release-manifest: Update rancher-turtles versions

Updates to align with rancher-turtles chart

This also overides the RKE2 provider version to 0.18.0 so we can consume
recent fixes, in particular rancher/cluster-api-provider-rke2#684

.gitea/workflows/check_manifest.yaml

@@ -17,7 +17,7 @@ jobs:
           object-format: 'sha256'
       - name: Setup dependencies
         run: |
-          zypper in -y python3-ruamel.yaml
+          zypper in -y python3-PyYAML
       - name: Check release manifest
         run: |
-          python3 .obs/manifest-check.py --check
+          python3 .obs/manifest-check.py

.gitignore

@@ -1,3 +1,4 @@
 */.osc
 */__pycache__
-.venv/
+.venv/
+.idea/

.obs/common.py

@@ -1,3 +1,3 @@
-PROJECT = "isv:SUSE:Edge:3.3"
+PROJECT = "isv:SUSE:Edge:Factory"
 REPOSITORY = "https://src.opensuse.org/suse-edge/Factory"
-BRANCH = "3.3"
+BRANCH = "main"

.obs/manifest-check.py

@@ -1,15 +1,11 @@
 #!/usr/bin/python3
 
-import ruamel.yaml
+import yaml
-import pathlib
-import argparse
 import sys
 
-yaml = ruamel.yaml.YAML()
-
 def get_chart_version(chart_name: str) -> str:
     with open(f"./{chart_name}-chart/Chart.yaml") as f:
-        chart = yaml.load(f)
+        chart = yaml.safe_load(f)
         return chart["version"]
 
 def get_charts(chart):
@@ -25,57 +21,22 @@ def get_charts(chart):
 
 def get_charts_list():
     with open("./release-manifest-image/release_manifest.yaml") as f:
-        manifest = yaml.load(f)
+        manifest = yaml.safe_load(f)
     charts = {}
     for chart in manifest["spec"]["components"]["workloads"]["helm"]:
         charts.update(get_charts(chart))
     return charts
 
-def check_charts(fix: bool) -> bool:
+def main():
+    print("Checking charts versions in release manifest")
     success = True
     charts = get_charts_list()
-    to_fix = {}
     for chart in charts:
         expected_version = get_chart_version(chart)
         if expected_version != charts[chart]:
             success = False
-            to_fix[f'%%CHART_REPO%%/%%CHART_PREFIX%%{chart}'] = expected_version
             print(f"{chart}: Expected: {expected_version}, Got: {charts[chart]}")
-    if fix and not success:
+    if not success:
-        fix_charts(to_fix)
-        return True
-    return success
-
-def fix_charts(to_fix):
-    manifest_path = pathlib.Path("./release-manifest-image/release_manifest.yaml")
-    manifest = yaml.load(manifest_path)
-    yaml.indent(mapping=2, sequence=4, offset=2)
-    yaml.width = 4096
-    for chart_index, chart in enumerate(manifest["spec"]["components"]["workloads"]["helm"]):
-        changed = False
-        if chart["chart"] in to_fix.keys():
-            changed = True
-            chart["version"] = to_fix[chart["chart"]]
-        for subchart_index, subchart in enumerate(chart.get("addonCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["addonCharts"][subchart_index] = subchart
-        for subchart_index, subchart in enumerate(chart.get("dependencyCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["dependencyCharts"][subchart_index] = subchart
-        if changed:
-            manifest["spec"]["components"]["workloads"]["helm"][chart_index] = chart
-    yaml.dump(manifest, manifest_path)
-
-def main():
-    print("Checking charts versions in release manifest")
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-c', '--check', action='store_true')
-    args = parser.parse_args()
-    if not check_charts(not args.check):
         sys.exit(1)
     else:
         print("All local charts in release manifest are using the right version")

.pre-commit-config.yaml

@@ -1,10 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: check-manifest
-        name: "Check release-manifest"
-        entry: python3 .obs/manifest-check.py
-        language: python
-        additional_dependencies: ['ruamel.yaml']
-        pass_filenames: false
-        always_run: true

_config

@@ -60,6 +60,7 @@ BuildFlags: onlybuild:release-manifest-image
     BuildFlags: excludebuild:endpoint-copier-operator-image
     BuildFlags: excludebuild:ironic-image
     BuildFlags: excludebuild:ironic-ipa-downloader-image
+    BuildFlags: excludebuild:kiwi-builder-image
     BuildFlags: excludebuild:kubectl-image
     BuildFlags: excludebuild:kube-rbac-proxy-image
     BuildFlags: excludebuild:metallb-controller-image
@@ -149,6 +150,10 @@ BuildFlags: onlybuild:release-manifest-image
 %else
     %if "%{sub %{reverse %_project} 1 7}" != "%{reverse :ToTest}" && "%{sub %{reverse %_project} 1 9}" != "%{reverse :Snapshot}"
       BuildFlags: excludebuild:kiwi-builder-image
+    %else
+      %ifarch aarch64
+        BuildFlags: onlybuild:kiwi-builder-image
+      %endif
     %endif
 %endif
 

akri-dashboard-extension-chart/Chart.yaml

@@ -1,4 +1,3 @@
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2
 #!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1
 #!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.1-%RELEASE%
 annotations:

edge-image-builder-image/artifacts.yaml

@@ -5,7 +5,7 @@ metallb:
 endpoint-copier-operator:
   chart: endpoint-copier-operator
   repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.0+up0.2.1"
+  version: "%%CHART_MAJOR%%.0.1+up0.3.0"
 kubernetes:
   k3s:
     selinuxPackage: k3s-selinux-1.6-1.slemicro.noarch

endpoint-copier-operator-chart/Chart.yaml

@@ -1,8 +1,8 @@
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0-%RELEASE%
 apiVersion: v2
-appVersion: v0.2.0
+appVersion: v0.3.0
 description: A Helm chart for Kubernetes
 name: endpoint-copier-operator
 type: application
-version: "%%CHART_MAJOR%%.0.0+up0.2.1"
+version: "%%CHART_MAJOR%%.0.1+up0.3.0"

endpoint-copier-operator-chart/templates/deployment.yaml

@@ -20,8 +20,23 @@ spec:
       labels:
         {{- include "endpoint-copier-operator.selectorLabels" . | nindent 8 }}
     spec:
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - command:
         - /manager

endpoint-copier-operator-chart/templates/rbac/role.yaml

@@ -7,9 +7,9 @@ metadata:
   name: {{ include "endpoint-copier-operator.fullname" . }}
 rules:
 - apiGroups:
-  - ""
+  - "discovery.k8s.io"
   resources:
-  - endpoints
+  - endpointslices
   verbs:
   - create
   - delete

endpoint-copier-operator-chart/values.yaml

@@ -8,7 +8,7 @@ image:
   repository: %%IMG_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: "0.2.0"
+  tag: "0.3.0"
 
 nameOverride: "endpoint-copier-operator"
 fullnameOverride: "endpoint-copier-operator"
@@ -29,6 +29,8 @@ podSecurityContext:
   seccompProfile:
     type: RuntimeDefault
 
