charts versions in release manifest")
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-c', '--check', action='store_true')
-    args = parser.parse_args()
-    if not check_charts(not args.check):
-        sys.exit(1)
-    else:
-        print("All local charts in release manifest are using the right version")
-
-if __name__ == "__main__":
-    main()
--- a/.obs/render_meta.py
+++ b/.obs/render_meta.py
@@ -8,6 +8,7 @@ def render(base_project, subproject, internal, scm_url=None):
    context = {
        "base_project": subproject == "",
        "title": f"SUSE Edge {version} {subproject}".rstrip(),
+        "ironic_base": "ISV:SUSE:Edge:Ironic" if internal else "Cloud:OpenStack",
    }
    if subproject == "ToTest":
        context["project"] = f"{base_project}:ToTest"
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,10 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: check-manifest
-        name: "Check release-manifest"
-        entry: python3 .obs/manifest-check.py
-        language: python
-        additional_dependencies: ['ruamel.yaml']
-        pass_filenames: false
-        always_run: true
--- a/34
+++ b/34
@@ -87,6 +87,7 @@ BuildFlags: onlybuild:release-manifest-image
    BuildFlags: onlybuild:metallb-controller-image
    BuildFlags: onlybuild:metallb-speaker-image
    BuildFlags: onlybuild:nm-configurator
+    BuildFlags: onlybuild:shim-noarch
  %endif
 %endif

@@ -103,36 +104,6 @@ BuildFlags: onlybuild:release-manifest-image
    PublishFlags: archsync
 %endif

-%if "%_repository" == "images_6.0"
-    Prefer: container:sles15-image
-    Type: docker
-    BuildEngine: podman
-    Repotype: none
-    Patterntype: none
-    BuildFlags: dockerarg:SLE_VERSION=16.0
-    BuildFlags: onlybuild:kiwi-builder-image
-
-    # Publish multi-arch container images only once all archs have been built
-    PublishFlags: archsync
-
-    # Exclude the images selected by the aarch64 section
-    %ifarch aarch64
-      BuildFlags: excludebuild:baremetal-operator-image
-      BuildFlags: excludebuild:edge-image-builder-image
-      BuildFlags: excludebuild:endpoint-copier-operator-image
-      BuildFlags: excludebuild:ironic-image
-      BuildFlags: excludebuild:ironic-ipa-downloader-image
-      BuildFlags: excludebuild:kube-rbac-proxy-image
-      BuildFlags: excludebuild:metallb-controller-image
-      BuildFlags: excludebuild:metallb-speaker-image
-    %endif
-
-%else
-    BuildFlags: excludebuild:kiwi-builder-image
-%endif
-
-
-
 %if "%_repository" == "charts" || "%_repository" == "phantomcharts" || "%_repository" == "releasecharts"
    Type: helm
    Repotype: helm
@@ -143,6 +114,9 @@ BuildFlags: onlybuild:release-manifest-image
 %if "%_repository" == "standard"
    # for build openstack-ironic-image
    BuildFlags: allowrootforbuild
+
+    # ironic-ipa-ramdisk are noarch packages that need to be availble to both archs
+    ExportFilter: ^ironic-ipa-ramdisk-.*\.noarch\.rpm$ aarch64 x86_64
 %endif

 # Enable reproducible builds
--- a/15
+++ b/15
@@ -31,19 +31,14 @@
    <arch>x86_64</arch>
  </repository>
 {%- endif %}
-{%- for repository in ["images", "images_6.0", "test_manifest_images"] %}
+{%- for repository in ["images", "test_manifest_images"] %}
  <repository name="{{ repository }}">
-    {%- if release_project is defined and repository != "test_manifest_images" %}
+    {%- if release_project is defined and repository == "images" %}
    <releasetarget project="{{ release_project }}" repository="images" trigger="manual"/>
    {%- endif %}
    <path project="SUSE:Registry" repository="standard"/>
-    {%- if repository == "images_6.0" %}
-      <path project="SUSE:CA" repository="16.0"/>
-      <path project="SUSE:ALP:Products:Marble:6.0" repository="standard"/>
-    {%- else %}
-      <path project="SUSE:CA" repository="SLE_15_SP6"/>
-      <path project="{{ project }}" repository="standard"/>
-    {%- endif %}
+    <path project="SUSE:CA" repository="SLE_15_SP6"/>
+    <path project="{{ project }}" repository="standard"/>
    <arch>x86_64</arch>
    <arch>aarch64</arch>
  </repository>
@@ -52,7 +47,7 @@
    {%- if release_project is defined and not for_release %}
    <releasetarget project="{{ release_project }}" repository="standard" trigger="manual"/>
    {%- endif %}
-    <path project="Cloud:OpenStack:2024.2" repository="15.6"/>
+    <path project="{{ ironic_base }}:2024.2" repository="15.6"/>
    <path project="SUSE:SLE-15-SP6:Update" repository="standard"/>
    <arch>x86_64</arch>
    <arch>aarch64</arch>
--- a/akri-dashboard-extension-chart/Chart.yaml
+++ b/akri-dashboard-extension-chart/Chart.yaml
@@ -13,9 +13,9 @@ annotations:
  catalog.cattle.io/ui-component: plugins
  catalog.cattle.io/ui-extensions-version: ">= 3.0.0 < 4.0.0"
 apiVersion: v2
-appVersion: 302.0.0+up1.2.1
-description: 'SUSE Edge: Akri extension for Rancher Dashboard'
+appVersion: 1.2.1
+description: "SUSE Edge: Akri extension for Rancher Dashboard"
+icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/akri/icon/color/akri-icon-color.svg
 name: akri-dashboard-extension
 type: application
 version: "%%CHART_MAJOR%%.0.0+up1.2.1"
-icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/akri/icon/color/akri-icon-color.svg
--- a/akri-dashboard-extension-chart/templates/_helpers.tpl
+++ b/akri-dashboard-extension-chart/templates/_helpers.tpl
@@ -38,7 +38,7 @@ Common labels
 helm.sh/chart: {{ include "extension-server.chart" . }}
 {{ include "extension-server.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | replace "+" "_" | quote }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
@@ -60,4 +60,4 @@ Pkg annotations
 {{ $key }}: {{ $value | quote }}
 {{- end }}
 {{- end }}
-{{- end }}
+{{- end }}
--- a/akri-dashboard-extension-chart/templates/cr.yaml
+++ b/akri-dashboard-extension-chart/templates/cr.yaml
@@ -8,7 +8,7 @@ spec:
  plugin:
    name: {{ include "extension-server.fullname" . }}
    version: {{ (semver (default .Chart.AppVersion .Values.plugin.versionOverride)).Original }}
-    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/302.0.0+up1.2.1
+    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/1.2.1
    noCache: {{ .Values.plugin.noCache }}
    noAuth: {{ .Values.plugin.noAuth }}
    metadata: {{ include "extension-server.pluginMetadata" . | indent 6 }}
--- a/edge-image-builder-image/Dockerfile
+++ b/edge-image-builder-image/Dockerfile
@@ -1,5 +1,5 @@
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.1.2-rc1
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.1.2-rc1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.1.0
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.1.0-%RELEASE%
 #!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-base:$SLE_VERSION
@@ -15,11 +15,11 @@ RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE edge-image-builder Container Image"
 LABEL org.opencontainers.image.description="edge-image-builder based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="1.1.2-rc1"
+LABEL org.opencontainers.image.version="1.1.0"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.1.2-rc1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.1.0-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
--- a/edge-image-builder-image/artifacts.yaml
+++ b/edge-image-builder-image/artifacts.yaml
@@ -1,7 +1,7 @@
 metallb:
  chart: metallb-chart
  repository: "%%CHART_REPO%%/%%IMG_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.1+up0.14.9"
+  version: "%%CHART_MAJOR%%.0.0+up0.14.9"
 endpoint-copier-operator:
  chart: endpoint-copier-operator-chart
  repository: "%%CHART_REPO%%/%%IMG_PREFIX%%"
--- a/edge-image-builder/_service
+++ b/edge-image-builder/_service
@@ -1,13 +1,10 @@
 <services>
  <service name="obs_scm">
    <param name="url">https://github.com/suse-edge/edge-image-builder.git</param>
+    <param name="versionformat">@PARENT_TAG@</param>
    <param name="scm">git</param>
    <param name="exclude">.git</param>
-    <param name="revision">v1.1.2-rc1</param>
-    <!-- Uncomment and set this For Pre-Release Version -->
-    <param name="version">1.1.2~rc0</param>
-    <!-- Uncomment and this for regular version -->
-    <!-- <param name="versionformat">@PARENT_TAG@</param> -->
+    <param name="revision">v1.1.0</param>
    <param name="versionrewrite-pattern">v(\d+).(\d+).(\d+)</param>
    <param name="versionrewrite-replacement">\1.\2.\3</param>
    <param name="changesgenerate">enable</param>
--- a/edge-image-builder/edge-image-builder.spec
+++ b/edge-image-builder/edge-image-builder.spec
@@ -17,7 +17,7 @@


 Name:           edge-image-builder
-Version:        1.1.2~rc1
+Version:        1.1.0
 Release:        0
 Summary:        Edge Image Builder
 License:        Apache-2.0
--- a/ironic-image/Dockerfile
+++ b/ironic-image/Dockerfile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.3
-#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.3-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.2
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.2-%RELEASE%
 #!BuildVersion: 15.6

 ARG SLE_VERSION
@@ -8,14 +8,8 @@ FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

 FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base

-#!ArchExclusiveLine: x86_64
-RUN if [ "$(uname -m)" = "x86_64" ];then \
-      zypper -n  in --no-recommends gcc git make xz-devel shim dosfstools mtools glibc-extra grub2-x86_64-efi grub2; zypper -n clean; rm -rf /var/log/*; \
-    fi
-#!ArchExclusiveLine: aarch64
-RUN if [ "$(uname -m)" = "aarch64" ];then \
-      zypper -n rm kubic-locale-archive-2.31-10.36.noarch openssl-1_1-1.1.1l-150500.17.37.1.aarch64; zypper -n in --no-recommends gcc git make xz-devel openssl-3 mokutil shim dosfstools mtools glibc glibc-extra grub2 grub2-arm64-efi; zypper -n clean; rm -rf /var/log/* ;\
-    fi
+RUN zypper -n in --no-recommends shim-x86_64 shim-aarch64 grub2-x86_64-efi grub2-arm64-efi dosfstools mtools
+
 WORKDIR /tmp
 COPY prepare-efi.sh /bin/
 RUN set -euo pipefail; chmod +x /bin/prepare-efi.sh
@@ -46,8 +40,8 @@ LABEL org.opencontainers.image.description="Openstack Ironic based on the SLE Ba
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opencontainers.image.version="26.1.2.3"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.3-%RELEASE%"
+LABEL org.opencontainers.image.version="26.1.2.2"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.2-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -88,7 +82,8 @@ RUN if [ "$(uname -m)" = "aarch64" ]; then\
     cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
    fi
    
-COPY --from=base /tmp/esp.img /tmp/uefi_esp.img
+COPY --from=base /tmp/esp-x86_64.img /tmp/uefi_esp-x86_64.img
+COPY --from=base /tmp/esp-aarch64.img /tmp/uefi_esp-arm64.img

 COPY ironic.conf.j2 /etc/ironic/
 COPY inspector.ipxe.j2 httpd-ironic-api.conf.j2 ipxe_config.template /tmp/
--- a/ironic-image/apache2-vmedia.conf.j2
+++ b/ironic-image/apache2-vmedia.conf.j2
@@ -10,15 +10,17 @@ Listen {{ env.VMEDIA_TLS_PORT }}
    SSLCertificateFile {{ env.IRONIC_VMEDIA_CERT_FILE }}
    SSLCertificateKeyFile {{ env.IRONIC_VMEDIA_KEY_FILE }}

-    <Directory "/shared">
-        AllowOverride None
-        Require all granted
+    <Directory ~ "/shared/html">
+         Order deny,allow
+         deny from all
    </Directory>
-
-    <Directory "/shared/html">
-        Options Indexes FollowSymLinks
-        AllowOverride None
-        Require all granted
+    <Directory ~ "/shared/html/(redfish|ilo)/">
+         Order allow,deny
+         allow from all
+    </Directory>
+    <Directory ~ "/shared/html/images/">
+         Order allow,deny
+         allow from all
    </Directory>
 </VirtualHost>

--- a/ironic-image/configure-ironic.sh
+++ b/ironic-image/configure-ironic.sh
@@ -68,7 +68,7 @@ if [[ -n "$IRONIC_EXTERNAL_IP" ]]; then
    fi
 fi

-IMAGE_CACHE_PREFIX=/shared/html/images/ironic-python-agent
+IMAGE_CACHE_PREFIX="/shared/html/images/ironic-python-agent-${DEPLOY_ARCHITECTURE}"
 if [[ -f "${IMAGE_CACHE_PREFIX}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}.initramfs" ]]; then
    export IRONIC_DEFAULT_KERNEL="${IMAGE_CACHE_PREFIX}.kernel"
    export IRONIC_DEFAULT_RAMDISK="${IMAGE_CACHE_PREFIX}.initramfs"
--- a/ironic-image/inspector.ipxe.j2
+++ b/ironic-image/inspector.ipxe.j2
@@ -5,6 +5,6 @@ echo In inspector.ipxe
 imgfree
 # NOTE(dtantsur): keep inspection kernel params in [mdns]params in
 # ironic-inspector-image and configuration in configure-ironic.sh
-kernel --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent.kernel ipa-insecure=1 ipa-inspection-collectors={{ env.IRONIC_IPA_COLLECTORS }} systemd.journald.forward_to_console=yes BOOTIF=${mac} ipa-debug=1 ipa-enable-vlan-interfaces={{ env.IRONIC_ENABLE_VLAN_INTERFACES }} ipa-inspection-dhcp-all-interfaces=1 ipa-collect-lldp=1 {{ env.INSPECTOR_EXTRA_ARGS }} initrd=ironic-python-agent.initramfs {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} || goto retry_boot
-initrd --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent.initramfs || goto retry_boot
+kernel --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent-${buildarch}.kernel ipa-insecure=1 ipa-inspection-collectors={{ env.IRONIC_IPA_COLLECTORS }} systemd.journald.forward_to_console=yes BOOTIF=${mac} ipa-debug=1 ipa-enable-vlan-interfaces={{ env.IRONIC_ENABLE_VLAN_INTERFACES }} ipa-inspection-dhcp-all-interfaces=1 ipa-collect-lldp=1 {{ env.INSPECTOR_EXTRA_ARGS }} initrd=ironic-python-agent.initramfs {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} || goto retry_boot
+initrd --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent-${buildarch}.initramfs || goto retry_boot
 boot
--- a/ironic-image/ironic.conf.j2
+++ b/ironic-image/ironic.conf.j2
@@ -83,7 +83,7 @@ send_sensor_data = {{ env.SEND_SENSOR_DATA }}
 # Power state is checked every 60 seconds and BMC activity should
 # be avoided more often than once every sixty seconds.
 send_sensor_data_interval = 160
-bootloader = {{ env.IRONIC_BOOT_BASE_URL }}/uefi_esp.img
+bootloader = http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/uefi_esp-{{ env.DEPLOY_ARCHITECTURE }}.img
 verify_step_priority_override = management.clear_job_queue:90
 # We don't use this feature, and it creates an additional load on the database
 node_history = False
@@ -112,7 +112,7 @@ default_boot_option = local
 erase_devices_metadata_priority = 10
 erase_devices_priority = 0
 http_root = /shared/html/
-http_url = {{ env.IRONIC_BOOT_BASE_URL }}
+http_url = http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}
 fast_track = {{ env.IRONIC_FAST_TRACK }}
 {% if env.IRONIC_BOOT_ISO_SOURCE %}
 ramdisk_image_download_source = {{ env.IRONIC_BOOT_ISO_SOURCE }}
--- a/ironic-image/prepare-efi.sh
+++ b/ironic-image/prepare-efi.sh
@@ -2,41 +2,26 @@

 set -euxo pipefail

-ARCH=$(uname -m)
-DEST=${2:-/tmp/esp.img}
-OS=${1:-sles}
+declare -A efi_arch=(
+  ["x86_64"]="X64"
+  ["aarch64"]="AA64"
+  )

-if [ $ARCH = "aarch64" ]; then
-  BOOTEFI=BOOTAA64.EFI
-  GRUBEFI=grubaa64.efi
-else
-  BOOTEFI=BOOTX64.efi
-  GRUBEFI=grubx64.efi
-fi
+for arch in "${!efi_arch[@]}"; do
+  
+  DEST=/tmp/esp-${arch}.img

-dd bs=1024 count=6400 if=/dev/zero of=$DEST
-mkfs.msdos -F 12 -n 'ESP_IMAGE' $DEST
+  dd bs=1024 count=6400 if=/dev/zero of=$DEST
+  mkfs.msdos -F 12 -n 'ESP_IMAGE' $DEST
+
+  mmd -i $DEST EFI
+  mmd -i $DEST EFI/BOOT
+
+  mcopy -i $DEST -v /usr/share/efi/${arch}/shim.efi ::EFI/BOOT/BOOT${efi_arch[$arch]}.EFI
+  mcopy -i $DEST -v /usr/share/efi/${arch}/grub.efi ::EFI/BOOT/GRUB.EFI
+
+  mdir -i $DEST ::EFI/BOOT;
+done

