Merge pull request 'update-devel' (#141 ) from nbelouin/Factory:update-devel into devel

Reviewed-on: #141 Reviewed-by: Denislav Prodanov <dprodanov@noreply.src.opensuse.org>
Merge branch 'main' into update-devel
2025-05-07 10:19:14 +02:00 · 2025-05-06 16:04:05 +02:00 · 2025-02-25 15:37:18 +01:00 · 2025-02-25 14:32:32 +01:00 · 2025-02-25 13:10:39 +01:00 · 2025-02-25 11:35:43 +01:00
382 changed files with 33371 additions and 10217 deletions
--- a/.gitea/workflows/check_manifest.yaml
+++ b/.gitea/workflows/check_manifest.yaml
@@ -1,23 +0,0 @@
-name: Check Release Manifest Local Charts Versions
-on:
-  pull_request:
-      branches-ignore:
-      - "devel"
-
-
-jobs:
-  sync-pr-project:
-    name: "Check Release Manifest Local Charts Versions"
-    runs-on: tumbleweed
-    steps:
-        # Waiting on PR to get merged for support in upstream action/checkout action
-      - uses: 'https://github.com/yangskyboxlabs/action-checkout@sha256'
-        name: Checkout repository
-        with:
-          object-format: 'sha256'
-      - name: Setup dependencies
-        run: |
-          zypper in -y python3-ruamel.yaml
-      - name: Check release manifest
-        run: |
-          python3 .obs/manifest-check.py --check
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,170 +1,15 @@
+[submodule "obs-service-set_version"]
+	path = obs-service-set_version
+	url = https://src.opensuse.org/SLFO-pool/obs-service-set_version.git
 [submodule "cri-tools"]
 	path = cri-tools
 	url = https://src.opensuse.org/pool/cri-tools.git
+[submodule "fakeroot"]
+	path = fakeroot
+	url = https://src.opensuse.org/pool/fakeroot.git
 [submodule "crudini"]
 	path = crudini
 	url = https://src.opensuse.org/pool/crudini.git
-[submodule "cni-plugins"]
-	path = cni-plugins
-	url = https://src.opensuse.org/pool/cni-plugins
-[submodule "python-kubernetes"]
-	path = python-kubernetes
-	url = https://src.opensuse.org/pool/python-kubernetes
-	branch = leap-16.0
-[submodule "python-durationpy"]
-	path = python-durationpy
-	url = https://src.opensuse.org/pool/python-durationpy
-	branch = leap-16.0
-[submodule "python-recommonmark"]
-	path = python-recommonmark
-	url = https://src.opensuse.org/pool/python-recommonmark
-	branch = leap-16.0
-[submodule "python-iniparse"]
-	path = python-iniparse
-	url = https://src.opensuse.org/pool/python-iniparse
-	branch = leap-16.0
-[submodule "python-commonmark"]
-	path = python-commonmark
-	url = https://src.opensuse.org/pool/python-commonmark
-	branch = leap-16.0
-[submodule "cni"]
-	path = cni
-	url = https://src.opensuse.org/pool/cni
-[submodule "python-tenacity"]
-	path = python-tenacity
-	url = https://src.opensuse.org/pool/python-tenacity
-[submodule "python-pint"]
-	path = python-pint
-	url = https://src.opensuse.org/pool/python-pint
-	branch = leap-16.0
-[submodule "python-flexcache"]
-	path = python-flexcache
-	url = https://src.opensuse.org/pool/python-flexcache
-	branch = leap-16.0
-[submodule "python-flexparser"]
-	path = python-flexparser
-	url = https://src.opensuse.org/pool/python-flexparser
-	branch = leap-16.0
-[submodule "python-uncertainties"]
-	path = python-uncertainties
-	url = https://src.opensuse.org/pool/python-uncertainties
-	branch = leap-16.0
-[submodule "python-dogpile.cache"]
-	path = python-dogpile.cache
-	url = https://src.opensuse.org/pool/python-dogpile.cache
-	branch = leap-16.0
-[submodule "python-pytest-mpl"]
-	path = python-pytest-mpl
-	url = https://src.opensuse.org/pool/python-pytest-mpl
-	branch = leap-16.0
-[submodule "python-zeroconf"]
-	path = python-zeroconf
-	url = https://src.opensuse.org/pool/python-zeroconf
-	branch = leap-16.0
-[submodule "python-ifaddr"]
-	path = python-ifaddr
-	url = https://src.opensuse.org/pool/python-ifaddr
-	branch = leap-16.0
-[submodule "python-yappi"]
-	path = python-yappi
-	url = https://src.opensuse.org/pool/python-yappi
-[submodule "python-routes"]
-	path = python-routes
-	url = https://src.opensuse.org/pool/python-routes
-	branch = leap-16.0
-[submodule "python-repoze.lru"]
-	path = python-repoze.lru
-	url = https://src.opensuse.org/pool/python-repoze.lru
-	branch = leap-16.0
-[submodule "ipxe"]
-	path = ipxe
-	url = https://src.opensuse.org/pool/ipxe
-	branch = leap-16.0
-[submodule "python-setproctitle"]
-	path = python-setproctitle
-	url = https://src.opensuse.org/pool/python-setproctitle
-	branch = leap-16.0
-[submodule "python-requests-kerberos"]
-	path = python-requests-kerberos
-	url = https://src.opensuse.org/pool/python-requests-kerberos
-	branch = leap-16.0
-[submodule "python-pecan"]
-	path = python-pecan
-	url = https://src.opensuse.org/pool/python-pecan
-	branch = leap-16.0
-[submodule "python-pycdlib"]
-	path = python-pycdlib
-	url = https://src.opensuse.org/pool/python-pycdlib
-[submodule "python-cliff"]
-	path = python-cliff
-	url = https://src.opensuse.org/pool/python-cliff
-[submodule "python-autopage"]
-	path = python-autopage
-	url = https://src.opensuse.org/pool/python-autopage
-[submodule "python-cmd2"]
-	path = python-cmd2
-	url = https://src.opensuse.org/pool/python-cmd2
-	branch = leap-16.0
-[submodule "uwsgi"]
-	path = uwsgi
-	url = https://src.opensuse.org/pool/uwsgi
-	branch = leap-16.0
-[submodule "python-requestsexceptions"]
-	path = python-requestsexceptions
-	url = https://src.opensuse.org/pool/python-requestsexceptions
-[submodule "python-python-memcached"]
-	path = python-python-memcached
-	url = https://src.opensuse.org/pool/python-python-memcached
-[submodule "python-kombu"]
-	path = python-kombu
-	url = https://src.opensuse.org/pool/python-kombu
-[submodule "python-amqp"]
-	path = python-amqp
-	url = https://src.opensuse.org/pool/python-amqp
-	branch = leap-16.0
-[submodule "python-statsd"]
-	path = python-statsd
-	url = https://src.opensuse.org/pool/python-statsd
-[submodule "python-warlock"]
-	path = python-warlock
-	url = https://src.opensuse.org/pool/python-warlock
-[submodule "python-case"]
-	path = python-case
-	url = https://src.opensuse.org/pool/python-case
-	branch = leap-16.0
-[submodule "python-vine"]
-	path = python-vine
-	url = https://src.opensuse.org/pool/python-vine
-	branch = leap-16.0
-[submodule "python-Pyro5"]
-	path = python-Pyro5
-	url = https://src.opensuse.org/pool/python-Pyro5
-	branch = leap-16.0
-[submodule "python-pre-commit"]
-	path = python-pre-commit
-	url = https://src.opensuse.org/pool/python-pre-commit
-[submodule "python-serpent"]
-	path = python-serpent
-	url = https://src.opensuse.org/pool/python-serpent
-	branch = leap-16.0
-[submodule "python-google-cloud-monitoring"]
-	path = python-google-cloud-monitoring
-	url = https://src.opensuse.org/pool/python-google-cloud-monitoring
-[submodule "python-google-cloud-pubsub"]
-	path = python-google-cloud-pubsub
-	url = https://src.opensuse.org/pool/python-google-cloud-pubsub
-[submodule "python-cfgv"]
-	path = python-cfgv
-	url = https://src.opensuse.org/pool/python-cfgv
-[submodule "python-identify"]
-	path = python-identify
-	url = https://src.opensuse.org/pool/python-identify
-[submodule "python-pandas"]
-	path = python-pandas
-	url = https://src.opensuse.org/pool/python-pandas
-[submodule "python-grpc-google-iam-v1"]
-	path = python-grpc-google-iam-v1
-	url = https://src.opensuse.org/pool/python-grpc-google-iam-v1
-[submodule "python-editdistance"]
-	path = python-editdistance
-	url = https://src.opensuse.org/pool/python-editdistance
+[submodule "autoconf"]
+	path = autoconf
+	url = https://src.opensuse.org/SLFO-pool/autoconf.git
--- a/.obs/common.py
+++ b/.obs/common.py
@@ -1,3 +1,3 @@
-PROJECT = "isv:SUSE:Edge:Factory"
+PROJECT = "isv:SUSE:Edge:Factory:Devel"
 REPOSITORY = "https://src.opensuse.org/suse-edge/Factory"
-BRANCH = "main"
+BRANCH = "devel"
--- a/.obs/manifest-check.py
+++ b/.obs/manifest-check.py
@@ -1,84 +0,0 @@
-#!/usr/bin/python3
-
-import ruamel.yaml
-import pathlib
-import argparse
-import sys
-
-yaml = ruamel.yaml.YAML()
-
-def get_chart_version(chart_name: str) -> str:
-    with open(f"./{chart_name}-chart/Chart.yaml") as f:
-        chart = yaml.load(f)
-        return chart["version"]
-
-def get_charts(chart):
-    if not chart["chart"].startswith("%%CHART_REPO%%"):
-        # Not a locally managed chart
-        return {}
-
-    chart_name = chart["chart"][len("%%CHART_REPO%%/%%CHART_PREFIX%%"):]
-    charts = { chart_name: chart["version"] }
-    for child_chart in chart.get("dependencyCharts", []) + chart.get("addonCharts", []):
-        charts.update(get_charts(child_chart))
-    return charts
-
-def get_charts_list():
-    with open("./release-manifest-image/release_manifest.yaml") as f:
-        manifest = yaml.load(f)
-    charts = {}
-    for chart in manifest["spec"]["components"]["workloads"]["helm"]:
-        charts.update(get_charts(chart))
-    return charts
-
-def check_charts(fix: bool) -> bool:
-    success = True
-    charts = get_charts_list()
-    to_fix = {}
-    for chart in charts:
-        expected_version = get_chart_version(chart)
-        if expected_version != charts[chart]:
-            success = False
-            to_fix[f'%%CHART_REPO%%/%%CHART_PREFIX%%{chart}'] = expected_version
-            print(f"{chart}: Expected: {expected_version}, Got: {charts[chart]}")
-    if fix and not success:
-        fix_charts(to_fix)
-        return True
-    return success
-
-def fix_charts(to_fix):
-    manifest_path = pathlib.Path("./release-manifest-image/release_manifest.yaml")
-    manifest = yaml.load(manifest_path)
-    yaml.indent(mapping=2, sequence=4, offset=2)
-    yaml.width = 4096
-    for chart_index, chart in enumerate(manifest["spec"]["components"]["workloads"]["helm"]):
-        changed = False
-        if chart["chart"] in to_fix.keys():
-            changed = True
-            chart["version"] = to_fix[chart["chart"]]
-        for subchart_index, subchart in enumerate(chart.get("addonCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["addonCharts"][subchart_index] = subchart
-        for subchart_index, subchart in enumerate(chart.get("dependencyCharts", [])):
-            if subchart["chart"] in to_fix.keys():
-                changed = True
-                subchart["version"] = to_fix[subchart["chart"]]
-                chart["dependencyCharts"][subchart_index] = subchart
-        if changed:
-            manifest["spec"]["components"]["workloads"]["helm"][chart_index] = chart
-    yaml.dump(manifest, manifest_path)
-
-def main():
-    print("Checking charts versions in release manifest")
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-c', '--check', action='store_true')
-    args = parser.parse_args()
-    if not check_charts(not args.check):
-        sys.exit(1)
-    else:
-        print("All local charts in release manifest are using the right version")
-
-if __name__ == "__main__":
-    main()
--- a/.obs/trigger_package.py
+++ b/.obs/trigger_package.py
@@ -0,0 +1,65 @@
+import xml.etree.ElementTree as ET
+import subprocess
+
+from sync_packages import get_local_packages
+from common import PROJECT
+
+def get_service_repo(package):
+    with open(f"{package}/_service") as service:
+        root = ET.parse(service).getroot()
+        for service in root.findall("service"):
+            if service.get("mode") in ["manual", "disabled"]:
+                continue
+            if service.get("name") not in ["obs_scm", "tar_scm"]:
+                continue
+            ref = service.find("param[@name='revision']").text
+            repo = service.find("param[@name='url']").text
+            return (repo, ref)
+    return None
+    
+
+def get_remote_ref(project, package):
+    files = subprocess.run(["osc", "ls", "-e", project, package], encoding='utf-8' , capture_output=True).stdout.splitlines()
+    for filename in files:
+        if filename.startswith("_service") and filename.endswith(".obsinfo"):
+            obsinfo = subprocess.run(["osc", "cat", project, package, filename], encoding='utf-8' , capture_output=True).stdout.splitlines()
+            for line in obsinfo:
+                if line.startswith("commit:"):
+                    return line.split(':')[-1].strip()
+
+def get_upstream_ref(repo, ref):
+    refs = subprocess.run(["git", "ls-remote", repo, ref, f"{ref}^{{}}"], encoding='utf-8' , capture_output=True).stdout.splitlines()
+    refpath = ref.split('/')
+    best = None
+    for rref in refs:
+        value = rref.split('\t')
+        (sha, name) = (value[0].strip(), value[1].strip())
+        namepath = name.split('/')
+        if len(namepath) == len(refpath) or len(namepath) - 2 == len(refpath):
+            if name.endswith(ref) and best is None:
+                best = sha
+            if name.endswith("^{}"):
+                best = sha
+    return best
+
+def trigger_service(project, package):
+    subprocess.run(["osc", "service", "remoterun", project, package], encoding="utf-8",check=True)
+
+def main():
+    packages = get_local_packages()
+    for package in packages:
+        try:
+            (repo, ref) = get_service_repo(package)
+            print(f"{package} uses {repo} at {ref}")
+        except: # Package is not using server side scm service
+            continue
+        remote_ref = get_remote_ref(PROJECT, package)
+        upstream_ref = get_upstream_ref(repo, ref)
+        if upstream_ref != remote_ref:
+            print(f"\t{package} needs a refresh")
+            print(f"\tOBS ref is {remote_ref}")
+            print(f"\tgit ref is {upstream_ref}")
+            trigger_service(PROJECT, package)
+            
+if __name__ == "__main__":
+    main()
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,10 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      - id: check-manifest
-        name: "Check release-manifest"
-        entry: python3 .obs/manifest-check.py
-        language: python
-        additional_dependencies: ['ruamel.yaml']
-        pass_filenames: false
-        always_run: true
--- a/121
+++ b/121
@@ -1,11 +1,7 @@
-Prefer: -libqpid-proton10 -python313-urllib3_1
-Prefer: -cargo1.58 -cargo1.57 cargo1.89
-Prefer: chrony-pool-suse
-Prefer: -postgresql17-devel-mini
-
-BuildFlags: excludebuild:python-pandas:test-py313
+Prefer: -libqpid-proton10 -python311-urllib3_1

 Macros:
+%__python3 /usr/bin/python3.11
 %registry_url %(echo %{vendor} | cut -d '/' -f 3 | sed 's/build/registry/')
 :Macros

@@ -49,57 +45,106 @@ Macros:
 :Macros
 %endif

+# Missing deps for testsuite
+BuildFlags: excludebuild:autoconf:el
+BuildFlags: excludebuild:autoconf:testsuite
+
 # Only build manifest embedding images here
 %if "%_repository" == "test_manifest_images"
 BuildFlags: onlybuild:edge-image-builder-image
 BuildFlags: onlybuild:release-manifest-image
-%else
-# Only a subset of stack is arm64 ready exclude what is not ready
+  # Exclude the images selected by the following section
+  # as the standard repository is a dependency
  %ifarch aarch64
-    # Akri
-    BuildFlags: excludebuild:akri
-    BuildFlags: excludebuild:akri-agent-image
-    BuildFlags: excludebuild:akri-controller-image
-    BuildFlags: excludebuild:akri-debug-echo-discovery-handler-image
-    BuildFlags: excludebuild:akri-onvif-discovery-handler-image
-    BuildFlags: excludebuild:akri-opcua-discovery-handler-image
-    BuildFlags: excludebuild:akri-udev-discovery-handler-image
-    BuildFlags: excludebuild:akri-webhook-configuration-image
-    BuildFlags: excludebuild:cri-tools
-
-    # FRR
-    BuildFlags: excludebuild:frr-image
-    BuildFlags: excludebuild:frr-k8s
-    BuildFlags: excludebuild:frr-k8s-image
-    
-    # Upgrade controller
-    BuildFlags: excludebuild:release-manifest-image
-    BuildFlags: excludebuild:upgrade-controller
-    BuildFlags: excludebuild:upgrade-controller-image 
+    BuildFlags: excludebuild:baremetal-operator-image
+    BuildFlags: excludebuild:endpoint-copier-operator-image
+    BuildFlags: excludebuild:ironic-image
+    BuildFlags: excludebuild:ironic-ipa-downloader-image
+    BuildFlags: excludebuild:kubectl-image
+    BuildFlags: excludebuild:kube-rbac-proxy-image
+    BuildFlags: excludebuild:metallb-controller-image
+    BuildFlags: excludebuild:metallb-speaker-image
+  %endif
+%else
+# Only a subset of stack is arm64 ready
+  %ifarch aarch64
+    BuildFlags: onlybuild:autoconf
+    BuildFlags: onlybuild:baremetal-operator
+    BuildFlags: onlybuild:baremetal-operator-image
+    BuildFlags: onlybuild:ca-certificates-suse
+    BuildFlags: onlybuild:container-build-checks
+    BuildFlags: onlybuild:crudini
+    BuildFlags: onlybuild:edge-build-checks
+    BuildFlags: onlybuild:edge-image-builder
+    BuildFlags: onlybuild:edge-image-builder-image
+    BuildFlags: onlybuild:endpoint-copier-operator
+    BuildFlags: onlybuild:endpoint-copier-operator-image
+    BuildFlags: onlybuild:fakeroot
+    BuildFlags: onlybuild:hauler
+    BuildFlags: onlybuild:ipcalc
+    BuildFlags: onlybuild:ironic-image
+    BuildFlags: onlybuild:ironic-ipa-downloader-image
+    BuildFlags: onlybuild:ironic-ipa-ramdisk
+    BuildFlags: onlybuild:kubectl
+    BuildFlags: onlybuild:kubectl-image
+    BuildFlags: onlybuild:kube-rbac-proxy
+    BuildFlags: onlybuild:kube-rbac-proxy-image
+    BuildFlags: onlybuild:metallb
+    BuildFlags: onlybuild:metallb-controller-image
+    BuildFlags: onlybuild:metallb-speaker-image
+    BuildFlags: onlybuild:nm-configurator
+    BuildFlags: onlybuild:shim-noarch
  %endif
 %endif

 %if "%_repository" == "images" || "%_repository" == "test_manifest_images"
+    Prefer: container:sles15-image
    Type: docker
    Repotype: none
    Patterntype: none
    BuildEngine: podman
-    Prefer: SLES-release
-    BuildFlags: dockerarg:SLE_VERSION=16.0
+    Prefer: sles-release
+    BuildFlags: dockerarg:SLE_VERSION=15.6

    # Publish multi-arch container images only once all archs have been built
    PublishFlags: archsync

-    # skopeo and umoci are used by build scripts to list packages
-    Substitute: system-packages:podman podman buildah createrepo_c release-compare skopeo umoci
-%endif
-
-%if "%_repository" == "images"
    # skopeo and umoci are used by build scripts to list packages
    Substitute: system-packages:podman podman buildah createrepo_c release-compare edge-build-checks skopeo umoci

 %endif

+%if "%_repository" == "images_16.0"
+    Prefer: container:sles15-image
+    Type: docker
+    BuildEngine: podman
+    Repotype: none
+    Patterntype: none
+    BuildFlags: dockerarg:SLE_VERSION=16.0
+    BuildFlags: onlybuild:kiwi-builder-image
+
+    # Publish multi-arch container images only once all archs have been built
+    PublishFlags: archsync
+
+    # Exclude the images selected by the aarch64 section
+    %ifarch aarch64
+      BuildFlags: excludebuild:baremetal-operator-image
+      BuildFlags: excludebuild:edge-image-builder-image
+      BuildFlags: excludebuild:endpoint-copier-operator-image
+      BuildFlags: excludebuild:ironic-image
+      BuildFlags: excludebuild:ironic-ipa-downloader-image
+      BuildFlags: excludebuild:kubectl-image
+      BuildFlags: excludebuild:kube-rbac-proxy-image
+      BuildFlags: excludebuild:metallb-controller-image
+      BuildFlags: excludebuild:metallb-speaker-image
+    %endif
+
+%else
+    BuildFlags: excludebuild:kiwi-builder-image
+%endif
+
+
+
 %if "%_repository" == "charts" || "%_repository" == "phantomcharts" || "%_repository" == "releasecharts"
    Type: helm
    Repotype: helm
@@ -116,16 +161,12 @@ BuildFlags: onlybuild:release-manifest-image

    # ironic-ipa-ramdisk are noarch packages that need to be availble to both archs
    ExportFilter: ^ironic-ipa-ramdisk-.*\.noarch\.rpm$ aarch64 x86_64
-    ExportFilter: ^grub2-.*-efi-.*\.noarch\.rpm$ aarch64 x86_64
 %endif

-%if "%_repository" != "standard"
-    BuildFlags: excludebuild:grub-aggregate 
-%endif
 # Enable reproducible builds
 # https://en.opensuse.org/openSUSE:Reproducible_Builds\#With_OBS
 Macros:
-%source_date_epoch_from_changelog N
+%source_date_epoch_from_changelog Y
 %clamp_mtime_to_source_date_epoch Y
 %use_source_date_epoch_as_buildtime Y
 %_buildhost reproducible
--- a/21
+++ b/21
@@ -23,9 +23,6 @@
    <disable/>
    <enable repository="charts"/>
    <enable repository="test_manifest_images"/>
-    {%- if for_release %}
-    <enable repository="releasecharts"/>
-    {%- endif %}
  </build>
  <publish>
    <disable repository="phantomcharts"/>
@@ -34,15 +31,20 @@
    <arch>x86_64</arch>
  </repository>
 {%- endif %}
-{%- for repository in ["images", "test_manifest_images"] %}
+{%- for repository in ["images", "images_16.0", "test_manifest_images"] %}
  <repository name="{{ repository }}">
    {%- if release_project is defined and repository != "test_manifest_images" %}
    <releasetarget project="{{ release_project }}" repository="images" trigger="manual"/>
    {%- endif %}
    <path project="SUSE:Registry" repository="standard"/>
-    <path project="{{ ironic_base }}:Factory" repository="16.0"/>
-    <path project="SUSE:CA" repository="openSUSE_Tumbleweed"/>
-    <path project="{{ project }}" repository="standard"/>
+    {%- if repository == "images_16.0" %}
+      <path project="SUSE:CA" repository="16.0"/>
+      <path project="SUSE:SLFO:Products:SLES:16.0" repository="standard"/>
+      <path project="SUSE:SLFO:Main:Build" repository="standard"/>
+    {%- else %}
+      <path project="SUSE:CA" repository="SLE_15_SP6"/>
+      <path project="{{ project }}" repository="standard"/>
+    {%- endif %}
    <arch>x86_64</arch>
    <arch>aarch64</arch>
  </repository>
@@ -51,9 +53,8 @@
    {%- if release_project is defined and not for_release %}
    <releasetarget project="{{ release_project }}" repository="standard" trigger="manual"/>
    {%- endif %}
-    <path project="{{ ironic_base }}:Factory" repository="16.0"/>
-    <path project="SUSE:SLFO:Products:SLES:16.0" repository="standard"/>
-    <path project="SUSE:SLFO:1.2" repository="standard"/>
+    <path project="{{ ironic_base }}:2024.2" repository="15.6"/>
+    <path project="SUSE:SLE-15-SP6:Update" repository="standard"/>
    <arch>x86_64</arch>
    <arch>aarch64</arch>
  </repository>
--- a/akri-dashboard-extension-chart/Chart.yaml
+++ b/akri-dashboard-extension-chart/Chart.yaml
@@ -1,5 +1,6 @@
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.2
-#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.4_up1.3.2-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.1
+#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.1_up1.3.0
+#!BuildTag: %%CHART_PREFIX%%akri-dashboard-extension:%%CHART_MAJOR%%.0.1_up1.3.0-%RELEASE%
 annotations:
  catalog.cattle.io/certified: rancher
  catalog.cattle.io/namespace: cattle-ui-plugin-system
@@ -9,13 +10,13 @@ annotations:
  catalog.cattle.io/ui-component: plugins
  catalog.cattle.io/display-name: Akri
  catalog.cattle.io/rancher-version: '>= 2.11.0-0'
-  catalog.cattle.io/ui-extensions-version: '>= 3.0.2 < 4.0.0'
+  catalog.cattle.io/ui-extensions-version: '>= 3.0.4 < 4.0.0'
  catalog.cattle.io/kube-version: '>= v1.26.0-0'
 apiVersion: v2
-appVersion: 1.3.2
+appVersion: 303.0.1+up1.3.0
 description: 'SUSE Edge: Akri extension for Rancher Dashboard'
 name: akri-dashboard-extension
 type: application
-version: "%%CHART_MAJOR%%.0.4+up1.3.2"
+version: "%%CHART_MAJOR%%.0.1+up1.3.0"
 icon: >-
  https://raw.githubusercontent.com/cncf/artwork/main/projects/akri/icon/color/akri-icon-color.svg
--- a/akri-dashboard-extension-chart/templates/cr.yaml
+++ b/akri-dashboard-extension-chart/templates/cr.yaml
@@ -8,7 +8,7 @@ spec:
  plugin:
    name: {{ include "extension-server.fullname" . }}
    version: {{ (semver (default .Chart.AppVersion .Values.plugin.versionOverride)).Original }}
-    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/1.3.2
+    endpoint: https://raw.githubusercontent.com/suse-edge/dashboard-extensions/gh-pages/extensions/akri-dashboard-extension/303.0.1+up1.3.0
    noCache: {{ .Values.plugin.noCache }}
    noAuth: {{ .Values.plugin.noAuth }}
    metadata: {{ include "extension-server.pluginMetadata" . | indent 6 }}
--- a/akri-dashboard-extension-chart/values.yaml
+++ b/akri-dashboard-extension-chart/values.yaml
@@ -8,5 +8,5 @@ plugin:
  metadata:
    catalog.cattle.io/display-name: Akri
    catalog.cattle.io/rancher-version: ">= 2.11.0-0"
-    catalog.cattle.io/ui-extensions-version: ">= 3.0.2 < 4.0.0"
+    catalog.cattle.io/ui-extensions-version: ">= 3.0.4 < 4.0.0"
    catalog.cattle.io/kube-version: ">= v1.26.0-0"
--- a/1
+++ b/1
--- a/baremetal-operator-image/Dockerfile
+++ b/baremetal-operator-image/Dockerfile
@@ -1,12 +1,13 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0
-#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.0-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%
+#!BuildTag: %%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

 FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
 COPY --from=micro / /installroot/
-RUN zypper --installroot /installroot --non-interactive install --no-recommends baremetal-operator python3-watchdog procps iproute2 bind-utils vim shadow; zypper -n clean; rm -rf /var/log/*
+RUN zypper --installroot /installroot --non-interactive install --no-recommends baremetal-operator iproute2 bind-utils vim shadow; zypper -n clean; rm -rf /var/log/*

 FROM micro AS final
 # Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -18,7 +19,7 @@ LABEL org.opencontainers.image.version="%%baremetal-operator_version%%"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%baremetal-operator:%%baremetal-operator_version%%-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -28,8 +29,6 @@ LABEL com.suse.release-stage="released"
 # endlabelprefix

 COPY --from=base /installroot /
-COPY bmo-run /usr/bin/bmo-run
-RUN chmod +x /usr/bin/bmo-run
 RUN groupadd -r -g 11000 bmo
 RUN useradd -u 11000 -g 11000 bmo
-ENTRYPOINT [ "/usr/bin/bmo-run" ]
+ENTRYPOINT [ "/usr/bin/baremetal-operator" ]
--- a/baremetal-operator-image/bmo-run
+++ b/baremetal-operator-image/bmo-run
@@ -1,13 +0,0 @@
-#!/bin/bash
-export RESTART_CONTAINER_CERTIFICATE_UPDATED=${RESTART_CONTAINER_CERTIFICATE_UPDATED:-"false"}
-export IRONIC_CACERT_FILE=${IRONIC_CACERT_FILE:-"/opt/metal3/certs/ca/tls.crt"}
-
-if [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-     watchmedo shell-command \
-            --patterns="$(basename "${IRONIC_CACERT_FILE}")" \
-            --ignore-directories \
-            --command='if [[ "${watch_event_type}" == "deleted" ]]; then pkill -TERM baremetal-opera; fi' \
-            "$(dirname "${IRONIC_CACERT_FILE}")" &
-fi
-
-exec /usr/bin/baremetal-operator $@
--- a/baremetal-operator/_service
+++ b/baremetal-operator/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/metal3-io/baremetal-operator</param>
    <param name="scm">git</param>
-    <param name="revision">v0.11.2</param>
+    <param name="revision">v0.9.1</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
--- a/baremetal-operator/baremetal-operator.spec
+++ b/baremetal-operator/baremetal-operator.spec
@@ -17,15 +17,14 @@


 Name:           baremetal-operator
-Version:        0.11.2
+Version:        0.9.1
 Release:        0
 Summary:        Implements a Kubernetes API for managing bare metal hosts
 License:        Apache-2.0
 URL:            https://github.com/metal3-io/baremetal-operator
 Source:         baremetal-operator-%{version}.tar
 Source1:        vendor.tar.gz
-
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.23
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

--- a/cdi-chart/Chart.yaml
+++ b/cdi-chart/Chart.yaml
@@ -1,9 +1,9 @@
-#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.1_up0.6.0
-#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.1_up0.6.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.0_up0.4.0
+#!BuildTag: %%CHART_PREFIX%%cdi:%%CHART_MAJOR%%.0.0_up0.4.0-%RELEASE%
 apiVersion: v2
-appVersion: 1.62.0
+appVersion: 1.60.1
 description: A Helm chart for Containerized Data Importer (CDI)
 icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/kubevirt/icon/color/kubevirt-icon-color.svg
 name: cdi
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.6.0"
+version: "%%CHART_MAJOR%%.0.0+up0.4.0"
--- a/cdi-chart/crds/cdi.yaml
+++ b/cdi-chart/crds/cdi.yaml
@@ -109,9 +109,9 @@ spec:
                  description: CDIConfig at CDI level
                  properties:
                    dataVolumeTTLSeconds:
-                      description: |-
-                        DataVolumeTTLSeconds is the time in seconds after DataVolume completion it can be garbage collected. Disabled by default.
-                        Deprecated: Removed in v1.62.
+                      description: DataVolumeTTLSeconds is the time in seconds after
+                        DataVolume completion it can be garbage collected. Disabled
+                        by default.
                      format: int32
                      type: integer
                    featureGates:
@@ -2641,9 +2641,9 @@ spec:
                  description: CDIConfig at CDI level
                  properties:
                    dataVolumeTTLSeconds:
-                      description: |-
-                        DataVolumeTTLSeconds is the time in seconds after DataVolume completion it can be garbage collected. Disabled by default.
-                        Deprecated: Removed in v1.62.
+                      description: DataVolumeTTLSeconds is the time in seconds after
+                        DataVolume completion it can be garbage collected. Disabled
+                        by default.
                      format: int32
                      type: integer
                    featureGates:
--- a/cdi-chart/templates/cdi-operator.yaml
+++ b/cdi-chart/templates/cdi-operator.yaml
@@ -599,8 +599,6 @@ spec:
  strategy: {}
  template:
    metadata:
-      annotations:
-        openshift.io/required-scc: restricted-v2
      labels:
        cdi.kubevirt.io: cdi-operator
        name: cdi-operator
@@ -608,7 +606,17 @@ spec:
        prometheus.cdi.kubevirt.io: "true"
    spec:
      affinity:
-{{- .Values.deployment.affinity | toYaml | nindent 8 }}
+        podAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: cdi.kubevirt.io
+                      operator: In
+                      values:
+                        - cdi-operator
+                topologyKey: kubernetes.io/hostname
+              weight: 1
      containers:
        - env:
            - name: DEPLOY_CLUSTER_RESOURCES
@@ -642,7 +650,9 @@ spec:
              name: metrics
              protocol: TCP
          resources:
-{{- .Values.deployment.resources | toYaml | nindent 12 }}
+            requests:
+              cpu: 100m
+              memory: 150Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
@@ -651,8 +661,6 @@ spec:
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
--- a/cdi-chart/templates/cdi.yaml
+++ b/cdi-chart/templates/cdi.yaml
@@ -19,7 +19,3 @@ spec:
  workload:
  {{- toYaml . | nindent 4 }}
  {{- end }}
-  {{- with .Values.cdi.customizeComponents }}
-  customizeComponents:
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
--- a/cdi-chart/values.yaml
+++ b/cdi-chart/values.yaml
@@ -1,36 +1,19 @@
 deployment:
-  version: 1.62.0-150700.9.3.1
-  operatorImage: registry.suse.com/suse/sles/15.7/cdi-operator
-  controllerImage: registry.suse.com/suse/sles/15.7/cdi-controller
-  importerImage: registry.suse.com/suse/sles/15.7/cdi-importer
-  clonerImage: registry.suse.com/suse/sles/15.7/cdi-cloner
-  apiserverImage: registry.suse.com/suse/sles/15.7/cdi-apiserver
-  uploadserverImage: registry.suse.com/suse/sles/15.7/cdi-uploadserver
-  uploadproxyImage: registry.suse.com/suse/sles/15.7/cdi-uploadproxy
+  version: 1.60.1-150600.3.9.1
+  operatorImage: registry.suse.com/suse/sles/15.6/cdi-operator
+  controllerImage: registry.suse.com/suse/sles/15.6/cdi-controller
+  importerImage: registry.suse.com/suse/sles/15.6/cdi-importer
+  clonerImage: registry.suse.com/suse/sles/15.6/cdi-cloner
+  apiserverImage: registry.suse.com/suse/sles/15.6/cdi-apiserver
+  uploadserverImage: registry.suse.com/suse/sles/15.6/cdi-uploadserver
+  uploadproxyImage: registry.suse.com/suse/sles/15.6/cdi-uploadproxy
  pullPolicy: IfNotPresent
-  affinity:
-    podAffinity:
-      preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-                - key: cdi.kubevirt.io
-                  operator: In
-                  values:
-                    - cdi-operator
-            topologyKey: kubernetes.io/hostname
-          weight: 1
-  resources:
-    requests:
-      cpu: 100m
-      memory: 150Mi

 cdi:
  config:
    featureGates:
      - HonorWaitForFirstConsumer
  imagePullPolicy: "IfNotPresent"
-  customizeComponents: {}
  infra:
    nodeSelector:
      kubernetes.io/os: linux
@@ -42,7 +25,7 @@ cdi:
    nodeSelector:
      kubernetes.io/os: linux

-hookImage: registry.rancher.com/rancher/kubectl:v1.33.1
+hookImage: registry.rancher.com/rancher/kubectl:v1.30.10
 hookRestartPolicy: OnFailure
 hookSecurityContext:
  seccompProfile:
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/edge-build-checks/20-helm-images
+++ b/edge-build-checks/20-helm-images
@@ -8,7 +8,6 @@ import pprint

 AUTHORIZED_REPOS = [
    "registry.suse.com/suse/sles/",
-    "registry.suse.com/rancher",
    "registry.rancher.com",
 ]

--- a/edge-image-builder-image/Dockerfile
+++ b/edge-image-builder-image/Dockerfile
@@ -1,5 +1,6 @@
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.3.1
-#!BuildTag: %%IMG_PREFIX%%edge-image-builder:1.3.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:%PACKAGE_VERSION%
+#!BuildTag: %%IMG_PREFIX%%edge-image-builder:%PACKAGE_VERSION%-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-base:$SLE_VERSION
 MAINTAINER SUSE LLC (https://www.suse.com/)
@@ -7,18 +8,18 @@ MAINTAINER SUSE LLC (https://www.suse.com/)
 COPY artifacts.yaml artifacts.yaml

 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
-RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86 qemu-uefi-aarch64 cni-plugins pigz zstd cpio && zypper -n clean && rm -rf /var/log/*
+RUN zypper --non-interactive install --no-recommends edge-image-builder qemu-x86 qemu-uefi-aarch64 cni-plugins; zypper -n clean; rm -rf /var/log/*

 # Define labels according to https://en.opensuse.org/Building_derived_containers
 # labelprefix=com.suse.application.edge-image-builder
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE edge-image-builder Container Image"
 LABEL org.opencontainers.image.description="edge-image-builder based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="1.3.1"
+LABEL org.opencontainers.image.version="%PACKAGE_VERSION%"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:1.3.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%edge-image-builder:%PACKAGE_VERSION%-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -32,7 +33,8 @@ LABEL com.suse.release-stage="released"
 # and also expects the boot kernel to be a portable executable (PE), not ELF.
 RUN mkdir -p /usr/share/edk2/aarch64 && \
  cp /usr/share/qemu/aavmf-aarch64-code.bin /usr/share/edk2/aarch64/QEMU_EFI-pflash.raw && \
-  cp /usr/share/qemu/aavmf-aarch64-vars.bin /usr/share/edk2/aarch64/vars-template-pflash.raw
+  cp /usr/share/qemu/aavmf-aarch64-vars.bin /usr/share/edk2/aarch64/vars-template-pflash.raw && \
+  mv /boot/vmlinux* /boot/backup-vmlinux

 ENTRYPOINT ["/usr/bin/eib"]

--- a/edge-image-builder-image/_service
+++ b/edge-image-builder-image/_service
@@ -1,5 +1,10 @@
 <services>
  <service mode="buildtime" name="kiwi_metainfo_helper"/>
+  <service name="replace_using_package_version" mode="buildtime">
+      <param name="file">Dockerfile</param>
+      <param name="regex">%PACKAGE_VERSION%</param>
+      <param name="package">edge-image-builder</param>
+    </service>
  <service name="replace_using_env" mode="buildtime">
    <param name="file">Dockerfile</param>
    <param name="eval">IMG_PREFIX=$(rpm --macros=/root/.rpmmacros -E %{?img_prefix})</param>
--- a/edge-image-builder-image/artifacts.yaml
+++ b/edge-image-builder-image/artifacts.yaml
@@ -1,19 +1,15 @@
 metallb:
  chart: metallb
  repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.1+up0.15.2"
+  version: "%%CHART_MAJOR%%.0.0+up0.14.9"
 endpoint-copier-operator:
  chart: endpoint-copier-operator
  repository: "%%CHART_REPO%%/%%CHART_PREFIX%%"
-  version: "%%CHART_MAJOR%%.0.1+up0.3.0"
+  version: "%%CHART_MAJOR%%.0.0+up0.2.1"
 kubernetes:
  k3s:
    selinuxPackage: k3s-selinux-1.6-1.slemicro.noarch
    selinuxRepository: https://rpm.rancher.io/k3s/stable/common/slemicro/noarch
-    selinuxRepositoryPriority: 1
-    releaseURL: https://github.com/k3s-io/k3s/releases/download/
  rke2:
    selinuxPackage: rke2-selinux
    selinuxRepository: https://rpm.rancher.io/rke2/stable/common/slemicro/noarch
-    selinuxRepositoryPriority: 1
-    releaseURL: https://github.com/rancher/rke2/releases/download/
--- a/edge-image-builder/_service
+++ b/edge-image-builder/_service
@@ -1,15 +1,12 @@
 <services>
  <service name="obs_scm">
    <param name="url">https://github.com/suse-edge/edge-image-builder.git</param>
+    <param name="versionformat">@PARENT_TAG@_%h.%ad</param>
    <param name="scm">git</param>
    <param name="exclude">.git</param>
-    <param name="revision">v1.3.1</param>
-    <!-- Uncomment and set this For Pre-Release Version -->
-    <!-- <param name="version">1.3.1</param> -->
-    <!-- Uncomment and this for regular version -->
-    <param name="versionformat">@PARENT_TAG@</param>
-    <param name="versionrewrite-pattern">v(\d+).(\d+).(\d+)</param>
-    <param name="versionrewrite-replacement">\1.\2.\3</param>
+    <param name="revision">main</param>
+    <param name="versionrewrite-pattern">v(.*)</param>
+    <param name="versionrewrite-replacement">\1</param>
    <param name="changesgenerate">enable</param>
  </service>
  <service mode="buildtime" name="tar">
--- a/edge-image-builder/edge-image-builder.spec
+++ b/edge-image-builder/edge-image-builder.spec
@@ -17,7 +17,7 @@


 Name:           edge-image-builder
-Version:        1.3.1
+Version:        0
 Release:        0
 Summary:        Edge Image Builder
 License:        Apache-2.0
@@ -52,7 +52,7 @@ Requires: ca-certificates-suse
 Tool for creating and configuring a set of images to automate the deployment of Edge environments

 %prep
-%autosetup -a1 -n edge-image-builder-%{version} -p1
+%autosetup -a1 -n edge-image-builder-%{version}

 %build
 tar -xf %{SOURCE1}
--- a/endpoint-copier-operator-chart/Chart.yaml
+++ b/endpoint-copier-operator-chart/Chart.yaml
@@ -1,8 +1,8 @@
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0
-#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.1_up0.3.0-%RELEASE%
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1
+#!BuildTag: %%CHART_PREFIX%%endpoint-copier-operator:%%CHART_MAJOR%%.0.0_up0.2.1-%RELEASE%
 apiVersion: v2
-appVersion: v0.3.0
+appVersion: v0.2.0
 description: A Helm chart for Kubernetes
 name: endpoint-copier-operator
 type: application
-version: "%%CHART_MAJOR%%.0.1+up0.3.0"
+version: "%%CHART_MAJOR%%.0.0+up0.2.1"
--- a/endpoint-copier-operator-chart/templates/deployment.yaml
+++ b/endpoint-copier-operator-chart/templates/deployment.yaml
@@ -20,23 +20,8 @@ spec:
      labels:
        {{- include "endpoint-copier-operator.selectorLabels" . | nindent 8 }}
    spec:
-      {{- if .Values.priorityClassName }}
-      priorityClassName: {{ .Values.priorityClassName }}
-      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - command:
        - /manager
--- a/endpoint-copier-operator-chart/templates/rbac/role.yaml
+++ b/endpoint-copier-operator-chart/templates/rbac/role.yaml
@@ -7,9 +7,9 @@ metadata:
  name: {{ include "endpoint-copier-operator.fullname" . }}
 rules:
 - apiGroups:
-  - "discovery.k8s.io"
+  - ""
  resources:
-  - endpointslices
+  - endpoints
  verbs:
  - create
  - delete
--- a/endpoint-copier-operator-chart/values.yaml
+++ b/endpoint-copier-operator-chart/values.yaml
@@ -8,7 +8,7 @@ image:
  repository: %%IMG_REPO%%/%%IMG_PREFIX%%endpoint-copier-operator
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: "0.3.0"
+  tag: "0.2.0"

 nameOverride: "endpoint-copier-operator"
 fullnameOverride: "endpoint-copier-operator"
@@ -29,8 +29,6 @@ podSecurityContext:
  seccompProfile:
    type: RuntimeDefault

-priorityClassName: "system-cluster-critical"
-
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
@@ -39,11 +37,11 @@ securityContext:

 resources:
  limits:
-    cpu: 100m
-    memory: 64Mi
+    cpu: 500m
+    memory: 128Mi
  requests:
-    cpu: 5m
-    memory: 32Mi
+    cpu: 10m
+    memory: 64Mi

 autoscaling:
  enabled: false
--- a/endpoint-copier-operator-image/Dockerfile
+++ b/endpoint-copier-operator-image/Dockerfile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #!BuildTag: %%IMG_PREFIX%%endpoint-copier-operator:%%endpoint-copier-operator_version%%
 #!BuildTag: %%IMG_PREFIX%%endpoint-copier-operator:%%endpoint-copier-operator_version%%-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

--- a/endpoint-copier-operator/_service
+++ b/endpoint-copier-operator/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/suse-edge/endpoint-copier-operator</param>
    <param name="scm">git</param>
-    <param name="revision">v0.3.0</param>
+    <param name="revision">v0.2.0</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
--- a/endpoint-copier-operator/endpoint-copier-operator.spec
+++ b/endpoint-copier-operator/endpoint-copier-operator.spec
@@ -17,14 +17,14 @@


 Name:           endpoint-copier-operator
-Version:        0.3.0
-Release:        0.3.0
+Version:        0.2.0
+Release:        0.2.0
 Summary:        Implements a Kubernetes API for copying endpoint resources
 License:        Apache-2.0
 URL:            https://github.com/suse-edge/endpoint-copier-operator
 Source:         endpoint-copier-operator-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.20
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

--- a/1
+++ b/1
--- a/frr-image/Dockerfile
+++ b/frr-image/Dockerfile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: MIT
-#!BuildTag: %%IMG_PREFIX%%frr:10.2.1
-#!BuildTag: %%IMG_PREFIX%%frr:10.2.1-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%frr:8.5.6
+#!BuildTag: %%IMG_PREFIX%%frr:8.5.6-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -14,11 +15,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="FRR Container Image"
 LABEL org.opencontainers.image.description="frr based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="10.2.1"
+LABEL org.opencontainers.image.version="8.5.6"
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%frr:10.2.1-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%frr:8.5.6-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
--- a/frr-k8s-image/Dockerfile
+++ b/frr-k8s-image/Dockerfile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #!BuildTag: %%IMG_PREFIX%%frr-k8s:v%%frr-k8s_version%%
 #!BuildTag: %%IMG_PREFIX%%frr-k8s:v%%frr-k8s_version%%-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

--- a/frr-k8s/_service
+++ b/frr-k8s/_service
@@ -2,7 +2,7 @@
 <service name="obs_scm">
    <param name="url">https://github.com/metallb/frr-k8s</param>
    <param name="scm">git</param>
-    <param name="revision">v0.0.20</param>
+    <param name="revision">v0.0.16</param>
    <param name="version">_auto_</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="changesgenerate">enable</param>
--- a/frr-k8s/frr-k8s.spec
+++ b/frr-k8s/frr-k8s.spec
@@ -17,14 +17,14 @@


 Name:           frr-k8s
-Version:        0.0.20
-Release:        0.0.20
+Version:        0.0.16
+Release:        0.0.16
 Summary:        A kubernetes based daemonset that exposes a subset of the FRR API in a kubernetes compliant manner.
 License:        Apache-2.0
 URL:            https://github.com/metallb/frr-k8s
 Source:         frr-k8s-%{version}.tar
 Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
+BuildRequires:  golang(API) = 1.22
 ExcludeArch:    s390
 ExcludeArch:    %{ix86}

--- a/grub-aggregate/_aggregate
+++ b/grub-aggregate/_aggregate
@@ -1,7 +0,0 @@
-<aggregatelist>
-  <aggregate project="SUSE:SLFO:1.2" >
-    <binary>grub2-x86_64-efi</binary>
-    <binary>grub2-arm64-efi</binary>
-    <repository target="standard" source="standard" />
-  </aggregate>
-</aggregatelist>
--- a/hauler/_service
+++ b/hauler/_service
@@ -4,7 +4,7 @@
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="scm">git</param>
    <param name="exclude">.get</param>
-    <param name="revision">v1.2.5</param>
+    <param name="revision">v1.2.1</param>
    <param name="versionrewrite-pattern">v(.*)</param>
    <param name="changesgenerate">enable</param>
  </service>
--- a/hauler/hauler.spec
+++ b/hauler/hauler.spec
@@ -18,7 +18,7 @@
 %define project github.com/hauler-dev/hauler