+priorityClassName: "system-cluster-critical"
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -37,11 +39,11 @@ securityContext:
 
 resources:
   limits:
-    cpu: 500m
+    cpu: 100m
-    memory: 128Mi
-  requests:
-    cpu: 10m
     memory: 64Mi
+  requests:
+    cpu: 5m
+    memory: 32Mi
 
 autoscaling:
   enabled: false

endpoint-copier-operator/_service

@@ -2,7 +2,7 @@
  <service name="obs_scm">
     <param name="url">https://github.com/suse-edge/endpoint-copier-operator</param>
     <param name="scm">git</param>
-    <param name="revision">v0.2.0</param>
+    <param name="revision">v0.3.0</param>
     <param name="version">_auto_</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>

endpoint-copier-operator/endpoint-copier-operator.spec

@@ -17,14 +17,14 @@
 
 
 Name:           endpoint-copier-operator
-Version:        0.2.0
+Version:        0.3.0
-Release:        0.2.0
+Release:        0.3.0
 Summary:        Implements a Kubernetes API for copying endpoint resources
 License:        Apache-2.0
 URL:            https://github.com/suse-edge/endpoint-copier-operator
 Source:         endpoint-copier-operator-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.20
+BuildRequires:  golang(API) = 1.24
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}
 

ironic-image/Dockerfile

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.4
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.5
-#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.4-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.5-%RELEASE%
 #!BuildVersion: 15.6
 
 ARG SLE_VERSION
@@ -20,11 +20,11 @@ RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes
 
 #!ArchExclusiveLine: x86_64
 RUN if [ "$(uname -m)" = "x86_64" ];then \
-      zypper --installroot /installroot --non-interactive install --no-recommends syslinux python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi inotify-tools ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
+      zypper --installroot /installroot --non-interactive install --no-recommends syslinux python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python311-pyinotify python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
     fi
 #!ArchExclusiveLine: aarch64
 RUN if [ "$(uname -m)" = "aarch64" ];then \
-      zypper --installroot /installroot --non-interactive install --no-recommends python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi inotify-tools ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
+      zypper --installroot /installroot --non-interactive install --no-recommends python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python311-pyinotify python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
     fi
     
 # DATABASE
@@ -32,7 +32,9 @@ RUN mkdir -p /installroot/var/lib/ironic && \
   /installroot/usr/bin/sqlite3 /installroot/var/lib/ironic/ironic.sqlite "pragma journal_mode=wal" && \
   zypper --installroot /installroot --non-interactive remove sqlite3
 
+# build actual image
 FROM micro AS final
+
 MAINTAINER SUSE LLC (https://www.suse.com/)
 # Define labels according to https://en.opensuse.org/Building_derived_containers
 LABEL org.opencontainers.image.title="SLE Openstack Ironic Container Image"
@@ -40,8 +42,8 @@ LABEL org.opencontainers.image.description="Openstack Ironic based on the SLE Ba
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opencontainers.image.version="26.1.2.4"
+LABEL org.opencontainers.image.version="26.1.2.5"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.4-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.5-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -62,14 +64,15 @@ RUN echo 'alias mkisofs="xorriso -as mkisofs"' >> ~/.bashrc
 COPY mkisofs_wrapper /usr/bin/mkisofs
 RUN set -euo pipefail; chmod +x /usr/bin/mkisofs
 
-COPY auth-common.sh configure-ironic.sh ironic-common.sh rundnsmasq runhttpd runironic runlogwatch.sh tls-common.sh configure-nonroot.sh ironic-probe.j2 /bin/
-RUN set -euo pipefail; chmod +x /bin/auth-common.sh; chmod +x /bin/configure-ironic.sh; chmod +x /bin/ironic-common.sh; chmod +x /bin/rundnsmasq; chmod +x /bin/runhttpd; chmod +x /bin/runironic; chmod +x /bin/runlogwatch.sh; chmod +x /bin/tls-common.sh; chmod +x /bin/configure-nonroot.sh;
 RUN mkdir -p /tftpboot
 RUN mkdir -p $GRUB_DIR
 
-# No need to support the Legacy BIOS boot
+COPY scripts/ /bin/
-#RUN cp /usr/share/syslinux/pxelinux.0 /tftpboot
+COPY configure-nonroot.sh /bin/
-#RUN cp /usr/share/syslinux/chain.c32 /tftpboot/
+RUN set -euo pipefail; chmod +x /bin/configure-ironic.sh /bin/rundnsmasq /bin/runhttpd /bin/runironic /bin/runlogwatch.sh /bin/configure-nonroot.sh
+
+COPY ironic-config/inspector.ipxe.j2 ironic-config/httpd-ironic-api.conf.j2 \
+     ironic-config/ipxe_config.template /tmp/
 
 # IRONIC #
 RUN cp /usr/share/ipxe/undionly.kpxe /tftpboot/undionly.kpxe
@@ -77,31 +80,29 @@ RUN cp /usr/share/ipxe/undionly.kpxe /tftpboot/undionly.kpxe
 RUN if [ "$(uname -m)" = "x86_64" ];then \
       cp /usr/share/ipxe/ipxe-x86_64.efi /tftpboot/ipxe.efi ;\
     fi
-#!ArchExclusiveLine: x86_64
+#!ArchExclusiveLine: aarch64 
 RUN if [ "$(uname -m)" = "aarch64" ]; then\ 
-     cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
+      cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
     fi
     
 COPY --from=base /tmp/esp-x86_64.img /tmp/uefi_esp-x86_64.img
 COPY --from=base /tmp/esp-aarch64.img /tmp/uefi_esp-arm64.img
 
-COPY ironic.conf.j2 /etc/ironic/
+COPY ironic-config/ironic.conf.j2 /etc/ironic/
-COPY inspector.ipxe.j2 httpd-ironic-api.conf.j2 ipxe_config.template /tmp/
+COPY ironic-config/network-data-schema-empty.json /etc/ironic/
-COPY network-data-schema-empty.json /etc/ironic/
 
 # DNSMASQ
-COPY dnsmasq.conf.j2 /etc/
+COPY ironic-config/dnsmasq.conf.j2 /etc/
-
-# Custom httpd config, removes all but the bare minimum needed modules
-COPY httpd.conf.j2 /etc/httpd/conf/
-COPY httpd-modules.conf /etc/httpd/conf.modules.d/
-COPY apache2-vmedia.conf.j2 /etc/httpd-vmedia.conf.j2
-COPY apache2-ipxe.conf.j2 /etc/httpd-ipxe.conf.j2
 
 # Workaround
 # Removing the 010-ironic.conf file that comes with the package 
 RUN rm /etc/ironic/ironic.conf.d/010-ironic.conf
 