-mkdir -p /boot/efi/EFI/BOOT
-mkdir -p /boot/efi/EFI/$OS
-if [ $ARCH = "aarch64" ]; then
-  cp -L /usr/share/efi/aarch64/shim.efi /boot/efi/EFI/BOOT/$BOOTEFI
-  cp -L /usr/share/efi/aarch64/grub.efi /boot/efi/EFI/BOOT/grub.efi
-  cp /usr/share/grub2/arm64-efi/grub.efi /boot/efi/EFI/$OS/grubaa64.efi
-else
-  cp -L /usr/lib64/efi/shim.efi /boot/efi/EFI/BOOT/$BOOTEFI
-  #cp /usr/share/grub2/x86_64-efi/grub.efi /boot/efi/EFI/$OS/$GRUBEFI
-  cp /usr/share/grub2/x86_64-efi/grub.efi /boot/efi/EFI/$OS/grub.efi
-fi

-mmd -i $DEST EFI
-mmd -i $DEST EFI/BOOT
-mcopy -i $DEST -v /boot/efi/EFI/BOOT/$BOOTEFI ::EFI/BOOT
-if [ $ARCH = "aarch64" ]; then
-  mcopy -i $DEST -v /boot/efi/EFI/BOOT/grub.efi ::EFI/BOOT
-  mcopy -i $DEST -v /boot/efi/EFI/$OS/$GRUBEFI ::EFI/BOOT
-else
-  mcopy -i $DEST -v /boot/efi/EFI/$OS/grub.efi ::EFI/BOOT
-fi 
-mdir -i $DEST ::EFI/BOOT;

--- a/ironic-image/runhttpd
+++ b/ironic-image/runhttpd
@@ -39,7 +39,7 @@ export INSPECTOR_EXTRA_ARGS

 # Copy files to shared mount
 render_j2_config /tmp/inspector.ipxe.j2 /shared/html/inspector.ipxe
-cp /tmp/uefi_esp.img /shared/html/uefi_esp.img
+cp /tmp/uefi_esp*.img /shared/html/

 # Render the core httpd config
 render_j2_config /etc/httpd/conf/httpd.conf.j2 /etc/httpd/conf/httpd.conf
--- a/ironic-ipa-downloader-image/Dockerfile
+++ b/ironic-ipa-downloader-image/Dockerfile
@@ -8,15 +8,8 @@ FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
 FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
 COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
-#!ArchExclusiveLine: x86_64
-RUN if [ "$(uname -m)" = "x86_64" ];then \
-  zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 python311-devel python311 python311-pip tar gawk git curl xz fakeroot shadow sed cpio; zypper -n clean; rm -rf /var/log/*; \
-  fi
-#!ArchExclusiveLine: aarch64
-RUN if [ "$(uname -m)" = "aarch64" ];then \
-  zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-aarch64 python311-devel python311 python311-pip tar gawk git curl xz fakeroot shadow sed cpio; zypper -n clean; rm -rf /var/log/*; \
-  fi
-#RUN zypper --installroot /installroot --non-interactive install --no-recommends sles-release;
+RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 ironic-ipa-ramdisk-aarch64 tar gawk curl xz zstd shadow cpio findutils
+
 RUN cp /usr/bin/getopt /installroot/

 FROM micro AS final
@@ -41,8 +34,9 @@ LABEL com.suse.release-stage="released"

 COPY --from=base /installroot /
 RUN cp /getopt /usr/bin/
-RUN cp /srv/tftpboot/openstack-ironic-image/initrd.xz /tmp
+RUN cp /srv/tftpboot/openstack-ironic-image/initrd*.zst /tmp
 RUN cp /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel /tmp
+RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/
 RUN set -euo pipefail; chmod +x /bin/configure-nonroot.sh
--- a/ironic-ipa-downloader-image/get-resource.sh
+++ b/ironic-ipa-downloader-image/get-resource.sh
@@ -6,12 +6,33 @@ export http_proxy=${http_proxy:-$HTTP_PROXY}
 export https_proxy=${https_proxy:-$HTTPS_PROXY}
 export no_proxy=${no_proxy:-$NO_PROXY}

+if [ -d "/tmp/ironic-certificates" ]; then
+  sha256sum /tmp/ironic-certificates/* > /tmp/certificates.sha256
+  if cmp "/shared/certificates.sha256" "/tmp/certificates.sha256"; then
+    CERTS_CHANGED=1
+  else
+    CERTS_CHANGED=0
+  fi
+fi
+
 # Which image should we use
 if [ -z "${IPA_BASEURI}" ]; then
-  # SLES BASED IPA - ironic-ipa-ramdisk-x86_64 package
+  if cmp "/shared/images.sha256" "/tmp/images.sha256"; then
+    if [ "${CERTS_CHANGED:-1}" = "1" ]; then
+      # everything is the same exit early
+      exit 0
+    fi
+  fi
+  IMAGE_CHANGED=0
+  # SLES BASED IPA - ironic-ipa-ramdisk-x86_64 and ironic-ipa-ramdisk-aarch64 packages
  mkdir -p /shared/html/images
-  cp /tmp/initrd.xz /shared/html/images/ironic-python-agent.initramfs
-  cp /tmp/openstack-ironic-image*.kernel /shared/html/images/ironic-python-agent.kernel
+  cp /tmp/initrd-x86_64.zst /shared/html/images/ironic-python-agent-x86_64.initramfs
+  cp /tmp/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent-x86_64.kernel
+  # Use arm64 as destination for iPXE compatibility
+  cp /tmp/initrd-aarch64.zst /shared/html/images/ironic-python-agent-arm64.initramfs
+  cp /tmp/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent-arm64.kernel
+
+  cp /tmp/images.sha256 /shared/images.sha256
 else
  FILENAME=ironic-python-agent
  FILENAME_EXT=.tar
@@ -25,47 +46,56 @@ else
  # If we have a CACHEURL and nothing has yet been downloaded
  # get header info from the cache
  ls -l
-  if [ -n "$CACHEURL" -a ! -e $FFILENAME.headers ] ; then
+  if [ -n "$CACHEURL" ] && [ ! -e $FFILENAME.headers ] ; then
      curl -g --verbose --fail -O "$CACHEURL/$FFILENAME.headers" || true
  fi
  
  # Download the most recent version of IPA
  if [ -e $FFILENAME.headers ] ; then
      ETAG=$(awk '/ETag:/ {print $2}' $FFILENAME.headers | tr -d "\r")
-      cd $TMPDIR
-      curl -g --verbose --dump-header $FFILENAME.headers -O $IPA_BASEURI/$FFILENAME --header "If-None-Match: $ETAG" || cp /shared/html/images/$FFILENAME.headers .
+      cd "$TMPDIR"
+      curl -g --verbose --dump-header $FFILENAME.headers -O "$IPA_BASEURI/$FFILENAME" --header "If-None-Match: $ETAG" || cp /shared/html/images/$FFILENAME.headers .
      # curl didn't download anything because we have the ETag already
      # but we don't have it in the images directory
      # Its in the cache, go get it
      ETAG=$(awk '/ETag:/ {print $2}' $FFILENAME.headers | tr -d "\"\r")
-      if [ ! -s $FFILENAME -a ! -e /shared/html/images/$FILENAME-$ETAG/$FFILENAME ] ; then
+      if [ ! -s $FFILENAME ] && [ ! -e "/shared/html/images/$FILENAME-$ETAG/$FFILENAME" ] ; then
          mv /shared/html/images/$FFILENAME.headers .
          curl -g --verbose -O "$CACHEURL/$FILENAME-$ETAG/$FFILENAME"
      fi
  else
-      cd $TMPDIR
-      curl -g --verbose --dump-header $FFILENAME.headers -O $IPA_BASEURI/$FFILENAME
+      cd "$TMPDIR"
+      curl -g --verbose --dump-header $FFILENAME.headers -O "$IPA_BASEURI/$FFILENAME"
  fi
  
  if [ -s $FFILENAME ] ; then
      tar -xf $FFILENAME
-  
+      xz -d -c -k --fast $FILENAME.initramfs | zstd -c > $FILENAME.initramfs.zstd
+      mv $FILENAME.initramfs.zstd $FILENAME.initramfs
+      ARCH=$(file -b ${FILENAME}.kernel | cut -d ' ' -f 3)
+      if [ "$ARCH" = "x86" ]; then
+        ARCH="x86_64"
+      fi
      ETAG=$(awk '/ETag:/ {print $2}' $FFILENAME.headers | tr -d "\"\r")
      cd -
-      chmod 755 $TMPDIR
-      mv $TMPDIR $FILENAME-$ETAG
-      ln -sf $FILENAME-$ETAG/$FFILENAME.headers $FFILENAME.headers
-      ln -sf $FILENAME-$ETAG/$FILENAME.initramfs $FILENAME.initramfs
-      ln -sf $FILENAME-$ETAG/$FILENAME.kernel $FILENAME.kernel
+      chmod 755 "$TMPDIR"
+      mv "$TMPDIR" "$FILENAME-$ETAG"
+      ln -sf "$FILENAME-$ETAG/$FFILENAME.headers" "$FFILENAME.headers"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.initramfs" "$FILENAME-${ARCH,,}.initramfs"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.kernel" "$FILENAME-${ARCH,,}.kernel"
+      
+      IMAGE_CHANGED=0
  else
-      rm -rf $TMPDIR
+      rm -rf "$TMPDIR"
  fi
 fi

-if [ -d "/tmp/ironic-certificates" ]; then
+if [ "${CERTS_CHANGED:-1}" = "0" ] || [ "${IMAGE_CHANGED:-1}" = "0" ]; then
  mkdir -p /tmp/ca/tmp-initrd && cd /tmp/ca/tmp-initrd
-  xz -d -c -k --fast /shared/html/images/ironic-python-agent.initramfs | fakeroot -s ../initrd.fakeroot cpio -i
  mkdir -p etc/ironic-python-agent.d/ca-certs
  cp /tmp/ironic-certificates/* etc/ironic-python-agent.d/ca-certs/
-  find . | fakeroot -i ../initrd.fakeroot cpio -o -H newc | xz --check=crc32 --x86 --lzma2 --fast > /shared/html/images/ironic-python-agent.initramfs
+  for initramfs in /shared/html/images/ironic-python-agent-*.initramfs; do
+    find . | cpio -o -H newc --reproducible | zstd -c >> "${initramfs}"
+  done
+  cp /tmp/certificates.sha256 /shared/certificates.sha256
 fi
--- a/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
+++ b/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<image schemaversion="7.4" name="openstack-ironic-image-301">
+<image schemaversion="7.4" name="openstack-ironic-image">
    <description type="system">
        <author>Cloud developers</author>
        <contact>cloud-devel@suse.de</contact>
--- a/ironic-ipa-ramdisk/ironic-ipa-ramdisk.spec
+++ b/ironic-ipa-ramdisk/ironic-ipa-ramdisk.spec
@@ -148,10 +148,8 @@ TDIR=`mktemp -d /tmp/openstack-ironic-image.XXXXX`
 cd /tmp/openstack-ironic-image/img/build/image-root 
 find . | cpio --create --format=newc --quiet > $TDIR/initrdtmp
 cd $TDIR
-gzip -9 -f initrdtmp
-INITRDGZ=`ls *.gz | head -1`
-gzip -cd $INITRDGZ | xz --check=crc32 -c9 > initrd.xz
-INITRD=`ls *.xz | head -1`
+zstd initrdtmp -o initrd-%{_arch}.zst
+INITRD=`ls *.zst | head -1`

 ls /tmp/openstack-ironic-image/img/openstack-ironic-image*
 KERNEL=`ls /tmp/openstack-ironic-image/img/openstack-ironic-image*default*kernel | head -1`
--- a/kiwi-builder-image/Dockerfile
+++ b/kiwi-builder-image/Dockerfile
@@ -1,20 +1,18 @@
-#!BuildTag: %%IMG_PREFIX%%kiwi-builder:%%kiwi_version%%.1-%RELEASE%
-#!BuildTag: %%IMG_PREFIX%%kiwi-builder:%%kiwi_version%%.1
-
-ARG KIWIVERSION="10.2.12"
-FROM registry.suse.com/bci/kiwi:${KIWIVERSION}
-ARG KIWIVERSION
+#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.1.16.1
+#!BuildTag: %%IMG_PREFIX%%kiwi-builder:10.1.16.1-%RELEASE%
+FROM registry.suse.com/bci/kiwi:10.1.16
+MAINTAINER SUSE LLC (https://www.suse.com/)

 # Define labels according to https://en.opensuse.org/Building_derived_containers
 # labelprefix=com.suse.application.akri
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Kiwi Builder Container Image"
 LABEL org.opencontainers.image.description="kiwi-builder based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="%%kiwi_version%%"
+LABEL org.opencontainers.image.version="%PACKAGE_VERSION%"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%kiwi-builder:%%kiwi_version%%.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%kiwi-builder:10.1.16.1"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -23,8 +21,8 @@ LABEL com.suse.image-type="application"
 LABEL com.suse.release-stage="released"
 # endlabelprefix

-# help the build service understand the need for python3-kiwi
-RUN zypper -n install -d -D python3-kiwi; [ "%%kiwi_version%%" = "${KIWIVERSION}" ] || { echo "expected kiwi version ${KIWIVERSION}: version mismatch"; exit 1; }
+# Configure Kiwi to use kpartx
+RUN echo -e "mapper:\n  - part_mapper: kpartx" > /etc/kiwi.yml

 # Copy build script into image and make it executable
 ADD build-image.sh /usr/bin/build-image
--- a/kiwi-builder-image/README
+++ b/kiwi-builder-image/README
@@ -2,13 +2,13 @@
 Kiwi SDK Image Instructions
 ###########################

-Please ensure that you're running this on a registered SLE Micro 6.0 system, and make sure that SELinux is disabled:
+Please ensure that you're running this on a registered SUSE Linux Micro 6.1 system, and make sure that SELinux is disabled:

 # setenforce 0

 Next, download the podman image:

-# podman pull %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1
+# podman pull %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1

 Make a local output directory (where the images will reside):

@@ -16,40 +16,40 @@ Make a local output directory (where the images will reside):

 Then, to build a standard "Base" image, run the following in podman:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image

 To build a "Base" SelfInstall ISO, you can add additional flags, for example:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image -p Base-SelfInstall
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image -p Base-SelfInstall

 Then, to build a standard "Default" image, run the following in podman:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image -p Default
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image -p Default

 To build a "Default" SelfInstall ISO, you can add additional flags, for example:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image -p Default-SelfInstall
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image -p Default-SelfInstall

 To build an image with a RealTime kernel, e.g. a RAW disk image ("Default"), use the following:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image -p Base-RT
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image -p Base-RT

 To build an image that supports a large block/sectorsize (4096), use the "-b" flag, for example:

-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image -p Default-SelfInstall -b
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image -p Default-SelfInstall -b

 # mkdir mydefs/
 # cp /path/to/SL-Micro.kiwi mydefs/
 # cp /path/to/config.sh mydefs/
-# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -v ./mydefs/:/micro-sdk/defs/ -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:%%kiwi_version%%.1 build-image
+# podman run --privileged -v /etc/zypp/repos.d:/micro-sdk/repos/ -v ./output:/tmp/output -v ./mydefs/:/micro-sdk/defs/ -it %%IMG_REPO%%/%%IMG_PREFIXkiwi-builder:10.1.16.1 build-image

 All output will be in the local $(pwd)/output directory, for example:

 # ls -1 output/
-SL-Micro.x86_64-6.0.changes
-SL-Micro.x86_64-6.0.packages
-SL-Micro.x86_64-6.0.raw
-SL-Micro.x86_64-6.0.verified
+SLE-Micro.x86_64-6.1.changes
+SLE-Micro.x86_64-6.1.packages
+SLE-Micro.x86_64-6.1.raw
+SLE-Micro.x86_64-6.1.verified
 build
 kiwi.result
 kiwi.result.json
--- a/kiwi-builder-image/SL-Micro.kiwi
+++ b/kiwi-builder-image/SL-Micro.kiwi
@@ -33,6 +33,12 @@
        <profile name="aarch64-self_install" description="Raw disk for aarch64" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="aarch64-rt" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="aarch64-rt-self_install" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
        <profile name="x86-legacy" description="Raw disk for x86_64 - legacy boot" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
@@ -63,6 +69,21 @@
        <profile name="s390-fba" description="Raw disk for s390 - DASD" arch="s390x">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="s390-fcp" description="Raw disk for s390 - SCSI" arch="s390x">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-512ss" description="Raw disk for PPc64 - 512 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-4096ss" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-512ss-self_install" description="Raw disk for PPc64 - 512 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-4096ss-self_install" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
        <!-- Images (flavor + platform) -->
        <profile name="Default" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="x86_64">
            <requires profile="full"/>
@@ -140,6 +161,15 @@
            <requires profile="x86-rt-self_install"/>
            <requires profile="self_install"/>
        </profile>
+        <profile name="Base-RT" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt"/>
+        </profile>
+        <profile name="Base-RT-SelfInstall" description="SL Micro with Podman as raw image with uEFI boot - SelfInstall" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
        <profile name="Default-qcow" description="SL Micro with Podman and KVM as raw image for KVM on System z" arch="s390x">
            <requires profile="full"/>
            <requires profile="s390-kvm"/>
@@ -164,6 +194,14 @@
            <requires profile="container-host"/>
            <requires profile="s390-fba"/>
        </profile>
+        <profile name="Default-fcp" description="SL Micro with Podman and KVM as raw image for zFCP on System z" arch="s390x">
+            <requires profile="full"/>
+            <requires profile="s390-fcp"/>
+        </profile>
+        <profile name="Base-fcp" description="SL Micro with Podman as raw image for zFCP on System z" arch="s390x">
+            <requires profile="container-host"/>
+            <requires profile="s390-fcp"/>
+        </profile>
        <profile name="Default-legacy" description="SL Micro with Podman as raw image with legacy boot" arch="x86_64">
            <requires profile="full"/>
            <requires profile="x86-legacy"/>
@@ -184,10 +222,47 @@
 	    <requires profile="container-host"/>
 	    <requires profile="aarch64-qcow"/>
        </profile>
+
+	<profile name="Base-512" description="SL Micro with Podman as raw image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-512ss"/>
+        </profile>
+	<profile name="Base-4096" description="SL Micro with Podman as raw image for ppc64le with 4096b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-4096ss"/>
+        </profile>
+	<profile name="Base-512-SelfInstall" description="SL Micro with Podman as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-512ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Base-4096-SelfInstall" description="SL Micro with Podman as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-4096ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Default-512" description="SL Micro with Podman and KVM as raw image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-512ss"/>
+        </profile>
+	<profile name="Default-4096" description="SL Micro with Podman and KVM as raw image for ppc64le with 4096b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-4096ss"/>
+        </profile>
+	<profile name="Default-512-SelfInstall" description="SL Micro with Podman and KVM as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-512ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Default-4096-SelfInstall" description="SL Micro with Podman and KVM as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-4096ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
    </profiles>