 Name:           hauler
-Version:        1.2.5
+Version:        1.2.1
 Release:        0
 Summary:        Airgap Swiss Army Knife
 License:        Apache-2.0
--- a/ib-sriov-cni-image/Dockerfile
+++ b/ib-sriov-cni-image/Dockerfile
@@ -1,33 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ib-sriov-cni:v%%ib-sriov-cni_version%%
-#!BuildTag: %%IMG_PREFIX%%ib-sriov-cni:v%%ib-sriov-cni_version%%-%RELEASE%
-ARG SLE_VERSION
-FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
-
-FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
-COPY --from=micro / /installroot/
-RUN zypper --installroot /installroot --non-interactive install --no-recommends ib-sriov-cni gawk which; \
-    zypper -n clean; \
-    rm -rf /var/log/*
-
-FROM micro AS final
-# Define labels according to https://en.opensuse.org/Building_derived_containers
-# labelprefix=com.suse.application.ib-sriov-cni
-LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
-LABEL org.opencontainers.image.title="SLE ib-sriov-cni Container Image"
-LABEL org.opencontainers.image.description="ib-sriov-cni based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="%%ib-sriov-cni_version%%"
-LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
-LABEL org.opencontainers.image.created="%BUILDTIME%"
-LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ib-sriov-cni:%%ib-sriov-cni_version%%-%RELEASE%"
-LABEL org.openbuildservice.disturl="%DISTURL%"
-LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
-LABEL com.suse.eula="SUSE Combined EULA February 2024"
-LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle"
-LABEL com.suse.image-type="application"
-LABEL com.suse.release-stage="released"
-# endlabelprefix
-
-COPY --from=base /installroot /
-ENTRYPOINT ["/entrypoint.sh"]
--- a/ib-sriov-cni-image/_service
+++ b/ib-sriov-cni-image/_service
@@ -1,19 +0,0 @@
-<services>
-  <service name="kiwi_metainfo_helper" mode="buildtime"/>
-  <service name="docker_label_helper" mode="buildtime"/>
-  <service name="replace_using_package_version" mode="buildtime">
-    <param name="file">Dockerfile</param>
-    <param name="regex">%%ib-sriov-cni_version%%</param>
-    <param name="package">ib-sriov-cni</param>
-    <param name="parse-version">patch</param>
-  </service>
-  <service name="replace_using_env" mode="buildtime">
-    <param name="file">Dockerfile</param>
-    <param name="eval">IMG_PREFIX=$(rpm --macros=/root/.rpmmacros -E %{?img_prefix})</param>
-    <param name="var">IMG_PREFIX</param>
-    <param name="eval">IMG_REPO=$(rpm --macros=/root/.rpmmacros -E %img_repo)</param>
-    <param name="var">IMG_REPO</param>
-    <param name="eval">SUPPORT_LEVEL=$(rpm --macros=/root/.rpmmacros -E %support_level)</param>
-    <param name="var">SUPPORT_LEVEL</param>
-  </service>
-</services>
--- a/ib-sriov-cni/_service
+++ b/ib-sriov-cni/_service
@@ -1,25 +0,0 @@
-<services>
- <service name="obs_scm">
-    <param name="url">https://github.com/k8snetworkplumbingwg/ib-sriov-cni</param>
-    <param name="scm">git</param>
-    <param name="revision">v1.3.0</param>
-    <param name="version">_auto_</param>
-    <param name="versionformat">@PARENT_TAG@</param>
-    <param name="changesgenerate">enable</param>
-    <param name="changesauthor">antonio.alarcon@suse.com</param>
-    <param name="match-tag">v*</param>
-    <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param>
-    <param name="without-version">yes</param>
-    <param name="versionrewrite-replacement">\1</param>
-  </service>
-  <service mode="buildtime" name="tar">
-    <param name="obsinfo">ib-sriov-cni.obsinfo</param>
-  </service>
-  <service name="go_modules" />
-  <service mode="buildtime" name="set_version" />
-  <service name="replace_using_env" mode="buildtime">
-    <param name="file">ib-sriov-cni.spec</param>
-    <param name="var">SOURCE_COMMIT</param>
-    <param name="eval">SOURCE_COMMIT=$(grep commit ib-sriov-cni.obsinfo | cut -d" " -f2)</param>
-  </service>
-</services>
--- a/ib-sriov-cni/ib-sriov-cni.spec
+++ b/ib-sriov-cni/ib-sriov-cni.spec
@@ -1,64 +0,0 @@
-#
-# spec file for package ib-sriov-cni
-#
-# Copyright (c) 2025 SUSE LLC
-#
-# All modifications and additions to the file contributed by third parties
-# remain the property of their copyright owners, unless otherwise agreed
-# upon. The license for this file, and modifications and additions to the
-# file, is the same license as for the pristine package itself (unless the
-# license for the pristine package is not an Open Source License, in which
-# case the license is the MIT License). An "Open Source License" is a
-# license that conforms to the Open Source Definition (Version 1.9)
-# published by the Open Source Initiative.
-
-# Please submit bugfixes or comments via https://bugs.opensuse.org/
-#
-
-
-Name:           ib-sriov-cni
-Version:        0
-Release:        0
-Summary:        Implements a Kubernetes CNI plugin operator for Infiniband SRIOV VFs
-License:        Apache-2.0
-URL:            https://github.com/k8snetworkplumbingwg/ib-sriov-cni
-Source:         %{name}-%{version}.tar
-Source1:        vendor.tar.gz
-BuildRequires:  golang(API) = 1.24
-ExcludeArch:    s390
-ExcludeArch:    %{ix86}
-
-%description
-Network Interface Cards (NICs) with SR-IOV capabilities are managed through physical functions (PFs) and virtual functions (VFs).
-A PF is used by the host and usually represents a single NIC port. VF configurations are applied through the PF.
-The SR-IOV CNI allows each VF to be treated as a separate network interface, assigned to a container, and configured with its own
-MAC, VLAN, IP and more.
-
-Infiniband SR-IOV CNI plugin works with Infiniband SR-IOV device plugin for VF allocation in Kubernetes. A CNI metaplugin such as Multus
-gets the allocated VF's deviceID(PCI address) and is responsible for invoking the Infiniband SR-IOV CNI plugin with that deviceID.
-
-%prep
-%autosetup -a1 -n %{name}-%{version} -p1
-
-%build
-# CGO is disabled by default in upstream Makefile:
-%define cgoenabled "0"
-# go build constrain (aka tag) "no_openssl" is set by default in upstream Makefile
-%define gotags "no_openssl"
-%define buildtime %(date +%%Y-%%m-%%dT%%H:%%M:%%S%%z)
-%define buildcommit %%SOURCE_COMMIT%%
-%define buildldflags "-X main.version=%{version} -X main.commit=%{buildcommit}% -X main.date=%{buildtime}%"
-CGO_ENABLED=%{cgoenabled} go build -mod=vendor -buildmode=pie -tags %{gotags} -ldflags %{buildldflags} -o ib-sriov cmd/ib-sriov-cni/main.go
-
-%install
-install -D -m0755 ib-sriov %{buildroot}%{_bindir}/ib-sriov
-install -D -m0755 images/entrypoint.sh %{buildroot}/entrypoint.sh
-
-
-%files
-%license LICENSE
-%doc README.md
-%{_bindir}/ib-sriov
-/entrypoint.sh
-
-%changelog
--- a/1
+++ b/1
--- a/ironic-image/Dockerfile
+++ b/ironic-image/Dockerfile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic:32.0.0.0
-#!BuildTag: %%IMG_PREFIX%%ironic:32.0.0.0-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.4
+#!BuildTag: %%IMG_PREFIX%%ironic:26.1.2.4-%RELEASE%
+#!BuildVersion: 15.6

 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
@@ -17,19 +18,13 @@ RUN /bin/prepare-efi.sh
 COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf

-RUN zypper --installroot /installroot --non-interactive install --no-recommends \
-    python3-devel python3 python3-pip \
-    python313-sushy \
-    python3-watchdog python313-ironicclient \
-    git curl sles-release tar gzip vim gawk \
-    dnsmasq dosfstools apache2 ipcalc ipmitool iproute2 \
-    bind-utils procps qemu-tools sqlite3 util-linux xorriso \
-    tftp ipxe-bootimgs crudini \
-    openstack-ironic
-
 #!ArchExclusiveLine: x86_64
 RUN if [ "$(uname -m)" = "x86_64" ];then \
-      zypper --installroot /installroot --non-interactive install --no-recommends syslinux  ; \
+      zypper --installroot /installroot --non-interactive install --no-recommends syslinux python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi inotify-tools ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
+    fi
+#!ArchExclusiveLine: aarch64
+RUN if [ "$(uname -m)" = "aarch64" ];then \
+      zypper --installroot /installroot --non-interactive install --no-recommends python311-devel python311 python311-pip python-dracclient python311-sushy-oem-idrac python311-proliantutils python311-sushy python3-ironicclient git curl sles-release tar gzip vim gawk dnsmasq dosfstools apache2 apache2-mod_wsgi inotify-tools ipcalc ipmitool iproute2 procps qemu-tools sqlite3 util-linux xorriso tftp ipxe-bootimgs python311-sushy-tools crudini openstack-ironic openstack-ironic-inspector-api; \
    fi
    
 # DATABASE
@@ -37,9 +32,7 @@ RUN mkdir -p /installroot/var/lib/ironic && \
  /installroot/usr/bin/sqlite3 /installroot/var/lib/ironic/ironic.sqlite "pragma journal_mode=wal" && \
  zypper --installroot /installroot --non-interactive remove sqlite3

-# build actual image
 FROM micro AS final
-
 MAINTAINER SUSE LLC (https://www.suse.com/)
 # Define labels according to https://en.opensuse.org/Building_derived_containers
 LABEL org.opencontainers.image.title="SLE Openstack Ironic Container Image"
@@ -47,8 +40,8 @@ LABEL org.opencontainers.image.description="Openstack Ironic based on the SLE Ba
 LABEL org.opencontainers.image.url="https://www.suse.com/products/server/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opencontainers.image.version="29.0.4.4"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:29.0.4.4-%RELEASE%"
+LABEL org.opencontainers.image.version="26.1.2.4"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic:26.1.2.4-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -59,8 +52,8 @@ LABEL com.suse.release-stage="released"

 COPY --from=base /installroot /

-RUN set -euo pipefail; ln -s /usr/bin/python3.13 /usr/local/bin/python3; \
-    ln -s /usr/bin/pydoc3.13 /usr/local/bin/pydoc
+RUN set -euo pipefail; ln -s /usr/bin/python3.11 /usr/local/bin/python3; \
+    ln -s /usr/bin/pydoc3.11 /usr/local/bin/pydoc

 ENV GRUB_DIR=/tftpboot/boot/grub

@@ -69,19 +62,14 @@ RUN echo 'alias mkisofs="xorriso -as mkisofs"' >> ~/.bashrc
 COPY mkisofs_wrapper /usr/bin/mkisofs
 RUN set -euo pipefail; chmod +x /usr/bin/mkisofs

+COPY auth-common.sh configure-ironic.sh ironic-common.sh rundnsmasq runhttpd runironic runlogwatch.sh tls-common.sh configure-nonroot.sh ironic-probe.j2 /bin/
+RUN set -euo pipefail; chmod +x /bin/auth-common.sh; chmod +x /bin/configure-ironic.sh; chmod +x /bin/ironic-common.sh; chmod +x /bin/rundnsmasq; chmod +x /bin/runhttpd; chmod +x /bin/runironic; chmod +x /bin/runlogwatch.sh; chmod +x /bin/tls-common.sh; chmod +x /bin/configure-nonroot.sh;
 RUN mkdir -p /tftpboot
 RUN mkdir -p $GRUB_DIR

-COPY scripts/ /bin/
-COPY configure-nonroot.sh /bin/
-RUN set -euo pipefail; chmod +x /bin/configure-ironic.sh /bin/ironic-probe.sh /bin/rundatabase-upgrade /bin/rundnsmasq /bin/runhttpd /bin/runironic /bin/runlogwatch.sh /bin/runonline-data-migrations /bin/configure-nonroot.sh
-
-RUN mv /bin/ironic-probe.sh /bin/ironic-readiness
-RUN cp /bin/ironic-readiness /bin/ironic-liveness
-
-COPY ironic-config/inspector.ipxe.j2 ironic-config/httpd-ironic-api.conf.j2 \
-     ironic-config/ipxe_config.template ironic-config/dnsmasq.conf.j2 \
-     /templates/
+# No need to support the Legacy BIOS boot
+#RUN cp /usr/share/syslinux/pxelinux.0 /tftpboot
+#RUN cp /usr/share/syslinux/chain.c32 /tftpboot/

 # IRONIC #
 RUN cp /usr/share/ipxe/undionly.kpxe /tftpboot/undionly.kpxe
@@ -89,24 +77,31 @@ RUN cp /usr/share/ipxe/undionly.kpxe /tftpboot/undionly.kpxe
 RUN if [ "$(uname -m)" = "x86_64" ];then \
      cp /usr/share/ipxe/ipxe-x86_64.efi /tftpboot/ipxe.efi ;\
    fi
-#!ArchExclusiveLine: aarch64 
+#!ArchExclusiveLine: x86_64
 RUN if [ "$(uname -m)" = "aarch64" ]; then\ 
-      cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
+     cp /usr/share/ipxe/snp-arm64.efi /tftpboot/ipxe.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp-arm64.efi; cp /usr/share/ipxe/snp-arm64.efi /tftpboot/snp.efi ;\
    fi
    
-COPY --from=base /tmp/uefi_esp_*.img /templates/
+COPY --from=base /tmp/esp-x86_64.img /tmp/uefi_esp-x86_64.img
+COPY --from=base /tmp/esp-aarch64.img /tmp/uefi_esp-arm64.img

-COPY ironic-config/ironic.conf.j2 ironic-config/network-data-schema-empty.json /etc/ironic/
+COPY ironic.conf.j2 /etc/ironic/
+COPY inspector.ipxe.j2 httpd-ironic-api.conf.j2 ipxe_config.template /tmp/
+COPY network-data-schema-empty.json /etc/ironic/
+
+# DNSMASQ
+COPY dnsmasq.conf.j2 /etc/
+
+# Custom httpd config, removes all but the bare minimum needed modules
+COPY httpd.conf.j2 /etc/httpd/conf/
+COPY httpd-modules.conf /etc/httpd/conf.modules.d/
+COPY apache2-vmedia.conf.j2 /etc/httpd-vmedia.conf.j2
+COPY apache2-ipxe.conf.j2 /etc/httpd-ipxe.conf.j2

 # Workaround
 # Removing the 010-ironic.conf file that comes with the package 
 RUN rm /etc/ironic/ironic.conf.d/010-ironic.conf

-# Custom httpd config, removes all but the bare minimum needed modules
-COPY ironic-config/httpd.conf.j2 /etc/httpd/conf/
-COPY ironic-config/httpd-modules.conf /etc/httpd/conf.modules.d/
-COPY ironic-config/apache2-vmedia.conf.j2 /templates/httpd-vmedia.conf.j2
-COPY ironic-config/apache2-ipxe.conf.j2 /templates/httpd-ipxe.conf.j2
-
 # configure non-root user and set relevant permissions
-RUN configure-nonroot.sh && rm -f /bin/configure-nonroot.sh
+RUN configure-nonroot.sh && \
+  rm -f /bin/configure-nonroot.sh
--- a/ironic-image/apache2-ipxe.conf.j2
+++ b/ironic-image/apache2-ipxe.conf.j2
@@ -0,0 +1,35 @@
+Listen {{ env.IPXE_TLS_PORT }}
+
+<VirtualHost *:{{ env.IPXE_TLS_PORT }}>
+    ErrorLog /dev/stderr
+    LogLevel debug
+    CustomLog /dev/stdout combined
+
+    SSLEngine on
+    SSLProtocol {{ env.IPXE_SSL_PROTOCOL }}
+    SSLCertificateFile {{ env.IPXE_CERT_FILE }}
+    SSLCertificateKeyFile {{ env.IPXE_KEY_FILE }}
+
+    <Directory "/shared/html">
+        Order Allow,Deny
+        Allow from all
+    </Directory>
+    <Directory "/shared/html/(redfish|ilo|images)/">
+        Order Deny,Allow
+        Deny from all
+    </Directory>
+</VirtualHost>
+
+<Location ~ "^/grub.*/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/pxelinux.cfg/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/.*\.conf/">
+    SSLRequireSSL
+</Location>
+<Location ~ "^/(([0-9]|[a-z]).*-){4}([0-9]|[a-z]).*/">
+    SSLRequireSSL
+</Location>
+
--- a/ironic-image/apache2-vmedia.conf.j2
+++ b/ironic-image/apache2-vmedia.conf.j2
@@ -0,0 +1,27 @@
+Listen {{ env.VMEDIA_TLS_PORT }}
+
+<VirtualHost *:{{ env.VMEDIA_TLS_PORT }}>
+    ErrorLog /dev/stderr
+    LogLevel debug
+    CustomLog /dev/stdout combined
+
+    SSLEngine on
+    SSLProtocol {{ env.IRONIC_VMEDIA_SSL_PROTOCOL }}
+    SSLCertificateFile {{ env.IRONIC_VMEDIA_CERT_FILE }}
+    SSLCertificateKeyFile {{ env.IRONIC_VMEDIA_KEY_FILE }}
+
+    <Directory "/shared">
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Directory "/shared/html">
+        Options Indexes FollowSymLinks
+        AllowOverride None
+        Require all granted
+    </Directory>
+</VirtualHost>
+
+<Location ~ "^/(redfish|ilo)/">
+    SSLRequireSSL
+</Location>
--- a/ironic-image/auth-common.sh
+++ b/ironic-image/auth-common.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/bash
+
+set -euxo pipefail
+
+export IRONIC_REVERSE_PROXY_SETUP=${IRONIC_REVERSE_PROXY_SETUP:-false}
+
+# Backward compatibility
+if [[ "${IRONIC_DEPLOYMENT:-}" == "Conductor" ]]; then
+    export IRONIC_EXPOSE_JSON_RPC=true
+else
+    export IRONIC_EXPOSE_JSON_RPC="${IRONIC_EXPOSE_JSON_RPC:-false}"
+fi
+
+IRONIC_HTPASSWD_FILE=/etc/ironic/htpasswd
+if [[ -f "/auth/ironic/htpasswd" ]]; then
+    IRONIC_HTPASSWD=$(</auth/ironic/htpasswd)
+fi
+export IRONIC_HTPASSWD=${IRONIC_HTPASSWD:-${HTTP_BASIC_HTPASSWD:-}}
+
+configure_client_basic_auth()
+{
+    local auth_config_file="/auth/$1/auth-config"
+    local dest="${2:-/etc/ironic/ironic.conf}"
+    if [[ -f "${auth_config_file}" ]]; then
+        # Merge configurations in the "auth" directory into the default ironic configuration file
+        crudini --merge "${dest}" < "${auth_config_file}"
+    fi
+}
+
+configure_json_rpc_auth()
+{
+    if [[ "${IRONIC_EXPOSE_JSON_RPC}" == "true" ]]; then
+        if [[ -z "${IRONIC_HTPASSWD}" ]]; then
+            echo "FATAL: enabling JSON RPC requires authentication"
+            exit 1
+        fi
+        printf "%s\n" "${IRONIC_HTPASSWD}" > "${IRONIC_HTPASSWD_FILE}-rpc"
+    fi
+}
+
+configure_ironic_auth()
+{
+    local config=/etc/ironic/ironic.conf
+    # Configure HTTP basic auth for API server
+    if [[ -n "${IRONIC_HTPASSWD}" ]]; then
+        printf "%s\n" "${IRONIC_HTPASSWD}" > "${IRONIC_HTPASSWD_FILE}"
+        if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "false" ]]; then
+            crudini --set "${config}" DEFAULT auth_strategy http_basic
+            crudini --set "${config}" DEFAULT http_basic_auth_user_file "${IRONIC_HTPASSWD_FILE}"
+        fi
+    fi
+}
+
+write_htpasswd_files()
+{
+    if [[ -n "${IRONIC_HTPASSWD:-}" ]]; then
+        printf "%s\n" "${IRONIC_HTPASSWD}" > "${IRONIC_HTPASSWD_FILE}"
+    fi
+}
--- a/ironic-image/configure-ironic.sh
+++ b/ironic-image/configure-ironic.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/bash
+
+set -euxo pipefail
+
+IRONIC_EXTERNAL_IP="${IRONIC_EXTERNAL_IP:-}"
+
+# Define the VLAN interfaces to be included in introspection report, e.g.
+#   all - all VLANs on all interfaces using LLDP information
+#   <interface> - all VLANs on a particular interface using LLDP information
+#   <interface.vlan> - a particular VLAN on an interface, not relying on LLDP
+export IRONIC_ENABLE_VLAN_INTERFACES=${IRONIC_ENABLE_VLAN_INTERFACES:-${IRONIC_INSPECTOR_VLAN_INTERFACES:-all}}
+
+# shellcheck disable=SC1091
+. /bin/tls-common.sh
+# shellcheck disable=SC1091
+. /bin/ironic-common.sh
+# shellcheck disable=SC1091
+. /bin/auth-common.sh
+
+export HTTP_PORT=${HTTP_PORT:-80}
+
+export IRONIC_USE_MARIADB=${IRONIC_USE_MARIADB:-true}
+
+if [[ "$IRONIC_USE_MARIADB" == "true" ]]; then
+    MARIADB_PASSWORD=${MARIADB_PASSWORD}
+    MARIADB_DATABASE=${MARIADB_DATABASE:-ironic}
+    MARIADB_USER=${MARIADB_USER:-ironic}
+    MARIADB_HOST=${MARIADB_HOST:-127.0.0.1}
+    export MARIADB_CONNECTION="mysql+pymysql://${MARIADB_USER}:${MARIADB_PASSWORD}@${MARIADB_HOST}/${MARIADB_DATABASE}?charset=utf8"
+    if [[ "$MARIADB_TLS_ENABLED" == "true" ]]; then
+        export MARIADB_CONNECTION="${MARIADB_CONNECTION}&ssl=on&ssl_ca=${MARIADB_CACERT_FILE}"
+    fi
+fi
+
+# TODO(dtantsur): remove the explicit default once we get
+# https://review.opendev.org/761185 in the repositories
+NUMPROC="$(grep -c "^processor" /proc/cpuinfo)"
+if [[ "$NUMPROC" -lt 4 ]]; then
+    NUMPROC=4
+fi
+export NUMWORKERS=${NUMWORKERS:-$NUMPROC}
+
+# Whether to enable fast_track provisioning or not
+export IRONIC_FAST_TRACK=${IRONIC_FAST_TRACK:-true}
+
+# Whether cleaning disks before and after deployment
+export IRONIC_AUTOMATED_CLEAN=${IRONIC_AUTOMATED_CLEAN:-true}
+
+# Wheter to enable the sensor data collection
+export SEND_SENSOR_DATA=${SEND_SENSOR_DATA:-false}
+
+# Set of collectors that should be used with IPA inspection
+export IRONIC_IPA_COLLECTORS=${IRONIC_IPA_COLLECTORS:-default,logs}
+
+wait_for_interface_or_ip
+
+# Hostname to use for the current conductor instance.
+export IRONIC_CONDUCTOR_HOST=${IRONIC_CONDUCTOR_HOST:-${IRONIC_URL_HOST}}
+
+export IRONIC_BASE_URL=${IRONIC_BASE_URL:-"${IRONIC_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_ACCESS_PORT}"}
+
+if [[ -n "$IRONIC_EXTERNAL_IP" ]]; then
+    export IRONIC_EXTERNAL_CALLBACK_URL=${IRONIC_EXTERNAL_CALLBACK_URL:-"${IRONIC_SCHEME}://${IRONIC_EXTERNAL_IP}:${IRONIC_ACCESS_PORT}"}
+    if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]]; then
+        export IRONIC_EXTERNAL_HTTP_URL=${IRONIC_EXTERNAL_HTTP_URL:-"https://${IRONIC_EXTERNAL_IP}:${VMEDIA_TLS_PORT}"}
+    else
+        export IRONIC_EXTERNAL_HTTP_URL=${IRONIC_EXTERNAL_HTTP_URL:-"http://${IRONIC_EXTERNAL_IP}:${HTTP_PORT}"}
+    fi
+fi
+
+IMAGE_CACHE_PREFIX="/shared/html/images/ironic-python-agent-${DEPLOY_ARCHITECTURE}"
+if [[ -f "${IMAGE_CACHE_PREFIX}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}.initramfs" ]]; then
+    export IRONIC_DEFAULT_KERNEL="${IMAGE_CACHE_PREFIX}.kernel"
+    export IRONIC_DEFAULT_RAMDISK="${IMAGE_CACHE_PREFIX}.initramfs"
+fi
+
+if [[ -f /etc/ironic/ironic.conf ]]; then
+    # Make a copy of the original supposed empty configuration file
+    cp /etc/ironic/ironic.conf /etc/ironic/ironic.conf_orig
+fi
+
+# oslo.config also supports Config Opts From Environment, log them to stdout
+echo 'Options set from Environment variables'
+env | grep "^OS_" || true
+
+mkdir -p /shared/html
+mkdir -p /shared/ironic_prometheus_exporter
+
+configure_json_rpc_auth
+
+if [[ -f /proc/sys/crypto/fips_enabled ]]; then
+    ENABLE_FIPS_IPA=$(cat /proc/sys/crypto/fips_enabled)
+    export ENABLE_FIPS_IPA
+fi
+
+# The original ironic.conf is empty, and can be found in ironic.conf_orig
+render_j2_config /etc/ironic/ironic.conf.j2 /etc/ironic/ironic.conf
+
+configure_client_basic_auth ironic-rpc
+
+# Make sure ironic traffic bypasses any proxies
+export NO_PROXY="${NO_PROXY:-},$IRONIC_IP"
+
+PROBE_CURL_ARGS=
+if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "true" ]]; then
+    if [[ "${IRONIC_PRIVATE_PORT}" == "unix" ]]; then
+        PROBE_URL="http://127.0.0.1:6385"
+        PROBE_CURL_ARGS="--unix-socket /shared/ironic.sock"
+    else
+        PROBE_URL="http://127.0.0.1:${IRONIC_PRIVATE_PORT}"
+    fi
+else
+        PROBE_URL="${IRONIC_BASE_URL}"
+fi
+export PROBE_CURL_ARGS
+export PROBE_URL
+
+PROBE_KIND=readiness render_j2_config /bin/ironic-probe.j2 /bin/ironic-readiness
+PROBE_KIND=liveness render_j2_config /bin/ironic-probe.j2 /bin/ironic-liveness
--- a/ironic-image/configure-nonroot.sh
+++ b/ironic-image/configure-nonroot.sh
@@ -1,70 +1,53 @@
 #!/usr/bin/bash