+# Custom httpd config, removes all but the bare minimum needed modules
+COPY ironic-config/httpd.conf.j2 /etc/httpd/conf/
+COPY ironic-config/httpd-modules.conf /etc/httpd/conf.modules.d/
+COPY ironic-config/apache2-vmedia.conf.j2 /etc/httpd-vmedia.conf.j2
+COPY ironic-config/apache2-ipxe.conf.j2 /etc/httpd-ipxe.conf.j2
+
 # configure non-root user and set relevant permissions
-RUN configure-nonroot.sh && \
+RUN configure-nonroot.sh && rm -f /bin/configure-nonroot.sh
-  rm -f /bin/configure-nonroot.sh

ironic-image/inspector-apache.conf.j2

@@ -1,57 +0,0 @@
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-
-{% if env.LISTEN_ALL_INTERFACES | lower == "true" %}
-Listen {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
- <VirtualHost *:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
-{% else %}
-Listen {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
- <VirtualHost {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
-{% endif %}
-    {% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
-    ProxyPass "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
-    ProxyPassReverse "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
-    {% else %}
-    ProxyPass "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
-    ProxyPassReverse "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
-    {% endif %}
-
-    SetEnv APACHE_RUN_USER ironic-suse
-    SetEnv APACHE_RUN_GROUP ironic-suse
-
-    ErrorLog /dev/stdout
-    LogLevel debug
-    CustomLog /dev/stdout combined
-
-    SSLEngine On
-    SSLProtocol {{ env.IRONIC_SSL_PROTOCOL }}
-    SSLCertificateFile {{ env.IRONIC_INSPECTOR_CERT_FILE }} 
-    SSLCertificateKeyFile {{ env.IRONIC_INSPECTOR_KEY_FILE }}
-
-    {% if "INSPECTOR_HTPASSWD" in env and env.INSPECTOR_HTPASSWD | length %}
-    <Location / >
-        AuthType Basic
-        AuthName "Restricted area"
-        AuthUserFile "/etc/ironic-inspector/htpasswd"
-        Require valid-user
-    </Location>
-
-    <Location ~ "^/(v1/?)?$" >
-        Require all granted
-    </Location>
-
-    <Location /v1/continue >
-        Require all granted
-    </Location>
-    {% endif %}
-</VirtualHost>

ironic-image/ironic-config/ironic.conf.j2

@@ -187,11 +187,6 @@ insecure = {{ env.IRONIC_INSECURE }}
 [nova]
 send_power_notifications = false
 
-[oslo_messaging_notifications]
-driver = prometheus_exporter
-location = /shared/ironic_prometheus_exporter
-transport_url = fake://
-
 [pxe]
 # NOTE(dtantsur): keep this value at least 3x lower than
 # [conductor]deploy_callback_timeout so that at least some retries happen.

ironic-image/ironic-inspector.conf.j2

@@ -1,68 +0,0 @@
-[DEFAULT]
-auth_strategy = noauth
-debug = true
-transport_url = fake://
-use_stderr = true
-{% if env.INSPECTOR_REVERSE_PROXY_SETUP == "true" %}
-{% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
-listen_unix_socket = /shared/inspector.sock
-# NOTE(dtantsur): this is not ideal, but since the socket is accessed from
-# another container, we need to make it world-writeable.
-listen_unix_socket_mode = 0666
-{% else %}
-listen_port = {{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}
-listen_address = 127.0.0.1
-{% endif %}
-{% elif env.LISTEN_ALL_INTERFACES | lower == "true" %}
-listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
-listen_address = ::
-{% else %}
-listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
-listen_address = {{ env.IRONIC_IP }}
-{% endif %}
-host = {{ env.IRONIC_IP }}
-{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
-use_ssl = true
-{% endif %}
-
-[database]
-connection = sqlite:////var/lib/ironic-inspector/ironic-inspector.db
-
-{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
-[discovery]
-enroll_node_driver = ipmi
-{% endif %}
-
-[ironic]
-auth_type = none
-endpoint_override = {{ env.IRONIC_BASE_URL }}
-{% if env.IRONIC_TLS_SETUP == "true" %}
-cafile = {{ env.IRONIC_CACERT_FILE }}
-insecure = {{ env.IRONIC_INSECURE }}
-{% endif %}
-
-[processing]
-add_ports = all
-always_store_ramdisk_logs = true
-keep_ports = present
-{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
-node_not_found_hook = enroll
-{% endif %}
-permit_active_introspection = true
-power_off = false
-processing_hooks = $default_processing_hooks,lldp_basic
-ramdisk_logs_dir = /shared/log/ironic-inspector/ramdisk
-store_data = database
-
-[pxe_filter]
-driver = noop
-
-[service_catalog]
-auth_type = none
-endpoint_override = {{ env.IRONIC_INSPECTOR_BASE_URL }}
-
-{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
-[ssl]
-cert_file = {{ env.IRONIC_INSPECTOR_CERT_FILE }}
-key_file = {{ env.IRONIC_INSPECTOR_KEY_FILE }}
-{% endif %}

ironic-image/runironic-api

@@ -1,13 +0,0 @@
-#!/usr/bin/bash
-
-export IRONIC_DEPLOYMENT="API"
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-export IRONIC_REVERSE_PROXY_SETUP=false
-
-python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < /tmp/httpd-ironic-api.conf.j2 > /etc/httpd/conf.d/ironic.conf
-
-# shellcheck disable=SC1091
-. /bin/runhttpd

ironic-image/runironic-conductor

@@ -1,20 +0,0 @@
-#!/usr/bin/bash
-
-export IRONIC_DEPLOYMENT="Conductor"
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-# Ramdisk logs
-mkdir -p /shared/log/ironic/deploy
-
-run_ironic_dbsync
-
-if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-    # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
-        kill $(pgrep ironic)
-    done &
-fi
-
-exec /usr/bin/ironic-conductor

ironic-image/runironic-exporter

@@ -1,12 +0,0 @@
-#!/usr/bin/bash
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-FLASK_RUN_HOST=${FLASK_RUN_HOST:-0.0.0.0}
-FLASK_RUN_PORT=${FLASK_RUN_PORT:-9608}
-
-export IRONIC_CONFIG="/etc/ironic/ironic.conf"
-
-exec gunicorn -b "${FLASK_RUN_HOST}:${FLASK_RUN_PORT}" -w 4 \
-    ironic_prometheus_exporter.app.wsgi:application

ironic-image/runironic-inspector

@@ -1,62 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-CONFIG=/etc/ironic-inspector/ironic-inspector.conf
-
-export IRONIC_INSPECTOR_ENABLE_DISCOVERY=${IRONIC_INSPECTOR_ENABLE_DISCOVERY:-false}
-export INSPECTOR_REVERSE_PROXY_SETUP=${INSPECTOR_REVERSE_PROXY_SETUP:-false}
-
-# shellcheck disable=SC1091
-. /bin/tls-common.sh
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-# shellcheck disable=SC1091
-. /bin/auth-common.sh
-
-if [[ "$USE_IRONIC_INSPECTOR" == "false" ]]; then
-    echo "FATAL: ironic-inspector is disabled via USE_IRONIC_INSPECTOR"
-    exit 1
-fi
-
-wait_for_interface_or_ip
-
-IRONIC_INSPECTOR_PORT=${IRONIC_INSPECTOR_ACCESS_PORT}
-if [[ "$IRONIC_INSPECTOR_TLS_SETUP" == "true" ]]; then
-    if [[ "${INSPECTOR_REVERSE_PROXY_SETUP}" == "true" ]] && [[ "${IRONIC_INSPECTOR_PRIVATE_PORT}" != "unix" ]]; then
-        IRONIC_INSPECTOR_PORT=$IRONIC_INSPECTOR_PRIVATE_PORT
-    fi
-else
-    export INSPECTOR_REVERSE_PROXY_SETUP="false" # If TLS is not used, we have no reason to use the reverse proxy
-fi
-
-export IRONIC_INSPECTOR_BASE_URL="${IRONIC_INSPECTOR_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_INSPECTOR_PORT}"
-export IRONIC_BASE_URL="${IRONIC_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_ACCESS_PORT}"
-
-build_j2_config()
-{
-    local CONFIG_FILE="$1"
-    python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$CONFIG_FILE.j2"
-}
-
-# Merge with the original configuration file from the package.
-build_j2_config "$CONFIG" | crudini --merge "$CONFIG"
-
-configure_inspector_auth
-
-configure_client_basic_auth ironic "${CONFIG}"
-
-ironic-inspector-dbsync --config-file "${CONFIG}" upgrade
-
-if [[ "$INSPECTOR_REVERSE_PROXY_SETUP" == "false" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-    # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_INSPECTOR_CERT_FILE}" | while read -r file event; do
-        kill $(pgrep ironic)
-    done &
-fi
-
-# Make sure ironic traffic bypasses any proxies
-export NO_PROXY="${NO_PROXY:-},$IRONIC_IP"
-
-# shellcheck disable=SC2086
-exec /usr/bin/ironic-inspector