    <preferences profiles="x86-encrypted,x86-rt-encrypted">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -198,7 +273,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -211,7 +286,7 @@
 	    luks_pbkdf="pbkdf2"
        >
            <luksformat>
-                <option name="--cipher" value="aes"/>
+                <option name="--cipher" value="aes-xts-plain64"/>
            </luksformat>
            <bootloader name="grub2" console="gfxterm" use_disk_password="true" />
            <systemdisk>
@@ -230,7 +305,7 @@
        </type>
    </preferences>
    <preferences profiles="x86,x86-rt">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -241,7 +316,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -266,7 +341,7 @@
    </preferences>

    <preferences profiles="x86-self_install,x86-rt-self_install">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -276,11 +351,12 @@
            image="oem"
            initrd_system="dracut"
            installiso="true"
+            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -304,8 +380,8 @@
        </type>
    </preferences>

-    <preferences profiles="rpi">
-        <version>6.0</version>
+    <preferences profiles="rpi,aarch64-rt">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -320,11 +396,11 @@
            install_continue_on_timeout="false"
            fsmountoptions="noatime"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
-            efipartsize="128"     
+            efipartsize="128"
            editbootinstall="editbootinstall_rpi.sh"
            btrfs_root_is_readonly_snapshot="true"
            btrfs_quota_groups="false"
@@ -344,8 +420,8 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64-self_install">
-        <version>6.0</version>
+    <preferences profiles="aarch64-self_install,aarch64-rt-self_install">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -355,12 +431,13 @@
            image="oem"
            initrd_system="dracut"
            installiso="true"
+            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            efipartsize="128"     
-	    kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            efipartsize="128"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -385,22 +462,22 @@
    </preferences>

    <preferences profiles="s390-kvm">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
        <type
            image="oem"
            filesystem="btrfs"
            bootpartition="true"
            bootpartsize="300"
-            bootfilesystem="ext2"
+            bootfilesystem="ext4"
        initrd_system="dracut"
        format="qcow2"
-            kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
        devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
            btrfs_root_is_readonly_snapshot="true"
@@ -423,7 +500,7 @@


    <preferences profiles="s390-dasd">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -434,9 +511,9 @@
          filesystem="btrfs"
          bootpartition="true"
          bootpartsize="300"
-          bootfilesystem="ext2"
+          bootfilesystem="ext4"
          initrd_system="dracut"
-          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
          devicepersistency="by-uuid"
          target_blocksize="4096"
          btrfs_root_is_snapshot="true"
@@ -461,7 +538,7 @@


    <preferences profiles="s390-fba">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -472,9 +549,9 @@
          filesystem="btrfs"
          bootpartition="true"
          bootpartsize="300"
-          bootfilesystem="ext2"
+          bootfilesystem="ext4"
          initrd_system="dracut"
-          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
          devicepersistency="by-uuid"
          btrfs_root_is_snapshot="true"
          btrfs_root_is_readonly_snapshot="true"
@@ -495,9 +572,47 @@
        </type>
    </preferences>

+    <preferences profiles="s390-fcp">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <type
+          image="oem"
+          filesystem="btrfs"
+          installpxe="true"
+          bootpartition="true"
+          bootpartsize="300"
+          bootfilesystem="ext4"
+          initrd_system="dracut"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
+          devicepersistency="by-uuid"
+          btrfs_root_is_snapshot="true"
+          btrfs_root_is_readonly_snapshot="true"
+          btrfs_quota_groups="true"
+        >
+            <oemconfig>
+                <oem-multipath-scan>true</oem-multipath-scan>
+            </oemconfig>
+            <bootloader name="grub2_s390x_emu" console="serial" timeout="3" targettype="SCSI"/>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/s390x-emu" mountpoint="boot/grub2/s390x-emu"/>
+                <volume name="boot/writable"/>
+                <volume name="usr/local"/>
+                <volume name="var" copy_on_write="false"/>
+            </systemdisk>
+            <size unit="G">5</size>
+        </type>
+    </preferences>

    <preferences profiles="x86-vmware">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -532,7 +647,7 @@
        </type>
    </preferences>
    <preferences profiles="x86-qcow">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -543,7 +658,7 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=qemu"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -567,9 +682,9 @@
            <size unit="G">32</size>
        </type>
    </preferences>
- 
+
    <preferences profiles="aarch64-qcow">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -580,8 +695,8 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            efipartsize="128"     
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=qemu"
+            efipartsize="128"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -592,7 +707,7 @@
            <systemdisk>
                <volume name="home"/>
                <volume name="root"/>
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
                <volume name="boot/writable"/>
@@ -603,6 +718,161 @@
        </type>
    </preferences>

+    <preferences profiles="ppc64le-512ss">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+    <preferences profiles="ppc64le-4096ss">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- TODO: supposedly this is needed as type attribute, but kiwi needs patching
+             disk_start_sector="256" -->
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            target_blocksize="4096"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+
+    <preferences profiles="ppc64le-512ss-self_install">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            installiso="true"
+            installpxe="true"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <installmedia>
+                <initrd action="omit">
+                    <dracut module="drm"/>
+                </initrd>
+            </installmedia>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+    <preferences profiles="ppc64le-4096ss-self_install">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- TODO: supposedly this is needed as type attribute, but kiwi needs patching
+             disk_start_sector="256" -->
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            installiso="true"
+            installpxe="true"
+            target_blocksize="4096"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <installmedia>
+                <initrd action="omit">
+                    <dracut module="drm"/>
+                </initrd>
+            </installmedia>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+
+
   <repository type="rpm-md" >
        <source path='obsrepositories:/'/>
    </repository>
@@ -616,7 +886,7 @@
 	<package name="patterns-base-kvm_host"/>
 	<package name="lzop"/>
        <namedCollection name="container_runtime_podman"/>
-        <package name="patterns-container-runtime_podman"/> 
+        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="cockpit"/>
        <package name="patterns-base-cockpit"/>
        <namedCollection name="selinux"/>
@@ -628,7 +898,6 @@
        <package name="firewalld"/>
        <package name="wpa_supplicant" arch="x86_64,aarch64"/>
 	<package name="libpwquality-tools"/>
-        <!-- <package name="k3s-install"/> -->
    </packages>

    <packages type="image" profiles="x86-encrypted,x86-rt-encrypted">
@@ -647,9 +916,7 @@
        <namedCollection name="base_transactional"/>
        <package name="patterns-base-transactional"/>
        <namedCollection name="container_runtime_podman"/>
-        <package name="patterns-container-runtime_podman"/> 
-        <namedCollection name="cockpit"/>
-        <package name="patterns-base-cockpit"/>
+        <package name="patterns-container-runtime_podman"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
        <package name="suseconnect-ng"/>
@@ -703,7 +970,7 @@
        <package name="NetworkManager"/>
        <package name="NetworkManager-branding-SLE"/>
 	<package name="ModemManager"/>
-	<!-- FIXME does not build without control file which is obsolete 
+	<!-- FIXME does not build without control file which is obsolete
 	<package name="live-add-yast-repos"/> -->
 	<package name="parted"/> <!-- seems missing to deploy the image -->
    </packages>
@@ -713,7 +980,8 @@
        <package name="grub2-x86_64-efi" arch="x86_64"/>
        <package name="grub2-arm64-efi" arch="aarch64"/>
        <package name="grub2-s390x-emu" arch="s390x"/>
-        <package name="grub2-branding-SLE" bootinclude="true" arch="x86_64,aarch64"/>
+        <package name="grub2-powerpc-ieee1275" arch="ppc64le"/>
+        <package name="grub2-branding-SLE" bootinclude="true" arch="x86_64,aarch64,ppc64le"/>
        <package name="grub2-snapper-plugin"/>
        <package name="shim" arch="x86_64,aarch64"/>
 	<package name="mokutil" arch="x86_64,aarch64"/>
@@ -721,46 +989,44 @@
 	    <package name="kpartx" arch="s390x"/>--> <!-- previous releases picked it always, now kiwi picks partx instead -->
    </packages>
    <!-- rpi kernel-default-base does not provide all necessary drivers -->
-    <packages type="image" profiles="x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba">
+    <packages type="image" profiles="rpi,aarch64-self_install,x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="kernel-default"/>
        <package name="kernel-firmware-all"/>
    </packages>
-    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted">
+    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-self_install">
        <package name="kernel-rt"/>
-	<package name="kernel-firmware-all"/>
-	<!-- FIXME intentionally removed from ALP code stream 
-	<package name="cpuset"/> -->
+        <package name="kernel-firmware-all"/>
+	<!-- FIXME intentionally removed from ALP code stream
+        <package name="cpuset"/> -->
    </packages>
-    <!-- makes the image build, but also include kernel-default
-    <packages type="image" profiles="x86-rt-encrypted">
-        <package name="kernel-default-extra"/>
-    </packages> -->
-    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba">
+    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba,s390-fcp">
+        <package name="dracut-kiwi-oem-dump"/>
        <package name="dracut-kiwi-oem-repart"/>
        <package name="blog"/>
    </packages>
-    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,rpi,aarch64-self_install">
+    <!-- FCP is usually used multipathed. -->
+    <packages type="image" profiles="s390-fcp">
+        <package name="multipath-tools"/>
+    </packages>
+    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="dracut-kiwi-oem-dump"/>
    </packages>
-    <packages type="image" profiles="rpi,aarch64-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="raspberrypi-firmware" arch="aarch64"/>
        <package name="raspberrypi-firmware-config" arch="aarch64"/>
        <package name="raspberrypi-firmware-dt" arch="aarch64"/>
        <package name="u-boot-rpiarm64" arch="aarch64"/>
        <package name="dracut-kiwi-oem-repart"/>
        <package name="bcm43xx-firmware"/>
-        <package name="kernel-firmware-all"/><!-- Fix choice between kernel-firmware and kernel-firmware-all -->
        <package name="wireless-regdb"/>
        <package name="wireless-tools"/>
        <package name="wpa_supplicant"/>
        <package name="grub2-arm64-efi"/>
-        <!-- kernel-default-base does not have all required drivers -->
-        <package name="kernel-default"/>
    </packages>
    <packages type="bootstrap">
-        <package name="coreutils"/>
        <package name="filesystem"/>
+        <package name="coreutils"/>
        <package name="ca-certificates"/>
        <package name="ca-certificates-mozilla"/>
    </packages>
@@ -774,4 +1040,14 @@
    <packages type="image" profiles="x86-qcow,aarch64-qcow">
        <package name="qemu-guest-agent"/>
    </packages>
+
+    <!-- jsc#PED-8599 -->
+    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096">
+        <package name="usbguard"/>
+    </packages>
+
+    <!-- jsc#PED-8788 -->
+    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-self_install">
+        <package name="stalld"/>
+    </packages>
 </image>
--- a/kiwi-builder-image/SL-Micro.kiwi.4096
+++ b/kiwi-builder-image/SL-Micro.kiwi.4096
@@ -33,6 +33,12 @@
        <profile name="aarch64-self_install" description="Raw disk for aarch64" arch="aarch64">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="aarch64-rt" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="aarch64-rt-self_install" description="Raw disk for aarch64 with RT kernel" arch="aarch64">
+            <requires profile="bootloader"/>
+        </profile>
        <profile name="x86-legacy" description="Raw disk for x86_64 - legacy boot" arch="x86_64">
            <requires profile="bootloader"/>
        </profile>
@@ -63,6 +69,21 @@
        <profile name="s390-fba" description="Raw disk for s390 - DASD" arch="s390x">
            <requires profile="bootloader"/>
        </profile>
+        <profile name="s390-fcp" description="Raw disk for s390 - SCSI" arch="s390x">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-512ss" description="Raw disk for PPc64 - 512 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-4096ss" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-512ss-self_install" description="Raw disk for PPc64 - 512 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
+        <profile name="ppc64le-4096ss-self_install" description="Raw disk for PPc64 - 4096 sector size" arch="ppc64le">
+            <requires profile="bootloader"/>
+        </profile>
        <!-- Images (flavor + platform) -->
        <profile name="Default" description="SL Micro with Podman and KVM as raw image with uEFI boot" arch="x86_64">
            <requires profile="full"/>
@@ -140,6 +161,15 @@
            <requires profile="x86-rt-self_install"/>
            <requires profile="self_install"/>
        </profile>
+        <profile name="Base-RT" description="SL Micro with Podman as raw image with uEFI boot" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt"/>
+        </profile>
+        <profile name="Base-RT-SelfInstall" description="SL Micro with Podman as raw image with uEFI boot - SelfInstall" arch="aarch64">
+            <requires profile="container-host"/>
+            <requires profile="aarch64-rt-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
        <profile name="Default-qcow" description="SL Micro with Podman and KVM as raw image for KVM on System z" arch="s390x">
            <requires profile="full"/>
            <requires profile="s390-kvm"/>
@@ -164,6 +194,14 @@
            <requires profile="container-host"/>
            <requires profile="s390-fba"/>
        </profile>
+        <profile name="Default-fcp" description="SL Micro with Podman and KVM as raw image for zFCP on System z" arch="s390x">
+            <requires profile="full"/>
+            <requires profile="s390-fcp"/>
+        </profile>
+        <profile name="Base-fcp" description="SL Micro with Podman as raw image for zFCP on System z" arch="s390x">
+            <requires profile="container-host"/>
+            <requires profile="s390-fcp"/>
+        </profile>
        <profile name="Default-legacy" description="SL Micro with Podman as raw image with legacy boot" arch="x86_64">
            <requires profile="full"/>
            <requires profile="x86-legacy"/>
@@ -184,10 +222,47 @@
 	    <requires profile="container-host"/>
 	    <requires profile="aarch64-qcow"/>
        </profile>
+
+	<profile name="Base-512" description="SL Micro with Podman as raw image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-512ss"/>
+        </profile>
+	<profile name="Base-4096" description="SL Micro with Podman as raw image for ppc64le with 4096b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-4096ss"/>
+        </profile>
+	<profile name="Base-512-SelfInstall" description="SL Micro with Podman as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-512ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Base-4096-SelfInstall" description="SL Micro with Podman as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="container-host"/>
+            <requires profile="ppc64le-4096ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Default-512" description="SL Micro with Podman and KVM as raw image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-512ss"/>
+        </profile>
+	<profile name="Default-4096" description="SL Micro with Podman and KVM as raw image for ppc64le with 4096b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-4096ss"/>
+        </profile>
+	<profile name="Default-512-SelfInstall" description="SL Micro with Podman and KVM as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-512ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
+	<profile name="Default-4096-SelfInstall" description="SL Micro with Podman and KVM as self-install image for ppc64le with 512b sector size" arch="ppc64le">
+            <requires profile="full"/>
+            <requires profile="ppc64le-4096ss-self_install"/>
+            <requires profile="self_install"/>
+        </profile>
    </profiles>

    <preferences profiles="x86-encrypted,x86-rt-encrypted">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -198,7 +273,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -213,7 +288,7 @@
            efipartsize="200"
        >
            <luksformat>
-                <option name="--cipher" value="aes"/>
+                <option name="--cipher" value="aes-xts-plain64"/>
            </luksformat>
            <bootloader name="grub2" console="gfxterm" use_disk_password="true" />
            <systemdisk>
@@ -232,7 +307,7 @@
        </type>
    </preferences>
    <preferences profiles="x86,x86-rt">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -243,7 +318,7 @@
            initrd_system="dracut"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -270,7 +345,7 @@
    </preferences>

    <preferences profiles="x86-self_install,x86-rt-self_install">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -280,11 +355,12 @@
            image="oem"
            initrd_system="dracut"
            installiso="true"
+            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -310,8 +386,8 @@
        </type>
    </preferences>

-    <preferences profiles="rpi">
-        <version>6.0</version>
+    <preferences profiles="rpi,aarch64-rt">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -326,7 +402,7 @@
            install_continue_on_timeout="false"
            fsmountoptions="noatime"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200n8 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
@@ -350,8 +426,8 @@
            </systemdisk>
        </type>
    </preferences>
-    <preferences profiles="aarch64-self_install">
-        <version>6.0</version>
+    <preferences profiles="aarch64-self_install,aarch64-rt-self_install">
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -361,12 +437,13 @@
            image="oem"
            initrd_system="dracut"
            installiso="true"
+            installpxe="true"
            filesystem="btrfs"
            installboot="install"
            install_continue_on_timeout="false"
            firmware="uefi"
            efipartsize="128"
-	    kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -391,22 +468,22 @@
    </preferences>