-# This script changes permissions to allow Ironic container to run as non-root
-# user. As the same image is used to run ironic, ironic-httpd, ironic-dsnmasq,
-# and ironic-log-watch via BMO's ironic k8s manifest, it has
-# to be configured to work with multiple different users and groups, while they
-# share files via bind mounts (/shared, /certs/*), which can only get one
-# group id as "fsGroup". Additionally, dnsmasq needs three capabilities to run
-# which we provide via "setcap", and "allowPrivilegeEscalation: true" in
-# manifest.
-
-set -eux
-
-# user and group are from ironic rpms (uid 997, gid 994)
 NONROOT_UID=10475
 NONROOT_GID=10475
-IRONIC_USER="ironic-suse"
-IRONIC_GROUP="ironic-suse"
+USER="ironic-suse"

-groupadd -r -g ${NONROOT_GID} ${IRONIC_GROUP}
+groupadd -r -g ${NONROOT_GID} ${USER}
 useradd -r -g ${NONROOT_GID} \
           -u ${NONROOT_UID} \
           -d /var/lib/ironic \
           -s /sbin/nologin \
-           ${IRONIC_USER}
+           ${USER}

-# most containers mount /shared but dnsmasq can live without it
-mkdir -p /shared
-mkdir -p /data
-mkdir -p /conf
-chown "${IRONIC_USER}":"${IRONIC_GROUP}" /shared
-chown "${IRONIC_USER}":"${IRONIC_GROUP}" /data
-chown "${IRONIC_USER}":"${IRONIC_GROUP}" /conf
+# create ironic's http_root directory
+mkdir -p /shared/html
+chown "${NONROOT_UID}":"${NONROOT_GID}" /shared/html

 # we'll bind mount shared ca and ironic certificate dirs here
 # that need to have correct ownership as the entire ironic in BMO
 # deployment shares a single fsGroup in manifest's securityContext
 mkdir -p /certs/ca
-chown "${IRONIC_USER}":"${IRONIC_GROUP}" /certs{,/ca}
+chown "${NONROOT_UID}":"${NONROOT_GID}" /certs{,/ca}
 chmod 2775 /certs{,/ca}

 # apache2 permission changes
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/apache2
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /run
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/apache2
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /run

 # ironic and httpd related changes
 mkdir -p /etc/httpd/conf.d
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/ironic /etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf.modules.d/
-chmod 2775 /etc/ironic /etc/httpd/conf /etc/httpd/conf.d /etc/httpd/conf.modules.d/
-#chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.d/*
-chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.modules.d/*
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/ironic /etc/httpd /etc/httpd
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/log
+chmod 2775 /etc/ironic /etc/httpd/conf /etc/httpd/conf.d
+chmod 664 /etc/ironic/* /etc/httpd/conf/* /etc/httpd/conf.d/*

-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /var/lib/ironic
-chmod 2775 /var/lib/ironic
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/lib/ironic
 chmod 664 /var/lib/ironic/ironic.sqlite

 # dnsmasq, and the capabilities required to run it as non-root user
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /etc/dnsmasq.conf
-#handled at chart level
-#setcap "cap_net_raw,cap_net_admin,cap_net_bind_service=+eip" /usr/sbin/dnsmasq
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /etc/dnsmasq.conf /var/lib/dnsmasq
+chmod 2775 /var/lib/dnsmasq
+touch /var/lib/dnsmasq/dnsmasq.leases
+chmod 664 /etc/dnsmasq.conf /var/lib/dnsmasq/dnsmasq.leases

 # ca-certificates permission changes
 touch /var/lib/ca-certificates/ca-bundle.pem.new
-chown -R "${IRONIC_USER}":"${IRONIC_GROUP}" /var/lib/ca-certificates/
+chown -R "${NONROOT_UID}":"${NONROOT_GID}" /var/lib/ca-certificates/
 chmod -R +w /var/lib/ca-certificates/

 # probes that are created before start
 touch /bin/ironic-{readi,live}ness
-chown root:"${IRONIC_GROUP}" /bin/ironic-{readi,live}ness
+chown root:"${NONROOT_GID}" /bin/ironic-{readi,live}ness
 chmod 775 /bin/ironic-{readi,live}ness
--- a/ironic-image/dnsmasq.conf.j2
+++ b/ironic-image/dnsmasq.conf.j2
@@ -0,0 +1,89 @@
+interface={{ env.PROVISIONING_INTERFACE }}
+bind-dynamic
+enable-tftp
+tftp-root=/shared/tftpboot
+log-queries
+
+# Configure listening for DNS (0 disables DNS)
+port={{ env.DNS_PORT }}
+
+{%- if env.DHCP_RANGE | length %}
+log-dhcp
+dhcp-range={{ env.DHCP_RANGE }}
+
+# It can be used when setting DNS or GW variables.
+{%- if env["GATEWAY_IP"] is undefined %}
+# Disable default router(s)
+dhcp-option=3
+{% else %}
+dhcp-option=option{% if ":" in env["GATEWAY_IP"] %}6{% endif %}:router,{{ env["GATEWAY_IP"] }}
+{% endif %}
+{%- if env["DNS_IP"] is undefined %}
+# Disable DNS over provisioning network
+dhcp-option=6
+{% else %}
+dhcp-option=option{% if ":" in env["DNS_IP"] %}6{% endif %}:dns-server,{{ env["DNS_IP"] }}
+{% endif %}
+
+{%- if env.IPV == "4" or env.IPV is undefined %}
+# IPv4 Configuration:
+dhcp-match=ipxe,175
+# Client is already running iPXE; move to next stage of chainloading
+{%- if env.IPXE_TLS_SETUP == "true"  %}
+# iPXE with (U)EFI
+dhcp-boot=tag:efi,tag:ipxe,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/custom-ipxe/snponly.efi
+# iPXE with BIOS
+dhcp-boot=tag:ipxe,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/custom-ipxe/undionly.kpxe
+{% else %}
+dhcp-boot=tag:ipxe,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/boot.ipxe
+{% endif %}
+
+# Note: Need to test EFI booting
+dhcp-match=set:efi,option:client-arch,7
+dhcp-match=set:efi,option:client-arch,9
+dhcp-match=set:efi,option:client-arch,11
+# Client is PXE booting over EFI without iPXE ROM; send EFI version of iPXE chainloader do the same also if iPXE ROM boots but TLS is enabled
+{%- if env.IPXE_TLS_SETUP == "true"  %}
+dhcp-boot=tag:efi,tag:ipxe,snponly.efi
+{% endif %}
+dhcp-boot=tag:efi,tag:!ipxe,snponly.efi
+
+# Client is running PXE over BIOS; send BIOS version of iPXE chainloader
+dhcp-boot=/undionly.kpxe,{{ env.IRONIC_IP }}
+{% endif %}
+
+{% if env.IPV == "6" %}
+# IPv6 Configuration:
+enable-ra
+ra-param={{ env.PROVISIONING_INTERFACE }},0,0
+
+dhcp-vendorclass=set:pxe6,enterprise:343,PXEClient
+dhcp-userclass=set:ipxe6,iPXE
+dhcp-option=tag:pxe6,option6:bootfile-url,tftp://{{ env.IRONIC_URL_HOST }}/snponly.efi
+dhcp-option=tag:ipxe6,option6:bootfile-url,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/boot.ipxe
+
+# It can be used when setting DNS or GW variables.
+{%- if env["GATEWAY_IP"] is undefined %}
+# Disable default router(s)
+dhcp-option=3
+{% else %}
+dhcp-option=3,{{ env["GATEWAY_IP"] }}
+{% endif %}
+{%- if env["DNS_IP"] is undefined %}
+# Disable DNS over provisioning network
+dhcp-option=6
+{% else %}
+dhcp-option=6,{{ env["DNS_IP"] }}
+{% endif %}
+{% endif %}
+{% endif %}
+
+{%- if env.DHCP_IGNORE | length %}
+dhcp-ignore={{ env.DHCP_IGNORE }}
+{% endif %}
+
+{%- if env.DHCP_HOSTS | length %}
+{%- for item in env.DHCP_HOSTS.split(";") %}
+dhcp-host={{ item }}
+{%- endfor %}
+{% endif %}
--- a/ironic-image/ironic-config/httpd-ironic-api.conf.j2
+++ b/ironic-image/ironic-config/httpd-ironic-api.conf.j2
@@ -12,36 +12,12 @@


 {% if env.LISTEN_ALL_INTERFACES | lower == "true" %}
-Listen 0.0.0.0:{{ env.IRONIC_LISTEN_PORT }}
-Listen [::]:{{ env.IRONIC_LISTEN_PORT }}
+Listen {{ env.IRONIC_LISTEN_PORT }}
 <VirtualHost *:{{ env.IRONIC_LISTEN_PORT }}>
 {% else %}
-{% if env.ENABLE_IPV4 %}
-Listen {{ env.IRONIC_IP }}:{{ env.IRONIC_LISTEN_PORT }}
+Listen {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_LISTEN_PORT }}
+ <VirtualHost {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_LISTEN_PORT }}>
 {% endif %}
-{% if env.ENABLE_IPV6 %}
-Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
-{% endif %}
-{% if env.IRONIC_URL_HOSTNAME is defined and env.IRONIC_URL_HOSTNAME|length %}
-<VirtualHost {{ env.IRONIC_URL_HOSTNAME }}:{{ env.IRONIC_LISTEN_PORT }}>
-{% else %}
-<VirtualHost {% if env.ENABLE_IPV4 %}{{ env.IRONIC_IP }}:{{ env.IRONIC_LISTEN_PORT }}{% endif %} {% if env.ENABLE_IPV6 %}[{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}{% endif %}>
-{% endif %}
-{% endif %}
-
-    DocumentRoot "/shared/html"
-
-    <Directory "/shared/html">
-        Require all denied
-    </Directory>
-
-    <Directory "/shared/html/images">
-        Require all granted
-    </Directory>
-
-    # Exclude /images from proxying
-    ProxyPass        "/images" !
-    ProxyPassReverse "/images" !

    {% if env.IRONIC_PRIVATE_PORT == "unix" %}
    ProxyPass "/"  "unix:/shared/ironic.sock|http://127.0.0.1/"
@@ -65,12 +41,11 @@ Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
    SSLCertificateKeyFile {{ env.IRONIC_KEY_FILE }}
 {% endif %}

-
    <Location />
         {% if "IRONIC_HTPASSWD" in env and env.IRONIC_HTPASSWD | length %}
            AuthType Basic
            AuthName "Restricted area"
-            AuthUserFile {{ env.HTPASSWD_FILE }}
+            AuthUserFile "/etc/ironic/htpasswd"
            Require valid-user
         {% endif %}
    </Location>
@@ -82,9 +57,4 @@ Listen [{{ env.IRONIC_IPV6 }}]:{{ env.IRONIC_LISTEN_PORT }}
    <Location ~ "^/(v1/)?(lookup|heartbeat|continue_inspection)" >
        Require all granted
    </Location>
-
-    <Location ~ "^/images(/.*)?$">
-        Require all granted
-    </Location>
-
 </VirtualHost>
--- a/ironic-image/ironic-config/httpd-modules.conf
+++ b/ironic-image/ironic-config/httpd-modules.conf
@@ -8,6 +8,8 @@ LoadModule authz_core_module /usr/lib64/apache2/mod_authz_core.so
 LoadModule ssl_module /usr/lib64/apache2/mod_ssl.so
 LoadModule env_module /usr/lib64/apache2/mod_env.so
 LoadModule proxy_module /usr/lib64/apache2/mod_proxy.so
+LoadModule proxy_ajp_module /usr/lib64/apache2/mod_proxy_ajp.so
+LoadModule proxy_balancer_module /usr/lib64/apache2/mod_proxy_balancer.so
 LoadModule proxy_http_module /usr/lib64/apache2/mod_proxy_http.so
 LoadModule slotmem_shm_module /usr/lib64/apache2/mod_slotmem_shm.so
 LoadModule headers_module /usr/lib64/apache2/mod_headers.so
@@ -15,4 +17,4 @@ LoadModule authn_core_module /usr/lib64/apache2/mod_authn_core.so
 LoadModule auth_basic_module /usr/lib64/apache2/mod_auth_basic.so
 LoadModule authn_file_module /usr/lib64/apache2/mod_authn_file.so
 LoadModule authz_user_module /usr/lib64/apache2/mod_authz_user.so
-#LoadModule access_compat_module /usr/lib64/apache2/mod_access_compat.so
+LoadModule access_compat_module /usr/lib64/apache2/mod_access_compat.so
--- a/ironic-image/ironic-config/httpd.conf.j2
+++ b/ironic-image/ironic-config/httpd.conf.j2
@@ -1,16 +1,10 @@
-ServerRoot {{ env.HTTPD_DIR }}
+ServerRoot "/etc/httpd"
 {%- if env.LISTEN_ALL_INTERFACES | lower == "true" %}
-Listen 0.0.0.0:{{ env.HTTP_PORT }}
-Listen [::]:{{ env.HTTP_PORT }}
+Listen {{ env.HTTP_PORT }}
 {% else %}
-{% if env.ENABLE_IPV4 %}
-Listen {{ env.IRONIC_IP }}:{{ env.HTTP_PORT }}
+Listen {{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}
 {% endif %}
-{% if env.ENABLE_IPV6 %}
-Listen [{{ env.IRONIC_IPV6 }}]:{{ env.HTTP_PORT }}
-{% endif %}
-{% endif %}
-Include /etc/httpd/conf.modules.d/*.conf
+Include conf.modules.d/*.conf
 User ironic-suse
 Group ironic-suse

@@ -22,43 +16,18 @@ Group ironic-suse
 DocumentRoot "/shared/html"

 <Directory "/shared/html">
-{%- if env.IPXE_TLS_SETUP | lower == "true" %}
-    Options Indexes FollowSymLinks
-    Require all denied
-{%- else %}
    Options Indexes FollowSymLinks
+    AllowOverride None
    Require all granted
-{%- endif %}
 </Directory>

-<Directory ~ "/shared/html/(redfish|ilo)/">
-{%- if env.IRONIC_VMEDIA_TLS_SETUP | lower == "true" %}
-    Require all denied
-{%- else %}
-    Require all granted
-{%- endif %}
-</Directory>
-
-{%- set serve_img = env.HTTPD_SERVE_NODE_IMAGES | lower %}
-{%- set image_tls = env.IRONIC_TLS_SETUP | lower %}
+{%- if env.HTTPD_SERVE_NODE_IMAGES | lower == "true" %}
 <Directory "/shared/html/images">
    Options Indexes FollowSymLinks
    AllowOverride None
-{%- if serve_img == "true" and image_tls != "true" %}
    Require all granted
-{%- else %}
-    Require all denied
-{%- endif %}
-
-    <FilesMatch "^ironic.*">
-{%- if env.IPXE_TLS_SETUP | lower == "true" %}
-        Require all denied
-{%- else %}
-        Require all granted
-{%- endif %}
-    </FilesMatch>
 </Directory>
-
+{% endif %}

 <IfModule dir_module>
    DirectoryIndex index.html
@@ -95,7 +64,7 @@ AddDefaultCharset UTF-8
    MIMEMagicFile conf/magic
 </IfModule>

-PidFile {{ env.IRONIC_TMP_DATA_DIR }}/httpd.pid
+PidFile /var/tmp/httpd.pid

 # EnableSendfile directive could speed up deployments but it could also cause
 # issues depending on the underlying file system, to learn more:
--- a/ironic-image/inspector-apache.conf.j2
+++ b/ironic-image/inspector-apache.conf.j2
@@ -0,0 +1,57 @@
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+{% if env.LISTEN_ALL_INTERFACES | lower == "true" %}
+Listen {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
+ <VirtualHost *:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
+{% else %}
+Listen {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
+ <VirtualHost {{ env.IRONIC_URL_HOST }}:{{ env.IRONIC_INSPECTOR_LISTEN_PORT }}>
+{% endif %}
+    {% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
+    ProxyPass "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
+    ProxyPassReverse "/"  "unix:/shared/inspector.sock|http://127.0.0.1/"
+    {% else %}
+    ProxyPass "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
+    ProxyPassReverse "/"  "http://127.0.0.1:{{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}/"
+    {% endif %}
+
+    SetEnv APACHE_RUN_USER ironic-suse
+    SetEnv APACHE_RUN_GROUP ironic-suse
+
+    ErrorLog /dev/stdout
+    LogLevel debug
+    CustomLog /dev/stdout combined
+
+    SSLEngine On
+    SSLProtocol {{ env.IRONIC_SSL_PROTOCOL }}
+    SSLCertificateFile {{ env.IRONIC_INSPECTOR_CERT_FILE }} 
+    SSLCertificateKeyFile {{ env.IRONIC_INSPECTOR_KEY_FILE }}
+
+    {% if "INSPECTOR_HTPASSWD" in env and env.INSPECTOR_HTPASSWD | length %}
+    <Location / >
+        AuthType Basic
+        AuthName "Restricted area"
+        AuthUserFile "/etc/ironic-inspector/htpasswd"
+        Require valid-user
+    </Location>
+
+    <Location ~ "^/(v1/?)?$" >
+        Require all granted
+    </Location>
+
+    <Location /v1/continue >
+        Require all granted
+    </Location>
+    {% endif %}
+</VirtualHost>
--- a/ironic-image/inspector.ipxe.j2
+++ b/ironic-image/inspector.ipxe.j2
@@ -0,0 +1,10 @@
+#!ipxe
+
+:retry_boot
+echo In inspector.ipxe
+imgfree
+# NOTE(dtantsur): keep inspection kernel params in [mdns]params in
+# ironic-inspector-image and configuration in configure-ironic.sh
+kernel --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent-${buildarch}.kernel ipa-insecure=1 ipa-inspection-collectors={{ env.IRONIC_IPA_COLLECTORS }} systemd.journald.forward_to_console=yes BOOTIF=${mac} ipa-debug=1 ipa-enable-vlan-interfaces={{ env.IRONIC_ENABLE_VLAN_INTERFACES }} ipa-inspection-dhcp-all-interfaces=1 ipa-collect-lldp=1 {{ env.INSPECTOR_EXTRA_ARGS }} initrd=ironic-python-agent.initramfs {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} || goto retry_boot
+initrd --timeout 60000 http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/images/ironic-python-agent-${buildarch}.initramfs || goto retry_boot
+boot
--- a/ironic-image/ironic-config/ipxe_config.template
+++ b/ironic-image/ironic-config/ipxe_config.template
--- a/ironic-image/ironic-common.sh
+++ b/ironic-image/ironic-common.sh
@@ -0,0 +1,107 @@
+#!/usr/bin/bash
+
+set -euxo pipefail
+
+IRONIC_IP="${IRONIC_IP:-}"
+PROVISIONING_INTERFACE="${PROVISIONING_INTERFACE:-}"
+PROVISIONING_IP="${PROVISIONING_IP:-}"
+PROVISIONING_MACS="${PROVISIONING_MACS:-}"
+IPXE_CUSTOM_FIRMWARE_DIR="${IPXE_CUSTOM_FIRMWARE_DIR:-/shared/custom_ipxe_firmware}"
+
+get_provisioning_interface()
+{
+    if [[ -n "$PROVISIONING_INTERFACE" ]]; then
+        # don't override the PROVISIONING_INTERFACE if one is provided
+        echo "$PROVISIONING_INTERFACE"
+        return
+    fi
+
+    local interface="provisioning"
+
+    if [[ -n "${PROVISIONING_IP}" ]]; then
+        if ip -br addr show | grep -qi " ${PROVISIONING_IP}/"; then
+            interface="$(ip -br addr show | grep -i " ${PROVISIONING_IP}/" | cut -f 1 -d ' ' | cut -f 1 -d '@')"
+        fi
+    fi
+
+    for mac in ${PROVISIONING_MACS//,/ }; do
+        if ip -br link show up | grep -qi "$mac"; then
+            interface="$(ip -br link show up | grep -i "$mac" | cut -f 1 -d ' ' | cut -f 1 -d '@')"
+            break
+        fi
+    done
+
+    echo "$interface"
+}
+
+PROVISIONING_INTERFACE="$(get_provisioning_interface)"
+export PROVISIONING_INTERFACE
+
+export LISTEN_ALL_INTERFACES="${LISTEN_ALL_INTERFACES:-true}"
+
+# Wait for the interface or IP to be up, sets $IRONIC_IP
+wait_for_interface_or_ip()
+{
+    # If $PROVISIONING_IP is specified, then we wait for that to become available on an interface, otherwise we look at $PROVISIONING_INTERFACE for an IP
+    if [[ -n "$PROVISIONING_IP" ]]; then
+        # Convert the address using ipcalc which strips out the subnet. For IPv6 addresses, this will give the short-form address
+        IRONIC_IP="$(ipcalc "${PROVISIONING_IP}" | grep "^Address:" | awk '{print $2}')"
+        export IRONIC_IP
+        until grep -F " ${IRONIC_IP}/" <(ip -br addr show); do
+            echo "Waiting for ${IRONIC_IP} to be configured on an interface"
+            sleep 1
+        done
+    else
+        until [[ -n "$IRONIC_IP" ]]; do
+            echo "Waiting for ${PROVISIONING_INTERFACE} interface to be configured"
+            IRONIC_IP="$(ip -br add show scope global up dev "${PROVISIONING_INTERFACE}" | awk '{print $3}' | sed -e 's%/.*%%' | head -n 1)"
+            export IRONIC_IP
+            sleep 1
+        done
+    fi
+
+    # If the IP contains a colon, then it's an IPv6 address, and the HTTP
+    # host needs surrounding with brackets
+    if [[ "$IRONIC_IP" =~ .*:.* ]]; then
+        export IPV=6
+        export IRONIC_URL_HOST="[$IRONIC_IP]"
+    else
+        export IPV=4
+        export IRONIC_URL_HOST="$IRONIC_IP"
+    fi
+}
+
+render_j2_config()
+{
+    ls $1 # DEBUG
+    python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$1"
+    python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$1" > "$2"
+    ls $2 # DEBUG
+}
+
+run_ironic_dbsync()
+{
+    if [[ "${IRONIC_USE_MARIADB:-true}" == "true" ]]; then
+        # It's possible for the dbsync to fail if mariadb is not up yet, so
+        # retry until success
+        until ironic-dbsync --config-file /etc/ironic/ironic.conf upgrade; do
+            echo "WARNING: ironic-dbsync failed, retrying"
+            sleep 1
+        done
+    else
+        # SQLite does not support some statements. Fortunately, we can just create
+        # the schema in one go if not already created, instead of going through an upgrade
+        DB_VERSION="$(ironic-dbsync --config-file /etc/ironic/ironic.conf version)"
+        if [[ "${DB_VERSION}" == "None" ]]; then
+            ironic-dbsync --config-file /etc/ironic/ironic.conf create_schema
+        fi
+    fi
+}
+
+# Use the special value "unix" for unix sockets
+export IRONIC_PRIVATE_PORT=${IRONIC_PRIVATE_PORT:-unix}
+
+export IRONIC_ACCESS_PORT=${IRONIC_ACCESS_PORT:-6385}
+export IRONIC_LISTEN_PORT=${IRONIC_LISTEN_PORT:-$IRONIC_ACCESS_PORT}
+
+export IRONIC_ENABLE_DISCOVERY=${IRONIC_ENABLE_DISCOVERY:-${IRONIC_INSPECTOR_ENABLE_DISCOVERY:-false}}
--- a/ironic-image/ironic-config/apache2-ipxe.conf.j2
+++ b/ironic-image/ironic-config/apache2-ipxe.conf.j2
@@ -1,27 +0,0 @@
-Listen 0.0.0.0:{{ env.IPXE_TLS_PORT }}
-Listen [::]:{{ env.IPXE_TLS_PORT }}
-
-<VirtualHost *:{{ env.IPXE_TLS_PORT }}>
-    ErrorLog /dev/stderr
-    LogLevel debug
-    CustomLog /dev/stdout combined
-
-    SSLEngine on
-    SSLProtocol {{ env.IPXE_SSL_PROTOCOL }}
-    SSLCertificateFile {{ env.IPXE_CERT_FILE }}
-    SSLCertificateKeyFile {{ env.IPXE_KEY_FILE }}
-
-    DocumentRoot "/shared/html"
-    <Directory "/shared/html">
-        Options Indexes FollowSymLinks
-        Require all granted
-    </Directory>
-    <Directory ~ "/shared/html/(redfish|ilo|images)/">
-        Require all denied
-    </Directory>
-
-    <Location ~ "^/.*">
-        SSLRequireSSL
-    </Location>
-
-</VirtualHost>
--- a/ironic-image/ironic-config/apache2-vmedia.conf.j2
+++ b/ironic-image/ironic-config/apache2-vmedia.conf.j2
@@ -1,39 +0,0 @@
-Listen 0.0.0.0:{{ env.VMEDIA_TLS_PORT }}
-Listen [::]:{{ env.VMEDIA_TLS_PORT }}
-
-<VirtualHost *:{{ env.VMEDIA_TLS_PORT }}>
-    ErrorLog /dev/stderr
-    LogLevel debug
-    CustomLog /dev/stdout combined
-
-    SSLEngine on
-    SSLProtocol {{ env.IRONIC_VMEDIA_SSL_PROTOCOL }}
-    SSLCertificateFile {{ env.IRONIC_VMEDIA_CERT_FILE }}
-    SSLCertificateKeyFile {{ env.IRONIC_VMEDIA_KEY_FILE }}
-
-    {% if "IRONIC_VMEDIA_TLS_12_CIPHERS" in env and env.IRONIC_VMEDIA_TLS_12_CIPHERS %}
-    SSLCipherSuite {{ env.IRONIC_VMEDIA_TLS_12_CIPHERS }}
-    {% endif %}
-    {% if "IRONIC_VMEDIA_TLS_13_CIPHERS" in env and env.IRONIC_VMEDIA_TLS_13_CIPHERS %}
-    SSLCipherSuite TLSv1.3 {{ env.IRONIC_VMEDIA_TLS_13_CIPHERS }}
-    {% endif %}
-    {% if "IRONIC_VMEDIA_CURVES" in env and env.IRONIC_VMEDIA_CURVES %}
-    SSLOpenSSLConfCmd Curves {{ env.IRONIC_VMEDIA_CURVES }}
-    {% endif %}
-    {% if env.IRONIC_VMEDIA_TLS_ENFORCE_SERVER_CIPHER_ORDER | lower == "true" %}
-    SSLHonorCipherOrder on
-    {% endif %}
-
-    <Directory ~ "/shared/html">
-        Require all denied
-    </Directory>
-    <Directory ~ "/shared/html/(redfish|ilo)/">
-        Require all granted
-    </Directory>
-
-    <Location ~ "^/.*">
-        SSLRequireSSL
-    </Location>
-
-</VirtualHost>
-
--- a/ironic-image/ironic-config/dnsmasq.conf.j2
+++ b/ironic-image/ironic-config/dnsmasq.conf.j2
@@ -1,74 +0,0 @@
-interface={{ env.PROVISIONING_INTERFACE }}
-bind-dynamic
-enable-tftp
-tftp-root=/shared/tftpboot
-log-queries
-dhcp-leasefile=/data/dnsmasq/dnsmasq.leases
-
-# Configure listening for DNS (0 disables DNS)
-port={{ env.DNS_PORT }}
-
-{%- if env.DHCP_RANGE | length %}
-log-dhcp
-dhcp-range={{ env.DHCP_RANGE }}
-{% endif %}
-
-{%- if env["DNS_IP"] is undefined %}
-# Disable DNS over provisioning network
-dhcp-option=6
-{% else %}
-dhcp-option=option{% if ":" in env["DNS_IP"] %}6{% endif %}:dns-server,{{ env["DNS_IP"] }}
-{% endif %}
-
-{# Network boot options for IPv4 and IPv6 #}
-{%- if env.IPV == "4" or env.IPV is undefined %}
-# IPv4 Configuration:
-dhcp-match=ipxe,175
-
-{# Set the router or disable it. Setting router is IPv4 specific, in v6 there #}
-{# are router advertisements that do the same thing. #}
-{%- if env["GATEWAY_IP"] is undefined %}
-# Disable default router(s)
-dhcp-option=3
-{% else %}
-dhcp-option=option:router,{{ env["GATEWAY_IP"] }}
-{% endif %}
-
-# Note: Need to test EFI booting
-dhcp-match=set:efi,option:client-arch,7
-dhcp-match=set:efi,option:client-arch,9
-dhcp-match=set:efi,option:client-arch,11
-# Client is (i)PXE booting on EFI machine
-dhcp-boot=tag:efi,/snponly.efi,{{ env.IRONIC_IP }}
-# Client is running (i)PXE on BIOS machine
-dhcp-boot=tag:!efi,/undionly.kpxe,{{ env.IRONIC_IP }}
-{%- if env.IPXE_TLS_SETUP != "true" %}
-dhcp-boot=tag:ipxe,http://{{ env.IRONIC_URL_HOST }}:{{ env.HTTP_PORT }}/boot.ipxe
-{% endif %}
-{% endif %}
-
-{% if env.IPV == "6" %}
-# IPv6 Configuration:
-enable-ra
-ra-param={{ env.PROVISIONING_INTERFACE }},0,0
-
-dhcp-vendorclass=set:pxe6,enterprise:343,PXEClient
-dhcp-userclass=set:ipxe6,iPXE
-# Client is (i)PXE booting on EFI machine
-dhcp-option=tag:efi,option6:bootfile-url,{{ env.IRONIC_URL_HOST }}/snponly.efi
-# Client is running (i)PXE on BIOS machine
-dhcp-option=tag:!efi,option6:bootfile-url,{{ env.IRONIC_URL_HOST }}/undionly.kpxe
-{%- if env.IPXE_TLS_SETUP != "true" %}
-dhcp-option=tag:ipxe6,option6:bootfile-url,{{ env.IRONIC_HTTP_URL }}/boot.ipxe
-{% endif %}
-{% endif %}
-
-{%- if env.DHCP_IGNORE | length %}
-dhcp-ignore={{ env.DHCP_IGNORE }}
-{% endif %}
-
-{%- if env.DHCP_HOSTS | length %}
-{%- for item in env.DHCP_HOSTS.split(";") %}
-dhcp-host={{ item }}
-{%- endfor %}
-{% endif %}
--- a/ironic-image/ironic-config/inspector.ipxe.j2
+++ b/ironic-image/ironic-config/inspector.ipxe.j2
@@ -1,10 +0,0 @@
-#!ipxe
-
-:retry_boot
-echo In inspector.ipxe
-imgfree
-# NOTE(dtantsur): keep inspection kernel params in [mdns]params in
-# ironic-inspector-image and configuration in configure-ironic.sh
-kernel --timeout 60000 {{ env.IRONIC_HTTP_URL }}/images/ironic-python-agent-${buildarch}.kernel ipa-insecure={{ env.IPA_INSECURE }} ipa-inspection-collectors={{ env.IRONIC_IPA_COLLECTORS }} systemd.journald.forward_to_console=yes BOOTIF=${mac} ipa-debug=1 ipa-enable-vlan-interfaces={{ env.IRONIC_ENABLE_VLAN_INTERFACES }} ipa-inspection-dhcp-all-interfaces=1 ipa-collect-lldp=1 {{ env.INSPECTOR_EXTRA_ARGS }} initrd=ironic-python-agent-${buildarch}.initramfs {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} || goto retry_boot
-initrd --timeout 60000 {{ env.IRONIC_HTTP_URL }}/images/ironic-python-agent-${buildarch}.initramfs || goto retry_boot
-boot
--- a/ironic-image/ironic-inspector.conf.j2
+++ b/ironic-image/ironic-inspector.conf.j2
@@ -0,0 +1,68 @@
+[DEFAULT]
+auth_strategy = noauth
+debug = true
+transport_url = fake://
+use_stderr = true
+{% if env.INSPECTOR_REVERSE_PROXY_SETUP == "true" %}
+{% if env.IRONIC_INSPECTOR_PRIVATE_PORT == "unix" %}
+listen_unix_socket = /shared/inspector.sock
+# NOTE(dtantsur): this is not ideal, but since the socket is accessed from
+# another container, we need to make it world-writeable.
+listen_unix_socket_mode = 0666
+{% else %}
+listen_port = {{ env.IRONIC_INSPECTOR_PRIVATE_PORT }}
+listen_address = 127.0.0.1
+{% endif %}
+{% elif env.LISTEN_ALL_INTERFACES | lower == "true" %}
+listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
+listen_address = ::
+{% else %}
+listen_port = {{ env.IRONIC_INSPECTOR_LISTEN_PORT }}
+listen_address = {{ env.IRONIC_IP }}
+{% endif %}
+host = {{ env.IRONIC_IP }}
+{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
+use_ssl = true
+{% endif %}
+
+[database]
+connection = sqlite:////var/lib/ironic-inspector/ironic-inspector.db
+
+{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
+[discovery]
+enroll_node_driver = ipmi
+{% endif %}
+
+[ironic]
+auth_type = none
+endpoint_override = {{ env.IRONIC_BASE_URL }}
+{% if env.IRONIC_TLS_SETUP == "true" %}
+cafile = {{ env.IRONIC_CACERT_FILE }}
+insecure = {{ env.IRONIC_INSECURE }}
+{% endif %}
+
+[processing]
+add_ports = all
+always_store_ramdisk_logs = true
+keep_ports = present
+{% if env.IRONIC_INSPECTOR_ENABLE_DISCOVERY == "true" %}
+node_not_found_hook = enroll
+{% endif %}
+permit_active_introspection = true
+power_off = false
+processing_hooks = $default_processing_hooks,lldp_basic
+ramdisk_logs_dir = /shared/log/ironic-inspector/ramdisk
+store_data = database
+
+[pxe_filter]
+driver = noop
+
+[service_catalog]
+auth_type = none
+endpoint_override = {{ env.IRONIC_INSPECTOR_BASE_URL }}
+
+{% if env.IRONIC_INSPECTOR_TLS_SETUP == "true" and env.INSPECTOR_REVERSE_PROXY_SETUP == "false" %}
+[ssl]
+cert_file = {{ env.IRONIC_INSPECTOR_CERT_FILE }}
+key_file = {{ env.IRONIC_INSPECTOR_KEY_FILE }}
+{% endif %}
--- a/ironic-image/ironic-probe.j2
+++ b/ironic-image/ironic-probe.j2
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+curl -sSf {{ env.PROBE_CURL_ARGS }} "{{ env.PROBE_URL }}"
+
+# TODO(dtantsur): when PROBE_KIND==readiness, try the conductor and driver API
+# to make sure the conductor is ready. This requires having access to secrets
+# since these endpoints are authenticated.
--- a/ironic-image/ironic-config/ironic.conf.j2
+++ b/ironic-image/ironic-config/ironic.conf.j2
@@ -4,19 +4,19 @@ debug = true
 default_deploy_interface = direct
 default_inspect_interface = agent
 default_network_interface = noop
-enabled_bios_interfaces = no-bios,redfish,idrac-redfish,irmc
-enabled_boot_interfaces = ipxe,pxe,fake,redfish-virtual-media,idrac-redfish-virtual-media,redfish-https
+enabled_bios_interfaces = no-bios,redfish,idrac-redfish,irmc,ilo
+enabled_boot_interfaces = ipxe,ilo-ipxe,pxe,ilo-pxe,fake,redfish-virtual-media,idrac-redfish-virtual-media,ilo-virtual-media,redfish-https
 enabled_deploy_interfaces = direct,fake,ramdisk,custom-agent
 enabled_firmware_interfaces = no-firmware,fake,redfish
 # NOTE(dtantsur): when changing this, make sure to update the driver
 # dependencies in Dockerfile.
-enabled_hardware_types = ipmi,idrac,irmc,fake-hardware,redfish,manual-management
-enabled_inspect_interfaces = agent,irmc,fake,redfish
-enabled_management_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,noop
+enabled_hardware_types = ipmi,idrac,irmc,fake-hardware,redfish,manual-management,ilo,ilo5
+enabled_inspect_interfaces = agent,irmc,fake,redfish,ilo
+enabled_management_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,ilo,ilo5,noop
 enabled_network_interfaces = noop
-enabled_power_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish
-enabled_raid_interfaces = no-raid,irmc,agent,fake,redfish,idrac-redfish
-enabled_vendor_interfaces = no-vendor,ipmitool,idrac-redfish,redfish,fake
+enabled_power_interfaces = ipmitool,irmc,fake,redfish,idrac-redfish,ilo
+enabled_raid_interfaces = no-raid,irmc,agent,fake,redfish,idrac-redfish,ilo5
+enabled_vendor_interfaces = no-vendor,ipmitool,idrac-redfish,redfish,ilo,fake
 {% if env.IRONIC_EXPOSE_JSON_RPC | lower == "true" %}
 rpc_transport = json-rpc
 {% else %}
@@ -25,13 +25,7 @@ rpc_transport = none
 use_stderr = true
 # NOTE(dtantsur): the default md5 is not compatible with FIPS mode
 hash_ring_algorithm = sha256
-{% if env.ENABLE_IPV4 %}
 my_ip = {{ env.IRONIC_IP }}
-{% endif %}
-{% if env.ENABLE_IPV6 %}
-my_ipv6 = {{ env.IRONIC_IPV6 }}
-{% endif %}
-
 host = {{ env.IRONIC_CONDUCTOR_HOST }}

 # If a path to a certificate is defined, use that first for webserver
@@ -47,10 +41,6 @@ isolinux_bin = /usr/share/syslinux/isolinux.bin
 # the ESP provided in [conductor]bootloader.
 grub_config_path = EFI/BOOT/grub.cfg

-# NOTE(hroyrh): updating the default temp directory to fix device cross links
-# errors when hard linking
-tempdir = /shared/tmp
-
 [agent]
 deploy_logs_collect = always
 deploy_logs_local_path = /shared/log/ironic/deploy
@@ -59,7 +49,6 @@ deploy_logs_local_path = /shared/log/ironic/deploy
 # retries here works around such problems without affecting the normal path.
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1822763
 max_command_attempts = 30
-certificates_path = {{ env.IRONIC_GEN_CERT_DIR }}

 [api]
 {% if env.IRONIC_REVERSE_PROXY_SETUP == "true" %}
@@ -74,7 +63,7 @@ port = {{ env.IRONIC_PRIVATE_PORT }}
 {% endif %}
 public_endpoint = {{ env.IRONIC_BASE_URL }}
 {% else %}
-host_ip = {{ env.IRONIC_HOST_IP }}
+host_ip = {% if env.LISTEN_ALL_INTERFACES | lower == "true" %}::{% else %}{{ env.IRONIC_IP }}{% endif %}
 port = {{ env.IRONIC_LISTEN_PORT }}
 {% if env.IRONIC_TLS_SETUP == "true" %}
 enable_ssl_api = true
@@ -89,40 +78,33 @@ network_data_schema = /etc/ironic/network-data-schema-empty.json
 automated_clean = {{ env.IRONIC_AUTOMATED_CLEAN }}
 # NOTE(dtantsur): keep aligned with [pxe]boot_retry_timeout below.
 deploy_callback_timeout = 4800
-bootloader_by_arch = {{ env.BOOTLOADER_BY_ARCH }}
+send_sensor_data = {{ env.SEND_SENSOR_DATA }}
+# NOTE(TheJulia): Do not lower this value below 120 seconds.
+# Power state is checked every 60 seconds and BMC activity should
+# be avoided more often than once every sixty seconds.
+send_sensor_data_interval = 160
+bootloader = {{ env.IRONIC_BOOT_BASE_URL }}/uefi_esp-{{ env.DEPLOY_ARCHITECTURE }}.img
 verify_step_priority_override = management.clear_job_queue:90
 # We don't use this feature, and it creates an additional load on the database
 node_history = False
 # Provide for a timeout longer than 60 seconds for certain vendor's hardware
 power_state_change_timeout = 120
-{% if env.DEPLOY_KERNEL_URL is defined %}
-deploy_kernel = {{ env.DEPLOY_KERNEL_URL }}
+{% if env.IRONIC_DEFAULT_KERNEL is defined %}
+deploy_kernel = file://{{ env.IRONIC_DEFAULT_KERNEL }}
 {% endif %}
-{% if env.DEPLOY_KERNEL_BY_ARCH is defined %}
-deploy_kernel_by_arch = {{ env.DEPLOY_KERNEL_BY_ARCH }}
+{% if env.IRONIC_DEFAULT_RAMDISK is defined %}
+deploy_ramdisk = file://{{ env.IRONIC_DEFAULT_RAMDISK }}
 {% endif %}
-{% if env.DEPLOY_RAMDISK_URL is defined %}
-deploy_ramdisk = {{ env.DEPLOY_RAMDISK_URL }}
-{% endif %}
-{% if env.DEPLOY_RAMDISK_BY_ARCH is defined %}
-deploy_ramdisk_by_arch = {{ env.DEPLOY_RAMDISK_BY_ARCH }}
-{% endif %}
-{% if env.DISABLE_DEEP_IMAGE_INSPECTION | lower == "true" %}
-disable_deep_image_inspection = True
-{% endif %}
-# Allowed path for file:// links: ipa-downloader uses /shared/html/images,
-# while the bootloader configuration above refers to /templates.
-file_url_allowed_paths = /shared/html/images,/templates

 [database]
-{% if env.IRONIC_USE_MARIADB | lower == "true" %}
-connection = {{ env.MARIADB_CONNECTION }}
-{% else %}
-connection = {{ env.LOCAL_DB_URI }}
+{% if env.IRONIC_USE_MARIADB | lower == "false" %}
+connection = sqlite:////var/lib/ironic/ironic.sqlite
 # Synchronous mode is required for data integrity in case of operating system
 # crash. In our case we restart the container from scratch, so we can save some
 # IO by not doing syncs all the time.
 sqlite_synchronous = False
+{% else %}
+connection = {{ env.MARIADB_CONNECTION }}
 {% endif %}

 [deploy]
@@ -130,16 +112,15 @@ default_boot_option = local
 erase_devices_metadata_priority = 10
 erase_devices_priority = 0
 http_root = /shared/html/
-http_url = {% if env.VMEDIA_TLS_PORT %}{{ env.IRONIC_HTTPS_VMEDIA_URL }}{% else %}{{ env.IRONIC_HTTP_URL }}{% endif %}
+http_url = {{ env.IRONIC_BOOT_BASE_URL }}
 fast_track = {{ env.IRONIC_FAST_TRACK }}
-iso_master_path = /shared/html/master_iso_images
 {% if env.IRONIC_BOOT_ISO_SOURCE %}
 ramdisk_image_download_source = {{ env.IRONIC_BOOT_ISO_SOURCE }}
 {% endif %}
 {% if env.IRONIC_EXTERNAL_HTTP_URL %}
 external_http_url = {{ env.IRONIC_EXTERNAL_HTTP_URL }}
-{% elif env.VMEDIA_TLS_PORT %}
-external_http_url = {{ env.IRONIC_HTTPS_VMEDIA_URL }}
+{% elif env.IRONIC_VMEDIA_TLS_SETUP == "true" %}
+external_http_url = https://{{ env.IRONIC_URL_HOST }}:{{ env.VMEDIA_TLS_PORT }}
 {% endif %}
 {% if env.IRONIC_EXTERNAL_CALLBACK_URL %}
 external_callback_url = {{ env.IRONIC_EXTERNAL_CALLBACK_URL }}
@@ -194,9 +175,8 @@ cipher_suite_versions = 3,17
 # unauthenticated connections from other processes in the same host since the
 # containers are in host networking.
 auth_strategy = http_basic
-http_basic_auth_user_file = {{ env.IRONIC_RPC_HTPASSWD_FILE }}
-host_ip = {{ env.IRONIC_HOST_IP }}
-port = {{ env.IRONIC_JSON_RPC_PORT }}
+http_basic_auth_user_file = /etc/ironic/htpasswd-rpc
+host_ip = {% if env.LISTEN_ALL_INTERFACES | lower == "true" %}::{% else %}{{ env.IRONIC_IP }}{% endif %}
 {% if env.IRONIC_TLS_SETUP == "true" %}
 use_ssl = true
 cafile = {{ env.IRONIC_CACERT_FILE }}
@@ -207,26 +187,11 @@ insecure = {{ env.IRONIC_INSECURE }}
 [nova]
 send_power_notifications = false

-# Sections (oslo_messaging_notifications, sensor_data, metrics) required for sensor data collection using ironic-prometheus-exporter (IPE):
-{% if env.SEND_SENSOR_DATA | lower == "true" %}
 [oslo_messaging_notifications]
 driver = prometheus_exporter
 location = /shared/ironic_prometheus_exporter
 transport_url = fake://

-[sensor_data]
-send_sensor_data = {{ env.SEND_SENSOR_DATA }}
-# NOTE(TheJulia): Do not lower this value below 120 seconds.
-# Power state is checked every 60 seconds and BMC activity should
-# be avoided more often than once every sixty seconds.
-interval = 160
-# Additional sensor_data options can be configured via OS_ environment variables:
-# https://docs.openstack.org/ironic/latest/configuration/config.html#sensor-data
-
-[metrics]
-backend = collector
-{% endif %}
-
 [pxe]
 # NOTE(dtantsur): keep this value at least 3x lower than
 # [conductor]deploy_callback_timeout so that at least some retries happen.
@@ -244,22 +209,19 @@ enable_netboot_fallback = true
 # Enable the fallback path to in-band inspection
 ipxe_fallback_script = inspector.ipxe
 {% if env.IPXE_TLS_SETUP | lower == "true" %}
-ipxe_config_template = /templates/ipxe_config.template
+ipxe_config_template = /tmp/ipxe_config.template
 {% endif %}

 [redfish]
 use_swift = false
 kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
-{% if env.BMC_TLS_ENABLED == "true" %}
-# idrac uses the same options as the redfish driver
-verify_ca = {{ env.BMC_CACERT_FILE }}
-{% endif %}
+
+[ilo]
+kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
+use_web_server_for_images = true

 [irmc]
 kernel_append_params = nofb nomodeset vga=normal ipa-insecure={{ env.IPA_INSECURE }} {% if env.ENABLE_FIPS_IPA %}fips={{ env.ENABLE_FIPS_IPA|trim }}{% endif %} {% if env.IRONIC_RAMDISK_SSH_KEY %}sshkey="{{ env.IRONIC_RAMDISK_SSH_KEY|trim }}"{% endif %} {{ env.IRONIC_KERNEL_PARAMS|trim }} systemd.journald.forward_to_console=yes net.ifnames={{ '0' if env.PREDICTABLE_NIC_NAMES == 'false' else '1' }}
-{% if env.BMC_TLS_ENABLED == "true" %}
-verify_ca = {{ env.BMC_CACERT_FILE }}
-{% endif %}

 [service_catalog]
 endpoint_override = {{ env.IRONIC_BASE_URL }}
@@ -269,8 +231,3 @@ endpoint_override = {{ env.IRONIC_BASE_URL }}
 cert_file = {{ env.IRONIC_CERT_FILE }}
 key_file = {{ env.IRONIC_KEY_FILE }}
 {% endif %}
-
-[oci]
-{% if env.IRONIC_OCI_AUTH_CONFIG is defined %}
-authentication_config = {{ env.IRONIC_OCI_AUTH_CONFIG }}
-{% endif %}
--- a/ironic-image/ironic-config/network-data-schema-empty.json
+++ b/ironic-image/ironic-config/network-data-schema-empty.json
--- a/ironic-image/prepare-efi.sh
+++ b/ironic-image/prepare-efi.sh
@@ -9,7 +9,7 @@ declare -A efi_arch=(

 for arch in "${!efi_arch[@]}"; do
  
-  DEST=/tmp/uefi_esp_${arch}.img
+  DEST=/tmp/esp-${arch}.img

  dd bs=1024 count=6400 if=/dev/zero of=$DEST
  mkfs.msdos -F 12 -n 'ESP_IMAGE' $DEST
--- a/ironic-image/scripts/rundnsmasq
+++ b/ironic-image/scripts/rundnsmasq
@@ -7,16 +7,13 @@ set -eux
 # shellcheck disable=SC1091
 . /bin/tls-common.sh

+export HTTP_PORT=${HTTP_PORT:-80}
 DNSMASQ_EXCEPT_INTERFACE=${DNSMASQ_EXCEPT_INTERFACE:-lo}
 export DNS_PORT=${DNS_PORT:-0}

 wait_for_interface_or_ip
 if [[ "${DNS_IP:-}" == "provisioning" ]]; then
-    if [[ "${IPV}" == "4" ]]; then
-      export DNS_IP="${IRONIC_IP}"
-    else
-      export DNS_IP="[${IRONIC_IP}]"
-    fi
+    export DNS_IP="$IRONIC_URL_HOST"
 fi

 mkdir -p /shared/tftpboot
@@ -35,12 +32,12 @@ fi
 # Template and write dnsmasq.conf
 # we template via /tmp as sed otherwise creates temp files in /etc directory
 # where we can't write
-python3.13 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' <"/templates/dnsmasq.conf.j2" >"${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"
+python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' </etc/dnsmasq.conf.j2 >/tmp/dnsmasq.conf

 for iface in $(echo "$DNSMASQ_EXCEPT_INTERFACE" | tr ',' ' '); do
-    sed -i -e "/^interface=.*/ a\except-interface=${iface}" "${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"
+    sed -i -e "/^interface=.*/ a\except-interface=${iface}" /tmp/dnsmasq.conf
 done
-cat "${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf" > "${DNSMASQ_CONF_DIR}/dnsmasq.conf"
-rm "${DNSMASQ_TEMP_DIR}/dnsmasq_temp.conf"
+cat /tmp/dnsmasq.conf > /etc/dnsmasq.conf
+rm /tmp/dnsmasq.conf