ironic-image/scripts/configure-ironic.sh

@@ -84,7 +84,6 @@ echo 'Options set from Environment variables'
 env | grep "^OS_" || true
 
 mkdir -p /shared/html
-mkdir -p /shared/ironic_prometheus_exporter
 
 configure_json_rpc_auth
 

ironic-image/scripts/runhttpd

@@ -72,7 +72,7 @@ fi
 # Set up inotify to kill the container (restart) whenever cert files for ironic api change
 if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
     # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
+    python3.11 -m pyinotify --raw-format -e IN_DELETE_SELF -v "${IRONIC_CERT_FILE}" | while read -r file event; do
         kill -WINCH $(pgrep httpd)
     done &
 fi
@@ -80,7 +80,7 @@ fi
 # Set up inotify to kill the container (restart) whenever cert of httpd for /shared/html/<redifsh;ilo> path change
 if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
     # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_VMEDIA_CERT_FILE}" | while read -r file event; do
+    python3.11 -m pyinotify --raw-format -e IN_DELETE_SELF -v "${IRONIC_VMEDIA_CERT_FILE}" | while read -r file event; do
         kill -WINCH $(pgrep httpd)
     done &
 fi

ironic-image/scripts/runironic

@@ -13,7 +13,7 @@ run_ironic_dbsync
 
 if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
     # shellcheck disable=SC2034
-    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
+    python3.11 -m pyinotify --raw-format -e IN_DELETE_SELF -v "${IRONIC_CERT_FILE}" | while read -r file event; do
         kill $(pgrep ironic)
     done &
 fi

ironic-image/scripts/runlogwatch.sh

@@ -11,7 +11,7 @@ while [ ! -d "${LOG_DIR}" ]; do
   sleep 5
 done
 
-inotifywait -m "${LOG_DIR}" -e close_write |
+python3.11 -m pyinotify --raw-format -e IN_CLOSE_WRITE -v "${LOG_DIR}" |
     while read -r path _action file; do
         echo "************ Contents of ${path}/${file} ramdisk log file bundle **************"
         tar -xOzvvf "${path}/${file}" | sed -e "s/^/${file}: /"

ironic-ipa-downloader-image/Dockerfile

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.7
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.8
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.7-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
 
@@ -18,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.6"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.7-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -33,8 +33,6 @@ LABEL com.suse.release-stage="released"
 
 COPY --from=base /installroot /
 RUN cp /getopt /usr/bin/
-RUN cp /srv/tftpboot/openstack-ironic-image/initrd*.zst /tmp
-RUN cp /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel /tmp
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/

ironic-ipa-downloader-image/Dockerfile.aarch64

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.7
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.8
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.7-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
 
@@ -18,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.6"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.7-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -33,8 +33,6 @@ LABEL com.suse.release-stage="released"
 
 COPY --from=base /installroot /
 RUN cp /getopt /usr/bin/
-RUN cp /srv/tftpboot/openstack-ironic-image/initrd*.zst /tmp
-RUN cp /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel /tmp
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/

ironic-ipa-downloader-image/Dockerfile.x86_64

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.7
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.8
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.7-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.8-%RELEASE%
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
 
@@ -18,11 +18,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.6"
+LABEL org.opencontainers.image.version="3.0.8"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.7-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -33,8 +33,6 @@ LABEL com.suse.release-stage="released"
 
 COPY --from=base /installroot /
 RUN cp /getopt /usr/bin/
-RUN cp /srv/tftpboot/openstack-ironic-image/initrd*.zst /tmp
-RUN cp /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel /tmp
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/

ironic-ipa-downloader-image/get-resource.sh

@@ -6,6 +6,8 @@ export http_proxy=${http_proxy:-$HTTP_PROXY}
 export https_proxy=${https_proxy:-$HTTPS_PROXY}
 export no_proxy=${no_proxy:-$NO_PROXY}
 
+IMAGES_BASE_PATH="/srv/tftpboot/openstack-ironic-image"
+
 if [ -d "/tmp/ironic-certificates" ]; then
   sha256sum /tmp/ironic-certificates/* > /tmp/certificates.sha256
   if cmp "/shared/certificates.sha256" "/tmp/certificates.sha256"; then
@@ -26,14 +28,14 @@ if [ -z "${IPA_BASEURI}" ]; then
   IMAGE_CHANGED=1
   # SLES BASED IPA - ironic-ipa-ramdisk-x86_64 and ironic-ipa-ramdisk-aarch64 packages
   mkdir -p /shared/html/images
-  if [ -f /tmp/initrd-x86_64.zst ]; then
+  if [ -f ${IMAGES_BASE_PATH}/initrd-x86_64.zst ]; then
-    cp /tmp/initrd-x86_64.zst /shared/html/images/ironic-python-agent-x86_64.initramfs
+    cp ${IMAGES_BASE_PATH}/initrd-x86_64.zst /shared/html/images/ironic-python-agent-x86_64.initramfs
-    cp /tmp/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent-x86_64.kernel
+    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent-x86_64.kernel
   fi
   # Use arm64 as destination for iPXE compatibility
-  if [ -f /tmp/initrd-aarch64.zst ]; then
+  if [ -f ${IMAGES_BASE_PATH}/initrd-aarch64.zst ]; then
-    cp /tmp/initrd-aarch64.zst /shared/html/images/ironic-python-agent-arm64.initramfs
+    cp ${IMAGES_BASE_PATH}/initrd-aarch64.zst /shared/html/images/ironic-python-agent-arm64.initramfs
-    cp /tmp/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent-arm64.kernel
+    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent-arm64.kernel
   fi
 
   cp /tmp/images.sha256 /shared/images.sha256

kubevirt-dashboard-extension-chart/Chart.yaml

@@ -1,4 +1,3 @@
-#!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2
 #!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2
 #!BuildTag: %%CHART_PREFIX%%kubevirt-dashboard-extension:%%CHART_MAJOR%%.0.2_up1.3.2-%RELEASE%
 annotations:

metal3-chart/Chart.yaml

@@ -1,7 +1,7 @@
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.7_up0.11.5
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.9_up0.11.7
-#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.7_up0.11.5-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%metal3:%%CHART_MAJOR%%.0.9_up0.11.7-%RELEASE%
 apiVersion: v2
-appVersion: 0.11.5
+appVersion: 0.11.7
 dependencies:
 - alias: metal3-baremetal-operator
   name: baremetal-operator
@@ -10,19 +10,19 @@ dependencies:
 - alias: metal3-ironic
   name: ironic
   repository: file://./charts/ironic
-  version: 0.10.5
+  version: 0.10.6
 - alias: metal3-mariadb
   condition: global.enable_mariadb
   name: mariadb
   repository: file://./charts/mariadb
-  version: 0.5.4
+  version: 0.6.0
 - alias: metal3-media
   condition: global.enable_metal3_media_server
   name: media
   repository: file://./charts/media
-  version: 0.6.2
+  version: 0.6.3
 description: A Helm chart that installs all of the dependencies needed for Metal3
 icon: https://github.com/cncf/artwork/raw/master/projects/metal3/icon/color/metal3-icon-color.svg
 name: metal3
 type: application
-version: "%%CHART_MAJOR%%.0.7+up0.11.5"
+version: "%%CHART_MAJOR%%.0.9+up0.11.7"

metal3-chart/charts/ironic/Chart.yaml

@@ -3,4 +3,4 @@ appVersion: 26.1.2
 description: A Helm chart for Ironic, used by Metal3
 name: ironic
 type: application
-version: 0.10.5
+version: 0.10.6

metal3-chart/charts/ironic/templates/configmap.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: ironic-bmo
+  name: ironic
   labels:
     {{- include "ironic.labels" . | nindent 4 }}
 data:
@@ -9,7 +9,6 @@ data:
   {{- $enableVMediaTLS := .Values.global.enable_vmedia_tls }}
   {{- $protocol := ternary "https" "http" $enableTLS }}
   {{- $ironicIP := .Values.global.ironicIP | default "" }}
-  {{- $ironicApiHost := print $ironicIP ":6385" }}
   {{- $ironicBootHost := print $ironicIP ":6180" }}
   {{- $ironicCacheHost := print $ironicIP ":6180" }}
   {{- $deployArch := .Values.global.deployArchitecture }}
@@ -25,11 +24,6 @@ data:
   {{- end }}
   HTTP_PORT: "6180"
   PREDICTABLE_NIC_NAMES: "{{ .Values.global.predictableNicNames }}"
-  USE_IRONIC_INSPECTOR: "false"
-  IRONIC_API_BASE_URL: {{ $protocol }}://{{ $ironicApiHost }}
-  IRONIC_API_HOST: {{ $ironicApiHost }}
-  IRONIC_API_HTTPD_SERVER_NAME: {{ $ironicApiHost }}
-  IRONIC_ENDPOINT: {{ $protocol }}://{{ $ironicApiHost }}/v1/
   # Switch VMedia to HTTP if enable_vmedia_tls is false
   {{- if and $enableTLS $enableVMediaTLS }}
     {{- $ironicBootHost = print $ironicIP ":" .Values.global.vmediaTLSPort }}
@@ -39,12 +33,8 @@ data:
     {{- $protocol = "http" }}
   {{- end }}
   IRONIC_EXTERNAL_HTTP_URL: {{ $protocol }}://{{ $ironicCacheHost }}
-  CACHEURL: {{ $protocol }}://{{ $ironicCacheHost }}/images
-  DEPLOY_KERNEL_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.kernel
-  DEPLOY_RAMDISK_URL: {{ $protocol }}://{{ $ironicBootHost }}/images/ironic-python-agent-{{ $deployArch }}.initramfs
   DEPLOY_ARCHITECTURE: {{ $deployArch }}
   IRONIC_BOOT_BASE_URL: {{ $protocol }}://{{ $ironicBootHost }}
-  IRONIC_VMEDIA_HTTPD_SERVER_NAME: {{ $ironicBootHost }}
   ENABLE_PXE_BOOT: "{{ .Values.global.enable_pxe_boot }}"
   {{- if .Values.global.provisioningInterface }}
   PROVISIONING_INTERFACE: {{ .Values.global.provisioningInterface }}
@@ -52,8 +42,6 @@ data:
   {{- if .Values.global.provisioningIP }}
   PROVISIONING_IP: {{ .Values.global.provisioningIP }}
   {{- end }}
-  IRONIC_ILO_USE_SWIFT: "false"
-  IRONIC_ILO_USE_WEB_SERVER_FOR_IMAGES: "true"
   IRONIC_FAST_TRACK: "true"
   LISTEN_ALL_INTERFACES: "true"
   {{- if .Values.global.ironicIP }}

metal3-chart/charts/ironic/templates/deployment.yaml

@@ -39,7 +39,7 @@ spec:
         - /bin/runhttpd
         envFrom:
         - configMapRef:
-            name: ironic-bmo
+            name: ironic
         livenessProbe:
           exec:
             command: ["sh", "-c", "curl -sSfk https://127.0.0.1:6385"]
@@ -97,7 +97,7 @@ spec:
         - /bin/runironic
         envFrom:
         - configMapRef:
-            name: ironic-bmo
+            name: ironic
         env:
         {{- if .Values.global.enable_basicAuth }}
         - name: IRONIC_HTPASSWD
@@ -170,7 +170,7 @@ spec:
         - /bin/rundnsmasq
         envFrom:
         - configMapRef:
-            name: ironic-bmo
+            name: ironic
         livenessProbe:
           exec:
             command:

metal3-chart/charts/ironic/values.yaml

@@ -56,11 +56,11 @@ images:
   ironic:
     repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic
     pullPolicy: IfNotPresent
-    tag: 26.1.2.4
+    tag: 26.1.2.5
   ironicIPADownloader:
     repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic-ipa-downloader
     pullPolicy: IfNotPresent
-    tag: 3.0.7
+    tag: 3.0.8
 
 nameOverride: ""
 fullnameOverride: ""

metal3-chart/charts/mariadb/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
-appVersion: 10.6.7
+appVersion: "10.11"
 description: A Helm chart for MariaDB, used by Metal3
 name: mariadb
 type: application
-version: 0.5.4
+version: 0.6.0

metal3-chart/charts/mariadb/templates/configmap-mariadb.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap 
+metadata:
+  name: mariadb-config
+  labels:
+    {{- include "mariadb.labels" . | nindent 4 }}
+data:
+  ironic.conf: |
+    [mariadb]
+    max_connections 64
+    max_heap_table_size 1M
+    innodb_buffer_pool_size 5M
+    innodb_log_buffer_size 512K

metal3-chart/charts/mariadb/templates/configmap.yaml

@@ -5,4 +5,7 @@ metadata:
   labels:
     {{- include "mariadb.labels" . | nindent 4 }}
 data:
-  RESTART_CONTAINER_CERTIFICATE_UPDATED: "false"
+  MARIADB_USER: ironic
+  MARIADB_RANDOM_ROOT_PASSWORD: "yes"
+  MARIADB_DATABASE: ironic
+  MARIADB_AUTO_UPGRADE: "yes"