    <preferences profiles="s390-kvm">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
        <rpm-excludedocs>true</rpm-excludedocs>
        <locale>en_US</locale>
-
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
        <type
            image="oem"
            filesystem="btrfs"
            bootpartition="true"
            bootpartsize="300"
-            bootfilesystem="ext2"
+            bootfilesystem="ext4"
        initrd_system="dracut"
        format="qcow2"
-            kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+            kernelcmdline="security=selinux selinux=1 quiet systemd.show_status=1 ignition.platform.id=metal"
        devicepersistency="by-uuid"
            btrfs_root_is_snapshot="true"
            btrfs_root_is_readonly_snapshot="true"
@@ -429,7 +506,7 @@


    <preferences profiles="s390-dasd">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -440,9 +517,9 @@
          filesystem="btrfs"
          bootpartition="true"
          bootpartsize="300"
-          bootfilesystem="ext2"
+          bootfilesystem="ext4"
          initrd_system="dracut"
-          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
          devicepersistency="by-uuid"
          target_blocksize="4096"
          btrfs_root_is_snapshot="true"
@@ -467,7 +544,7 @@


    <preferences profiles="s390-fba">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -478,9 +555,9 @@
          filesystem="btrfs"
          bootpartition="true"
          bootpartsize="300"
-          bootfilesystem="ext2"
+          bootfilesystem="ext4"
          initrd_system="dracut"
-          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
          devicepersistency="by-uuid"
          btrfs_root_is_snapshot="true"
          btrfs_root_is_readonly_snapshot="true"
@@ -501,9 +578,47 @@
        </type>
    </preferences>

+    <preferences profiles="s390-fcp">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <type
+          image="oem"
+          filesystem="btrfs"
+          installpxe="true"
+          bootpartition="true"
+          bootpartsize="300"
+          bootfilesystem="ext4"
+          initrd_system="dracut"
+          kernelcmdline="hvc_iucv=8 TERM=dumb security=selinux selinux=1 quiet systemd.show_status=1"
+          devicepersistency="by-uuid"
+          btrfs_root_is_snapshot="true"
+          btrfs_root_is_readonly_snapshot="true"
+          btrfs_quota_groups="true"
+        >
+            <oemconfig>
+                <oem-multipath-scan>true</oem-multipath-scan>
+            </oemconfig>
+            <bootloader name="grub2_s390x_emu" console="serial" timeout="3" targettype="SCSI"/>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/s390x-emu" mountpoint="boot/grub2/s390x-emu"/>
+                <volume name="boot/writable"/>
+                <volume name="usr/local"/>
+                <volume name="var" copy_on_write="false"/>
+            </systemdisk>
+            <size unit="G">5</size>
+        </type>
+    </preferences>

    <preferences profiles="x86-vmware">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -538,7 +653,7 @@
        </type>
    </preferences>
    <preferences profiles="x86-qcow">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -549,7 +664,7 @@
            format="qcow2"
            filesystem="btrfs"
            firmware="uefi"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=qemu"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -577,7 +692,7 @@
    </preferences>

    <preferences profiles="aarch64-qcow">
-        <version>6.0</version>
+        <version>6.1</version>
        <packagemanager>zypper</packagemanager>
        <bootsplash-theme>SLE</bootsplash-theme>
        <bootloader-theme>SLE</bootloader-theme>
@@ -589,7 +704,7 @@
            filesystem="btrfs"
            firmware="uefi"
            efipartsize="128"
-            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=qemu"
+            kernelcmdline="console=ttyS0,115200 console=tty0 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=qemu"
            bootpartition="false"
            bootkernel="custom"
            devicepersistency="by-uuid"
@@ -600,7 +715,7 @@
            <systemdisk>
                <volume name="home"/>
                <volume name="root"/>
- 		<volume name="opt"/>
+                <volume name="opt"/>
                <volume name="srv"/>
                <volume name="boot/grub2/arm64-efi" mountpoint="boot/grub2/arm64-efi"/>
                <volume name="boot/writable"/>
@@ -611,6 +726,161 @@
        </type>
    </preferences>

+    <preferences profiles="ppc64le-512ss">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+    <preferences profiles="ppc64le-4096ss">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- TODO: supposedly this is needed as type attribute, but kiwi needs patching
+             disk_start_sector="256" -->
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            target_blocksize="4096"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+
+    <preferences profiles="ppc64le-512ss-self_install">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            installiso="true"
+            installpxe="true"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <installmedia>
+                <initrd action="omit">
+                    <dracut module="drm"/>
+                </initrd>
+            </installmedia>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+    <preferences profiles="ppc64le-4096ss-self_install">
+        <version>6.1</version>
+        <packagemanager>zypper</packagemanager>
+        <bootsplash-theme>SLE</bootsplash-theme>
+        <bootloader-theme>SLE</bootloader-theme>
+        <rpm-excludedocs>true</rpm-excludedocs>
+        <locale>en_US</locale>
+        <!-- TODO: supposedly this is needed as type attribute, but kiwi needs patching
+             disk_start_sector="256" -->
+        <!-- Use ignition.platform.id=metal to avoid bsc#1227689 -->
+        <type
+            image="oem"
+            installiso="true"
+            installpxe="true"
+            target_blocksize="4096"
+            filesystem="btrfs"
+            firmware="ofw"
+            kernelcmdline="console=hvc0,115200 security=selinux selinux=1 quiet systemd.show_status=1 net.ifnames=0 ignition.platform.id=metal"
+            bootpartition="false"
+            bootkernel="custom"
+            devicepersistency="by-uuid"
+            btrfs_root_is_snapshot="true"
+            btrfs_root_is_readonly_snapshot="true"
+            btrfs_quota_groups="true"
+        >
+            <installmedia>
+                <initrd action="omit">
+                    <dracut module="drm"/>
+                </initrd>
+            </installmedia>
+            <systemdisk>
+                <volume name="home"/>
+                <volume name="root"/>
+		<!-- on tmpfs jsc#SMO-2                <volume name="tmp"/> -->
+                <volume name="opt"/>
+                <volume name="srv"/>
+                <volume name="boot/grub2/powerpc-ieee1275"/>
+                <volume name="boot/writable"/>
+		<volume name="usr/local"/>
+		<volume name="var" copy_on_write="false"/>
+            </systemdisk>
+        </type>
+    </preferences>
+
+
   <repository type="rpm-md" >
        <source path='obsrepositories:/'/>
    </repository>
@@ -655,8 +925,6 @@
        <package name="patterns-base-transactional"/>
        <namedCollection name="container_runtime_podman"/>
        <package name="patterns-container-runtime_podman"/>
-        <namedCollection name="cockpit"/>
-        <package name="patterns-base-cockpit"/>
        <namedCollection name="selinux"/>
        <package name="patterns-base-selinux"/>
        <package name="suseconnect-ng"/>
@@ -720,7 +988,8 @@
        <package name="grub2-x86_64-efi" arch="x86_64"/>
        <package name="grub2-arm64-efi" arch="aarch64"/>
        <package name="grub2-s390x-emu" arch="s390x"/>
-        <package name="grub2-branding-SLE" bootinclude="true" arch="x86_64,aarch64"/>
+        <package name="grub2-powerpc-ieee1275" arch="ppc64le"/>
+        <package name="grub2-branding-SLE" bootinclude="true" arch="x86_64,aarch64,ppc64le"/>
        <package name="grub2-snapper-plugin"/>
        <package name="shim" arch="x86_64,aarch64"/>
 	<package name="mokutil" arch="x86_64,aarch64"/>
@@ -728,46 +997,44 @@
 	    <package name="kpartx" arch="s390x"/>--> <!-- previous releases picked it always, now kiwi picks partx instead -->
    </packages>
    <!-- rpi kernel-default-base does not provide all necessary drivers -->
-    <packages type="image" profiles="x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba">
+    <packages type="image" profiles="rpi,aarch64-self_install,x86,x86-encrypted,x86-legacy,x86-self_install,x86-vmware,x86-qcow,aarch64-qcow,s390-kvm,s390-dasd,s390-fba,s390-fcp,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="kernel-default"/>
        <package name="kernel-firmware-all"/>
    </packages>
-    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted">
+    <packages type="image" profiles="x86-rt,x86-rt-self_install,x86-rt-encrypted,aarch64-rt,aarch64-rt-self_install">
        <package name="kernel-rt"/>
-	<package name="kernel-firmware-all"/>
+        <package name="kernel-firmware-all"/>
 	<!-- FIXME intentionally removed from ALP code stream
-	<package name="cpuset"/> -->
+        <package name="cpuset"/> -->
    </packages>
-    <!-- makes the image build, but also include kernel-default
-    <packages type="image" profiles="x86-rt-encrypted">
-        <package name="kernel-default-extra"/>
-    </packages> -->
-    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba">
+    <packages type="image" profiles="s390-kvm,s390-dasd,s390-fba,s390-fcp">
+        <package name="dracut-kiwi-oem-dump"/>
        <package name="dracut-kiwi-oem-repart"/>
        <package name="blog"/>
    </packages>
-    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,rpi,aarch64-self_install">
+    <!-- FCP is usually used multipathed. -->
+    <packages type="image" profiles="s390-fcp">
+        <package name="multipath-tools"/>
+    </packages>
+    <packages type="image" profiles="x86,x86-encrypted,x86-rt-encrypted,x86-self_install,x86-legacy,x86-vmware,x86-rt,x86-rt-self_install,x86-qcow,aarch64-qcow,rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install,ppc64le-512ss,ppc64le-4096ss,ppc64le-512ss-self_install,ppc64le-4096ss-self_install">
        <package name="dracut-kiwi-oem-repart"/>
        <package name="dracut-kiwi-oem-dump"/>
    </packages>
-    <packages type="image" profiles="rpi,aarch64-self_install">
+    <packages type="image" profiles="rpi,aarch64-self_install,aarch64-rt,aarch64-rt-self_install">
        <package name="raspberrypi-firmware" arch="aarch64"/>
        <package name="raspberrypi-firmware-config" arch="aarch64"/>
        <package name="raspberrypi-firmware-dt" arch="aarch64"/>
        <package name="u-boot-rpiarm64" arch="aarch64"/>
        <package name="dracut-kiwi-oem-repart"/>
        <package name="bcm43xx-firmware"/>
-        <package name="kernel-firmware-all"/><!-- Fix choice between kernel-firmware and kernel-firmware-all -->
        <package name="wireless-regdb"/>
        <package name="wireless-tools"/>
        <package name="wpa_supplicant"/>
        <package name="grub2-arm64-efi"/>
-        <!-- kernel-default-base does not have all required drivers -->
-        <package name="kernel-default"/>
    </packages>
    <packages type="bootstrap">
-        <package name="coreutils"/>
        <package name="filesystem"/>
+        <package name="coreutils"/>
        <package name="ca-certificates"/>
        <package name="ca-certificates-mozilla"/>
    </packages>
@@ -781,4 +1048,14 @@
    <packages type="image" profiles="x86-qcow,aarch64-qcow">
        <package name="qemu-guest-agent"/>
    </packages>
-</image>
+
+    <!-- jsc#PED-8599 -->
+    <packages type="image" profiles="Base,Base-encrypted,Base-RT,Base-RT-encrypted,Base-fba,Base-dasd,Base-fcp,Base-512,Base-4096,Default,Default-encrypted,Default-fba,Default-dasd,Default-fcp,Default-512,Default-4096">
+        <package name="usbguard"/>
+    </packages>
+
+    <!-- jsc#PED-8788 -->
+    <packages type="image" profiles="Base-RT,Base-RT-encrypted,x86-rt-encrypted,x86-rt,x86-rt-self_install,aarch64-rt,aarch64-rt-self_install">
+        <package name="stalld"/>
+    </packages>
+</image>
--- a/kiwi-builder-image/_service
+++ b/kiwi-builder-image/_service
@@ -16,14 +16,4 @@
    <param name="eval">SUPPORT_LEVEL=$(rpm --macros=/root/.rpmmacros -E %support_level)</param>
    <param name="var">SUPPORT_LEVEL</param>
  </service>
-  <service mode="buildtime" name="replace_using_package_version">
-    <param name="file">Dockerfile</param>
-    <param name="regex">%%kiwi_version%%</param>
-    <param name="package">python3-kiwi</param>
-  </service>
-  <service mode="buildtime" name="replace_using_package_version">
-    <param name="file">README</param>
-    <param name="regex">%%kiwi_version%%</param>
-    <param name="package">python3-kiwi</param>
-  </service>
 </services>
--- a/kiwi-builder-image/build-image.sh
+++ b/kiwi-builder-image/build-image.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -27,9 +27,9 @@ LARGEBLOCK=false
 # Print usage
 usage(){
  cat <<-EOF
-  ==============================
-  SLE Micro 6.0 Kiwi SDK Builder
-  ==============================
+  =====================================
+  SUSE Linux Micro 6.1 Kiwi SDK Builder
+  =====================================

  Usage: ${0} [-p <profile>] [-b]

--- a/kiwi-builder-image/config.sh
+++ b/kiwi-builder-image/config.sh
@@ -35,14 +35,6 @@ mkdir /var/lib/misc/reconfig_system
 #--------------------------------------
 echo "Configure image: [$kiwi_iname]-[$kiwi_profiles]..."

-#======================================
-# This is a workaround - someone,
-# somewhere needs to load the xts crypto
-# module, otherwise luksOpen will fail while
-# creating the image.
-#--------------------------------------
-modprobe xts || true
-
 #======================================
 # add missing fonts
 #--------------------------------------
@@ -139,9 +131,6 @@ for i in /usr/lib/rpm/gnupg/keys/gpg-pubkey*asc; do
    rpm --import $i || true
 done

-# Temporary workaround for bsc#1212187
-echo "techpreview.ZYPP_MEDIANETWORK=1" >> /etc/zypp/zypp.conf
-
 #======================================
 # Enable kubelet if installed
 #--------------------------------------
@@ -170,8 +159,18 @@ if [ "${kiwi_btrfs_root_is_snapshot-false}" = 'true' ]; then
 	sed -i'' 's/^NUMBER_LIMIT_IMPORTANT=.*$/NUMBER_LIMIT_IMPORTANT="4-10"/g' /etc/snapper/configs/root
 fi

-# Enable jeos-firstboot if installed, disabled by combustion/ignition
-if rpm -q --whatprovides jeos-firstboot >/dev/null; then
+# Enable multipathd for MP images
+if [ "${kiwi_oemmultipath_scan-false}" = 'true' ]; then
+        systemctl enable multipathd.service
+fi
+
+# On those s390 targets the console is not capable of running jeos-firstboot,
+# use systemd-firstboot as minimal alternative.
+if [[ "$kiwi_profiles" =~ s390-(dasd|fba|fcp) ]]; then
+	systemctl enable systemd-firstboot
+	# Enable prompting for the root password
+	echo 'root:!unprovisioned' | chpasswd -e
+elif rpm -q --whatprovides jeos-firstboot >/dev/null; then
        mkdir -p /var/lib/YaST2
        touch /var/lib/YaST2/reconfig_system
        systemctl enable jeos-firstboot.service
@@ -281,7 +280,7 @@ if [[ "$kiwi_profiles" == *"RaspberryPi"* ]]; then
 		options smsc95xx turbo_mode=N
 	EOF

