**FAILURE** rebase-4.15.0-0.nightly_amd64-2025-04-16-032433_arm64-2025-04-15-193250

[microshift-rebase-script]

rebase.sh failed - check committed rebase_sh.log

amd64: 4.15.0-0.nightly-2025-04-16-032433
arm64: 4.15.0-0.nightly-arm64-2025-04-15-193250
prow job: https://prow.ci.openshift.org/view/gs/origin-ci-test/logs/periodic-ci-openshift-microshift-release-4.15-rebase-on-nightlies/1912717997315723264

• cluster-network-operator embedded-component 20786bb70ae9a238f0673b3fbf1f90e25df659ab to e88176de7420cb92099445af4a81d7da48558bfd

  • 028a541 2025-04-02T16:31:04+02:00 Check on ipsec.service instead of libreswan package on host
  • 0740a44 2025-04-02T16:31:04+02:00 Add version check for machine config operator
  • 7667d26 2025-04-02T16:31:04+02:00 Mount top level directory for IPsec host paths
  • 7d2cec6 2025-04-02T16:31:04+02:00 Move to use newer IPsec DaemonSets irrespective of MCP state
  • 27c1c43 2025-04-02T16:31:04+02:00 Better handling of status manager machine config cache
  • b5b261c 2025-04-02T16:31:04+02:00 Use network config last seen annotation for machine config
  • 72c1a7f 2025-04-02T16:31:04+02:00 Report network status for machine config deletes
  • 6a7d66a 2025-04-02T16:31:04+02:00 Use source kind for machine config watcher
  • 517be54 2025-04-02T16:31:04+02:00 Revert "Update network operator status for IPsec"
  • 6da5b01 2025-04-02T16:31:00+02:00 Make machine config handling to be more generic
  • c21aeb0 2025-04-02T16:27:50+02:00 Report IPsec machine config progressing status
  • cc08f45 2025-04-02T16:27:46+02:00 Add machine config watcher for status manager
  • ac08dda 2025-04-02T16:25:36+02:00 Keep rendering OVN IPsec when its daemonset not available
  • f739545 2025-04-02T16:25:36+02:00 Remove 4.13 IPsec upgrade handling
  • c0a9387 2025-04-02T16:25:36+02:00 Keep ovn ipsec enabled during the upgrade     The following change on the machine pool status.MachineCount == status.UpdatedMachineCount && hasSourceInMachineConfigStatus(status, machineConfigs) is introduced with PR OCPBUGS-32525: Check every MachineConfigPool for IPsec plugin existence cluster-network-operator#2349 which ensures IPsec machine config is always installed on all the nodes in the cluster, So this is deleting the IPsec daemonset as per the CNO state machine for IPsec when the condition is not met. But this is also accidentally disabling IPsec in OVN which is not an expected behavior. This causes ovs-monitor-ipsec to refresh existing ipsec connections unnecessarily when IPsec pod comes up as it is not able to find remote_name from the tunnel. This may also trigger deleting IPsec connection entries from openshift.conf file if ovs-monitor-ipsec is not killed timely when ipsec daemonset is removed. So this commit enables ovn ipsec option as long as the API is set with Full mode.
  • e9d52db 2025-04-02T16:25:36+02:00 Restart IPsec service only when needed
  • 1da2a28 2025-04-02T16:25:36+02:00 Revert "Configure narrowing=yes for IPsec connections"
  • 8f3926c 2025-04-02T16:25:36+02:00 Cleanup ipsec state only when ipsec is not full mode

• machine-config-operator embedded-component d6c08256872b54e79fc00fa2c280b626d23bd276 to b23bb29eeffa659058ae6a88969cc0e6a97d82f5

  • b57530e9 2025-03-21T12:23:07+01:00 Add crio dependency for ipsec.service
  • 3ce8a3a9 2025-03-21T12:22:58+01:00 Add ipsec connect wait service

• ovn-kubernetes image-amd64 01af23cb323ec1506b5faf23e3e0d3b59df24fc8 to 1ba21a20c877b452d0b0c091644eb34ff60352fe

  • e1bf7ac 2025-03-18T17:11:47+01:00 Dockerfile.base: bump OVS version to 3.3.

• ovn-kubernetes image-arm64 01af23cb323ec1506b5faf23e3e0d3b59df24fc8 to 1ba21a20c877b452d0b0c091644eb34ff60352fe

  • e1bf7ac 2025-03-18T17:11:47+01:00 Dockerfile.base: bump OVS version to 3.3.

/label tide/merge-method-squash
/label cherry-pick-approved
/label backport-risk-assessed
/label jira/valid-bug

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: microshift-rebase-script[bot]
Once this PR has been reviewed and has the lgtm label, please assign copejon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pmtk]

/close

[openshift-ci]

@pmtk: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@microshift-rebase-script[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	3ae6ffa	link	true	/test images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.