-exec /usr/sbin/dnsmasq -d -q -C "${DNSMASQ_CONF_DIR}/dnsmasq.conf"
+exec /usr/sbin/dnsmasq -d -q -C /etc/dnsmasq.conf
--- a/ironic-image/scripts/runhttpd
+++ b/ironic-image/scripts/runhttpd
@@ -5,6 +5,7 @@
 . /bin/ironic-common.sh
 . /bin/auth-common.sh

+export HTTP_PORT=${HTTP_PORT:-80}
 export VMEDIA_TLS_PORT=${VMEDIA_TLS_PORT:-8083}

 export IRONIC_REVERSE_PROXY_SETUP=${IRONIC_REVERSE_PROXY_SETUP:-false}
@@ -27,28 +28,25 @@ wait_for_interface_or_ip
 mkdir -p /shared/html
 chmod 0777 /shared/html

-INSPECTOR_EXTRA_ARGS=" ipa-inspection-callback-url=${IRONIC_BASE_URL}/v1/continue_inspection"
+IRONIC_BASE_URL="${IRONIC_SCHEME}://${IRONIC_URL_HOST}"
+
+INSPECTOR_EXTRA_ARGS=" ipa-inspection-callback-url=${IRONIC_BASE_URL}:${IRONIC_ACCESS_PORT}/v1/continue_inspection"

 if [[ "$IRONIC_FAST_TRACK" == "true" ]]; then
-    INSPECTOR_EXTRA_ARGS+=" ipa-api-url=${IRONIC_BASE_URL}"
+    INSPECTOR_EXTRA_ARGS+=" ipa-api-url=${IRONIC_BASE_URL}:${IRONIC_ACCESS_PORT}"
 fi
 export INSPECTOR_EXTRA_ARGS

 # Copy files to shared mount
-render_j2_config /templates/inspector.ipxe.j2 /shared/html/inspector.ipxe
-# cp -r /etc/httpd/* "${HTTPD_DIR}"
-if [[ -f "${HTTPD_CONF_DIR}/httpd.conf" ]]; then
-    mv "${HTTPD_CONF_DIR}/httpd.conf" "${HTTPD_CONF_DIR}/httpd.conf.example"
-fi
+render_j2_config /tmp/inspector.ipxe.j2 /shared/html/inspector.ipxe
+cp /tmp/uefi_esp*.img /shared/html/

 # Render the core httpd config
-render_j2_config "/etc/httpd/conf/httpd.conf.j2" \
-    "${HTTPD_CONF_DIR}/httpd.conf"
+render_j2_config /etc/httpd/conf/httpd.conf.j2 /etc/httpd/conf/httpd.conf

 if [[ "$IRONIC_TLS_SETUP" == "true" ]]; then
    if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "true" ]]; then
-        render_j2_config "/templates/httpd-ironic-api.conf.j2" \
-            "${HTTPD_CONF_DIR_D}/ironic.conf"
+        render_j2_config /tmp/httpd-ironic-api.conf.j2 /etc/httpd/conf.d/ironic.conf
    fi
 else
    export IRONIC_REVERSE_PROXY_SETUP="false" # If TLS is not used, we have no reason to use the reverse proxy
@@ -58,24 +56,33 @@ write_htpasswd_files

 # Render httpd TLS configuration for /shared/html/<redifsh;ilo>
 if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]]; then
-    render_j2_config "/templates/httpd-vmedia.conf.j2" \
-        "${HTTPD_CONF_DIR_D}/vmedia.conf"
+    render_j2_config /etc/httpd-vmedia.conf.j2 /etc/httpd/conf.d/vmedia.conf
 fi

 # Render httpd TLS configuration for /shared/html
 if [[ "$IPXE_TLS_SETUP" == "true" ]]; then
    mkdir -p /shared/html/custom-ipxe
    chmod 0777 /shared/html/custom-ipxe
-    render_j2_config "/templates/httpd-ipxe.conf.j2" "${HTTPD_CONF_DIR_D}/ipxe.conf"
+    render_j2_config "/etc/httpd-ipxe.conf.j2" "/etc/httpd/conf.d/ipxe.conf"
    cp "${IPXE_CUSTOM_FIRMWARE_DIR}/undionly.kpxe" \
       "${IPXE_CUSTOM_FIRMWARE_DIR}/snponly.efi" \
       "/shared/html/custom-ipxe"
 fi

 # Set up inotify to kill the container (restart) whenever cert files for ironic api change
-configure_restart_on_certificate_update "${IRONIC_TLS_SETUP}" httpd "${IRONIC_CERT_FILE}"
+if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
+        kill -WINCH $(pgrep httpd)
+    done &
+fi

 # Set up inotify to kill the container (restart) whenever cert of httpd for /shared/html/<redifsh;ilo> path change
-configure_restart_on_certificate_update "${IRONIC_VMEDIA_TLS_SETUP}" httpd "${IRONIC_VMEDIA_CERT_FILE}"
+if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_VMEDIA_CERT_FILE}" | while read -r file event; do
+        kill -WINCH $(pgrep httpd)
+    done &
+fi

-exec /usr/sbin/httpd -DFOREGROUND -f "${HTTPD_CONF_DIR}/httpd.conf"
+exec /usr/sbin/httpd -DFOREGROUND -f /etc/httpd/conf/httpd.conf
--- a/ironic-image/runironic
+++ b/ironic-image/runironic
@@ -0,0 +1,23 @@
+#!/usr/bin/bash
+
+# This setting must go before configure-ironic since it has different defaults.
+export IRONIC_USE_MARIADB=${IRONIC_USE_MARIADB:-false}
+
+# shellcheck disable=SC1091
+. /bin/configure-ironic.sh
+
+# Ramdisk logs
+mkdir -p /shared/log/ironic/deploy
+
+run_ironic_dbsync
+
+if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
+        kill $(pgrep ironic)
+    done &
+fi
+
+configure_ironic_auth
+
+exec /usr/bin/ironic
--- a/ironic-image/runironic-api
+++ b/ironic-image/runironic-api
@@ -0,0 +1,13 @@
+#!/usr/bin/bash
+
+export IRONIC_DEPLOYMENT="API"
+
+# shellcheck disable=SC1091
+. /bin/configure-ironic.sh
+
+export IRONIC_REVERSE_PROXY_SETUP=false
+
+python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < /tmp/httpd-ironic-api.conf.j2 > /etc/httpd/conf.d/ironic.conf
+
+# shellcheck disable=SC1091
+. /bin/runhttpd
--- a/ironic-image/runironic-conductor
+++ b/ironic-image/runironic-conductor
@@ -0,0 +1,20 @@
+#!/usr/bin/bash
+
+export IRONIC_DEPLOYMENT="Conductor"
+
+# shellcheck disable=SC1091
+. /bin/configure-ironic.sh
+
+# Ramdisk logs
+mkdir -p /shared/log/ironic/deploy
+
+run_ironic_dbsync
+
+if [[ "$IRONIC_TLS_SETUP" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_CERT_FILE}" | while read -r file event; do
+        kill $(pgrep ironic)
+    done &
+fi
+
+exec /usr/bin/ironic-conductor
--- a/ironic-image/runironic-exporter
+++ b/ironic-image/runironic-exporter
@@ -0,0 +1,12 @@
+#!/usr/bin/bash
+
+# shellcheck disable=SC1091
+. /bin/configure-ironic.sh
+
+FLASK_RUN_HOST=${FLASK_RUN_HOST:-0.0.0.0}
+FLASK_RUN_PORT=${FLASK_RUN_PORT:-9608}
+
+export IRONIC_CONFIG="/etc/ironic/ironic.conf"
+
+exec gunicorn -b "${FLASK_RUN_HOST}:${FLASK_RUN_PORT}" -w 4 \
+    ironic_prometheus_exporter.app.wsgi:application
--- a/ironic-image/runironic-inspector
+++ b/ironic-image/runironic-inspector
@@ -0,0 +1,62 @@
+#!/usr/bin/bash
+
+set -euxo pipefail
+
+CONFIG=/etc/ironic-inspector/ironic-inspector.conf
+
+export IRONIC_INSPECTOR_ENABLE_DISCOVERY=${IRONIC_INSPECTOR_ENABLE_DISCOVERY:-false}
+export INSPECTOR_REVERSE_PROXY_SETUP=${INSPECTOR_REVERSE_PROXY_SETUP:-false}
+
+# shellcheck disable=SC1091
+. /bin/tls-common.sh
+# shellcheck disable=SC1091
+. /bin/ironic-common.sh
+# shellcheck disable=SC1091
+. /bin/auth-common.sh
+
+if [[ "$USE_IRONIC_INSPECTOR" == "false" ]]; then
+    echo "FATAL: ironic-inspector is disabled via USE_IRONIC_INSPECTOR"
+    exit 1
+fi
+
+wait_for_interface_or_ip
+
+IRONIC_INSPECTOR_PORT=${IRONIC_INSPECTOR_ACCESS_PORT}
+if [[ "$IRONIC_INSPECTOR_TLS_SETUP" == "true" ]]; then
+    if [[ "${INSPECTOR_REVERSE_PROXY_SETUP}" == "true" ]] && [[ "${IRONIC_INSPECTOR_PRIVATE_PORT}" != "unix" ]]; then
+        IRONIC_INSPECTOR_PORT=$IRONIC_INSPECTOR_PRIVATE_PORT
+    fi
+else
+    export INSPECTOR_REVERSE_PROXY_SETUP="false" # If TLS is not used, we have no reason to use the reverse proxy
+fi
+
+export IRONIC_INSPECTOR_BASE_URL="${IRONIC_INSPECTOR_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_INSPECTOR_PORT}"
+export IRONIC_BASE_URL="${IRONIC_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_ACCESS_PORT}"
+
+build_j2_config()
+{
+    local CONFIG_FILE="$1"
+    python3 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$CONFIG_FILE.j2"
+}
+
+# Merge with the original configuration file from the package.
+build_j2_config "$CONFIG" | crudini --merge "$CONFIG"
+
+configure_inspector_auth
+
+configure_client_basic_auth ironic "${CONFIG}"
+
+ironic-inspector-dbsync --config-file "${CONFIG}" upgrade
+
+if [[ "$INSPECTOR_REVERSE_PROXY_SETUP" == "false" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
+    # shellcheck disable=SC2034
+    inotifywait -m -e delete_self "${IRONIC_INSPECTOR_CERT_FILE}" | while read -r file event; do
+        kill $(pgrep ironic)
+    done &
+fi
+
+# Make sure ironic traffic bypasses any proxies
+export NO_PROXY="${NO_PROXY:-},$IRONIC_IP"
+
+# shellcheck disable=SC2086
+exec /usr/bin/ironic-inspector
--- a/ironic-image/runlogwatch.sh
+++ b/ironic-image/runlogwatch.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/bash
+
+# Ramdisk logs path
+LOG_DIR="/shared/log/ironic/deploy"
+
+# The ironic container creates the directory, wait for
+# it to exist before running inotifywait or it can fail causing
+# a spurious restart
+while [ ! -d "${LOG_DIR}" ]; do
+  echo "Waiting for ${LOG_DIR}"
+  sleep 5
+done
+
+inotifywait -m "${LOG_DIR}" -e close_write |
+    while read -r path _action file; do
+        echo "************ Contents of ${path}/${file} ramdisk log file bundle **************"
+        tar -xOzvvf "${path}/${file}" | sed -e "s/^/${file}: /"
+        rm -f "${path}/${file}"
+    done
--- a/ironic-image/scripts/auth-common.sh
+++ b/ironic-image/scripts/auth-common.sh
@@ -1,101 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-export IRONIC_REVERSE_PROXY_SETUP=${IRONIC_REVERSE_PROXY_SETUP:-false}
-
-# CUSTOM_CONFIG_DIR is also managed in the ironic-common.sh, in order to
-# keep auth-common and ironic-common separate (to stay consistent with the
-# architecture) part of the ironic-common logic had to be duplicated
-CUSTOM_CONFIG_DIR="${CUSTOM_CONFIG_DIR:-/conf}"
-IRONIC_CONF_DIR="${CUSTOM_CONFIG_DIR}/ironic"
-
-# Backward compatibility
-if [[ "${IRONIC_DEPLOYMENT:-}" == "Conductor" ]]; then
-    export IRONIC_EXPOSE_JSON_RPC=true
-else
-    export IRONIC_EXPOSE_JSON_RPC="${IRONIC_EXPOSE_JSON_RPC:-false}"
-fi
-
-IRONIC_HTPASSWD_FILE="${IRONIC_CONF_DIR}/htpasswd"
-export IRONIC_RPC_HTPASSWD_FILE="${IRONIC_HTPASSWD_FILE}-rpc"
-if [[ -f "/auth/ironic/htpasswd" ]]; then
-    IRONIC_HTPASSWD=$(</auth/ironic/htpasswd)
-fi
-if [[ -f "/auth/ironic-rpc/htpasswd" ]]; then
-    IRONIC_RPC_HTPASSWD=$(</auth/ironic-rpc/htpasswd)
-fi
-export IRONIC_HTPASSWD=${IRONIC_HTPASSWD:-${HTTP_BASIC_HTPASSWD:-}}
-export IRONIC_RPC_HTPASSWD=${IRONIC_RPC_HTPASSWD:-${IRONIC_HTPASSWD}}
-
-if [[ -n "${MARIADB_PASSWORD:-}" ]]; then
-    echo "WARNING: passing MARIADB_PASSWORD is deprecated, mount a secret under /auth/mariadb instead"
-elif [[ -f /auth/mariadb/password ]]; then
-    MARIADB_PASSWORD=$(</auth/mariadb/password)
-fi
-
-if [[ -z "${MARIADB_USER:-}" ]] && [[ -f /auth/mariadb/username ]]; then
-    MARIADB_USER=$(</auth/mariadb/username)
-fi
-
-IRONIC_CONFIG="${IRONIC_CONF_DIR}/ironic.conf"
-
-if [[ -z "${IRONIC_OCI_AUTH_CONFIG:-}" ]] && [[ -f "/auth/oci.json" ]]; then
-    export IRONIC_OCI_AUTH_CONFIG="/auth/oci.json"
-fi
-
-configure_json_rpc_auth()
-{
-    if [[ "${IRONIC_EXPOSE_JSON_RPC}" != "true" ]]; then
-        return
-    fi
-
-    local auth_config_file="/auth/ironic-rpc/auth-config"
-    local username_file="/auth/ironic-rpc/username"
-    local password_file="/auth/ironic-rpc/password"
-    if [[ -f "${username_file}" ]] && [[ -f "${password_file}" ]]; then
-        crudini --set "${IRONIC_CONFIG}" json_rpc username "$(<${username_file})"
-        set +x
-        crudini --set "${IRONIC_CONFIG}" json_rpc password "$(<${password_file})"
-        set -x
-    elif [[ -f "${auth_config_file}" ]]; then
-        echo "WARNING: using auth-config is deprecated, mount a secret directly"
-        # Merge configurations in the "auth" directory into the default ironic configuration file
-        crudini --merge "${IRONIC_CONFIG}" < "${auth_config_file}"
-    else
-        echo "FATAL: no client-side credentials provided for JSON RPC"
-        echo "HINT: mount a secret with username and password fields under /auth/ironic-rpc"
-        exit 1
-    fi
-
-    if [[ -z "${IRONIC_RPC_HTPASSWD}" ]]; then
-        if [[ -f "${username_file}" ]] && [[ -f "${password_file}" ]]; then
-            htpasswd -c -i -B "${IRONIC_RPC_HTPASSWD_FILE}" "$(<${username_file})" <"${password_file}"
-        else
-            echo "FATAL: enabling JSON RPC requires authentication"
-            echo "HINT: mount a secret with either username and password or htpasswd under /auth/ironic-rpc"
-            exit 1
-        fi
-    else
-        printf "%s\n" "${IRONIC_RPC_HTPASSWD}" > "${IRONIC_RPC_HTPASSWD_FILE}"
-    fi
-}
-
-configure_ironic_auth()
-{
-    # Configure HTTP basic auth for API server
-    if [[ -n "${IRONIC_HTPASSWD}" ]]; then
-        printf "%s\n" "${IRONIC_HTPASSWD}" > "${IRONIC_HTPASSWD_FILE}"
-        if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "false" ]]; then
-            crudini --set "${IRONIC_CONFIG}" DEFAULT auth_strategy http_basic
-            crudini --set "${IRONIC_CONFIG}" DEFAULT http_basic_auth_user_file "${IRONIC_HTPASSWD_FILE}"
-        fi
-    fi
-}
-
-write_htpasswd_files()
-{
-    if [[ -n "${IRONIC_HTPASSWD:-}" ]]; then
-        printf "%s\n" "${IRONIC_HTPASSWD}" > "${IRONIC_HTPASSWD_FILE}"
-    fi
-}
--- a/ironic-image/scripts/configure-ironic.sh
+++ b/ironic-image/scripts/configure-ironic.sh
@@ -1,153 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-IRONIC_EXTERNAL_IP="${IRONIC_EXTERNAL_IP:-}"
-export VMEDIA_TLS_PORT="${VMEDIA_TLS_PORT:-}"
-
-# Define the VLAN interfaces to be included in introspection report, e.g.
-#   all - all VLANs on all interfaces using LLDP information
-#   <interface> - all VLANs on a particular interface using LLDP information
-#   <interface.vlan> - a particular VLAN on an interface, not relying on LLDP
-export IRONIC_ENABLE_VLAN_INTERFACES=${IRONIC_ENABLE_VLAN_INTERFACES:-${IRONIC_INSPECTOR_VLAN_INTERFACES:-all}}
-
-# shellcheck disable=SC1091
-. /bin/tls-common.sh
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-# shellcheck disable=SC1091
-. /bin/auth-common.sh
-
-if [[ "${IRONIC_USE_MARIADB}" == true ]]; then
-    if [[ -z "${MARIADB_PASSWORD:-}" ]]; then
-        echo "FATAL: IRONIC_USE_MARIADB requires password, mount a secret under /auth/mariadb"
-        exit 1
-    fi
-    MARIADB_DATABASE=${MARIADB_DATABASE:-ironic}
-    MARIADB_USER=${MARIADB_USER:-ironic}
-    MARIADB_HOST=${MARIADB_HOST:-127.0.0.1}
-    export MARIADB_CONNECTION="mysql+pymysql://${MARIADB_USER}:${MARIADB_PASSWORD}@${MARIADB_HOST}/${MARIADB_DATABASE}?charset=utf8"
-    if [[ "$MARIADB_TLS_ENABLED" == "true" ]]; then
-        export MARIADB_CONNECTION="${MARIADB_CONNECTION}&ssl=on&ssl_ca=${MARIADB_CACERT_FILE}"
-    fi
-fi
-
-# zero makes it do cpu number detection on Ironic side
-export NUMWORKERS=${NUMWORKERS:-0}
-
-
-# Whether to enable fast_track provisioning or not
-export IRONIC_FAST_TRACK=${IRONIC_FAST_TRACK:-true}
-
-# Whether cleaning disks before and after deployment
-export IRONIC_AUTOMATED_CLEAN=${IRONIC_AUTOMATED_CLEAN:-true}
-
-# Wheter to enable the sensor data collection
-export SEND_SENSOR_DATA=${SEND_SENSOR_DATA:-false}
-
-# Set of collectors that should be used with IPA inspection
-export IRONIC_IPA_COLLECTORS=${IRONIC_IPA_COLLECTORS:-default,logs}
-
-wait_for_interface_or_ip
-
-if [[ "$(echo "$LISTEN_ALL_INTERFACES" | tr '[:upper:]' '[:lower:]')" == "true" ]]; then
-export IRONIC_HOST_IP="::"
-elif [[ -n "${ENABLE_IPV6}" ]]; then
-export IRONIC_HOST_IP="$IRONIC_IPV6"
-else
-export IRONIC_HOST_IP="$IRONIC_IP"
-fi
-
-if [[ "${VMEDIA_TLS_PORT}" ]]; then
-   export IRONIC_HTTPS_VMEDIA_URL="https://${IRONIC_URL_HOST}:${VMEDIA_TLS_PORT}"
-fi
-
-# Hostname to use for the current conductor instance.
-export IRONIC_CONDUCTOR_HOST=${IRONIC_CONDUCTOR_HOST:-${IRONIC_URL_HOST}}
-
-if [[ -n "$IRONIC_EXTERNAL_IP" ]]; then
-    export IRONIC_EXTERNAL_CALLBACK_URL=${IRONIC_EXTERNAL_CALLBACK_URL:-"${IRONIC_SCHEME}://${IRONIC_EXTERNAL_IP}:${IRONIC_ACCESS_PORT}"}
-    if [[ "$IRONIC_VMEDIA_TLS_SETUP" == "true" ]]; then
-        export IRONIC_EXTERNAL_HTTP_URL=${IRONIC_EXTERNAL_HTTP_URL:-"https://${IRONIC_EXTERNAL_IP}:${VMEDIA_TLS_PORT}"}
-    else
-        export IRONIC_EXTERNAL_HTTP_URL=${IRONIC_EXTERNAL_HTTP_URL:-"http://${IRONIC_EXTERNAL_IP}:${HTTP_PORT}"}
-    fi
-fi
-
-IMAGE_CACHE_PREFIX="/shared/html/images/ironic-python-agent"
-if [[ -z "${DEPLOY_KERNEL_URL:-}" ]] && [[ -z "${DEPLOY_RAMDISK_URL:-}" ]] && \
-       [[ -f "${IMAGE_CACHE_PREFIX}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}.initramfs" ]]; then
-    export DEPLOY_KERNEL_URL="file://${IMAGE_CACHE_PREFIX}.kernel"
-    export DEPLOY_RAMDISK_URL="file://${IMAGE_CACHE_PREFIX}.initramfs"
-fi
-
-declare -A detected_arch
-for var_arch in "${!DEPLOY_KERNEL_URL_@}"; do
-    IPA_ARCH="${var_arch#DEPLOY_KERNEL_URL}"
-    detected_arch["${IPA_ARCH,,}"]=1
-done
-for file_arch in "${IMAGE_CACHE_PREFIX}"_*.kernel; do
-    if [[ -f "${file_arch}" ]]; then
-        IPA_ARCH="$(basename "${file_arch#"${IMAGE_CACHE_PREFIX}"_}" .kernel)"
-        detected_arch["${IPA_ARCH}"]=1
-    fi
-done
-
-DEPLOY_KERNEL_BY_ARCH=""
-DEPLOY_RAMDISK_BY_ARCH=""
-for IPA_ARCH in "${!detected_arch[@]}"; do
-    kernel_var="DEPLOY_KERNEL_URL_${IPA_ARCH^^}"
-    ramdisk_var="DEPLOY_RAMDISK_URL_${IPA_ARCH^^}"
-    if [[ -z "${!kernel_var:-}" ]] && [[ -z "${!ramdisk_var:-}" ]] && \
-        [[ -f "${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.kernel" ]] && [[ -f "${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.initramfs" ]]; then
-      export "${kernel_var}"="file://${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.kernel"
-      export "${ramdisk_var}"="file://${IMAGE_CACHE_PREFIX}_${IPA_ARCH}.initramfs"
-    fi
-    DEPLOY_KERNEL_BY_ARCH+="${!kernel_var:+${IPA_ARCH}:${!kernel_var},}"
-    DEPLOY_RAMDISK_BY_ARCH+="${!ramdisk_var:+${IPA_ARCH}:${!ramdisk_var},}"
-done
-if [[ -n "${DEPLOY_KERNEL_BY_ARCH}" ]] && [[ -n "${DEPLOY_RAMDISK_BY_ARCH}" ]]; then
-    export DEPLOY_KERNEL_BY_ARCH="${DEPLOY_KERNEL_BY_ARCH%?}"
-    export DEPLOY_RAMDISK_BY_ARCH="${DEPLOY_RAMDISK_BY_ARCH%?}"
-fi
-
-if [[ -f "${IRONIC_CONF_DIR}/ironic.conf" ]]; then
-    # Make a copy of the original supposed empty configuration file
-    cp "${IRONIC_CONF_DIR}/ironic.conf" "${IRONIC_CONF_DIR}/ironic.conf.orig"
-fi
-
-BOOTLOADER_BY_ARCH=""
-for bootloader in /templates/uefi_esp_*.img; do
-    BOOTLOADER_ARCH="$(basename "${bootloader#/templates/uefi_esp_}" .img)"
-    BOOTLOADER_BY_ARCH+="${BOOTLOADER_ARCH}:file://${bootloader},"
-done
-export BOOTLOADER_BY_ARCH="${BOOTLOADER_BY_ARCH%?}"
-
-# oslo.config also supports Config Opts From Environment, log them to stdout
-echo 'Options set from Environment variables'
-env | grep "^OS_" || true
-
-mkdir -p /shared/html
-mkdir -p /shared/tmp
-mkdir -p /shared/ironic_prometheus_exporter
-
-if [[ -f /proc/sys/crypto/fips_enabled ]]; then
-    ENABLE_FIPS_IPA=$(cat /proc/sys/crypto/fips_enabled)
-    export ENABLE_FIPS_IPA
-fi
-
-# The original ironic.conf is empty, and can be found in ironic.conf_orig
-render_j2_config "/etc/ironic/ironic.conf.j2" \
-    "${IRONIC_CONF_DIR}/ironic.conf"
-
-configure_json_rpc_auth
-
-# Make sure ironic traffic bypasses any proxies
-export NO_PROXY="${NO_PROXY:-}"
-
-if [[ -n "$IRONIC_IPV6" ]]; then
-export NO_PROXY="${NO_PROXY},${IRONIC_IPV6}"
-fi
-if [[ -n "$IRONIC_IP" ]]; then
-export NO_PROXY="${NO_PROXY},${IRONIC_IP}"
-fi
--- a/ironic-image/scripts/ironic-common.sh
+++ b/ironic-image/scripts/ironic-common.sh
@@ -1,300 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-# Export IRONIC_IP to avoid needing to lean on IRONIC_URL_HOST for consumption in
-# e.g. dnsmasq configuration
-export IRONIC_IP="${IRONIC_IP:-}"
-IRONIC_IPV6="${IRONIC_IPV6:-}"
-PROVISIONING_INTERFACE="${PROVISIONING_INTERFACE:-}"
-PROVISIONING_IP="${PROVISIONING_IP:-}"
-PROVISIONING_MACS="${PROVISIONING_MACS:-}"
-IRONIC_URL_HOSTNAME="${IRONIC_URL_HOSTNAME:-}"
-IPXE_CUSTOM_FIRMWARE_DIR="${IPXE_CUSTOM_FIRMWARE_DIR:-/shared/custom_ipxe_firmware}"
-CUSTOM_CONFIG_DIR="${CUSTOM_CONFIG_DIR:-/conf}"
-CUSTOM_DATA_DIR="${CUSTOM_DATA_DIR:-/data}"
-export DNSMASQ_CONF_DIR="${CUSTOM_CONFIG_DIR}/dnsmasq"
-export DNSMASQ_DATA_DIR="${CUSTOM_DATA_DIR}/dnsmasq"
-export DNSMASQ_TEMP_DIR="${CUSTOM_CONFIG_DIR}/dnsmasq"
-export HTTPD_DIR="${CUSTOM_CONFIG_DIR}/httpd"
-export HTTPD_CONF_DIR="${HTTPD_DIR}/conf"
-export HTTPD_CONF_DIR_D="${HTTPD_DIR}/conf.d"
-export IRONIC_CONF_DIR="${CUSTOM_CONFIG_DIR}/ironic"
-export IRONIC_DB_DIR="${CUSTOM_DATA_DIR}/db"
-export IRONIC_GEN_CERT_DIR="${CUSTOM_DATA_DIR}/auto_gen_certs"
-export IRONIC_TMP_DATA_DIR="${CUSTOM_DATA_DIR}/tmp"
-export PROBE_CONF_DIR="${CUSTOM_CONFIG_DIR}/probes"
-
-export HTTP_PORT=${HTTP_PORT:-80}
-# NOTE(elfosardo): the default port for json_rpc in ironic is 8089, but
-# we need to use a different port to avoid conflicts with other services
-export IRONIC_JSON_RPC_PORT=${IRONIC_JSON_RPC_PORT:-6189}
-
-mkdir -p "${IRONIC_CONF_DIR}" "${PROBE_CONF_DIR}" "${HTTPD_CONF_DIR}" \
-    "${HTTPD_CONF_DIR_D}" "${DNSMASQ_CONF_DIR}" "${DNSMASQ_TEMP_DIR}" \
-    "${IRONIC_DB_DIR}" "${IRONIC_GEN_CERT_DIR}" "${DNSMASQ_DATA_DIR}" \
-    "${IRONIC_TMP_DATA_DIR}"
-
-export HTPASSWD_FILE="${IRONIC_CONF_DIR}/htpasswd"
-export LOCAL_DB_URI="sqlite:///${IRONIC_DB_DIR}/ironic.sqlite"
-
-export IRONIC_USE_MARIADB=${IRONIC_USE_MARIADB:-false}
-
-
-get_ip_of_hostname()
-{
-    if [[ "$#" -ne 2 ]]; then
-        echo "${FUNCNAME}: two parameters required, $# provided" >&2
-        return 1
-    fi
-
-    case $2 in
-        4)
-            QUERY="a";;
-        6)
-            QUERY="aaaa";;
-        *)
-            echo "${FUNCNAME}: the second parameter should be [a|aaaa] for A and AAAA records"
-            return 1;;
-    esac
-
-    local HOSTNAME=$1
-
-    echo $(nslookup -type=${QUERY} "${HOSTNAME}" | tail -n2 | grep -w "Address:" | cut -d " " -f2)
-}
-
-get_interface_of_ip()
-{
-    local IP_VERS=""
-
-    if [[ "$#" -gt 2 ]]; then
-        echo "${FUNCNAME}: too many parameters" >&2
-        return 1
-    fi
-
-    if [[ "$#" -eq 2 ]]; then
-        case $2 in
-        4|6)
-            local IP_VERS="-${2}"
-            ;;
-        *)
-            echo "${FUNCNAME}: the second parameter should be [4|6] (or missing for both)" >&2
-            return 2
-            ;;
-        esac
-    fi
-
-    local IP_ADDR=$1
-
-    # Convert the address using ipcalc which strips out the subnet.
-    # For IPv6 addresses, this will give the short-form address
-    IP_ADDR="$(ipcalc "${IP_ADDR}" | grep "^Address:" | awk '{print $2}')"
-
-    echo $(ip ${IP_VERS} -br addr show scope global | grep -i " ${IP_ADDR}/" | cut -f 1 -d ' ' | cut -f 1 -d '@')
-}
-
-get_ip_of_interface()
-{
-    local IP_VERS=""
-
-    if [[ "$#" -gt 2 ]]; then
-        echo "${FUNCNAME}: too many parameters" >&2
-        return 1
-    fi
-
-    if [[ "$#" -eq 2 ]]; then
-        case $2 in
-        4|6)
-            local IP_VERS="-${2}"
-            ;;
-        *)
-            echo "${FUNCNAME}: the second parameter should be [4|6] (or missing for both)" >&2
-            return 2
-            ;;
-        esac
-    fi
-
-    local IFACE=$1
-
-    echo $(ip ${IP_VERS} -br addr show scope global up dev ${IFACE} | awk '{print $3}' | sed -e 's%/.*%%' | head -n 1)
-}
-
-get_provisioning_interface()
-{
-    if [[ -n "$PROVISIONING_INTERFACE" ]]; then
-        # don't override the PROVISIONING_INTERFACE if one is provided
-        echo "$PROVISIONING_INTERFACE"
-        return
-    fi
-
-    local interface=""
-
-    for mac in ${PROVISIONING_MACS//,/ }; do
-        if ip -br link show up | grep -i "$mac" &>/dev/null; then
-            interface="$(ip -br link show up | grep -i "$mac" | cut -f 1 -d ' ' | cut -f 1 -d '@')"
-            break
-        fi
-    done
-
-    echo "$interface"
-}
-
-PROVISIONING_INTERFACE="$(get_provisioning_interface)"
-export PROVISIONING_INTERFACE
-
-export LISTEN_ALL_INTERFACES="${LISTEN_ALL_INTERFACES:-true}"
-
-# Wait for the interface or IP to be up, sets $IRONIC_IP
-wait_for_interface_or_ip()
-{
-    # If $PROVISIONING_IP is specified, then we wait for that to become
-    # available on an interface, otherwise we look at $PROVISIONING_INTERFACE
-    # for an IP
-    if [[ -n "${PROVISIONING_IP}" ]]; then
-        local IFACE_OF_IP=""
-
-        until [[ -n "$IFACE_OF_IP" ]]; do
-            echo "Waiting for ${PROVISIONING_IP} to be configured on an interface..."
-            IFACE_OF_IP="$(get_interface_of_ip "${PROVISIONING_IP}")"
-            sleep 1
-        done
-
-        echo "Found $PROVISIONING_IP on interface \"${IFACE_OF_IP}\"!"
-
-        export PROVISIONING_INTERFACE="$IFACE_OF_IP"
-	# If the IP contains a colon, then it's an IPv6 address
-        if [[ "$PROVISIONING_IP" =~ .*:.* ]]; then
-            export IRONIC_IPV6="$PROVISIONING_IP"
-            export IRONIC_IP=""
-        else
-            export IRONIC_IP="$PROVISIONING_IP"
-        fi
-    elif [[ -n "${IRONIC_IP}" ]]; then
-        if [[ "$IRONIC_IP" =~ .*:.* ]]; then
-            export IRONIC_IPV6="$IRONIC_IP"
-            export IRONIC_IP=""
-        fi
-    elif [[ -n "${PROVISIONING_INTERFACE}" ]]; then
-        until [[ -n "$IRONIC_IPV6" ]] || [[ -n "$IRONIC_IP" ]]; do
-            echo "Waiting for ${PROVISIONING_INTERFACE} interface to be configured..."
-
-            IRONIC_IPV6="$(get_ip_of_interface "${PROVISIONING_INTERFACE}" 6)"
-            sleep 1
-
-            IRONIC_IP="$(get_ip_of_interface "${PROVISIONING_INTERFACE}" 4)"
-            sleep 1
-        done
-
-        if [[ -n "$IRONIC_IPV6" ]]; then
-            echo "Found $IRONIC_IPV6 on interface \"${PROVISIONING_INTERFACE}\"!"
-	    export IRONIC_IPV6
-        fi
-        if [[ -n "$IRONIC_IP" ]]; then
-            echo "Found $IRONIC_IP on interface \"${PROVISIONING_INTERFACE}\"!"
-	    export IRONIC_IP
-        fi
-    elif [[ -n "$IRONIC_URL_HOSTNAME" ]]; then
-        local IPV6_IFACE=""
-        local IPV4_IFACE=""
-        
-        # we should get at least one IP address
-        until [[ -n "$IPV6_IFACE" ]] || [[ -n "$IPV4_IFACE" ]]; do
-            local IPV6_RECORD=""
-            local IPV4_RECORD=""
-
-            IPV6_RECORD="$(get_ip_of_hostname "${IRONIC_URL_HOSTNAME}" 6)"
-            IPV4_RECORD="$(get_ip_of_hostname "${IRONIC_URL_HOSTNAME}" 4)"
-
-            # We couldn't get any IP
-            if [[ -z "$IPV4_RECORD" ]] && [[ -z "$IPV6_RECORD" ]]; then
-                echo "${FUNCNAME}: no valid IP found for hostname ${IRONIC_URL_HOSTNAME}" >&2
-                return 1
-            fi
-
-            echo "Waiting for ${IPV6_RECORD} to be configured on an interface"
-            IPV6_IFACE="$(get_interface_of_ip "${IPV6_RECORD}" 6)"
-            sleep 1
-
-            echo "Waiting for ${IPV4_RECORD} to be configured on an interface"
-            IPV4_IFACE="$(get_interface_of_ip "${IPV4_RECORD}" 4)"
-            sleep 1
-        done
-
-        # Add some debugging output
-        if [[ -n "$IPV6_IFACE" ]]; then
-            echo "Found $IPV6_RECORD on interface \"${IPV6_IFACE}\"!"
-            export IRONIC_IPV6="$IPV6_RECORD"
-        fi
-        if [[ -n "$IPV4_IFACE" ]]; then
-            echo "Found $IPV4_RECORD on interface \"${IPV4_IFACE}\"!"
-            export IRONIC_IP="$IPV4_RECORD"
-        fi
-
-        # Make sure both IPs are asigned to the same interface
-        if [[ -n "$IPV6_IFACE" ]] && [[ -n "$IPV4_IFACE" ]] && [[ "$IPV6_IFACE" != "$IPV4_IFACE" ]]; then
-            echo "Warning, the IPv4 and IPv6 addresses from \"${HOSTNAME}\" are assigned to different " \
-            "interfaces (\"${IPV6_IFACE}\" and \"${IPV4_IFACE}\")" >&2
-        fi
-
-    else
-        echo "Cannot determine an interface or an IP for binding and creating URLs"
-        return 1
-    fi
-
-    # Define the URLs based on the what we have found,
-    # prioritize IPv6 for IRONIC_URL_HOST
-    if [[ -n "$IRONIC_IP" ]]; then
-        export ENABLE_IPV4=yes
-        export IRONIC_URL_HOST="$IRONIC_IP"
-    fi
-    if [[ -n "$IRONIC_IPV6" ]]; then
-        export ENABLE_IPV6=yes
-        export IRONIC_URL_HOST="[${IRONIC_IPV6}]" # The HTTP host needs surrounding with brackets
-    fi
-
-    # Once determined if we have IPv4 and/or IPv6, override the hostname if provided
-    if [[ -n "$IRONIC_URL_HOSTNAME" ]]; then
-        IRONIC_URL_HOST=$IRONIC_URL_HOSTNAME
-    fi
-
-    # Avoid having to construct full URL multiple times while allowing
-    # the override of IRONIC_HTTP_URL for environments in which IRONIC_IP
-    # is unreachable from hosts being provisioned.
-    export IRONIC_HTTP_URL="${IRONIC_HTTP_URL:-http://${IRONIC_URL_HOST}:${HTTP_PORT}}"
-    export IRONIC_TFTP_URL="${IRONIC_TFTP_URL:-tftp://${IRONIC_URL_HOST}}"
-    export IRONIC_BASE_URL=${IRONIC_BASE_URL:-"${IRONIC_SCHEME}://${IRONIC_URL_HOST}:${IRONIC_ACCESS_PORT}"}
-}
-
-render_j2_config()
-{
-    python3.13 -c 'import os; import sys; import jinja2; sys.stdout.write(jinja2.Template(sys.stdin.read()).render(env=os.environ))' < "$1" > "$2"
-}
-
-run_ironic_dbsync()
-{
-    if [[ "${IRONIC_USE_MARIADB}" == "true" ]]; then
-        # It's possible for the dbsync to fail if mariadb is not up yet, so
-        # retry until success
-        until ironic-dbsync --config-file "${IRONIC_CONF_DIR}/ironic.conf" upgrade; do
-            echo "WARNING: ironic-dbsync failed, retrying"
-            sleep 1
-        done
-    else
-        # SQLite does not support some statements. Fortunately, we can just
-        # create the schema in one go if not already created, instead of going
-        # through an upgrade
-        cp "/var/lib/ironic/ironic.sqlite" "${IRONIC_DB_DIR}/ironic.sqlite"
-        DB_VERSION="$(ironic-dbsync --config-file "${IRONIC_CONF_DIR}/ironic.conf" version)"
-        if [[ "${DB_VERSION}" == "None" ]]; then
-            ironic-dbsync --config-file "${IRONIC_CONF_DIR}/ironic.conf" create_schema
-        fi
-    fi
-}
-
-# Use the special value "unix" for unix sockets
-export IRONIC_PRIVATE_PORT=${IRONIC_PRIVATE_PORT:-unix}
-
-export IRONIC_ACCESS_PORT=${IRONIC_ACCESS_PORT:-6385}
-export IRONIC_LISTEN_PORT=${IRONIC_LISTEN_PORT:-$IRONIC_ACCESS_PORT}
-
-export IRONIC_ENABLE_DISCOVERY=${IRONIC_ENABLE_DISCOVERY:-${IRONIC_INSPECTOR_ENABLE_DISCOVERY:-false}}
--- a/ironic-image/scripts/ironic-probe.sh
+++ b/ironic-image/scripts/ironic-probe.sh
@@ -1,23 +0,0 @@
-#!/bin/bash
-
-set -eu -o pipefail
-
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-# shellcheck disable=SC1091
-. /bin/auth-common.sh
-
-PROBE_CURL_ARGS=
-if [[ "${IRONIC_REVERSE_PROXY_SETUP}" == "true" ]]; then
-    if [[ "${IRONIC_PRIVATE_PORT}" == "unix" ]]; then
-        PROBE_URL="http://127.0.0.1:6385"
-        PROBE_CURL_ARGS="--unix-socket /shared/ironic.sock"
-    else
-        PROBE_URL="http://127.0.0.1:${IRONIC_PRIVATE_PORT}"
-    fi
-else
-        PROBE_URL="${IRONIC_BASE_URL}"
-fi
-
-# shellcheck disable=SC2086
-curl -sSf ${PROBE_CURL_ARGS} "${PROBE_URL}"
--- a/ironic-image/scripts/rundatabase-upgrade
+++ b/ironic-image/scripts/rundatabase-upgrade
@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-# NOTE(dtantsur): no retries here: this script is supposed to be run as a Job
-# that is retried on failure.
-exec ironic-dbsync --config-file "${IRONIC_CONF_DIR}/ironic.conf" upgrade
--- a/ironic-image/scripts/runironic
+++ b/ironic-image/scripts/runironic
@@ -1,27 +0,0 @@
-#!/usr/bin/bash
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-# Ramdisk logs
-mkdir -p /shared/log/ironic/deploy
-
-# Allows skipping dbsync if it's done by an external job
-if [[ "${IRONIC_SKIP_DBSYNC:-false}" != true ]]; then
-    run_ironic_dbsync
-fi
-
-configure_restart_on_certificate_update "${IRONIC_TLS_SETUP}" ironic "${IRONIC_CERT_FILE}"
-
-configure_ironic_auth
-
-if [[ -d "${BMC_CACERTS_PATH}" ]]; then
-    # shellcheck disable=SC2034
-    watchmedo shell-command \
-        --patterns="*" \
-        --ignore-directories \
-        --command='cat "${BMC_CACERTS_PATH}"/* > "${BMC_CACERT_FILE}"' \
-        "${BMC_CACERTS_PATH}" &
-fi
-
-exec /usr/bin/ironic --config-dir "${IRONIC_CONF_DIR}"
--- a/ironic-image/scripts/runironic-exporter
+++ b/ironic-image/scripts/runironic-exporter
@@ -1,20 +0,0 @@
-#!/usr/bin/bash
-
-# Set dummy provisioning IP to avoid interface detection issues (not needed to run IPE to service `/metrics`)
-export PROVISIONING_IP="127.0.0.1"
-# Set to true since running this script implies sensor data metrics are needed
-# ironic-prometheus-exporter (IPE) needs to read from oslo_messaging_notifications.location (i.e content under /shared) where Ironic writes to
-export SEND_SENSOR_DATA=true
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-# shellcheck disable=SC1091
-. /bin/ironic-common.sh
-
-FLASK_RUN_HOST=${FLASK_RUN_HOST:-0.0.0.0}
-FLASK_RUN_PORT=${FLASK_RUN_PORT:-9608}
-
-export IRONIC_CONFIG="${IRONIC_CONF_DIR}/ironic.conf"
-
-exec gunicorn -b "${FLASK_RUN_HOST}:${FLASK_RUN_PORT}" -w 4 \
-    ironic_prometheus_exporter.app.wsgi:application
--- a/ironic-image/scripts/runlogwatch.sh
+++ b/ironic-image/scripts/runlogwatch.sh
@@ -1,32 +0,0 @@
-#!/usr/bin/bash
-
-# Ramdisk logs path
-export LOG_DIR="/shared/log/ironic/deploy"
-
-mkdir -p "${LOG_DIR}"
-
-# Function to process log files
-process_log_file() {
-    local FILEPATH="$1"
-    # shellcheck disable=SC2155
-    local FILENAME=$(basename "${FILEPATH}")
-
-    echo "************ Contents of ${LOG_DIR}/${FILENAME} ramdisk log file bundle **************"
-    tar -tzf "${FILEPATH}" | while read -r entry; do
-        echo "${FILENAME}: **** Entry: ${entry} ****"
-        tar -xOzf "${FILEPATH}" "${entry}" | sed -e "s/^/${FILENAME}: /"
-        echo
-    done
-    rm -f "${FILEPATH}"
-}
-
-# Export the function so watchmedo can use it
-export -f process_log_file
-
-# Use watchmedo to monitor for file close events
-# shellcheck disable=SC2016
-watchmedo shell-command \
-    --patterns="*" \
-    --ignore-directories \
-    --command='if [[ "${watch_event_type}" == "closed" ]]; then process_log_file "${watch_src_path}"; fi' \
-    "${LOG_DIR}"
--- a/ironic-image/scripts/runonline-data-migrations
+++ b/ironic-image/scripts/runonline-data-migrations
@@ -1,10 +0,0 @@
-#!/usr/bin/bash
-
-set -euxo pipefail
-
-# shellcheck disable=SC1091
-. /bin/configure-ironic.sh
-
-# NOTE(dtantsur): no retries here: this script is supposed to be run as a Job
-# that is retried on failure.
-exec ironic-dbsync --config-file "${IRONIC_CONF_DIR}/ironic.conf" online_data_migrations
--- a/ironic-image/scripts/tls-common.sh
+++ b/ironic-image/scripts/tls-common.sh
@@ -1,14 +1,13 @@
 #!/bin/bash

+export IRONIC_CERT_FILE=/certs/ironic/tls.crt
+export IRONIC_KEY_FILE=/certs/ironic/tls.key
+export IRONIC_CACERT_FILE=/certs/ca/ironic/tls.crt
 export IRONIC_INSECURE=${IRONIC_INSECURE:-false}
 export IRONIC_SSL_PROTOCOL=${IRONIC_SSL_PROTOCOL:-"-ALL +TLSv1.2 +TLSv1.3"}
 export IPXE_SSL_PROTOCOL=${IPXE_SSL_PROTOCOL:-"-ALL +TLSv1.2 +TLSv1.3"}
 export IRONIC_VMEDIA_SSL_PROTOCOL=${IRONIC_VMEDIA_SSL_PROTOCOL:-"ALL"}

-# Node image storage is using the same cert and port as the API
-export IRONIC_CERT_FILE=/certs/ironic/tls.crt
-export IRONIC_KEY_FILE=/certs/ironic/tls.key
-
 export IRONIC_VMEDIA_CERT_FILE=/certs/vmedia/tls.crt
 export IRONIC_VMEDIA_KEY_FILE=/certs/vmedia/tls.key

@@ -17,15 +16,15 @@ export IPXE_KEY_FILE=/certs/ipxe/tls.key

 export RESTART_CONTAINER_CERTIFICATE_UPDATED=${RESTART_CONTAINER_CERTIFICATE_UPDATED:-"false"}

-# By default every cert has to be signed with Ironic's
-# CA otherwise node image and IPA verification would fail
 export MARIADB_CACERT_FILE=/certs/ca/mariadb/tls.crt
-export BMC_CACERTS_PATH=/certs/ca/bmc
-export BMC_CACERT_FILE=/conf/bmc-tls.pem
-export IRONIC_CACERT_FILE=/certs/ca/ironic/tls.crt

 export IPXE_TLS_PORT="${IPXE_TLS_PORT:-8084}"

+mkdir -p /certs/ironic
+mkdir -p /certs/ca/ironic
+mkdir -p /certs/ipxe
+mkdir -p /certs/vmedia
+
 if [[ -f "$IRONIC_CERT_FILE" ]] && [[ ! -f "$IRONIC_KEY_FILE" ]]; then
    echo "Missing TLS Certificate key file $IRONIC_KEY_FILE"
    exit 1
@@ -70,7 +69,6 @@ if [[ -f "$IRONIC_CERT_FILE" ]] || [[ -f "$IRONIC_CACERT_FILE" ]]; then
    export IRONIC_TLS_SETUP="true"
    export IRONIC_SCHEME="https"
    if [[ ! -f "$IRONIC_CACERT_FILE" ]]; then
-        mkdir -p "$(dirname "${IRONIC_CACERT_FILE}")"
        copy_atomic "$IRONIC_CERT_FILE" "$IRONIC_CACERT_FILE"
    fi
 else
@@ -97,33 +95,3 @@ if [[ -f "$MARIADB_CACERT_FILE" ]]; then
 else
    export MARIADB_TLS_ENABLED="false"
 fi
-
-configure_restart_on_certificate_update()
-{
-    local enabled="$1"
-    local service="$2"
-    local cert_file="$3"
-    local signal="TERM"
-
-    if [[ "${enabled}" == "true" ]] && [[ "${RESTART_CONTAINER_CERTIFICATE_UPDATED}" == "true" ]]; then
-        if [[ "${service}" == httpd ]]; then
-            # shellcheck disable=SC2034
-            signal="WINCH"
-        fi
-
-        # Use watchmedo to monitor certificate file deletion
-        # shellcheck disable=SC2016
-        watchmedo shell-command \
-            --patterns="$(basename "${cert_file}")" \
-            --ignore-directories \
-            --command='if [[ "${watch_event_type}" == "deleted" ]]; then pkill -'"${signal}"' '"${service}"'; fi' \
-            "$(dirname "${cert_file}")" &
-    fi
-}
-
-if [ -d "${BMC_CACERTS_PATH}" ]; then
-    export BMC_TLS_ENABLED="true"
-    cat "${BMC_CACERTS_PATH}"/* > "${BMC_CACERT_FILE}"
-else
-    export BMC_TLS_ENABLED="false"
-fi
--- a/ironic-ipa-downloader-image/Dockerfile
+++ b/ironic-ipa-downloader-image/Dockerfile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.3
+#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader:3.0.3-%RELEASE%
+#!BuildVersion: 15.6
 ARG SLE_VERSION
 FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro

@@ -9,6 +10,8 @@ COPY --from=micro / /installroot/
 RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
 RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 ironic-ipa-ramdisk-aarch64 tar gawk curl xz zstd shadow cpio findutils

+RUN cp /usr/bin/getopt /installroot/
+
 FROM micro AS final

 # Define labels according to https://en.opensuse.org/Building_derived_containers
@@ -16,11 +19,11 @@ FROM micro AS final
 LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
 LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
 LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
+LABEL org.opencontainers.image.version="3.0.3"
 LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
 LABEL org.opencontainers.image.created="%BUILDTIME%"
 LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
+LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.3-%RELEASE%"
 LABEL org.openbuildservice.disturl="%DISTURL%"
 LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
 LABEL com.suse.eula="SUSE Combined EULA February 2024"
@@ -30,6 +33,9 @@ LABEL com.suse.release-stage="released"
 # endlabelprefix

 COPY --from=base /installroot /
+RUN cp /getopt /usr/bin/
+RUN cp /srv/tftpboot/openstack-ironic-image/initrd*.zst /tmp
+RUN cp /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel /tmp
 RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
 # configure non-root user
 COPY configure-nonroot.sh /bin/
--- a/ironic-ipa-downloader-image/Dockerfile.aarch64
+++ b/ironic-ipa-downloader-image/Dockerfile.aarch64
@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-aarch64:3.0.10-%RELEASE%
-ARG SLE_VERSION
-FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
-
-FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
-COPY --from=micro / /installroot/
-RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
-RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-aarch64 tar gawk curl xz zstd shadow cpio findutils
-
-FROM micro AS final
-
-# Define labels according to https://en.opensuse.org/Building_derived_containers
-# labelprefix=com.suse.application.ironic
-LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
-LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
-LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
-LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
-LABEL org.opencontainers.image.created="%BUILDTIME%"
-LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
-LABEL org.openbuildservice.disturl="%DISTURL%"
-LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
-LABEL com.suse.eula="SUSE Combined EULA February 2024"
-LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle"
-LABEL com.suse.image-type="application"
-LABEL com.suse.release-stage="released"
-# endlabelprefix
-
-COPY --from=base /installroot /
-RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
-# configure non-root user
-COPY configure-nonroot.sh /bin/
-RUN set -euo pipefail; chmod +x /bin/configure-nonroot.sh
-RUN set -euo pipefail; /bin/configure-nonroot.sh && rm -f /bin/configure-nonroot.sh
-COPY get-resource.sh /usr/local/bin/get-resource.sh
-
-RUN set -euo pipefail; chmod +x /usr/local/bin/get-resource.sh
--- a/ironic-ipa-downloader-image/Dockerfile.x86_64
+++ b/ironic-ipa-downloader-image/Dockerfile.x86_64
@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.10
-#!BuildTag: %%IMG_PREFIX%%ironic-ipa-downloader-x86_64:3.0.10-%RELEASE%
-ARG SLE_VERSION
-FROM registry.suse.com/bci/bci-micro:$SLE_VERSION AS micro
-
-FROM registry.suse.com/bci/bci-base:$SLE_VERSION AS base
-COPY --from=micro / /installroot/
-RUN sed -i -e 's%^# rpm.install.excludedocs = no.*%rpm.install.excludedocs = yes%g' /etc/zypp/zypp.conf
-RUN zypper --installroot /installroot --non-interactive install --no-recommends ironic-ipa-ramdisk-x86_64 tar gawk curl xz zstd shadow cpio findutils
-
-FROM micro AS final
-
-# Define labels according to https://en.opensuse.org/Building_derived_containers
-# labelprefix=com.suse.application.ironic
-LABEL org.opencontainers.image.authors="SUSE LLC (https://www.suse.com/)"
-LABEL org.opencontainers.image.title="SLE Based Ironic IPA Downloader Container Image"
-LABEL org.opencontainers.image.description="ironic-ipa-downloader based on the SLE Base Container Image."
-LABEL org.opencontainers.image.version="3.0.10"
-LABEL org.opencontainers.image.url="https://www.suse.com/solutions/edge-computing/"
-LABEL org.opencontainers.image.created="%BUILDTIME%"
-LABEL org.opencontainers.image.vendor="SUSE LLC"
-LABEL org.opensuse.reference="%%IMG_REPO%%/%%IMG_PREFIX%%ironic-ipa-downloader:3.0.10-%RELEASE%"
-LABEL org.openbuildservice.disturl="%DISTURL%"
-LABEL com.suse.supportlevel="%%SUPPORT_LEVEL%%"
-LABEL com.suse.eula="SUSE Combined EULA February 2024"
-LABEL com.suse.lifecycle-url="https://www.suse.com/lifecycle"
-LABEL com.suse.image-type="application"
-LABEL com.suse.release-stage="released"
-# endlabelprefix
-
-COPY --from=base /installroot /
-RUN sha256sum /srv/tftpboot/openstack-ironic-image/initrd*.zst /srv/tftpboot/openstack-ironic-image/openstack-ironic-image*.kernel > /tmp/images.sha256
-# configure non-root user
-COPY configure-nonroot.sh /bin/
-RUN set -euo pipefail; chmod +x /bin/configure-nonroot.sh
-RUN set -euo pipefail; /bin/configure-nonroot.sh && rm -f /bin/configure-nonroot.sh
-COPY get-resource.sh /usr/local/bin/get-resource.sh
-
-RUN set -euo pipefail; chmod +x /usr/local/bin/get-resource.sh
--- a/ironic-ipa-downloader-image/_multibuild
+++ b/ironic-ipa-downloader-image/_multibuild
@@ -1,4 +0,0 @@
-<multibuild>
-  <flavor>x86_64</flavor>
-  <flavor>aarch64</flavor>
-</multibuild>
--- a/ironic-ipa-downloader-image/_service
+++ b/ironic-ipa-downloader-image/_service
@@ -2,8 +2,6 @@
  <service mode="buildtime" name="kiwi_metainfo_helper"/>
  <service mode="buildtime" name="docker_label_helper"/>
  <service name="replace_using_env" mode="buildtime">
-    <param name="file">Dockerfile.aarch64</param>
-    <param name="file">Dockerfile.x86_64</param>
    <param name="file">Dockerfile</param>
    <param name="eval">IMG_PREFIX=$(rpm --macros=/root/.rpmmacros -E %{?img_prefix})</param>
    <param name="var">IMG_PREFIX</param>
--- a/ironic-ipa-downloader-image/get-resource.sh
+++ b/ironic-ipa-downloader-image/get-resource.sh
@@ -6,8 +6,6 @@ export http_proxy=${http_proxy:-$HTTP_PROXY}
 export https_proxy=${https_proxy:-$HTTPS_PROXY}
 export no_proxy=${no_proxy:-$NO_PROXY}

-IMAGES_BASE_PATH="/srv/tftpboot/openstack-ironic-image"
-
 if [ -d "/tmp/ironic-certificates" ]; then
  sha256sum /tmp/ironic-certificates/* > /tmp/certificates.sha256
  if cmp "/shared/certificates.sha256" "/tmp/certificates.sha256"; then
@@ -28,14 +26,11 @@ if [ -z "${IPA_BASEURI}" ]; then
  IMAGE_CHANGED=1
  # SLES BASED IPA - ironic-ipa-ramdisk-x86_64 and ironic-ipa-ramdisk-aarch64 packages
  mkdir -p /shared/html/images
-  if [ -f ${IMAGES_BASE_PATH}/initrd-x86_64.zst ]; then
-    cp ${IMAGES_BASE_PATH}/initrd-x86_64.zst /shared/html/images/ironic-python-agent_x86_64.initramfs
-    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent_x86_64.kernel
-  fi
-  if [ -f ${IMAGES_BASE_PATH}/initrd-aarch64.zst ]; then
-    cp ${IMAGES_BASE_PATH}/initrd-aarch64.zst /shared/html/images/ironic-python-agent_aarch64.initramfs
-    cp ${IMAGES_BASE_PATH}/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent_aarch64.kernel
-  fi
+  cp /tmp/initrd-x86_64.zst /shared/html/images/ironic-python-agent-x86_64.initramfs
+  cp /tmp/openstack-ironic-image.x86_64*.kernel /shared/html/images/ironic-python-agent-x86_64.kernel
+  # Use arm64 as destination for iPXE compatibility
+  cp /tmp/initrd-aarch64.zst /shared/html/images/ironic-python-agent-arm64.initramfs
+  cp /tmp/openstack-ironic-image.aarch64*.kernel /shared/html/images/ironic-python-agent-arm64.kernel

  cp /tmp/images.sha256 /shared/images.sha256
 else
@@ -86,8 +81,8 @@ else
      chmod 755 "$TMPDIR"
      mv "$TMPDIR" "$FILENAME-$ETAG"
      ln -sf "$FILENAME-$ETAG/$FFILENAME.headers" "$FFILENAME.headers"
-      ln -sf "$FILENAME-$ETAG/$FILENAME.initramfs" "${FILENAME}_${ARCH,,}.initramfs"
-      ln -sf "$FILENAME-$ETAG/$FILENAME.kernel" "${FILENAME}_${ARCH,,}.kernel"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.initramfs" "$FILENAME-${ARCH,,}.initramfs"
+      ln -sf "$FILENAME-$ETAG/$FILENAME.kernel" "$FILENAME-${ARCH,,}.kernel"
      
      IMAGE_CHANGED=1
  else
@@ -99,7 +94,7 @@ if [ "${CERTS_CHANGED:-0}" = "1" ] || [ "${IMAGE_CHANGED:-0}" = "1" ]; then
  mkdir -p /tmp/ca/tmp-initrd && cd /tmp/ca/tmp-initrd
  mkdir -p etc/ironic-python-agent.d/ca-certs
  cp /tmp/ironic-certificates/* etc/ironic-python-agent.d/ca-certs/
-  for initramfs in /shared/html/images/ironic-python-agent_*.initramfs; do
+  for initramfs in /shared/html/images/ironic-python-agent-*.initramfs; do
    find . | cpio -o -H newc --reproducible | zstd -c >> "${initramfs}"
  done
  cp /tmp/certificates.sha256 /shared/certificates.sha256
--- a/ironic-ipa-ramdisk/config.sh
+++ b/ironic-ipa-ramdisk/config.sh
@@ -13,10 +13,15 @@ echo "Configure image: [$kiwi_iname]..."
 #------------------------------------------
 baseSetupBuildDay

+#======================================
+# Mount system filesystems
+#--------------------------------------
+#baseMount
+
 #==========================================
 # remove unneded kernel files
 #------------------------------------------
-#suseStripKernel
+suseStripKernel
 baseStripLocales en_US.utf-8 C.utf8

 #======================================
@@ -34,8 +39,12 @@ suseImportBuildKey
 #--------------------------------------
 baseInsertService openstack-ironic-python-agent
 baseInsertService suse-ironic-image-setup
+baseInsertService suse-network-setup
 baseInsertService sshd
 baseInsertService NetworkManager
+#suseInsertService sshd
+#suseInsertService openstack-ironic-python-agent
+#suseInsertService suse-ironic-image-setup

 echo 'DEFAULT_TIMEZONE="UTC"' >> /etc/sysconfig/clock
 baseUpdateSysConfig /etc/sysconfig/clock HWCLOCK "-u"
@@ -55,7 +64,42 @@ sed -E 's/^(ExecStart=.*\/agetty).*(--noclear.*)/\1 \2 --autologin root/' /usr/l
 #------------------------------------------
 echo 'tmpfs /tmp tmpfs size=3G 0 0' >> /etc/fstab

+#==========================================
+# remove package docs and manuals
+#------------------------------------------
+#baseStripDocs
+#baseStripMans
+#baseStripInfos
+
+#======================================
+# only basic version of vim is
+# installed; no syntax highlighting
+#--------------------------------------
+sed -i -e's/^syntax on/" syntax on/' /etc/vimrc
+
+#======================================
+# Remove yast if not in use
+#--------------------------------------
+#suseRemoveYaST
+
+#======================================
+# Remove package manager
+#--------------------------------------
+#suseStripPackager
+
+#rm -f usr/lib/perl5/*/*/auto/Encode/??/??.so # 9MB
+
+#======================================
+# Umount kernel filesystems
+#--------------------------------------
+#baseCleanMount
+
 ln -s /sbin/init /init

+#==========================================
+# umount
+#------------------------------------------
+umount /proc >/dev/null 2>&1
+
 exit 0

--- a/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
+++ b/ironic-ipa-ramdisk/ironic-ipa-ramdisk.kiwi
@@ -12,7 +12,6 @@
        <locale>en_US</locale>
        <packagemanager>zypper</packagemanager>
        <rpm-check-signatures>false</rpm-check-signatures>
-        <rpm-excludedocs>true</rpm-excludedocs>
        <timezone>UTC</timezone>
        <version>1.0.0</version> 
    </preferences>	
@@ -28,6 +27,68 @@
      <source path="dir:///.build.binaries"/>
    </repository>

+    <drivers>
+        <file name="crypto/*"/>
+        <file name="drivers/acpi/*"/>
+        <file name="drivers/acpi/dock.ko"/>
+        <file name="drivers/ata/*"/>
+        <file name="drivers/block/brd.ko"/>
+        <file name="drivers/block/cciss.ko"/>
+        <file name="drivers/block/loop.ko"/>
+        <file name="drivers/block/virtio_blk.ko"/>
+        <file name="drivers/cdrom/*"/>
+        <file name="drivers/char/hw_random/virtio-rng.ko"/>
+        <file name="drivers/char/lp.ko"/>
+        <file name="drivers/char/ipmi/*"/>
+        <file name="drivers/firmware/iscsi_ibft.ko"/>
+        <file name="drivers/firmware/edd.ko"/>
+        <file name="drivers/gpu/drm/*"/>
+        <file name="drivers/hid/*"/>
+        <file name="drivers/hv/*"/>
+        <file name="drivers/hwmon/*"/>
+        <file name="drivers/ide/*"/>
+        <file name="drivers/input/keyboard/*"/>
+        <file name="drivers/input/mouse/*"/>
+        <file name="drivers/md/*"/>
+        <file name="drivers/message/fusion/*"/>
+        <file name="drivers/misc/hpilo.ko"/>
+        <file name="drivers/net/*"/>
+        <file name="drivers/parport/*"/>
+        <file name="drivers/scsi/*"/>
+        <file name="drivers/staging/hv/*"/>
+        <file name="drivers/target/*"/>
+        <file name="drivers/thermal/*"/>
+        <file name="drivers/usb/*"/>
+        <file name="drivers/virtio/*"/>
+        <file name="fs/binfmt_aout.ko"/>
+        <file name="fs/binfmt_misc.ko"/>
+        <file name="fs/overlayfs/*"/>
+        <file name="fs/btrfs/*"/>
+        <file name="fs/exportfs/*"/>
+        <file name="fs/ext4/*"/>
+        <file name="fs/fat/*"/>
+        <file name="fs/fuse/*"/>
+        <file name="fs/hfs/*"/>
+        <file name="fs/jbd2/*"/>
+        <file name="fs/nfs/*"/>
+        <file name="fs/mbcache.ko"/>
+        <file name="fs/nls/nls_cp437.ko"/>
+        <file name="fs/nls/nls_iso8859-1.ko"/>
+        <file name="fs/nls/nls_utf8.ko"/>
+        <file name="fs/quota_v1.ko"/>
+        <file name="fs/quota_v2.ko"/>
+        <file name="fs/squashfs/*"/>
+        <file name="fs/udf/*"/>
+        <file name="fs/vfat/*"/>
+        <file name="fs/xfs/*"/>
+        <file name="fs/isofs/*"/>
+        <file name="lib/crc-t10dif.ko"/>
+        <file name="lib/crc16.ko"/>
+        <file name="lib/libcrc32c.ko"/>
+        <file name="lib/zlib_deflate/zlib_deflate.ko"/>
+        <file name="net/packet/*"/>
+    </drivers>
+
    <packages type="delete">
        <package name="gpg2"/>
        <package name="libcairo2"/>
@@ -41,23 +102,62 @@
        <package name="libxcb-render0"/>
        <package name="libxcb-shm0"/>
        <package name="libxcb1"/>
-        <package name="kernel-firmware-amdgpu"/>
-        <package name="kernel-firmware-ath10k"/>
-        <package name="kernel-firmware-ath11k"/>
-        <package name="kernel-firmware-ath12k"/>
-        <package name="kernel-firmware-atheros"/>
-        <package name="kernel-firmware-bluetooth"/>
-        <package name="kernel-firmware-brcm"/>
-        <package name="kernel-firmware-i915"/>
-        <package name="kernel-firmware-iwlwifi"/>
-        <package name="kernel-firmware-media"/>
-        <package name="kernel-firmware-nvidia"/>
-        <package name="kernel-firmware-qcom"/>
-        <package name="kernel-firmware-radeon"/>
-        <package name="kernel-firmware-realtek"/>
-        <package name="kernel-firmware-sound"/>
-        <package name="kernel-firmware-ti"/>
-        <package name="kernel-firmware-ueagle"/>
+        <package name="plymouth"/>
+        <package name="plymouth-branding-SLE"/>
+    </packages>
+
+    <packages type="image">
+        <package name="checkmedia"/>
+        <package name="plymouth-branding-SLE"/>
+        <package name="plymouth-dracut"/>
+        <package name="plymouth-theme-bgrt"/>
+        <package name="grub2-branding-SLE"/>
+        <package name="iputils"/>
+        <package name="vim"/>
+        <package name="grub2"/>
+        <package name="grub2-x86_64-efi" arch="x86_64"/>
+        <package name="grub2-arm64-efi" arch="aarch64"/>
+        <package name="grub2-i386-pc" arch="x86_64"/>
+        <package name="syslinux" arch="x86_64"/>
+        <package name="lvm2"/>
+        <package name="plymouth"/>
+        <package name="fontconfig"/>
+        <package name="fonts-config"/>
+        <package name="openssh"/>
+        <package name="iproute2"/>
+        <package name="which"/>
+        <package name="kernel-firmware"/>
+        <package name="kernel-default"/>
+        <package name="NetworkManager"/>
+        <package name="nm-configurator"/>
+        <package name="timezone"/>
+        <package name="haveged"/>
+        <!-- ironic-python-agent specific -->
+        <package name="openstack-ironic-python-agent"/>
+        <package name="hdparm"/>
+        <package name="qemu-tools"/>
+        <package name="python311-proliantutils"/>
+        <package name="lshw"/>
+        <package name="dmidecode"/>
+        <package name="efibootmgr"/>
+        <package name="gptfdisk"/>
+        <package name="open-iscsi"/>
+        <package name="hwinfo"/>
+        <package name="ipmitool"/>
+        <package name="iputils"/>
+        <package name="lvm2"/>
+        <package name="net-tools"/>
+        <package name="ntp"/>
+        <package name="parted"/>
+        <package name="psmisc"/>
+        <package name="timezone"/>
+        <package name="which"/>
+        <package name="kbd"/>
+    </packages>
+
+    <packages type="kis">
+        <package name="dracut-kiwi-oem-repart"/>
+        <package name="dracut-kiwi-oem-dump"/>
    </packages> 

    <packages type="bootstrap">
@@ -67,51 +167,5 @@
        <package name="cracklib-dict-full"/>
        <package name="ca-certificates"/>
        <package name="sles-release"/>
-
-        <package name="checkmedia"/>
-        <package name="fontconfig"/>
-        <package name="fonts-config"/>
-        <package name="grub2-arm64-efi" arch="aarch64"/>
-        <package name="grub2-branding-SLE"/>
-        <package name="grub2-i386-pc" arch="x86_64"/>
-        <package name="grub2-x86_64-efi" arch="x86_64"/>
-        <package name="grub2"/>
-        <package name="gettext-runtime"/>
-        <package name="iproute2"/>
-        <package name="iputils"/>
-        <package name="kernel-default"/>
-        <package name="kernel-firmware-all"/>
-        <package name="lvm2"/>
-        <package name="NetworkManager"/>
-        <package name="nm-configurator"/>
-        <package name="openssh"/>
-        <package name="timezone"/>
-        <package name="which"/>
-        <!-- ironic-python-agent specific -->
-        <package name="chrony"/>
-        <package name="dmidecode"/>
-        <package name="efibootmgr"/>
-        <package name="gptfdisk"/>
-        <package name="hdparm"/>
-        <package name="hwinfo"/>
-        <package name="ipmitool"/>
-        <package name="iputils"/>
-        <package name="kbd"/>
-        <package name="krb5"/>
-        <package name="lshw"/>
-        <package name="lvm2"/>
-        <package name="net-tools"/>
-        <package name="open-iscsi"/>
-        <package name="openstack-ironic-python-agent"/>
-        <package name="parted"/>
-        <package name="psmisc"/>
-        <package name="qemu-tools"/>
-        <package name="timezone"/>
-        <package name="which"/>
-    </packages>
-
-    <packages type="kis">
-        <package name="dracut-kiwi-oem-repart"/>
-        <package name="dracut-kiwi-oem-dump"/>
    </packages>
 </image>
--- a/Show More
+++ b/Show More
Author	SHA256	Message	Date
Nicolas Belouin	b1dfe698ff	Merge pull request 'update-devel' (#141 ) from nbelouin/Factory:update-devel into devel Reviewed-on: #141 Reviewed-by: Denislav Prodanov <dprodanov@noreply.src.opensuse.org>	2025-05-07 10:19:14 +02:00
Nicolas Belouin	9581e030ce	Merge branch 'main' into update-devel	2025-05-06 16:04:05 +02:00
Nicolas Belouin	76036c2dd8	Merge pull request 'update-devel' (#81 ) from nbelouin/Factory:update-devel into devel Reviewed-on: #81 Reviewed-by: Denislav Prodanov <dprodanov@noreply.src.opensuse.org>	2025-02-25 15:37:18 +01:00
Nicolas Belouin	0c6db5d5cc	Merge branch 'main' into devel	2025-02-25 14:32:32 +01:00
Nicolas Belouin	0b03d14cee	Merge pull request 'Add a script to trigger refresh on packages that need one' (#79 ) from nbelouin/Factory:devel-trigger into devel Reviewed-on: #79 Reviewed-by: Denislav Prodanov <dprodanov@noreply.src.opensuse.org>	2025-02-25 13:10:39 +01:00
Nicolas Belouin	9f2dc045e9	Add a script to trigger refresh on packages that need one Signed-off-by: Nicolas Belouin <nicolas.belouin@suse.com>	2025-02-25 11:35:43 +01:00
Denislav Prodanov	f90f614746	update eib image to use package version	2025-01-31 14:59:32 +02:00
Denislav Prodanov	35f06da226	Update edge-image-builder/_service	2025-01-29 09:52:25 +01:00
Denislav Prodanov	8dd6d7d9d7	Update edge-image-builder/edge-image-builder.spec	2025-01-28 13:54:58 +01:00
Denislav Prodanov	f9c5a29a9f	Update edge-image-builder/_service	2025-01-28 13:54:39 +01:00
Denislav Prodanov	1b83b54b58	Update edge-image-builder/_service	2025-01-28 13:47:41 +01:00
Denislav Prodanov	c6b64a252f	Update edge-image-builder/edge-image-builder.spec	2025-01-28 13:43:23 +01:00
Denislav Prodanov	689c80ffcc	Update edge-image-builder/_service	2025-01-28 13:39:56 +01:00
Denislav Prodanov	d8745fe060	Update edge-image-builder/_service	2025-01-28 13:35:25 +01:00
Denislav Prodanov	9e39bdcf7f	Update edge-image-builder/edge-image-builder.spec	2025-01-28 13:30:15 +01:00
Denislav Prodanov	9e376ffb74	Update edge-image-builder/_service	2025-01-28 13:29:50 +01:00
Denislav Prodanov	0fc166ff06	Add _config	2025-01-28 11:37:52 +01:00