-	cat > /usr/lib/sysctl.d/50-rpi3.conf <<-EOF
+	cat > /etc/sysctl.d/50-rpi3.conf <<-EOF
 		# Avoid running out of DMA pages for smsc95xx (bsc#1012449)
 		vm.min_free_kbytes = 2048
 	EOF
--- a/kubevirt-dashboard-extension-chart/Chart.yaml
+++ b/kubevirt-dashboard-extension-chart/Chart.yaml
@@ -13,10 +13,9 @@ annotations:
  catalog.cattle.io/ui-component: plugins
  catalog.cattle.io/ui-extensions-version: ">= 3.0.0 < 4.0.0"
 apiVersion: v2
-appVersion: 302.0.0+up1.2.1
+appVersion: 1.2.1
 description: 'SUSE Edge: KubeVirt extension for Rancher Dashboard'
+icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/kubevirt/icon/color/kubevirt-icon-color.svg
 name: kubevirt-dashboard-extension
 type: application
 version: "%%CHART_MAJOR%%.0.0+up1.2.1"
-icon: >-
-  https://raw.githubusercontent.com/cncf/artwork/master/projects/kubevirt/icon/color/kubevirt-icon-color.svg
--- a/kubevirt-dashboard-extension-chart/templates/_helpers.tpl
+++ b/kubevirt-dashboard-extension-chart/templates/_helpers.tpl
@@ -38,7 +38,7 @@ Common labels
 helm.sh/chart: {{ include "extension-server.chart" . }}
 {{ include "extension-server.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | replace "+" "_" | quote }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
@@ -60,4 +60,4 @@ Pkg annotations
 {{ $key }}: {{ $value | quote }}
 {{- end }}
 {{- end }}
-{{- end }}
+{{- end }}
--- a/kubevirt-dashboard-extension-chart/templates/cr.yaml
+++ b/kubevirt-dashboard-extension-chart/templates/cr.yaml
@@ -8,7 +8,7 @@ spec:
  plugin:
    name: {{ include "extension-server.fullname" . }}
    version: {{ (semver (default .Chart.AppVersion .Values.plugin.versionOverride)).Original }}
-    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/kubevirt-dashboard-extension/302.0.0+up1.2.1
+    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/kubevirt-dashboard-extension/1.2.1
    noCache: {{ .Values.plugin.noCache }}
    noAuth: {{ .Values.plugin.noAuth }}
    metadata: {{ include "extension-server.pluginMetadata" . | indent 6 }}
--- a/metal3-chart/Chart.yaml
+++ b/metal3-chart/Chart.yaml
@@ -1,7 +1,7 @@
-#!BuildTag: %%IMG_PREFIX%%metal3-chart:%%CHART_MAJOR%%.0.1_up0.9.4
-#!BuildTag: %%IMG_PREFIX%%metal3-chart:%%CHART_MAJOR%%.0.1_up0.9.4-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%metal3-chart:%%CHART_MAJOR%%.0.0_up0.9.2
+#!BuildTag: %%IMG_PREFIX%%metal3-chart:%%CHART_MAJOR%%.0.0_up0.9.2-%RELEASE%
 apiVersion: v2
-appVersion: 0.9.4
+appVersion: 0.9.2
 dependencies:
 - alias: metal3-baremetal-operator
  name: baremetal-operator
@@ -10,7 +10,7 @@ dependencies:
 - alias: metal3-ironic
  name: ironic
  repository: file://./charts/ironic
-  version: 0.9.3
+  version: 0.9.1
 - alias: metal3-mariadb
  condition: global.enable_mariadb
  name: mariadb
@@ -25,4 +25,4 @@ description: A Helm chart that installs all of the dependencies needed for Metal
 icon: https://github.com/cncf/artwork/raw/master/projects/metal3/icon/color/metal3-icon-color.svg
 name: metal3
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.9.4"
+version: "%%CHART_MAJOR%%.0.0+up0.9.2"
--- a/metal3-chart/charts/baremetal-operator/templates/configmap-ironic.yaml
+++ b/metal3-chart/charts/baremetal-operator/templates/configmap-ironic.yaml
@@ -5,6 +5,7 @@
  {{- $ironicApiHost := print $ironicIP ":6385" }}
  {{- $ironicBootHost := print $ironicIP ":6180" }}
  {{- $ironicCacheHost := print $ironicIP ":6180" }}
+  {{- $deployArch := .Values.global.deployArchitecture }}

 apiVersion: v1
 data:
@@ -19,8 +20,9 @@ data:
    {{- $protocol = "http" }}
  {{- end }}
  CACHEURL: "{{ $protocol }}://{{ $ironicCacheHost }}/images"
-  DEPLOY_KERNEL_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent.kernel"
-  DEPLOY_RAMDISK_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent.initramfs"
+  DEPLOY_KERNEL_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.kernel"
+  DEPLOY_RAMDISK_URL: "{{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.initramfs"
+  DEPLOY_ARCHITECTURE: "{{ $deployArch }}"
 kind: ConfigMap
 metadata:
  name: baremetal-operator-ironic
--- a/metal3-chart/charts/ironic/Chart.yaml
+++ b/metal3-chart/charts/ironic/Chart.yaml
@@ -3,4 +3,4 @@ appVersion: 26.1.2
 description: A Helm chart for Ironic, used by Metal3
 name: ironic
 type: application
-version: 0.9.3
+version: 0.9.1
--- a/metal3-chart/charts/ironic/templates/configmap.yaml
+++ b/metal3-chart/charts/ironic/templates/configmap.yaml
@@ -12,6 +12,7 @@ data:
  {{- $ironicApiHost := print $ironicIP ":6385" }}
  {{- $ironicBootHost := print $ironicIP ":6180" }}
  {{- $ironicCacheHost := print $ironicIP ":6180" }}
+  {{- $deployArch := .Values.global.deployArchitecture }}

  {{- if  ( .Values.global.enable_dnsmasq ) }}
  DNSMASQ_BOOT_SERVER_ADDRESS: {{ $ironicBootHost }}
@@ -39,8 +40,9 @@ data:
  {{- end }}
  IRONIC_EXTERNAL_HTTP_URL: {{ $protocol }}://{{ $ironicCacheHost }}
  CACHEURL: {{ $protocol }}://{{ $ironicCacheHost }}/images
-  DEPLOY_KERNEL_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent.kernel
-  DEPLOY_RAMDISK_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent.initramfs
+  DEPLOY_KERNEL_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.kernel
+  DEPLOY_RAMDISK_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.initramfs
+  DEPLOY_ARCHITECTURE: {{ $deployArch }}
  IRONIC_BOOT_BASE_URL: {{ $protocol }}://{{ $ironicBootHost }}
  IRONIC_VMEDIA_HTTPD_SERVER_NAME: {{ $ironicBootHost }}
  ENABLE_PXE_BOOT: "{{ .Values.global.enable_pxe_boot }}"
--- a/metal3-chart/charts/ironic/templates/deployment.yaml
+++ b/metal3-chart/charts/ironic/templates/deployment.yaml
@@ -77,6 +77,9 @@ spec:
            mountPath: "/certs/vmedia"
            readOnly: true
          {{- end }}
+          - mountPath: /shared/html/tstcerts
+            name: cert-ironic-ca
+            readOnly: true
        {{- end }}
      - name: ironic-log-watch
        image: {{ .Values.images.ironic.repository }}:{{ .Values.images.ironic.tag }}
--- a/metal3-chart/charts/ironic/values.yaml
+++ b/metal3-chart/charts/ironic/values.yaml
@@ -56,7 +56,7 @@ images:
  ironic:
    repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic
    pullPolicy: IfNotPresent
-    tag: 26.1.2.3
+    tag: 26.1.2.2
  ironicIPADownloader:
    repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic-ipa-downloader
    pullPolicy: IfNotPresent
--- a/metal3-chart/values.yaml
+++ b/metal3-chart/values.yaml
@@ -63,6 +63,9 @@ global:
  # Name for the MariaDB service
  databaseServiceName: metal3-mariadb

+  # Architecture for deployed nodes (either x86_64 or arm64)
+  deployArchitecture: x86_64
+
  # In a multi-node cluster use the node selector to ensure the pods
  # all run on the same host where the dnsmasqDNSServer and provisioningIP
  # and /opt/media exist. Uncomment the nodeSelector and update the
--- a/metallb-chart/Chart.yaml
+++ b/metallb-chart/Chart.yaml
@@ -1,10 +1,9 @@
-#!BuildTag: %%IMG_PREFIX%%metallb-chart:%%CHART_MAJOR%%.0.1_up0.14.9
-#!BuildTag: %%IMG_PREFIX%%metallb-chart:%%CHART_MAJOR%%.0.1_up0.14.9-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%metallb-chart:%%CHART_MAJOR%%.0.0_up0.14.9
+#!BuildTag: %%IMG_PREFIX%%metallb-chart:%%CHART_MAJOR%%.0.0_up0.14.9-%RELEASE%
 apiVersion: v2
 appVersion: v0.14.3
 dependencies:
- alias: metallb-frr-k8s
-  condition: frrk8s.enabled
+- condition: frrk8s.enabled
  name: frr-k8s
  repository: file://./charts/frr-k8s
  version: 0.0.15
@@ -21,4 +20,4 @@ name: metallb
 sources:
 - https://github.com/metallb/metallb
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.14.9"
+version: "%%CHART_MAJOR%%.0.0+up0.14.9"
--- a/metallb-chart/charts/frr-k8s/values.yaml
+++ b/metallb-chart/charts/frr-k8s/values.yaml
@@ -53,7 +53,7 @@ prometheus:
  # the image to be used for the kuberbacproxy container
  rbacProxy:
    repository: "registry.opensuse.org/isv/suse/edge/metallb/images/kube-rbac-proxy"
-    tag: "0.18.1"
+    tag: "v0.18.0"
    pullPolicy: IfNotPresent