metal3-chart/charts/mariadb/templates/deployment.yaml

@@ -25,23 +25,50 @@ spec:
       serviceAccountName: {{ include "mariadb.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+      # This would run during entrypoint if run as root
+      - name: set-volume-owners
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: true
+            capabilities:
+              drop:
+              - ALL
+              add:
+              - CHOWN
+              - FOWNER
+              - DAC_OVERRIDE
+            seccompProfile:
+              type: RuntimeDefault
+        volumeMounts:
+          - name: mariadb-conf
+            mountPath: /etc/mysql/conf.d
+          - name: mariadb-run
+            mountPath: /run/mysql
+          {{- $volmounts }}
+        command: ['bash', '-c', 'source /usr/local/bin/docker-entrypoint.sh && docker_create_db_directories']
+        env:
+          - name: DATADIR
+            value: /var/lib/mysql
+          - name: SOCKET
+            value: /run/mysql/mysql.sock
       containers:
       - name: mariadb
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         securityContext:
           {{- toYaml .Values.securityContext | nindent 12 }}
+        envFrom:
+          - configMapRef:
+              name: mariadb-cm
         env:
           - name: MARIADB_PASSWORD
             valueFrom:
               secretKeyRef:
                 key: password
                 name: ironic-mariadb
-          - name: RESTART_CONTAINER_CERTIFICATE_UPDATED
-            valueFrom:
-              configMapKeyRef:
-                name: mariadb-cm
-                key: RESTART_CONTAINER_CERTIFICATE_UPDATED
         lifecycle:
           preStop:
             exec:
@@ -52,9 +79,9 @@ spec:
         livenessProbe:
           exec:
             command:
-              - sh
+              - healthcheck.sh
-              - -c
+              - --connect
-              - mysqladmin status -uironic -p$(printenv MARIADB_PASSWORD)
+              - --innodb_initialized
           failureThreshold: 10
           initialDelaySeconds: 30
           periodSeconds: 30
@@ -67,19 +94,29 @@ spec:
         readinessProbe:
           exec:
             command:
-              - sh
+              - healthcheck.sh
-              - -c
+              - --connect
-              - mysqladmin status -uironic -p$(printenv MARIADB_PASSWORD)
+              - --innodb_initialized
           failureThreshold: 10
           initialDelaySeconds: 30
           periodSeconds: 30
           successThreshold: 1
           timeoutSeconds: 10
         volumeMounts:
+            - name: mariadb-conf
+              mountPath: /etc/mysql/conf.d
+            - name: mariadb-run
+              mountPath: /run/mysql
             {{- $volmounts }}
       {{- with .Values.global.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
+        - name: mariadb-conf
+          configMap:
+            name: mariadb-config
+        - name: mariadb-run
+          emptyDir:
+            sizeLimit: 20Mi
         {{- $volumes }}

metal3-chart/charts/mariadb/values.yaml

@@ -12,9 +12,9 @@ service:
     targetPort: 3306
 
 image:
-  repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/suse/mariadb
+  repository: registry.suse.com/suse/mariadb
   pullPolicy: IfNotPresent
-  tag: 10.6.15.1
+  tag: 10.11
 
 nameOverride: ""
 fullnameOverride: ""
@@ -31,8 +31,8 @@ serviceAccount:
 podAnnotations: {}
 
 podSecurityContext:
-  runAsUser: 10060
+  runAsUser: 60
-  fsGroup: 10060
+  fsGroup: 60
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -60,6 +60,7 @@ persistence:
 volumeMounts:
   - name: mariadb-data-volume
     mountPath: /var/lib/mysql
+    subPath: data
 
 volumes:
   - name: mariadb-data-volume

metal3-chart/charts/media/Chart.yaml

@@ -3,4 +3,4 @@ appVersion: 1.16.0
 description: A Helm chart for Media, used by Metal3
 name: media
 type: application
-version: 0.6.2
+version: 0.6.3

metal3-chart/charts/media/values.yaml

@@ -24,7 +24,7 @@ replicaCount: 1
 image:
   repository: registry.opensuse.org/isv/suse/edge/metal3/containers/images/ironic
   pullPolicy: IfNotPresent
-  tag: 26.1.2.4
+  tag: 26.1.2.5
 
 imagePullSecrets: []
 nameOverride: ""

metal3-chart/values.yaml

@@ -115,8 +115,8 @@ metal3-mariadb:
   persistence:
     storageClass: ""
   image:
-    repository: "registry.suse.com/edge/mariadb"
+    repository: "registry.suse.com/suse/mariadb"
-    tag: "10.6.15.1"
+    tag: "10.11"
 
 #
 # Baremetal Operator

release-manifest-image/Dockerfile

@@ -1,4 +1,4 @@
-#!BuildTag: %%IMG_PREFIX%%release-manifest:3.3.2
+#!BuildTag: %%IMG_PREFIX%%release-manifest:3.4.0
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION
 
@@ -7,11 +7,11 @@ FROM registry.suse.com/bci/bci-micro:$SLE_VERSION
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SUSE Edge Release Manifest"
 LABEL org.opencontainers.image.description="Release Manifest containing information about a specific SUSE Edge release"
-LABEL org.opencontainers.image.version="3.3.2"
+LABEL org.opencontainers.image.version="3.4.0"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%release-manifest:3.3.2"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%release-manifest:3.4.0"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -20,4 +20,4 @@ LABEL com.suse.image-type="release-manifest"
 LABEL com.suse.release-stage="released"
 # endlabelprefix
 
-COPY release_manifest.yaml release_manifest.yaml
+COPY release_manifest.yaml release_images.yaml ./

release-manifest-image/_service

@@ -2,6 +2,7 @@
   <service mode="buildtime" name="kiwi_metainfo_helper"/>
   <service name="replace_using_env" mode="buildtime">
     <param name="file">Dockerfile</param>
+    <param name="file">release_images.yaml</param>
     <param name="eval">IMG_PREFIX=$(rpm --macros=/root/.rpmmacros -E %{?img_prefix})</param>
     <param name="var">IMG_PREFIX</param>
     <param name="eval">IMG_REPO=$(rpm --macros=/root/.rpmmacros -E %manifest_repo)</param>

release-manifest-image/release_images.yaml

@@ -0,0 +1,64 @@
+images:
+  - name: quay.io/jetstack/cert-manager-cainjector:v1.14.2
+  - name: quay.io/jetstack/cert-manager-controller:v1.14.2
+  - name: quay.io/jetstack/cert-manager-webhook:v1.14.2
+  - name: registry.rancher.com/rancher/hardened-cluster-autoscaler:v1.10.2-build20250507
+  - name: registry.rancher.com/rancher/hardened-cni-plugins:v1.7.1-build20250509
+  - name: registry.rancher.com/rancher/hardened-coredns:v1.12.1-build20250507
+  - name: registry.rancher.com/rancher/hardened-etcd:v3.5.21-k3s1-build20250411
+  - name: registry.rancher.com/rancher/hardened-k8s-metrics-server:v0.7.2-build20250507
+  - name: registry.rancher.com/rancher/hardened-kubernetes:v1.32.5-rke2r1-build20250515
+  - name: registry.rancher.com/rancher/hardened-multus-cni:v4.2.0-build20250326
+  - name: registry.rancher.com/rancher/klipper-helm:v0.9.5-build20250306
+  - name: registry.rancher.com/rancher/mirrored-cilium-cilium:v1.17.3
+  - name: registry.rancher.com/rancher/mirrored-cilium-operator-generic:v1.17.3
+  - name: registry.rancher.com/rancher/mirrored-longhornio-csi-attacher:v4.8.1
+  - name: registry.rancher.com/rancher/mirrored-longhornio-csi-node-driver-registrar:v2.13.0
+  - name: registry.rancher.com/rancher/mirrored-longhornio-csi-provisioner:v5.2.0
+  - name: registry.rancher.com/rancher/mirrored-longhornio-csi-resizer:v1.13.2
+  - name: registry.rancher.com/rancher/mirrored-longhornio-csi-snapshotter:v8.2.0
+  - name: registry.rancher.com/rancher/mirrored-longhornio-livenessprobe:v2.15.0
+  - name: registry.rancher.com/rancher/mirrored-longhornio-longhorn-engine:v1.8.1
+  - name: registry.rancher.com/rancher/mirrored-longhornio-longhorn-instance-manager:v1.8.1
+  - name: registry.rancher.com/rancher/mirrored-longhornio-longhorn-manager:v1.8.1
+  - name: registry.rancher.com/rancher/mirrored-longhornio-longhorn-share-manager:v1.8.1
+  - name: registry.rancher.com/rancher/mirrored-longhornio-longhorn-ui:v1.8.1
+  - name: registry.rancher.com/rancher/mirrored-sig-storage-snapshot-controller:v8.2.0
+  - name: registry.rancher.com/rancher/neuvector-compliance-config:1.0.4
+  - name: registry.rancher.com/rancher/neuvector-controller:5.4.3
+  - name: registry.rancher.com/rancher/neuvector-enforcer:5.4.3
+  - name: registry.rancher.com/rancher/nginx-ingress-controller:v1.12.1-hardened6
+  - name: registry.rancher.com/rancher/rke2-cloud-provider:v1.32.0-rc3.0.20241220224140-68fbd1a6b543-build20250101
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%baremetal-operator:0.9.1.1
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator:0.3.0
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.8
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.5
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%metallb-controller:v0.14.9
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%metallb-speaker:v0.14.9
+  - name: %%IMG_REPO%%/%%IMG_PREFIX%%upgrade-controller:0.1.1
+  - name: registry.rancher.com/rancher/cluster-api-operator:v0.17.0
+  - name: registry.rancher.com/rancher/fleet-agent:v0.12.3
+  - name: registry.rancher.com/rancher/fleet:v0.12.3
+  - name: registry.rancher.com/rancher/hardened-node-feature-discovery:v0.15.7-build20250425
+  - name: registry.rancher.com/rancher/rancher-webhook:v0.7.2
+  - name: registry.rancher.com/rancher/rancher/turtles:v0.20.0
+  - name: registry.rancher.com/rancher/rancher:v2.11.2
+  - name: registry.rancher.com/rancher/shell:v0.4.1
+  - name: registry.rancher.com/rancher/system-upgrade-controller:v0.15.2
+  - name: registry.suse.com/rancher/cluster-api-addon-provider-fleet:v0.10.0
+  - name: registry.suse.com/rancher/cluster-api-controller:v1.9.5
+  - name: registry.suse.com/rancher/cluster-api-provider-metal3:v1.9.3
+  - name: registry.suse.com/rancher/cluster-api-provider-rke2-bootstrap:v0.16.1
+  - name: registry.suse.com/rancher/cluster-api-provider-rke2-controlplane:v0.16.1
+  - name: registry.suse.com/rancher/elemental-operator:1.6.8
+  - name: registry.suse.com/rancher/hardened-sriov-network-operator:v1.5.0-build20250425
+  - name: registry.suse.com/rancher/ip-address-manager:v1.9.4
+  - name: registry.suse.com/suse/sles/15.6/cdi-apiserver:1.61.0-150600.3.12.1
+  - name: registry.suse.com/suse/sles/15.6/cdi-controller:1.61.0-150600.3.12.1
+  - name: registry.suse.com/suse/sles/15.6/cdi-operator:1.61.0-150600.3.12.1
+  - name: registry.suse.com/suse/sles/15.6/cdi-uploadproxy:1.61.0-150600.3.12.1
+  - name: registry.suse.com/suse/sles/15.6/virt-api:1.4.0-150600.5.15.1
+  - name: registry.suse.com/suse/sles/15.6/virt-controller:1.4.0-150600.5.15.1
+  - name: registry.suse.com/suse/sles/15.6/virt-handler:1.4.0-150600.5.15.1
+  - name: registry.suse.com/suse/sles/15.6/virt-launcher:1.4.0-150600.5.15.1
+  - name: registry.suse.com/suse/sles/15.6/virt-operator:1.4.0-150600.5.15.1

