NO-ISSUE: rebase-release-4.18-4.18.0-0.nightly-2025-04-02-174719_amd64-2025-04-02_arm64-2025-04-02

[microshift-rebase-script]

amd64: 4.18.0-0.nightly-2025-04-02-174719
arm64: 4.18.0-0.nightly-arm64-2025-04-02-182118
prow job: https://prow.ci.openshift.org/view/gs/origin-ci-test/logs/periodic-ci-openshift-microshift-release-4.18-periodics-rebase-on-nightlies/1907644532682395648

• cluster-ingress-operator embedded-component b0222ed2054e3ff7b87f4f90d72b42b6cf2b53a7 to d967a73c5f7da76783ee1af093f21817e7681e1d

  • c22c21d 2025-03-20T17:15:22+00:00 NE-1951: Pre-upgrade Admin Gate for Gateway API CRD Management Succession

• cluster-network-operator embedded-component 8cbda2ddf6aef578ea40f224c1281c2a6ee262c4 to 670c2e35eb315547eceae8a3a1b6e19638ff4f44

  • 1abd78b 2025-03-19T13:39:52+01:00 Check on ipsec.service instead of libreswan package on host
  • c8f4cf8 2025-03-19T13:39:52+01:00 Add version check for machine config operator
  • 91a6b78 2025-03-19T13:39:52+01:00 Mount top level directory for IPsec host paths
  • 2ddaf1c 2025-03-19T13:39:52+01:00 Move to use newer IPsec DaemonSets irrespective of MCP state
  • 541ca8f 2025-03-19T13:36:58+01:00 Better handling of status manager machine config cache
  • 79e7d3e 2025-03-19T13:36:58+01:00 Use network config last seen annotation for machine config
  • 717548e 2025-03-19T13:36:58+01:00 Report network status for machine config deletes
  • 1484a6a 2025-03-19T13:36:58+01:00 Use source kind for machine config watcher
  • 083bb1e 2025-03-19T13:36:58+01:00 Revert "Update network operator status for IPsec"
  • bb98709 2025-03-19T13:36:58+01:00 Make machine config handling to be more generic
  • a788057 2025-03-19T13:36:58+01:00 Report IPsec machine config progressing status
  • d7eded0 2025-03-19T13:36:58+01:00 Add machine config watcher for status manager
  • 738f193 2025-03-19T13:36:58+01:00 Keep rendering OVN IPsec when its daemonset not available
  • 08e448d 2025-03-19T13:36:58+01:00 Remove 4.13 IPsec upgrade handling
  • 35ce486 2025-03-19T13:36:58+01:00 Keep ovn ipsec enabled during the upgrade     The following change on the machine pool status.MachineCount == status.UpdatedMachineCount && hasSourceInMachineConfigStatus(status, machineConfigs) is introduced with PR OCPBUGS-32525: Check every MachineConfigPool for IPsec plugin existence cluster-network-operator#2349 which ensures IPsec machine config is always installed on all the nodes in the cluster, So this is deleting the IPsec daemonset as per the CNO state machine for IPsec when the condition is not met. But this is also accidentally disabling IPsec in OVN which is not an expected behavior. This causes ovs-monitor-ipsec to refresh existing ipsec connections unnecessarily when IPsec pod comes up as it is not able to find remote_name from the tunnel. This may also trigger deleting IPsec connection entries from openshift.conf file if ovs-monitor-ipsec is not killed timely when ipsec daemonset is removed. So this commit enables ovn ipsec option as long as the API is set with Full mode.
  • 44296d2 2025-03-19T13:36:58+01:00 Restart IPsec service only when needed
  • a893992 2025-03-19T13:36:58+01:00 Revert "Configure narrowing=yes for IPsec connections"
  • 56ecd0c 2025-03-19T13:36:58+01:00 Cleanup ipsec state only when ipsec is not full mode

• kubernetes embedded-component 6020cf5333bdeb77f95fa33f8272e5251ea28edc to 97471c6ac55733da63e4db6680889897a5915ca7