  # Prometheus Operator ServiceMonitors.
--- a/metallb-chart/values.yaml
+++ b/metallb-chart/values.yaml
@@ -378,15 +378,3 @@ frrk8s:
  enabled: false
  external: false
  namespace: ""
-
-# Override any settings for the metallb frr-k8s service here
-metallb-frr-k8s:
-  prometheus:
-    rbacProxy:
-      repository: "%%IMG_REPO%%/%%IMG_PREFIX%%kube-rbac-proxy"
-  frrk8s:
-    image:
-      repository: "%%IMG_REPO%%/%%IMG_PREFIX%%frr-k8s"
-    frr:
-      image:
-        repository: "%%IMG_REPO%%/%%IMG_PREFIX%%frr"
--- a/rancher-turtles-airgap-resources-chart/Chart.yaml
+++ b/rancher-turtles-airgap-resources-chart/Chart.yaml
@@ -1,10 +1,10 @@
-#!BuildTag: %%IMG_PREFIX%%rancher-turtles-airgap-resources-chart:%%CHART_MAJOR%%.0.0_up0.14.1
-#!BuildTag: %%IMG_PREFIX%%rancher-turtles-airgap-resources-chart:%%CHART_MAJOR%%.0.0_up0.14.1
+#!BuildTag: %%IMG_PREFIX%%rancher-turtles-airgap-resources-chart:%%CHART_MAJOR%%.0.0_up0.16.0
+#!BuildTag: %%IMG_PREFIX%%rancher-turtles-airgap-resources-chart:%%CHART_MAJOR%%.0.0_up0.16.0
 apiVersion: v2
-appVersion: 0.14.1
+appVersion: 0.16.0
 description: Rancher Turtles utility chart for airgap scenarios
 home: https://github.com/rancher/turtles/
 icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg
 name: rancher-turtles-airgap-resources
 type: application
-version: "%%CHART_MAJOR%%.0.0+up0.14.1"
+version: "%%CHART_MAJOR%%.0.0+up0.16.0"
--- a/rancher-turtles-airgap-resources-chart/templates/airgap-cm-core.yaml
+++ b/rancher-turtles-airgap-resources-chart/templates/airgap-cm-core.yaml
--- a/rancher-turtles-airgap-resources-chart/templates/airgap-cm-metal3.yaml
+++ b/rancher-turtles-airgap-resources-chart/templates/airgap-cm-metal3.yaml
--- a/rancher-turtles-airgap-resources-chart/templates/airgap-cm-rke2-bootstrap.yaml
+++ b/rancher-turtles-airgap-resources-chart/templates/airgap-cm-rke2-bootstrap.yaml
@@ -22,7 +22,7 @@ data:
    metadata:
      annotations:
        cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert
-        controller-gen.kubebuilder.io/version: v0.14.0
+        controller-gen.kubebuilder.io/version: v0.16.1
      labels:
        cluster.x-k8s.io/provider: bootstrap-rke2
        cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1
@@ -154,7 +154,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -300,7 +299,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -439,7 +437,6 @@ data:
                                    the event) or if no container name is specified "spec.containers[2]" (container with
                                    index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                    referencing a part of an object.
-                                    TODO: this design is not final and this field is subject to change in the future.
                                  type: string
                                kind:
                                  description: |-
@@ -495,7 +492,6 @@ data:
                                        the event) or if no container name is specified "spec.containers[2]" (container with
                                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                        referencing a part of an object.
-                                        TODO: this design is not final and this field is subject to change in the future.
                                      type: string
                                    kind:
                                      description: |-
@@ -582,20 +578,20 @@ data:
                          description: |-
                            The reason for the condition's last transition in CamelCase.
                            The specific API may choose whether or not this field is considered a guaranteed API.
-                            This field may not be empty.
+                            This field may be empty.
                          type: string
                        severity:
                          description: |-
-                            Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                            severity provides an explicit classification of Reason code, so the users or machines can immediately
                            understand the current situation and act accordingly.
                            The Severity field MUST be set only when Status=False.
                          type: string
                        status:
-                          description: Status of the condition, one of True, False, Unknown.
+                          description: status of the condition, one of True, False, Unknown.
                          type: string
                        type:
                          description: |-
-                            Type of condition in CamelCase or in foo.example.com/CamelCase.
+                            type of condition in CamelCase or in foo.example.com/CamelCase.
                            Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                            can be useful (see .node.status.conditions), the ability to deconflict is important.
                          type: string
@@ -742,7 +738,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -893,7 +888,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -1029,7 +1023,6 @@ data:
                                    the event) or if no container name is specified "spec.containers[2]" (container with
                                    index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                    referencing a part of an object.
-                                    TODO: this design is not final and this field is subject to change in the future.
                                  type: string
                                kind:
                                  description: |-
@@ -1085,7 +1078,6 @@ data:
                                        the event) or if no container name is specified "spec.containers[2]" (container with
                                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                        referencing a part of an object.
-                                        TODO: this design is not final and this field is subject to change in the future.
                                      type: string
                                    kind:
                                      description: |-
@@ -1172,20 +1164,20 @@ data:
                          description: |-
                            The reason for the condition's last transition in CamelCase.
                            The specific API may choose whether or not this field is considered a guaranteed API.
-                            This field may not be empty.
+                            This field may be empty.
                          type: string
                        severity:
                          description: |-
-                            Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                            severity provides an explicit classification of Reason code, so the users or machines can immediately
                            understand the current situation and act accordingly.
                            The Severity field MUST be set only when Status=False.
                          type: string
                        status:
-                          description: Status of the condition, one of True, False, Unknown.
+                          description: status of the condition, one of True, False, Unknown.
                          type: string
                        type:
                          description: |-
-                            Type of condition in CamelCase or in foo.example.com/CamelCase.
+                            type of condition in CamelCase or in foo.example.com/CamelCase.
                            Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                            can be useful (see .node.status.conditions), the ability to deconflict is important.
                          type: string
@@ -1226,7 +1218,7 @@ data:
    metadata:
      annotations:
        cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert
-        controller-gen.kubebuilder.io/version: v0.14.0
+        controller-gen.kubebuilder.io/version: v0.16.1
      labels:
        cluster.x-k8s.io/provider: bootstrap-rke2
        cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1
@@ -1369,7 +1361,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -1523,7 +1514,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -1664,7 +1654,6 @@ data:
                                            the event) or if no container name is specified "spec.containers[2]" (container with
                                            index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                            referencing a part of an object.
-                                            TODO: this design is not final and this field is subject to change in the future.
                                          type: string
                                        kind:
                                          description: |-
@@ -1720,7 +1709,6 @@ data:
                                                the event) or if no container name is specified "spec.containers[2]" (container with
                                                index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                                referencing a part of an object.
-                                                TODO: this design is not final and this field is subject to change in the future.
                                              type: string
                                            kind:
                                              description: |-
@@ -1920,7 +1908,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -2079,7 +2066,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -2217,7 +2203,6 @@ data:
                                            the event) or if no container name is specified "spec.containers[2]" (container with
                                            index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                            referencing a part of an object.
-                                            TODO: this design is not final and this field is subject to change in the future.
                                          type: string
                                        kind:
                                          description: |-
@@ -2273,7 +2258,6 @@ data:
                                                the event) or if no container name is specified "spec.containers[2]" (container with
                                                index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                                referencing a part of an object.
-                                                TODO: this design is not final and this field is subject to change in the future.
                                              type: string
                                            kind:
                                              description: |-
@@ -2543,7 +2527,7 @@ data:
            - --insecure-diagnostics=${CAPRKE2_INSECURE_DIAGNOSTICS:=false}
            command:
            - /manager
-            image: ghcr.io/rancher/cluster-api-provider-rke2-bootstrap:v0.9.0
+            image: ghcr.io/rancher/cluster-api-provider-rke2-bootstrap:v0.11.0
            imagePullPolicy: IfNotPresent
            livenessProbe:
              httpGet:
@@ -2757,10 +2741,16 @@ data:
      - major: 0
        minor: 9
        contract: v1beta1
+      - major: 0
+        minor: 10
+        contract: v1beta1
+      - major: 0
+        minor: 11
+        contract: v1beta1
 kind: ConfigMap
 metadata:
  creationTimestamp: null
-  name: v0.9.0
+  name: v0.11.0
  namespace: rke2-bootstrap-system
  labels:
    provider-components: rke2-bootstrap
--- a/rancher-turtles-airgap-resources-chart/templates/airgap-cm-rke2-control-plane.yaml
+++ b/rancher-turtles-airgap-resources-chart/templates/airgap-cm-rke2-control-plane.yaml
@@ -22,7 +22,7 @@ data:
    metadata:
      annotations:
        cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert
-        controller-gen.kubebuilder.io/version: v0.14.0
+        controller-gen.kubebuilder.io/version: v0.16.1
      labels:
        cluster.x-k8s.io/provider: control-plane-rke2
        cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1
@@ -154,7 +154,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -300,7 +299,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -418,7 +416,6 @@ data:
                          the event) or if no container name is specified "spec.containers[2]" (container with
                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                          referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                        type: string
                      kind:
                        description: |-
@@ -464,7 +461,6 @@ data:
                          the event) or if no container name is specified "spec.containers[2]" (container with
                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                          referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                        type: string
                      kind:
                        description: |-
@@ -537,7 +533,6 @@ data:
                                    the event) or if no container name is specified "spec.containers[2]" (container with
                                    index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                    referencing a part of an object.
-                                    TODO: this design is not final and this field is subject to change in the future.
                                  type: string
                                kind:
                                  description: |-
@@ -593,7 +588,6 @@ data:
                                        the event) or if no container name is specified "spec.containers[2]" (container with
                                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                        referencing a part of an object.
-                                        TODO: this design is not final and this field is subject to change in the future.
                                      type: string
                                    kind:
                                      description: |-
@@ -727,7 +721,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -804,7 +797,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -935,7 +927,6 @@ data:
                                          the event) or if no container name is specified "spec.containers[2]" (container with
                                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                          referencing a part of an object.
-                                          TODO: this design is not final and this field is subject to change in the future.
                                        type: string
                                      kind:
                                        description: |-
@@ -980,6 +971,7 @@ data:
                                    description: |-
                                      S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket.
                                      The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key".
+                                      If empty, the controller will default to IAM authentication
                                    properties:
                                      apiVersion:
                                        description: API version of the referent.
@@ -993,7 +985,6 @@ data:
                                          the event) or if no container name is specified "spec.containers[2]" (container with
                                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                          referencing a part of an object.
-                                          TODO: this design is not final and this field is subject to change in the future.
                                        type: string
                                      kind:
                                        description: |-
@@ -1024,7 +1015,6 @@ data:
                                    x-kubernetes-map-type: atomic
                                required:
                                - endpoint
-                                - s3CredentialSecret
                                type: object
                              scheduleCron:
                                description: 'ScheduleCron Snapshot interval time in cron
@@ -1201,20 +1191,20 @@ data:
                          description: |-
                            The reason for the condition's last transition in CamelCase.
                            The specific API may choose whether or not this field is considered a guaranteed API.
-                            This field may not be empty.
+                            This field may be empty.
                          type: string
                        severity:
                          description: |-
-                            Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                            severity provides an explicit classification of Reason code, so the users or machines can immediately
                            understand the current situation and act accordingly.
                            The Severity field MUST be set only when Status=False.
                          type: string
                        status:
-                          description: Status of the condition, one of True, False, Unknown.
+                          description: status of the condition, one of True, False, Unknown.
                          type: string
                        type:
                          description: |-
-                            Type of condition in CamelCase or in foo.example.com/CamelCase.
+                            type of condition in CamelCase or in foo.example.com/CamelCase.
                            Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                            can be useful (see .node.status.conditions), the ability to deconflict is important.
                          type: string
@@ -1387,7 +1377,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -1538,7 +1527,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -1640,6 +1628,7 @@ data:
                    description: |-
                      InfrastructureRef is a required reference to a custom resource
                      offered by an infrastructure provider.
+                      This field is deprecated. Use `.machineTemplate.infrastructureRef` instead.
                    properties:
                      apiVersion:
                        description: API version of the referent.
@@ -1653,7 +1642,6 @@ data:
                          the event) or if no container name is specified "spec.containers[2]" (container with
                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                          referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                        type: string
                      kind:
                        description: |-
@@ -1704,7 +1692,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -1742,7 +1729,7 @@ data:
                            additionalProperties:
                              type: string
                            description: |-
-                              Annotations is an unstructured key value map stored with a resource that may be
+                              annotations is an unstructured key value map stored with a resource that may be
                              set by external tools to store and retrieve arbitrary metadata. They are not
                              queryable and should be preserved when modifying objects.
                              More info: http://kubernetes.io/docs/user-guide/annotations
@@ -1783,7 +1770,6 @@ data:
                          the event) or if no container name is specified "spec.containers[2]" (container with
                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                          referencing a part of an object.
-                          TODO: this design is not final and this field is subject to change in the future.
                        type: string
                      kind:
                        description: |-
@@ -1817,6 +1803,7 @@ data:
                      NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node
                      The default value is 0, meaning that the node can be drained without any time limitations.
                      NOTE: NodeDrainTimeout is different from `kubectl drain --timeout`
+                      This field is deprecated. Use `.machineTemplate.nodeDrainTimeout` instead.
                    type: string
                  postRKE2Commands:
                    description: PostRKE2Commands specifies extra commands to run after
@@ -1856,7 +1843,6 @@ data:
                                    the event) or if no container name is specified "spec.containers[2]" (container with
                                    index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                    referencing a part of an object.
-                                    TODO: this design is not final and this field is subject to change in the future.
                                  type: string
                                kind:
                                  description: |-
@@ -1912,7 +1898,6 @@ data:
                                        the event) or if no container name is specified "spec.containers[2]" (container with
                                        index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                        referencing a part of an object.
-                                        TODO: this design is not final and this field is subject to change in the future.
                                      type: string
                                    kind:
                                      description: |-
@@ -2043,7 +2028,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -2120,7 +2104,6 @@ data:
                              the event) or if no container name is specified "spec.containers[2]" (container with
                              index 2 in this pod). This syntax is chosen only to have some well-defined way of
                              referencing a part of an object.
-                              TODO: this design is not final and this field is subject to change in the future.
                            type: string
                          kind:
                            description: |-
@@ -2251,7 +2234,6 @@ data:
                                          the event) or if no container name is specified "spec.containers[2]" (container with
                                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                          referencing a part of an object.
-                                          TODO: this design is not final and this field is subject to change in the future.
                                        type: string
                                      kind:
                                        description: |-
@@ -2296,6 +2278,7 @@ data:
                                    description: |-
                                      S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket.
                                      The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key".
+                                      If empty, the controller will default to IAM authentication
                                    properties:
                                      apiVersion:
                                        description: API version of the referent.
@@ -2309,7 +2292,6 @@ data:
                                          the event) or if no container name is specified "spec.containers[2]" (container with
                                          index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                          referencing a part of an object.
-                                          TODO: this design is not final and this field is subject to change in the future.
                                        type: string
                                      kind:
                                        description: |-
@@ -2340,7 +2322,6 @@ data:
                                    x-kubernetes-map-type: atomic
                                required:
                                - endpoint
-                                - s3CredentialSecret
                                type: object
                              scheduleCron:
                                description: 'ScheduleCron Snapshot interval time in cron
@@ -2490,7 +2471,6 @@ data:
                    pattern: (v\d\.\d{2}\.\d+\+rke2r\d)|^$
                    type: string
                required:
-                - infrastructureRef
                - rolloutStrategy
                type: object
              status:
@@ -2524,20 +2504,20 @@ data:
                          description: |-
                            The reason for the condition's last transition in CamelCase.
                            The specific API may choose whether or not this field is considered a guaranteed API.
-                            This field may not be empty.
+                            This field may be empty.
                          type: string
                        severity:
                          description: |-
-                            Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                            severity provides an explicit classification of Reason code, so the users or machines can immediately
                            understand the current situation and act accordingly.
                            The Severity field MUST be set only when Status=False.
                          type: string
                        status:
-                          description: Status of the condition, one of True, False, Unknown.
+                          description: status of the condition, one of True, False, Unknown.
                          type: string
                        type:
                          description: |-
-                            Type of condition in CamelCase or in foo.example.com/CamelCase.
+                            type of condition in CamelCase or in foo.example.com/CamelCase.
                            Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                            can be useful (see .node.status.conditions), the ability to deconflict is important.
                          type: string
@@ -2609,7 +2589,7 @@ data:
    metadata:
      annotations:
        cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert
-        controller-gen.kubebuilder.io/version: v0.14.0
+        controller-gen.kubebuilder.io/version: v0.16.1
      labels:
        cluster.x-k8s.io/provider: control-plane-rke2
        cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1
@@ -2796,7 +2776,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -2955,7 +2934,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -3058,6 +3036,7 @@ data:
                            description: |-
                              InfrastructureRef is a required reference to a custom resource
                              offered by an infrastructure provider.
+                              This field is deprecated. Use `.machineTemplate.infrastructureRef` instead.
                            properties:
                              apiVersion:
                                description: API version of the referent.
@@ -3071,7 +3050,6 @@ data:
                                  the event) or if no container name is specified "spec.containers[2]" (container with
                                  index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                  referencing a part of an object.
-                                  TODO: this design is not final and this field is subject to change in the future.
                                type: string
                              kind:
                                description: |-
@@ -3122,7 +3100,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -3160,7 +3137,7 @@ data:
                                    additionalProperties:
                                      type: string
                                    description: |-
-                                      Annotations is an unstructured key value map stored with a resource that may be
+                                      annotations is an unstructured key value map stored with a resource that may be
                                      set by external tools to store and retrieve arbitrary metadata. They are not
                                      queryable and should be preserved when modifying objects.
                                      More info: http://kubernetes.io/docs/user-guide/annotations
@@ -3201,7 +3178,6 @@ data:
                                  the event) or if no container name is specified "spec.containers[2]" (container with
                                  index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                  referencing a part of an object.
-                                  TODO: this design is not final and this field is subject to change in the future.
                                type: string
                              kind:
                                description: |-
@@ -3235,6 +3211,7 @@ data:
                              NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node
                              The default value is 0, meaning that the node can be drained without any time limitations.
                              NOTE: NodeDrainTimeout is different from `kubectl drain --timeout`
+                              This field is deprecated. Use `.machineTemplate.nodeDrainTimeout` instead.
                            type: string
                          postRKE2Commands:
                            description: PostRKE2Commands specifies extra commands to
@@ -3275,7 +3252,6 @@ data:
                                            the event) or if no container name is specified "spec.containers[2]" (container with
                                            index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                            referencing a part of an object.
-                                            TODO: this design is not final and this field is subject to change in the future.
                                          type: string
                                        kind:
                                          description: |-
@@ -3331,7 +3307,6 @@ data:
                                                the event) or if no container name is specified "spec.containers[2]" (container with
                                                index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                                referencing a part of an object.
-                                                TODO: this design is not final and this field is subject to change in the future.
                                              type: string
                                            kind:
                                              description: |-