release-manifest-image/release_manifest.yaml

@@ -1,95 +1,95 @@
 apiVersion: lifecycle.suse.com/v1alpha1
 kind: ReleaseManifest
 metadata:
-  name: release-manifest-3-3-2
+  name: release-manifest-3-4-0
 spec:
-  releaseVersion: 3.3.2
+  releaseVersion: 3.4.0
   components:
     kubernetes:
       k3s:
-        version: v1.32.5+k3s1
+        version: v1.32.4+k3s1
         coreComponents:
-          - name: traefik-crd
+        - name: traefik-crd
-            version: 34.2.1+up34.2.0
+          version: 34.2.1+up34.2.0
-            type: HelmChart
+          type: HelmChart
-          - name: traefik
+        - name: traefik
-            version: 34.2.1+up34.2.0
+          version: 34.2.1+up34.2.0
-            type: HelmChart
+          type: HelmChart
+        - name: local-path-provisioner
+          containers:
           - name: local-path-provisioner
-            containers:
+            image: rancher/local-path-provisioner:v0.0.31
-              - name: local-path-provisioner
+          type: Deployment
-                image: rancher/local-path-provisioner:v0.0.31
+        - name: coredns
-            type: Deployment
+          containers:
           - name: coredns
-            containers:
+            image: rancher/mirrored-coredns-coredns:1.12.1
-              - name: coredns
+          type: Deployment
-                image: rancher/mirrored-coredns-coredns:1.12.1
+        - name: metrics-server
-            type: Deployment
+          containers:
           - name: metrics-server
-            containers:
+            image: rancher/mirrored-metrics-server:v0.7.2
-              - name: metrics-server
+          type: Deployment
-                image: rancher/mirrored-metrics-server:v0.7.2
-            type: Deployment
       rke2:
-        version: v1.32.5+rke2r1
+        version: v1.32.4+rke2r1
         coreComponents:
-          - name: rke2-cilium
+        - name: rke2-cilium
-            version: 1.17.301
+          version: 1.17.300
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-canal
+        - name: rke2-canal
-            version: v3.30.0-build2025051500
+          version: v3.29.3-build2025040801
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-calico-crd
+        - name: rke2-calico-crd
-            version: v3.30.001
+          version: v3.29.101
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-calico
+        - name: rke2-calico
-            version: v3.30.001
+          version: v3.29.300
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-coredns
+        - name: rke2-coredns
-            version: 1.42.000
+          version: 1.39.201
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-ingress-nginx
+        - name: rke2-ingress-nginx
-            version: 4.12.103
+          version: 4.12.101
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-metrics-server
+        - name: rke2-metrics-server
-            version: 3.12.201
+          version: 3.12.200
-            type: HelmChart
+          type: HelmChart
-          - name: rancher-vsphere-csi
+        - name: rancher-vsphere-csi
-            version: 3.3.1-rancher900
+          version: 3.3.1-rancher900
-            type: HelmChart
+          type: HelmChart
-          - name: rancher-vsphere-cpi
+        - name: rancher-vsphere-cpi
-            version: 1.10.000
+          version: 1.10.000
-            type: HelmChart
+          type: HelmChart
-          - name: harvester-cloud-provider
+        - name: harvester-cloud-provider
-            version: 0.2.1000
+          version: 0.2.900
-            type: HelmChart
+          type: HelmChart
-          - name: harvester-csi-driver
+        - name: harvester-csi-driver
-            version: 0.1.2300
+          version: 0.1.2300
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-snapshot-controller-crd
+        - name: rke2-snapshot-controller-crd
-            version: 4.0.002
+          version: 4.0.002
-            type: HelmChart
+          type: HelmChart
-          - name: rke2-snapshot-controller
+        - name: rke2-snapshot-controller
-            version: 4.0.002
+          version: 4.0.002
-            type: HelmChart
+          type: HelmChart
-          # Deprecated this empty chart addon can be removed in v1.34
+        # Deprecated this empty chart addon can be removed in v1.34
-          - name: rke2-snapshot-validation-webhook
+        - name: rke2-snapshot-validation-webhook
-            version: 0.0.0
+          version: 0.0.0
-            type: HelmChart
+          type: HelmChart
     operatingSystem:
-      version: '6.1'
+      version: "6.1"
-      zypperID: SL-Micro
+      zypperID: "SL-Micro"
-      cpeScheme: cpe:/o:suse:sl-micro:6.1
+      cpeScheme: "cpe:/o:suse:sl-micro:6.1"
-      prettyName: SUSE Linux Micro 6.1
+      prettyName: "SUSE Linux Micro 6.1"
       supportedArchs:
-        - x86_64
+        - "x86_64"
-        - aarch64
+        - "aarch64"
     workloads:
       helm:
         - prettyName: Rancher
           releaseName: rancher
           chart: rancher
-          version: 2.11.3
+          version: 2.11.2
           repository: https://charts.rancher.com/server-charts/prime
           values:
             postDelete:
@@ -97,38 +97,38 @@ spec:
         - prettyName: Longhorn
           releaseName: longhorn
           chart: longhorn
-          version: 106.2.1+up1.8.2
+          version: 106.2.0+up1.8.1
           repository: https://charts.rancher.io
           dependencyCharts:
             - releaseName: longhorn-crd
               chart: longhorn-crd
-              version: 106.2.1+up1.8.2
+              version: 106.2.0+up1.8.1
               repository: https://charts.rancher.io
         - prettyName: MetalLB
           releaseName: metallb
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%metallb'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%metallb"
-          version: '%%CHART_MAJOR%%.0.0+up0.14.9'
+          version: "%%CHART_MAJOR%%.0.0+up0.14.9"
         - prettyName: CDI
           releaseName: cdi
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%cdi'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%cdi"
-          version: '%%CHART_MAJOR%%.0.0+up0.5.0'
+          version: "%%CHART_MAJOR%%.0.0+up0.5.0"
         - prettyName: KubeVirt
           releaseName: kubevirt
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%kubevirt'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%kubevirt"
-          version: '%%CHART_MAJOR%%.0.0+up0.5.0'
+          version: "%%CHART_MAJOR%%.0.0+up0.5.0"
           addonCharts:
             - releaseName: kubevirt-dashboard-extension
-              chart: '%%CHART_REPO%%/%%CHART_PREFIX%%kubevirt-dashboard-extension'
+              chart: "%%CHART_REPO%%/%%CHART_PREFIX%%kubevirt-dashboard-extension"
-              version: '%%CHART_MAJOR%%.0.2+up1.3.2'
+              version: "%%CHART_MAJOR%%.0.2+up1.3.2"
         - prettyName: NeuVector
           releaseName: neuvector
           chart: neuvector
-          version: 106.0.2+up2.8.7
+          version: 106.0.1+up2.8.6
           repository: https://charts.rancher.io
           dependencyCharts:
             - releaseName: neuvector-crd
               chart: neuvector-crd
-              version: 106.0.2+up2.8.7
+              version: 106.0.1+up2.8.6
               repository: https://charts.rancher.io
           addonCharts:
             - releaseName: neuvector-ui-ext
@@ -137,8 +137,8 @@ spec:
               version: 2.1.3
         - prettyName: EndpointCopierOperator
           releaseName: endpoint-copier-operator
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%endpoint-copier-operator'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%endpoint-copier-operator"
-          version: '%%CHART_MAJOR%%.0.0+up0.2.1'
+          version: "%%CHART_MAJOR%%.0.1+up0.3.0"
         - prettyName: Elemental
           releaseName: elemental-operator
           chart: oci://registry.suse.com/rancher/elemental-operator-chart
@@ -154,29 +154,29 @@ spec:
               version: 3.0.0
         - prettyName: SRIOV
           releaseName: sriov-network-operator
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%sriov-network-operator'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%sriov-network-operator"
-          version: '%%CHART_MAJOR%%.0.2+up1.5.0'
+          version: "%%CHART_MAJOR%%.0.2+up1.5.0"
           dependencyCharts:
             - releaseName: sriov-crd
-              chart: '%%CHART_REPO%%/%%CHART_PREFIX%%sriov-crd'
+              chart: "%%CHART_REPO%%/%%CHART_PREFIX%%sriov-crd"
-              version: '%%CHART_MAJOR%%.0.2+up1.5.0'
+              version: "%%CHART_MAJOR%%.0.2+up1.5.0"
         - prettyName: Akri
           releaseName: akri
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%akri'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%akri"
-          version: '%%CHART_MAJOR%%.0.0+up0.12.20'
+          version: "%%CHART_MAJOR%%.0.0+up0.12.20"
           addonCharts:
             - releaseName: akri-dashboard-extension
-              chart: '%%CHART_REPO%%/%%CHART_PREFIX%%akri-dashboard-extension'
+              chart: "%%CHART_REPO%%/%%CHART_PREFIX%%akri-dashboard-extension"
-              version: '%%CHART_MAJOR%%.0.2+up1.3.1'
+              version: "%%CHART_MAJOR%%.0.2+up1.3.1"
         - prettyName: Metal3
           releaseName: metal3
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%metal3'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%metal3"
-          version: '%%CHART_MAJOR%%.0.7+up0.11.5'
+          version: "%%CHART_MAJOR%%.0.9+up0.11.7"
         - prettyName: RancherTurtles
           releaseName: rancher-turtles
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%rancher-turtles'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%rancher-turtles"
-          version: '%%CHART_MAJOR%%.0.5+up0.21.0'
+          version: "%%CHART_MAJOR%%.0.5+up0.21.0"
         - prettyName: RancherTurtlesAirgapResources
           releaseName: rancher-turtles-airgap-resources
-          chart: '%%CHART_REPO%%/%%CHART_PREFIX%%rancher-turtles-airgap-resources'
+          chart: "%%CHART_REPO%%/%%CHART_PREFIX%%rancher-turtles-airgap-resources"
-          version: '%%CHART_MAJOR%%.0.5+up0.21.0'
+          version: "%%CHART_MAJOR%%.0.5+up0.21.0"