  • 579a60270 2025-03-18T22:12:32+01:00 UPSTREAM: : Disable default off feature
  • 4a4e94297 2025-03-18T21:52:35+01:00 UPSTREAM: : hack/update-vendor.sh, make update and update image
  • e5a6db4e6 2025-03-18T21:09:30+01:00 UPSTREAM: : manually resolve conflicts
  • da5358784 2025-03-11T19:55:16+00:00 Release commit for Kubernetes v1.31.7
  • ae9dcc0a7 2025-03-06T11:00:19-08:00 Update status before returning err
  • f12dbc31a 2025-03-03T13:43:37-08:00 Add the feature gate OrderedNamespaceDeletion for apiserver.
  • 2a90c25ac 2025-02-25T20:37:17+00:00 Update kubectl exec to use correct format
  • 475334f99 2025-02-20T15:21:35+02:00 kubeadm: fix panic when no UpgradeConfiguration was found in the config file
  • e8b0252a4 2025-02-18T21:09:33-05:00 proxy: should add PingPeriod for websocket translator
  • 3a9f05a1e 2025-02-15T15:40:08-05:00 Bump to build with go 1.23.6
  • 51a17c3c4 2025-02-14T12:57:36-05:00 Honor KUBE_HACK_TOOLS_GOTOOLCHAIN
  • 5d5ac1696 2025-02-14T14:14:37+01:00 Deflake the PodReplacementPolicyFeatureToggling Job integration test
  • c1cddd5ff 2025-02-14T07:54:16+01:00 Limit ResourceQuota LIST requests to times when informer is not synced
  • 1d723e384 2025-02-12T21:51:09+00:00 Update CHANGELOG/CHANGELOG-1.31.md for v1.31.6
  • 19ebee96b 2025-02-10T14:39:06-08:00 Add tests
  • 93a63da85 2025-02-10T14:35:20-08:00 do not install handler for /metrics/slis using sync.Once
  • 087e65b19 2025-02-10T16:45:58+01:00 Fix the flaky Job test: TestSuccessPolicy_ReEnabling

• machine-config-operator embedded-component 805bc69d1d4adc10ab57fe0466eb7ab342e903af to 28740b628797734ed26d4b4926530f6d41d4ce6b

  • 680d1ce4 2025-03-19T08:50:19+01:00 Add crio dependency for ipsec.service
  • 16e81a42 2025-03-19T08:50:06+01:00 Add ipsec connect wait service
  • 28ee0ab0 2025-02-20T12:20:50-05:00 crio: Master, Worker and Arbiter /etc/crio/crio.conf.d/00-default contains runtime_root for runc

• ovn-kubernetes image-amd64 799f96146c2056a50ae8252a87c03de1cc698f13

The change list was truncated. See scripts/auto-rebase/changelog.txt in the PR for the full details.

/label tide/merge-method-squash
/label cherry-pick-approved
/label backport-risk-assessed
/label jira/valid-bug

[openshift-ci-robot]

@microshift-rebase-script[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

amd64: 4.18.0-0.nightly-2025-04-02-174719
arm64: 4.18.0-0.nightly-arm64-2025-04-02-182118
prow job: https://prow.ci.openshift.org/view/gs/origin-ci-test/logs/periodic-ci-openshift-microshift-release-4.18-periodics-rebase-on-nightlies/1907644532682395648

• cluster-ingress-operator embedded-component b0222ed2054e3ff7b87f4f90d72b42b6cf2b53a7 to d967a73c5f7da76783ee1af093f21817e7681e1d

• c22c21d 2025-03-20T17:15:22+00:00 NE-1951: Pre-upgrade Admin Gate for Gateway API CRD Management Succession

• cluster-network-operator embedded-component 8cbda2ddf6aef578ea40f224c1281c2a6ee262c4 to 670c2e35eb315547eceae8a3a1b6e19638ff4f44

• 1abd78b 2025-03-19T13:39:52+01:00 Check on ipsec.service instead of libreswan package on host

• c8f4cf8 2025-03-19T13:39:52+01:00 Add version check for machine config operator

• 91a6b78 2025-03-19T13:39:52+01:00 Mount top level directory for IPsec host paths

• 2ddaf1c 2025-03-19T13:39:52+01:00 Move to use newer IPsec DaemonSets irrespective of MCP state

• 541ca8f 2025-03-19T13:36:58+01:00 Better handling of status manager machine config cache

• 79e7d3e 2025-03-19T13:36:58+01:00 Use network config last seen annotation for machine config

• 717548e 2025-03-19T13:36:58+01:00 Report network status for machine config deletes

• 1484a6a 2025-03-19T13:36:58+01:00 Use source kind for machine config watcher

• 083bb1e 2025-03-19T13:36:58+01:00 Revert "Update network operator status for IPsec"

• bb98709 2025-03-19T13:36:58+01:00 Make machine config handling to be more generic

• a788057 2025-03-19T13:36:58+01:00 Report IPsec machine config progressing status

• d7eded0 2025-03-19T13:36:58+01:00 Add machine config watcher for status manager

• 738f193 2025-03-19T13:36:58+01:00 Keep rendering OVN IPsec when its daemonset not available