@@ -3466,7 +3441,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -3545,7 +3519,6 @@ data:
                                      the event) or if no container name is specified "spec.containers[2]" (container with
                                      index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                      referencing a part of an object.
-                                      TODO: this design is not final and this field is subject to change in the future.
                                    type: string
                                  kind:
                                    description: |-
@@ -3679,7 +3652,6 @@ data:
                                                  the event) or if no container name is specified "spec.containers[2]" (container with
                                                  index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                                  referencing a part of an object.
-                                                  TODO: this design is not final and this field is subject to change in the future.
                                                type: string
                                              kind:
                                                description: |-
@@ -3724,6 +3696,7 @@ data:
                                            description: |-
                                              S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket.
                                              The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key".
+                                              If empty, the controller will default to IAM authentication
                                            properties:
                                              apiVersion:
                                                description: API version of the referent.
@@ -3737,7 +3710,6 @@ data:
                                                  the event) or if no container name is specified "spec.containers[2]" (container with
                                                  index 2 in this pod). This syntax is chosen only to have some well-defined way of
                                                  referencing a part of an object.
-                                                  TODO: this design is not final and this field is subject to change in the future.
                                                type: string
                                              kind:
                                                description: |-
@@ -3768,7 +3740,6 @@ data:
                                            x-kubernetes-map-type: atomic
                                        required:
                                        - endpoint
-                                        - s3CredentialSecret
                                        type: object
                                      scheduleCron:
                                        description: 'ScheduleCron Snapshot interval time
@@ -3927,7 +3898,6 @@ data:
                            pattern: (v\d\.\d{2}\.\d+\+rke2r\d)|^$
                            type: string
                        required:
-                        - infrastructureRef
                        - rolloutStrategy
                        type: object
                    required:
@@ -3967,20 +3937,20 @@ data:
                          description: |-
                            The reason for the condition's last transition in CamelCase.
                            The specific API may choose whether or not this field is considered a guaranteed API.
-                            This field may not be empty.
+                            This field may be empty.
                          type: string
                        severity:
                          description: |-
-                            Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                            severity provides an explicit classification of Reason code, so the users or machines can immediately
                            understand the current situation and act accordingly.
                            The Severity field MUST be set only when Status=False.
                          type: string
                        status:
-                          description: Status of the condition, one of True, False, Unknown.
+                          description: status of the condition, one of True, False, Unknown.
                          type: string
                        type:
                          description: |-
-                            Type of condition in CamelCase or in foo.example.com/CamelCase.
+                            type of condition in CamelCase or in foo.example.com/CamelCase.
                            Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                            can be useful (see .node.status.conditions), the ability to deconflict is important.
                          type: string
@@ -4293,7 +4263,7 @@ data:
              valueFrom:
                fieldRef:
                  fieldPath: metadata.uid
-            image: ghcr.io/rancher/cluster-api-provider-rke2-controlplane:v0.9.0
+            image: ghcr.io/rancher/cluster-api-provider-rke2-controlplane:v0.11.0
            imagePullPolicy: IfNotPresent
            livenessProbe:
              httpGet:
@@ -4348,7 +4318,7 @@ data:
          volumes:
          - name: cert
            secret:
-              secretName: rke2-control-plane-webhook-service-cert
+              secretName: rke2-controlplane-webhook-service-cert
    ---
    apiVersion: cert-manager.io/v1
    kind: Certificate
@@ -4364,7 +4334,7 @@ data:
      issuerRef:
        kind: Issuer
        name: rke2-control-plane-selfsigned-issuer
-      secretName: rke2-control-plane-webhook-service-cert
+      secretName: rke2-controlplane-webhook-service-cert
      subject:
        organizations:
        - Rancher by SUSE
@@ -4514,10 +4484,16 @@ data:
      - major: 0
        minor: 9
        contract: v1beta1
+      - major: 0
+        minor: 10
+        contract: v1beta1
+      - major: 0
+        minor: 11
+        contract: v1beta1
 kind: ConfigMap
 metadata:
  creationTimestamp: null
-  name: v0.9.0
+  name: v0.11.0
  namespace: rke2-control-plane-system
  labels:
    provider-components: rke2-control-plane
--- a/rancher-turtles-chart/Chart.lock
+++ b/rancher-turtles-chart/Chart.lock
@@ -1,6 +1,6 @@
 dependencies:
 - name: cluster-api-operator
  repository: https://kubernetes-sigs.github.io/cluster-api-operator
-  version: 0.14.0
-digest: sha256:9e9e851dbab3212c279efec06bcf0da147228ea1590470f3a8cbbb5806a250d4
-generated: "2024-12-03T09:34:12.871417074Z"
+  version: 0.16.0
+digest: sha256:9b296be6ee446bff492e6736e084ce3734b07ea613791b77fd15d31c0f62dc70
+generated: "2025-01-30T10:14:58.692942399Z"
--- a/rancher-turtles-chart/Chart.yaml
+++ b/rancher-turtles-chart/Chart.yaml
@@ -1,5 +1,5 @@
-#!BuildTag: %%IMG_PREFIX%%rancher-turtles-chart:%%CHART_MAJOR%%.0.0_up0.14.1
-#!BuildTag: %%IMG_PREFIX%%rancher-turtles-chart:%%CHART_MAJOR%%.0.0_up0.14.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%rancher-turtles-chart:%%CHART_MAJOR%%.0.0_up0.16.0
+#!BuildTag: %%IMG_PREFIX%%rancher-turtles-chart:%%CHART_MAJOR%%.0.0_up0.16.0-%RELEASE%
 annotations:
  catalog.cattle.io/certified: rancher
  catalog.cattle.io/display-name: Rancher Turtles - the Cluster API Extension
@@ -12,7 +12,7 @@ annotations:
  catalog.cattle.io/scope: management
  catalog.cattle.io/type: cluster-tool
 apiVersion: v2
-appVersion: 0.14.1
+appVersion: 0.16.0
 dependencies:
 - condition: cluster-api-operator.enabled
  name: cluster-api-operator
@@ -29,4 +29,4 @@ keywords:
 - provisioning
 name: rancher-turtles
 type: application
-version: "%%CHART_MAJOR%%.0.0+up0.14.1"
+version: "%%CHART_MAJOR%%.0.0+up0.16.0"
--- a/rancher-turtles-chart/questions.yml
+++ b/rancher-turtles-chart/questions.yml
@@ -1,78 +1,44 @@
 namespace: rancher-turtles-system
 questions:
- variable: rancherTurtles.features.default
-  default: "false"
-  description: "Customize install settings"
-  label: Customize install settings
-  type: boolean
-  show_subquestion_if: true
-  group: "Rancher Turtles Extra Settings"
-  subquestions:
-  - variable: cluster-api-operator.cert-manager.enabled
-    default: false
+  - variable: rancherTurtles.features.default
+    default: "false"
+    description: "Customize install settings"
+    label: Customize install settings
    type: boolean
-    description: "Flag to enable or disable installation of cert-manager. If set to false then you will need to install cert-manager manually"
-    label: "Enable Cert Manager"
-  - variable: rancherTurtles.features.cluster-api-operator.cleanup
-    default: true
-    description: "Specify that the CAPI Operator post-delete cleanup job will be performed"
-    type: boolean
-    label: Cleanup CAPI Operator installation
-    group: "CAPI Operator cleanup settings"
    show_subquestion_if: true
+    group: "Rancher Turtles Extra Settings"
    subquestions:
-    - variable: rancherTurtles.features.cluster-api-operator.kubectlImage
-      default: "rancher/kubectl:v1.30.3"
-      description: "Specify the image to use when cleaning up the Cluster API Operator manifests"
-      type: string
-      label: Cleanup Image
-      group: "CAPI Operator cleanup settings"
-  - variable: rancherTurtles.features.rancher-webhook.cleanup
-    default: true
-    description: "Specify that the Rancher embedded cluster api webhooks should be removed"
-    type: boolean
-    label: Cleanup Rancher Embedded CAPI Webhooks
-    group: "Rancher webhook cleanup settings"
-    show_subquestion_if: true
-    subquestions:
-    - variable: rancherTurtles.features.rancher-webhook.kubectlImage
-      default: "rancher/kubectl:v1.30.3"
-      description: "Specify the image to use when cleaning up the webhooks"
-      type: string
-      label: Webhook Cleanup Image
-      group: "Rancher webhook cleanup settings"
-  - variable: rancherTurtles.features.rancher-kubeconfigs.label
-    default: false
-    description: "(Experimental) Specify that the kubeconfigs generated by Rancher should be automatically patched to contain the CAPI expected labels"
-    type: boolean
-    label: Label Rancher Kubeconfigs
-    group: "Rancher Turtles Features Settings"
-  - variable: rancherTurtles.features.managementv3-cluster.enabled
-    default: true
-    description: "Use v3/management cluster manifest for import, instead of v1/provisioning"
-    type: boolean
-    label: Use management v3 cluster manifest
-    group: "Rancher Turtles Features Settings"
-  - variable: rancherTurtles.features.managementv3-cluster-migration.enabled
-    default: false
-    description: "Automatically migrate between provisioning and management clusters on upgrade"
-    type: boolean
-    label: All imported clusters will use new cluster manifest, replacing old cluster manifest.
-    group: "Rancher Turtles Features Settings"
-  - variable: cluster-api-operator.cluster-api.rke2.enabled
-    default: "true"
-    description: "Flag to enable or disable installation of the RKE2 provider for Cluster API. By default this is enabled."
-    label: "Enable RKE2 Provider"
-    type: boolean
-  - variable: rancherTurtles.features.propagate-labels.enabled
-    default: false
-    description: "(Experimental) Specify that the labels from CAPI should be propagated to Rancher"
-    type: boolean
-    label: Propagate CAPI Labels
-    group: "Rancher Turtles Features Settings"
-  - variable: rancherTurtles.features.addon-provider-fleet.enabled
-    default: false
-    description: "Enable Fleet Addon Provider functionality in Rancher Turtles"
-    type: boolean
-    label: Seamless integration with Fleet and CAPI
-    group: "Rancher Turtles Features Settings"
+      - variable: cluster-api-operator.cert-manager.enabled
+        default: false
+        type: boolean
+        description: "Flag to enable or disable installation of cert-manager. If set to false then you will need to install cert-manager manually"
+        label: "Enable Cert Manager"
+      - variable: rancherTurtles.cluster-api-operator.cleanup
+        default: true
+        description: "Specify that the CAPI Operator post-delete cleanup job will be performed"
+        type: boolean
+        label: Cleanup CAPI Operator installation
+        group: "CAPI Operator cleanup settings"
+      - variable: cluster-api-operator.cluster-api.rke2.enabled
+        default: "true"
+        description: "Flag to enable or disable installation of the RKE2 provider for Cluster API. By default this is enabled."
+        label: "Enable RKE2 Provider"
+        type: boolean
+      - variable: rancherTurtles.features.addon-provider-fleet.enabled
+        default: false
+        description: "[BETA] Enable Fleet Addon Provider functionality in Rancher Turtles"
+        type: boolean
+        label: Seamless integration with Fleet and CAPI
+        group: "Rancher Turtles Features Settings"
+      - variable: rancherTurtles.features.agent-tls-mode.enabled
+        default: false
+        description: "[ALPHA] If enabled Turtles will use the agent-tls-mode setting to determine CA cert trust mode for importing clusters"
+        type: boolean
+        label: Enable Agent TLS Mode
+        group: "Rancher Turtles Features Settings"
+      - variable: rancherTurtles.kubectlImage
+        default: "registry.suse.com/edge/3.2/kubectl:1.30.3"
+        description: "Specify the image to use when running kubectl in jobs"
+        type: string
+        label: Kubectl Image
+        group: "Rancher Turtles Features Settings"
--- a/rancher-turtles-chart/templates/addon-provider-fleet.yaml
+++ b/rancher-turtles-chart/templates/addon-provider-fleet.yaml
@@ -35,10 +35,17 @@ data:
      cluster:
        patchResource: true
        setOwnerReferences: true
+        hostNetwork: true
        selector:
          matchLabels:
            cluster-api.cattle.io/rancher-auto-import: "true"
+          matchExpressions:
+            - key: cluster-api.cattle.io/disable-fleet-auto-import
+              operator: DoesNotExist
        namespaceSelector:
          matchLabels:
            cluster-api.cattle.io/rancher-auto-import: "true"
+          matchExpressions:
+            - key: cluster-api.cattle.io/disable-fleet-auto-import
+              operator: DoesNotExist
 {{- end }}
--- a/rancher-turtles-chart/templates/clusterctl-cm-cleanup-job.yaml
+++ b/rancher-turtles-chart/templates/clusterctl-cm-cleanup-job.yaml
@@ -1,4 +1,4 @@
-{{- if index .Values "rancherTurtles" "features" "rancher-webhook" "cleanup" }}
+{{- if index .Values "rancherTurtles" "rancherInstalled" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -55,7 +55,7 @@ spec:
      serviceAccountName: pre-upgrade-job
      containers:
        - name: rancher-clusterctl-configmap-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          args:
          - delete
          - configmap
--- a/rancher-turtles-chart/templates/deployment.yaml
+++ b/rancher-turtles-chart/templates/deployment.yaml
@@ -26,7 +26,7 @@ spec:
      containers:
      - args:
        - --leader-elect
-        - --feature-gates=propagate-labels={{ index .Values "rancherTurtles" "features" "propagate-labels" "enabled"}},managementv3-cluster={{ index .Values "rancherTurtles" "features" "managementv3-cluster" "enabled"}},rancher-kube-secret-patch={{ index .Values "rancherTurtles" "features" "rancher-kubeconfigs" "label"}}
+        - --feature-gates=addon-provider-fleet={{ index .Values "rancherTurtles" "features" "addon-provider-fleet" "enabled"}},agent-tls-mode={{ index .Values "rancherTurtles" "features" "agent-tls-mode" "enabled"}}
        {{- range .Values.rancherTurtles.managerArguments }}
        - {{ . }}
        {{- end }}  
@@ -67,10 +67,10 @@ spec:
        resources:
          limits:
            cpu: 500m
-            memory: 128Mi
+            memory: 256Mi
          requests:
            cpu: 10m
-            memory: 64Mi
+            memory: 128Mi
      serviceAccountName: rancher-turtles-manager
      terminationGracePeriodSeconds: 10
      tolerations:
--- a/rancher-turtles-chart/templates/metal3-infrastructure.yaml
+++ b/rancher-turtles-chart/templates/metal3-infrastructure.yaml
@@ -22,7 +22,7 @@ metadata:
 spec:
  providers:
  - name: metal3
-    url: "https://github.com/metal3-io/cluster-api-provider-metal3/releases/v1.7.2/infrastructure-components.yaml"
+    url: "https://github.com/rancher-sandbox/cluster-api-provider-metal3/releases/v1.9.2/infrastructure-components.yaml"
    type: InfrastructureProvider
 ---
 apiVersion: turtles-capi.cattle.io/v1alpha1
--- a/rancher-turtles-chart/templates/post-delete-job.yaml
+++ b/rancher-turtles-chart/templates/post-delete-job.yaml
@@ -1,4 +1,4 @@
-{{- if index .Values "rancherTurtles" "features" "cluster-api-operator" "cleanup" }}
+{{- if index .Values "cluster-api-operator" "cleanup" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -41,7 +41,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: post-delete-job
-    namespace: rancher-turtles-system
+    namespace: '{{ .Values.rancherTurtles.namespace }}'
 roleRef:
  kind: ClusterRole
  name: post-delete-job-delete-webhooks
@@ -62,7 +62,7 @@ spec:
      serviceAccountName: post-delete-job
      containers:
        - name: cluster-api-operator-mutatingwebhook-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          command: ["kubectl"]
          args:
          - delete
@@ -90,7 +90,7 @@ spec:
      serviceAccountName: post-delete-job
      containers:
        - name: cluster-api-operator-validatingwebhook-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          command: ["kubectl"]
          args:
          - delete
@@ -119,7 +119,7 @@ spec:
      restartPolicy: Never
      containers:
      - name: delete-capi-controller-manager
-        image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+        image: {{ index .Values "rancherTurtles" "kubectlImage" }}
        command: ["kubectl"]
        args:
        - delete
@@ -128,7 +128,7 @@ spec:
        - {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }}
        - --ignore-not-found=true
      - name: delete-capi-kubeadm-bootstrap-controller-manager
-        image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+        image: {{ index .Values "rancherTurtles" "kubectlImage" }}
        command: ["kubectl"]
        args:
        - delete
@@ -137,7 +137,7 @@ spec:
        - capi-kubeadm-bootstrap-system
        - --ignore-not-found=true
      - name: delete-capi-kubeadm-control-plane-controller-manager
-        image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+        image: {{ index .Values "rancherTurtles" "kubectlImage" }}
        command: ["kubectl"]
        args:
        - delete
@@ -146,7 +146,7 @@ spec:
        - capi-kubeadm-control-plane-system
        - --ignore-not-found=true
      - name: delete-rke2-kubeadm-bootstrap-controller-manager
-        image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+        image: {{ index .Values "rancherTurtles" "kubectlImage" }}
        command: ["kubectl"]
        args:
        - delete
@@ -155,7 +155,7 @@ spec:
        - {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "namespace" }}
        - --ignore-not-found=true
      - name: delete-rke2-control-plane-controller-manager
-        image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }}
+        image: {{ index .Values "rancherTurtles" "kubectlImage" }}
        command: ["kubectl"]
        args:
        - delete
--- a/rancher-turtles-chart/templates/post-upgrade-job.yaml
+++ b/rancher-turtles-chart/templates/post-upgrade-job.yaml
@@ -1,10 +1,9 @@
-{{- if eq (index .Values "rancherTurtles" "features" "managementv3-cluster-migration" "enabled") true }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: post-upgrade-job
-  namespace: rancher-turtles-system
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": post-upgrade
    "helm.sh/hook-weight": "1"
@@ -24,13 +23,6 @@ rules:
  verbs:
  - list
  - delete
- apiGroups:
-  - management.cattle.io
-  resources:
-  - clusters
-  verbs:
-  - list
-  - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -42,7 +34,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: post-upgrade-job
-    namespace: rancher-turtles-system
+    namespace: '{{ .Values.rancherTurtles.namespace }}'
 roleRef:
  kind: ClusterRole
  name: post-upgrade-job-delete-clusters
@@ -52,6 +44,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
  name: post-upgrade-delete-clusters
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": post-upgrade
    "helm.sh/hook-weight": "2"
@@ -62,17 +55,12 @@ spec:
      serviceAccountName: post-upgrade-job
      containers:
        - name: post-upgrade-delete-clusters
-          image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          args:
          - delete
-          {{- if eq (index .Values "rancherTurtles" "features" "managementv3-cluster" "enabled") true }}
          - clusters.provisioning.cattle.io
-          {{- else }}
-          - clusters.management.cattle.io
-          {{- end }}
          - --selector=cluster-api.cattle.io/owned
          - -A
          - --ignore-not-found=true
          - --wait
      restartPolicy: OnFailure
-{{- end }}
--- a/rancher-turtles-chart/templates/pre-delete-job.yaml
+++ b/rancher-turtles-chart/templates/pre-delete-job.yaml
@@ -1,10 +1,10 @@
-{{- if index .Values "rancherTurtles" "features" "rancher-webhook" "cleanup" }}
+{{- if index .Values "rancherTurtles" "rancherInstalled" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: pre-delete-job
-  namespace: rancher-turtles-system
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "-2"
@@ -35,7 +35,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: pre-delete-job
-    namespace: rancher-turtles-system
+    namespace: '{{ .Values.rancherTurtles.namespace }}'
 roleRef:
  kind: ClusterRole
  name: pre-delete-job-delete-capiproviders
@@ -45,7 +45,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
  name: rancher-capiprovider-cleanup
-  namespace: rancher-turtles-system
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": pre-delete
    "helm.sh/hook-weight": "-1"
@@ -56,7 +56,7 @@ spec:
      serviceAccountName: pre-delete-job
      containers:
        - name: rancher-capiprovider-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          args:
          - delete
          - capiproviders
--- a/rancher-turtles-chart/templates/pre-install-job.yaml
+++ b/rancher-turtles-chart/templates/pre-install-job.yaml
@@ -1,4 +1,3 @@
-{{- if index .Values "rancherTurtles" "features" "embedded-capi" "disabled" }}
 {{- if index .Values "rancherTurtles" "rancherInstalled"}}
 ---
 apiVersion: management.cattle.io/v3
@@ -11,14 +10,13 @@ metadata:
 spec:
  value: false
 {{- end }}
-{{- end }}
-{{- if index .Values "rancherTurtles" "features" "rancher-webhook" "cleanup" }}
+{{- if index .Values "rancherTurtles" "rancherInstalled" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: pre-install-job
-  namespace: rancher-turtles-system
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "1"
@@ -49,7 +47,7 @@ metadata:
 subjects:
  - kind: ServiceAccount
    name: pre-install-job
-    namespace: rancher-turtles-system
+    namespace: '{{ .Values.rancherTurtles.namespace }}'
 roleRef:
  kind: ClusterRole
  name: pre-install-job-delete-webhooks
@@ -59,6 +57,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
  name: rancher-mutatingwebhook-cleanup
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "2"
@@ -69,7 +68,7 @@ spec:
      serviceAccountName: pre-install-job
      containers:
        - name: rancher-mutatingwebhook-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          args:
          - delete
          - mutatingwebhookconfigurations.admissionregistration.k8s.io
@@ -81,6 +80,7 @@ apiVersion: batch/v1
 kind: Job
 metadata:
  name: rancher-validatingwebhook-cleanup
+  namespace: '{{ .Values.rancherTurtles.namespace }}'
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-weight": "2"
@@ -91,7 +91,7 @@ spec:
      serviceAccountName: pre-install-job
      containers:
        - name: rancher-validatingwebhook-cleanup
-          image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }}
+          image: {{ index .Values "rancherTurtles" "kubectlImage" }}
          args:
          - delete
          - validatingwebhookconfigurations.admissionregistration.k8s.io
--- a/rancher-turtles-chart/templates/rancher-turtles-components.yaml
+++ b/rancher-turtles-chart/templates/rancher-turtles-components.yaml
--- a/rancher-turtles-chart/templates/rancher-turtles-exp-etcdrestore-components.yaml
+++ b/rancher-turtles-chart/templates/rancher-turtles-exp-etcdrestore-components.yaml
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ index .Values "rancherTurtles" "namespace" }}/rancher-turtles-etcdsnapshotrestore-serving-cert
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
  labels:
    turtles-capi.cattle.io: etcd-restore
  name: etcdmachinesnapshots.turtles-capi.cattle.io
@@ -116,7 +116,7 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ index .Values "rancherTurtles" "namespace" }}/rancher-turtles-etcdsnapshotrestore-serving-cert
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
  labels:
    turtles-capi.cattle.io: etcd-restore
  name: etcdsnapshotrestores.turtles-capi.cattle.io
@@ -195,20 +195,20 @@ spec:
                      description: |-
                        The reason for the condition's last transition in CamelCase.
                        The specific API may choose whether or not this field is considered a guaranteed API.
-                        This field may not be empty.
+                        This field may be empty.
                      type: string
                    severity:
                      description: |-
-                        Severity provides an explicit classification of Reason code, so the users or machines can immediately
+                        severity provides an explicit classification of Reason code, so the users or machines can immediately
                        understand the current situation and act accordingly.
                        The Severity field MUST be set only when Status=False.
                      type: string
                    status:
-                      description: Status of the condition, one of True, False, Unknown.
+                      description: status of the condition, one of True, False, Unknown.
                      type: string
                    type:
                      description: |-
-                        Type of condition in CamelCase or in foo.example.com/CamelCase.
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions
                        can be useful (see .node.status.conditions), the ability to deconflict is important.
                      type: string
@@ -235,7 +235,7 @@ kind: CustomResourceDefinition
 metadata:
  annotations:
    cert-manager.io/inject-ca-from: {{ index .Values "rancherTurtles" "namespace" }}/rancher-turtles-etcdsnapshotrestore-serving-cert
-    controller-gen.kubebuilder.io/version: v0.14.0
+    controller-gen.kubebuilder.io/version: v0.16.1
  labels:
    turtles-capi.cattle.io: etcd-restore
  name: rke2etcdmachinesnapshotconfigs.turtles-capi.cattle.io
@@ -438,29 +438,7 @@ rules:
  - cluster.x-k8s.io
  resources:
  - clusters
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - cluster.x-k8s.io
-  resources:
  - clusters/status
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - cluster.x-k8s.io
-  resources:
  - machines
  verbs:
  - create
@@ -499,57 +477,7 @@ rules:
  - turtles-capi.cattle.io
  resources:
  - etcdmachinesnapshots
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
-  - etcdmachinesnapshots/finalizers
-  verbs:
-  - update
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
-  - etcdmachinesnapshots/status
-  verbs:
-  - get
-  - patch
-  - update
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
  - etcdsnapshotrestores
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
-  - etcdsnapshotrestores/finalizers
-  verbs:
-  - update
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
-  - etcdsnapshotrestores/status
-  verbs:
-  - get
-  - patch
-  - update
- apiGroups:
-  - turtles-capi.cattle.io
-  resources:
  - rke2etcdmachinesnapshotconfigs
  verbs:
  - create
@@ -562,12 +490,16 @@ rules:
 - apiGroups:
  - turtles-capi.cattle.io
  resources:
+  - etcdmachinesnapshots/finalizers
+  - etcdsnapshotrestores/finalizers
  - rke2etcdmachinesnapshotconfigs/finalizers
  verbs:
  - update
 - apiGroups:
  - turtles-capi.cattle.io
  resources:
+  - etcdmachinesnapshots/status
+  - etcdsnapshotrestores/status
  - rke2etcdmachinesnapshotconfigs/status
  verbs:
  - get
--- a/rancher-turtles-chart/values.yaml
+++ b/rancher-turtles-chart/values.yaml
@@ -1,35 +1,24 @@
 rancherTurtles:
  image: registry.rancher.com/rancher/rancher/turtles
-  imageVersion: v0.14.1
+  imageVersion: v0.16.0
  imagePullPolicy: IfNotPresent
  namespace: rancher-turtles-system
  managerArguments: []
  imagePullSecrets: []
-  rancherInstalled: true
+  rancherInstalled: false
+  kubectlImage: registry.suse.com/edge/3.2/kubectl:1.30.3
  features:
-    cluster-api-operator:
-      cleanup: true
-      kubectlImage: rancher/kubectl:v1.30.3
-    embedded-capi:
-      disabled: false
-    rancher-webhook:
-      cleanup: false
-      kubectlImage: rancher/kubectl:v1.30.3
-    rancher-kubeconfigs:
-      label: false
-    managementv3-cluster:
-      enabled: true
-    managementv3-cluster-migration:
-      enabled: false
-    propagate-labels:
-      enabled: false
    etcd-snapshot-restore:
      enabled: false
      image: registry.rancher.com/rancher/rancher/turtles
-      imageVersion: v0.14.1
+      imageVersion: v0.16.0
      imagePullPolicy: IfNotPresent
+    # beta feature, see documentation for more information on feature stages
    addon-provider-fleet:
      enabled: false
+    # alpha feature, see documentation for more information on feature stages
+    agent-tls-mode:
+      enabled: false
 cluster-api-operator:
  enabled: true
  cert-manager:
@@ -53,6 +42,7 @@ cluster-api-operator:
      - mountPath: /config
        name: clusterctl-config
        readOnly: true
+  cleanup: true
  cluster-api:
    enabled: true
    configSecret:
@@ -60,30 +50,34 @@ cluster-api-operator:
      defaultName: capi-env-variables
    core:
      namespace: capi-system
+      imageUrl: ""
      fetchConfig:
        url: ""
        selector: ""
    rke2:
      enabled: true
+      version: ""
      bootstrap:
        namespace: rke2-bootstrap-system
+        imageUrl: ""
        fetchConfig:
          url: ""
          selector: ""
      controlPlane:
        namespace: rke2-control-plane-system
+        imageUrl: ""
        fetchConfig:
          url: ""
          selector: ""
    metal3:
      enabled: true
-      version: "v1.8.2"
+      version: "v1.9.2"
      infrastructure:
        namespace: capm3-system
-        imageUrl: "registry.rancher.com/rancher/cluster-api-metal3-controller:v1.8.2"
+        imageUrl: "registry.suse.com/rancher/cluster-api-provider-metal3:v1.9.2"
        fetchConfig:
          url: ""
          selector: ""
      ipam:
        namespace: capm3-system
-        imageUrl: "registry.rancher.com/rancher/cluster-api-metal3-ipam-controller:v1.8.1"
+        imageUrl: "registry.suse.com/rancher/ip-address-manager:v1.9.3"
--- a/release-manifest-image/Dockerfile
+++ b/release-manifest-image/Dockerfile
@@ -1,4 +1,4 @@
-#!BuildTag: %%IMG_PREFIX%%release-manifest:3.2.2
+#!BuildTag: %%IMG_PREFIX%%release-manifest:3.2.0
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION

@@ -7,11 +7,11 @@ FROM registry.suse.com/bci/bci-micro:$SLE_VERSION
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SUSE Edge Release Manifest"
 LABEL org.opencontainers.image.description="Release Manifest containing information about a specific SUSE Edge release"
-LABEL org.opencontainers.image.version="3.2.2"
+LABEL org.opencontainers.image.version="3.2.0"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%release-manifest:3.2.2"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%release-manifest:3.2.0"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
--- a/release-manifest-image/release_manifest.yaml
+++ b/release-manifest-image/release_manifest.yaml
@@ -1,94 +1,94 @@
 apiVersion: lifecycle.suse.com/v1alpha1
 kind: ReleaseManifest
 metadata:
-  name: release-manifest-3-2-2
+  name: release-manifest-3-2-0
 spec:
-  releaseVersion: 3.2.2
+  releaseVersion: 3.2.0
  components:
    kubernetes:
      k3s:
-        version: v1.31.7+k3s1
+        version: v1.31.3+k3s1
        coreComponents:
-          - name: traefik-crd
-            version: 27.0.201+up27.0.2
-            type: HelmChart
-          - name: traefik
-            version: 27.0.201+up27.0.2
-            type: HelmChart
+        - name: traefik-crd
+          version: 27.0.201+up27.0.2
+          type: HelmChart
+        - name: traefik
+          version: 27.0.201+up27.0.2
+          type: HelmChart
+        - name: local-path-provisioner
+          containers:
          - name: local-path-provisioner
-            containers:
-              - name: local-path-provisioner
-                image: rancher/local-path-provisioner:v0.0.31
-            type: Deployment
+            image: rancher/local-path-provisioner:v0.0.30
+          type: Deployment
+        - name: coredns
+          containers:
          - name: coredns
-            containers:
-              - name: coredns
-                image: rancher/mirrored-coredns-coredns:1.12.0
-            type: Deployment
+            image: rancher/mirrored-coredns-coredns:1.11.3
+          type: Deployment
+        - name: metrics-server
+          containers:
          - name: metrics-server
-            containers:
-              - name: metrics-server
-                image: rancher/mirrored-metrics-server:v0.7.2
-            type: Deployment
+            image: rancher/mirrored-metrics-server:v0.7.2
+          type: Deployment
      rke2:
-        version: v1.31.7+rke2r1
+        version: v1.31.3+rke2r1
        coreComponents:
-          - name: rke2-cilium
-            version: 1.17.100
-            type: HelmChart
-          - name: rke2-canal
-            version: v3.29.2-build2025030601
-            type: HelmChart
-          - name: rke2-calico-crd
-            version: v3.29.101
-            type: HelmChart
-          - name: rke2-calico
-            version: v3.29.200
-            type: HelmChart
-          - name: rke2-coredns
-            version: 1.39.100
-            type: HelmChart
-          - name: rke2-ingress-nginx
-            version: 4.12.100
-            type: HelmChart
-          - name: rke2-metrics-server
-            version: 3.12.200
-            type: HelmChart
-          - name: rancher-vsphere-csi
-            version: 3.3.1-rancher900
-            type: HelmChart
-          - name: rancher-vsphere-cpi
-            version: 1.9.100
-            type: HelmChart
-          - name: harvester-cloud-provider
-            version: 0.2.900
-            type: HelmChart
-          - name: harvester-csi-driver
-            version: 0.1.2300
-            type: HelmChart
-          - name: rke2-snapshot-controller-crd
-            version: 4.0.002
-            type: HelmChart
-          - name: rke2-snapshot-controller
-            version: 4.0.002
-            type: HelmChart
-          - name: rke2-snapshot-validation-webhook
-            version: 0.0.0
-            type: HelmChart
+        - name: rke2-cilium
+          version: 1.16.303
+          type: HelmChart
+        - name: rke2-canal
+          version: v3.29.0-build2024110400
+          type: HelmChart
+        - name: rke2-calico-crd
+          version: v3.29.000
+          type: HelmChart
+        - name: rke2-calico
+          version: v3.29.000
+          type: HelmChart
+        - name: rke2-coredns
+          version: 1.33.005
+          type: HelmChart
+        - name: rke2-ingress-nginx
+          version: 4.10.502
+          type: HelmChart
+        - name: rke2-metrics-server
+          version: 3.12.004
+          type: HelmChart
+        - name: rancher-vsphere-csi
+          version: 3.3.1-rancher700
+          type: HelmChart
+        - name: rancher-vsphere-cpi
+          version: 1.9.100
+          type: HelmChart
+        - name: harvester-cloud-provider
+          version: 0.2.600
+          type: HelmChart
+        - name: harvester-csi-driver
+          version: 0.1.2000
+          type: HelmChart
+        - name: rke2-snapshot-controller-crd
+          version: 3.0.601
+          type: HelmChart
+        - name: rke2-snapshot-controller
+          version: 3.0.601
+          type: HelmChart
+        - name: rke2-snapshot-validation-webhook
+          version: 1.9.001
+          type: HelmChart
    operatingSystem:
-      version: '6.0'
-      zypperID: SL-Micro
-      cpeScheme: cpe:/o:suse:sl-micro:6.0
-      prettyName: SUSE Linux Micro 6.0
+      version: "6.0"
+      zypperID: "SL-Micro"
+      cpeScheme: "cpe:/o:suse:sl-micro:6.0"
+      prettyName: "SUSE Linux Micro 6.0"
      supportedArchs:
-        - x86_64
-        - aarch64
+        - "x86_64"
+        - "aarch64"
    workloads:
      helm:
        - prettyName: Rancher
          releaseName: rancher
          chart: rancher
-          version: 2.10.3
+          version: 2.10.1
          repository: https://charts.rancher.com/server-charts/prime
          values:
            postDelete:
@@ -96,38 +96,38 @@ spec:
        - prettyName: Longhorn
          releaseName: longhorn
          chart: longhorn
-          version: 105.1.1+up1.7.3
+          version: 105.1.0+up1.7.2
          repository: https://charts.rancher.io
          dependencyCharts:
            - releaseName: longhorn-crd
              chart: longhorn-crd
-              version: 105.1.1+up1.7.3
+              version: 105.1.0+up1.7.2
              repository: https://charts.rancher.io
        - prettyName: MetalLB
          releaseName: metallb
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%metallb-chart'
-          version: '%%CHART_MAJOR%%.0.1+up0.14.9'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%metallb-chart
+          version: %%CHART_MAJOR%%.0.0+up0.14.9
        - prettyName: CDI
          releaseName: cdi
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%cdi-chart'
-          version: '%%CHART_MAJOR%%.0.0+up0.4.0'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%cdi-chart
+          version: %%CHART_MAJOR%%.0.0+up0.4.0
        - prettyName: KubeVirt
          releaseName: kubevirt
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%kubevirt-chart'
-          version: '%%CHART_MAJOR%%.0.0+up0.4.0'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%kubevirt-chart
+          version: %%CHART_MAJOR%%.0.0+up0.4.0
          addonCharts:
            - releaseName: kubevirt-dashboard-extension
-              chart: '%%CHART_REPO%%/%%IMG_PREFIX%%kubevirt-dashboard-extension-chart'
-              version: '%%CHART_MAJOR%%.0.0+up1.2.1'
+              chart: %%CHART_REPO%%/%%IMG_PREFIX%%kubevirt-dashboard-extension-chart
+              version: %%CHART_MAJOR%%.0.0+up1.2.1
        - prettyName: NeuVector
          releaseName: neuvector
          chart: neuvector
-          version: 105.0.1+up2.8.4
+          version: 105.0.0+up2.8.3
          repository: https://charts.rancher.io
          dependencyCharts:
            - releaseName: neuvector-crd
              chart: neuvector-crd
-              version: 105.0.1+up2.8.4
+              version: 105.0.0+up2.8.3
              repository: https://charts.rancher.io
          addonCharts:
            - releaseName: neuvector-ui-ext
@@ -136,8 +136,8 @@ spec:
              version: 2.0.1
        - prettyName: EndpointCopierOperator
          releaseName: endpoint-copier-operator
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator-chart'
-          version: '%%CHART_MAJOR%%.0.0+up0.2.1'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator-chart
+          version: %%CHART_MAJOR%%.0.0+up0.2.1
        - prettyName: Elemental
          releaseName: elemental-operator
          chart: oci://registry.suse.com/rancher/elemental-operator-chart
@@ -153,25 +153,25 @@ spec:
              version: 3.0.0
        - prettyName: SRIOV
          releaseName: sriov-network-operator
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%sriov-network-operator-chart'
-          version: '%%CHART_MAJOR%%.0.0+up1.4.0'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%sriov-network-operator-chart
+          version: %%CHART_MAJOR%%.0.0+up1.4.0
          dependencyCharts:
            - releaseName: sriov-crd
-              chart: '%%CHART_REPO%%/%%IMG_PREFIX%%sriov-crd-chart'
-              version: '%%CHART_MAJOR%%.0.0+up1.4.0'
+              chart: %%CHART_REPO%%/%%IMG_PREFIX%%sriov-crd-chart
+              version: %%CHART_MAJOR%%.0.0+up1.4.0
        - prettyName: Akri
          releaseName: akri
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%akri-chart'
-          version: '%%CHART_MAJOR%%.0.0+up0.12.20'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%akri-chart
+          version: %%CHART_MAJOR%%.0.0+up0.12.20
          addonCharts:
            - releaseName: akri-dashboard-extension
-              chart: '%%CHART_REPO%%/%%IMG_PREFIX%%akri-dashboard-extension-chart'
-              version: '%%CHART_MAJOR%%.0.0+up1.2.1'
+              chart: %%CHART_REPO%%/%%IMG_PREFIX%%akri-dashboard-extension-chart
+              version: %%CHART_MAJOR%%.0.0+up1.2.1
        - prettyName: Metal3
          releaseName: metal3
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%metal3-chart'
-          version: '%%CHART_MAJOR%%.0.1+up0.9.4'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%metal3-chart
+          version: %%CHART_MAJOR%%.0.0+up0.9.0
        - prettyName: RancherTurtles
          releaseName: rancher-turtles
-          chart: '%%CHART_REPO%%/%%IMG_PREFIX%%rancher-turtles-chart'
-          version: '%%CHART_MAJOR%%.0.0+up0.14.1'
+          chart: %%CHART_REPO%%/%%IMG_PREFIX%%rancher-turtles-chart
+          version: %%CHART_MAJOR%%.0.0+up0.14.1
--- a/shim-noarch/shim-15.7-150300.4.16.1.aarch64.rpm
+++ b/shim-noarch/shim-15.7-150300.4.16.1.aarch64.rpm
--- a/shim-noarch/shim-15.7-150300.4.16.1.x86_64.rpm
+++ b/shim-noarch/shim-15.7-150300.4.16.1.x86_64.rpm
--- a/shim-noarch/shim.changes
+++ b/shim-noarch/shim.changes
--- a/shim-noarch/shim.spec
+++ b/shim-noarch/shim.spec
@@ -0,0 +1,90 @@
+#
+# spec file for package shim
+#
+# Copyright (c) 2021 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+%undefine _debuginfo_subpackages
+%undefine _build_create_debug
+# Move 'efi'-executables to '/usr/share/efi' (FATE#326960, bsc#1166523)
+%define sysefibasedir  %{_datadir}/efi
+
+Name:           shim
+Version:        15.7
+Release:        0
+Summary:        UEFI shim loader
+License:        BSD-2-Clause
+Group:          System/Boot
+URL:            https://github.com/rhboot/shim
+Source:         shim-15.7-150300.4.16.1.x86_64.rpm
+Source1:        shim-15.7-150300.4.16.1.aarch64.rpm
+Requires:       perl-Bootloader
+BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+BuildArch:      noarch
+
+%description
+shim is a trivial EFI application that, when run, attempts to open and
+execute another application.
+
+%package aarch64
+Provides:       shim(aarch64)
+Group:          System/Boot
+Summary:        UEFI shim loader
+
+%package x86_64
+Provides:       shim(x86_64)
+Group:          System/Boot
+Summary:        UEFI shim loader
+
+%description aarch64
+shim is a trivial EFI application that, when run, attempts to open and
+execute another application.
+
+%description x86_64
+shim is a trivial EFI application that, when run, attempts to open and
+execute another application.
+
+%prep
+rpm2cpio %{SOURCE0} | cpio --extract --unconditional --preserve-modification-time --make-directories
+rpm2cpio %{SOURCE1} | cpio --extract --unconditional --preserve-modification-time --make-directories
+
+%build
+
+%install
+# purely repackaged
+cp -a * %{buildroot}
+rm -rf %{buildroot}/usr/lib64/efi
+rm %{buildroot}/etc/uefi/certs/BCA4E38E-shim.crt %{buildroot}/usr/sbin/shim-install %{buildroot}/usr/share/doc/packages/shim/COPYRIGHT
+
+%files aarch64
+%defattr(-,root,root)
+%dir %{?sysefibasedir}
+%dir %{sysefibasedir}/aarch64
+%{sysefibasedir}/aarch64/shim.efi
+%{sysefibasedir}/aarch64/shim-*.efi
+%{sysefibasedir}/aarch64/shim-*.der
+%{sysefibasedir}/aarch64/MokManager.efi
+%{sysefibasedir}/aarch64/fallback.efi
+
+%files x86_64
+%defattr(-,root,root)
+%dir %{?sysefibasedir}
+%dir %{sysefibasedir}/x86_64
+%{sysefibasedir}/x86_64/shim.efi
+%{sysefibasedir}/x86_64/shim-*.efi
+%{sysefibasedir}/x86_64/shim-*.der
+%{sysefibasedir}/x86_64/MokManager.efi
+%{sysefibasedir}/x86_64/fallback.efi
+
+%changelog