• 08e448d 2025-03-19T13:36:58+01:00 Remove 4.13 IPsec upgrade handling

• 35ce486 2025-03-19T13:36:58+01:00 Keep ovn ipsec enabled during the upgrade     The following change on the machine pool status.MachineCount == status.UpdatedMachineCount && hasSourceInMachineConfigStatus(status, machineConfigs) is introduced with PR OCPBUGS-32525: Check every MachineConfigPool for IPsec plugin existence cluster-network-operator#2349 which ensures IPsec machine config is always installed on all the nodes in the cluster, So this is deleting the IPsec daemonset as per the CNO state machine for IPsec when the condition is not met. But this is also accidentally disabling IPsec in OVN which is not an expected behavior. This causes ovs-monitor-ipsec to refresh existing ipsec connections unnecessarily when IPsec pod comes up as it is not able to find remote_name from the tunnel. This may also trigger deleting IPsec connection entries from openshift.conf file if ovs-monitor-ipsec is not killed timely when ipsec daemonset is removed. So this commit enables ovn ipsec option as long as the API is set with Full mode.

• 44296d2 2025-03-19T13:36:58+01:00 Restart IPsec service only when needed

• a893992 2025-03-19T13:36:58+01:00 Revert "Configure narrowing=yes for IPsec connections"

• 56ecd0c 2025-03-19T13:36:58+01:00 Cleanup ipsec state only when ipsec is not full mode

• kubernetes embedded-component 6020cf5333bdeb77f95fa33f8272e5251ea28edc to 97471c6ac55733da63e4db6680889897a5915ca7

• 579a60270 2025-03-18T22:12:32+01:00 UPSTREAM: : Disable default off feature

• 4a4e94297 2025-03-18T21:52:35+01:00 UPSTREAM: : hack/update-vendor.sh, make update and update image

• e5a6db4e6 2025-03-18T21:09:30+01:00 UPSTREAM: : manually resolve conflicts

• da5358784 2025-03-11T19:55:16+00:00 Release commit for Kubernetes v1.31.7

• ae9dcc0a7 2025-03-06T11:00:19-08:00 Update status before returning err

• f12dbc31a 2025-03-03T13:43:37-08:00 Add the feature gate OrderedNamespaceDeletion for apiserver.

• 2a90c25ac 2025-02-25T20:37:17+00:00 Update kubectl exec to use correct format

• 475334f99 2025-02-20T15:21:35+02:00 kubeadm: fix panic when no UpgradeConfiguration was found in the config file

• e8b0252a4 2025-02-18T21:09:33-05:00 proxy: should add PingPeriod for websocket translator

• 3a9f05a1e 2025-02-15T15:40:08-05:00 Bump to build with go 1.23.6

• 51a17c3c4 2025-02-14T12:57:36-05:00 Honor KUBE_HACK_TOOLS_GOTOOLCHAIN

• 5d5ac1696 2025-02-14T14:14:37+01:00 Deflake the PodReplacementPolicyFeatureToggling Job integration test

• c1cddd5ff 2025-02-14T07:54:16+01:00 Limit ResourceQuota LIST requests to times when informer is not synced

• 1d723e384 2025-02-12T21:51:09+00:00 Update CHANGELOG/CHANGELOG-1.31.md for v1.31.6

• 19ebee96b 2025-02-10T14:39:06-08:00 Add tests

• 93a63da85 2025-02-10T14:35:20-08:00 do not install handler for /metrics/slis using sync.Once

• 087e65b19 2025-02-10T16:45:58+01:00 Fix the flaky Job test: TestSuccessPolicy_ReEnabling

• machine-config-operator embedded-component 805bc69d1d4adc10ab57fe0466eb7ab342e903af to 28740b628797734ed26d4b4926530f6d41d4ce6b

• 680d1ce4 2025-03-19T08:50:19+01:00 Add crio dependency for ipsec.service

• 16e81a42 2025-03-19T08:50:06+01:00 Add ipsec connect wait service

• 28ee0ab0 2025-02-20T12:20:50-05:00 crio: Master, Worker and Arbiter /etc/crio/crio.conf.d/00-default contains runtime_root for runc

• ovn-kubernetes image-amd64 799f96146c2056a50ae8252a87c03de1cc698f13

The change list was truncated. See scripts/auto-rebase/changelog.txt in the PR for the full details.

/label tide/merge-method-squash
/label cherry-pick-approved
/label backport-risk-assessed
/label jira/valid-bug

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@microshift-rebase-script[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pmtk]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: microshift-rebase-script[bot], pmtk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pmtk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment