--- apiVersion: v1 items: - apiVersion: v1 data: cnibincopy.sh: |- #!/bin/bash set -e function log() { echo "$(date --iso-8601=seconds) [cnibincopy] ${1}" } DESTINATION_DIRECTORY=/host/opt/cni/bin/ # Perform validation of usage if [ -z "$RHEL8_SOURCE_DIRECTORY" ] || [ -z "$RHEL9_SOURCE_DIRECTORY" ] || [ -z "$DEFAULT_SOURCE_DIRECTORY" ]; then log "FATAL ERROR: You must set env variables: RHEL8_SOURCE_DIRECTORY, RHEL9_SOURCE_DIRECTORY, DEFAULT_SOURCE_DIRECTORY" exit 1 fi if [ ! -d "$DESTINATION_DIRECTORY" ]; then log "FATAL ERROR: Destination directory ($DESTINATION_DIRECTORY) does not exist" exit 1 fi # Collect host OS information . /host/etc/os-release rhelmajor= # detect which version we're using in order to copy the proper binaries case "${ID}" in rhcos|scos) RHEL_VERSION=$(echo "${CPE_NAME}" | cut -f 5 -d :) rhelmajor=$(echo $RHEL_VERSION | sed -E 's/([0-9]+)\.{1}[0-9]+(\.[0-9]+)?/\1/') ;; rhel|centos) rhelmajor=$(echo "${VERSION_ID}" | cut -f 1 -d .) ;; fedora) if [ "${VARIANT_ID}" == "coreos" ]; then rhelmajor=8 else log "FATAL ERROR: Unsupported Fedora variant=${VARIANT_ID}" exit 1 fi ;; *) log "FATAL ERROR: Unsupported OS ID=${ID}"; exit 1 ;; esac # Set which directory we'll copy from, detect if it exists sourcedir= founddir=false case "${rhelmajor}" in 8) if [ -d "${RHEL8_SOURCE_DIRECTORY}" ]; then sourcedir=${RHEL8_SOURCE_DIRECTORY} founddir=true fi ;; 9) if [ -d "${RHEL9_SOURCE_DIRECTORY}" ]; then sourcedir=${RHEL9_SOURCE_DIRECTORY} founddir=true fi ;; *) log "ERROR: RHEL Major Version Unsupported, rhelmajor=${rhelmajor}" ;; esac # When it doesn't exist, fall back to the original directory. if [ "$founddir" == false ]; then log "Source directory unavailable for OS version: ${rhelmajor}" sourcedir=$DEFAULT_SOURCE_DIRECTORY fi # Use a subdirectory called "upgrade" so we can atomically move fully copied files. # We now use --remove-destination after running into an issue with -f not working over symlinks UPGRADE_DIRECTORY=${DESTINATION_DIRECTORY}upgrade_$(uuidgen) rm -Rf $UPGRADE_DIRECTORY mkdir -p $UPGRADE_DIRECTORY cp -r --remove-destination ${sourcedir}* $UPGRADE_DIRECTORY if [ $? -eq 0 ]; then log "Successfully copied files in ${sourcedir} to $UPGRADE_DIRECTORY" else log "Failed to copy files in ${sourcedir} to $UPGRADE_DIRECTORY" rm -Rf $UPGRADE_DIRECTORY exit 1 fi mv -f $UPGRADE_DIRECTORY/* ${DESTINATION_DIRECTORY}/ if [ $? -eq 0 ]; then log "Successfully moved files in $UPGRADE_DIRECTORY to ${DESTINATION_DIRECTORY}" else log "Failed to move files in $UPGRADE_DIRECTORY to ${DESTINATION_DIRECTORY}" rm -Rf $UPGRADE_DIRECTORY exit 1 fi rm -Rf $UPGRADE_DIRECTORY kind: ConfigMap metadata: annotations: kubernetes.io/description: | This is a script used to copy CNI binaries based on host OS release.openshift.io/version: 4.21.24 creationTimestamp: "2026-07-14T15:05:34Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:cnibincopy.sh: {} f:metadata: f:annotations: f:kubernetes.io/description: {} f:release.openshift.io/version: {} f:ownerReferences: k:{"uid":"b66a3911-a210-4e14-b380-ec7d5423889c"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-14T15:05:34Z" name: cni-copy-resources namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: b66a3911-a210-4e14-b380-ec7d5423889c resourceVersion: "2354" uid: b94fae33-66a3-411d-a5ca-3ed71b356ebf - apiVersion: v1 data: allowlist.conf: |- ^net.ipv4.conf.IFNAME.accept_redirects$ ^net.ipv4.conf.IFNAME.accept_source_route$ ^net.ipv4.conf.IFNAME.arp_accept$ ^net.ipv4.conf.IFNAME.arp_notify$ ^net.ipv4.conf.IFNAME.disable_policy$ ^net.ipv4.conf.IFNAME.secure_redirects$ ^net.ipv4.conf.IFNAME.send_redirects$ ^net.ipv6.conf.IFNAME.accept_ra$ ^net.ipv6.conf.IFNAME.accept_redirects$ ^net.ipv6.conf.IFNAME.accept_source_route$ ^net.ipv6.conf.IFNAME.arp_accept$ ^net.ipv6.conf.IFNAME.arp_notify$ ^net.ipv6.neigh.IFNAME.base_reachable_time_ms$ ^net.ipv6.neigh.IFNAME.retrans_time_ms$ kind: ConfigMap metadata: annotations: kubernetes.io/description: | Sysctl allowlist for nodes. release.openshift.io/version: 4.21.24 creationTimestamp: "2026-07-14T15:05:34Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:allowlist.conf: {} f:metadata: f:annotations: .: {} f:kubernetes.io/description: {} f:release.openshift.io/version: {} manager: network-operator operation: Update time: "2026-07-14T15:05:34Z" name: cni-sysctl-allowlist namespace: openshift-multus resourceVersion: "2352" uid: c7edb3cb-bb0e-4dcd-80c2-763be8c7f43f - apiVersion: v1 data: allowlist.conf: |- ^net.ipv4.conf.IFNAME.accept_redirects$ ^net.ipv4.conf.IFNAME.accept_source_route$ ^net.ipv4.conf.IFNAME.arp_accept$ ^net.ipv4.conf.IFNAME.arp_notify$ ^net.ipv4.conf.IFNAME.disable_policy$ ^net.ipv4.conf.IFNAME.secure_redirects$ ^net.ipv4.conf.IFNAME.send_redirects$ ^net.ipv6.conf.IFNAME.accept_ra$ ^net.ipv6.conf.IFNAME.accept_redirects$ ^net.ipv6.conf.IFNAME.accept_source_route$ ^net.ipv6.conf.IFNAME.arp_accept$ ^net.ipv6.conf.IFNAME.arp_notify$ ^net.ipv6.neigh.IFNAME.base_reachable_time_ms$ ^net.ipv6.neigh.IFNAME.retrans_time_ms$ kind: ConfigMap metadata: annotations: kubernetes.io/description: | Sysctl allowlist for nodes. release.openshift.io/version: 4.21.24 creationTimestamp: "2026-07-14T15:05:34Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:allowlist.conf: {} f:metadata: f:annotations: f:kubernetes.io/description: {} f:release.openshift.io/version: {} f:ownerReferences: k:{"uid":"b66a3911-a210-4e14-b380-ec7d5423889c"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-14T15:05:34Z" name: default-cni-sysctl-allowlist namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: b66a3911-a210-4e14-b380-ec7d5423889c resourceVersion: "2351" uid: 70696c3b-43a5-4c48-b7fa-d5363d71fc3a - apiVersion: v1 data: ca.crt: | -----BEGIN CERTIFICATE----- MIIDPDCCAiSgAwIBAgIIcJmzQlWgw28wDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MDcxNDE1MDIwM1oX DTM2MDcxMTE1MDIwM1owJjESMBAGA1UECxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdy b290LWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuVBLuIOrqu1b clHtevyTE2Pps20pG2S8WXdBIqIP9buPs2Z71nxLQRXC10r5y7n2LbXGRoQCaaO6 9jY2lfAadV8jNtzz+wobDFJ7uhwskXjH+jbqSyLAvDuAkC6lLtk80Ep8OJL+lT7a +AHUbPnHAA+e0UCKOmkLH8H3waYxShliRE3FKnzGhXNJ1xHuIx/3qibCWS+R/OMu DhBCXtS1/NSIDlTNiyNanjUrgi5uM1oSilCN3Irb0eavYamxnbjOt68ybfw1/x6S Ov2+i9oD6MIUgig7S8LTYAAf1NXxEdt+0t/5i0VFSayvbLEHIhkabJDs6/ZWtyEd 8WyRRYJJIwIDAQABo24wbDAOBgNVHQ8BAf8EBAMCAqQwDwYDVR0TAQH/BAUwAwEB /zBJBgNVHQ4EQgRA6Prz+JZwfGYWqFMeOfgI1ZNRHHPKREl4SPzD1aFgJpeqcCG1 ny7KgZtHCEMbvq9BrMKGsPtFqq0VnOVetDt7ozANBgkqhkiG9w0BAQsFAAOCAQEA Uv7I6Ei+a9E2SZZa1srIs8kUqIJw5pZM8J6rzNNqRZC1HN7RS8NW8xeFhje/Arqa TQEEvqtnWJ6/QHadQuqzdF9yhbMh0wZk3Bd8thHV0LJR4nGiPKjNun8roYObve3y KL/fdFuwNw9B85N51sGkK73Cr0J60sYz7ssj3m8J1tJi1MwWGHfHPCu/yFdGcqlR pqPOOSErA/KNCaMS01lT2gIZ7xbiqA8WlWjQB9VDWzV0xxqUWYzQHC6LYo8La2En gJu32MkWdxTNBhOeTV7P0efoIkTNL7g9IUKu/tgI52bEGyxSdMKAJ99PO4LOJaQy 4C+NEmUWjWBr3IUDewxrYQ== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEADCCAuigAwIBAgIIJmQFWLN5IgEwDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MDcxNDE1MDI0N1oX DTI3MDcxNDE1MDI0N1owMDESMBAGA1UEChMJb3BlbnNoaWZ0MRowGAYDVQQDExFv cGVuc2hpZnQtaW5ncmVzczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AL6ZlnRSfB0FVNHRcGYoYYDjGSiNF2O9KqLOJZPgudBTXoOl8ZXCrroSear2RHM8 yviV6ZKSuzoYxNW61KhJGkAXs1JB8SIiH7wDnIn9eNzCKbHGraOPyDXlq27y36im LUdFLiE7bTKJGOjXjATH/+VGNzAbZHFZEZl9dwoStRqYOOYW6UKCpYWognc2llM+ tuqXp4r/6APVTDbCzFvviUYev0CmalTpiFbghv5fbpSLM6jxRkf4IF+9djKqzYQD ersng4eYmGktyd6VpQyweXSNKF/7xn5p1ESjeCxOtRBcgQRNQvEdnVJqvAEG+/KD jhrLvm2sYy6FMu3fCmDBUrUCAwEAAaOCASYwggEiMA4GA1UdDwEB/wQEAwIFoDAd BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBJBgNV HQ4EQgRAJ7ljYO2QV0Dm91YYOZoIS8vsaXyhvIWfs24vHoaIqilQaDPAf2rn/zUb 3LRv7k54aWsmRYH7nnWv4tU07PvtiDBLBgNVHSMERDBCgEDo+vP4lnB8ZhaoUx45 +AjVk1Ecc8pESXhI/MPVoWAml6pwIbWfLsqBm0cIQxu+r0Gswoaw+0WqrRWc5V60 O3ujMEsGA1UdEQREMEKCQCouYXBwcy5mMjg3MGI3Yy1hOWQ4LTRhYzEtYTdhNi1l NWM5NjkyYzFjOWMucHJvZC5rb25mbHV4ZWFhcy5jb20wDQYJKoZIhvcNAQELBQAD ggEBAIhPLtqrsUXslamSo3uqpguVg/3TpcaLAlFIH0cTS/QWdlAXhy4IVE5G1ihY ItzcWnYFobvkaDffornMTyH/H0Ti0Yzr5A/fLfARN3vG7RBMubGUYq3UP/NhqWzf TYGMSngSPgFYhs6bUudVenCgz807+/CZ8i0h+Qk4Ns+2Ypv0QskCl0ea8u/B2uVj C95gG8Us1xWTsbF+gUzEWeGVTfX8VzVGUXUBCKf8rK7vd1blhTPmqK+YwQBrAcsN rMiL2/anA6uj3AFEL87BH4RuhC53ZI3fIc5W8eBk6t23MN/fc3E7jhvtKM/sg4zU zIxLH7JShwauFiFz27pHBoHxvSc= -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: kubernetes.io/description: Contains a CA bundle that can be used to verify the kube-apiserver when using internal endpoints such as the internal service IP or kubernetes.default.svc. No other usage is guaranteed across distributions of Kubernetes clusters. creationTimestamp: "2026-07-14T15:05:48Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:ca.crt: {} f:metadata: f:annotations: .: {} f:kubernetes.io/description: {} manager: kube-controller-manager operation: Update time: "2026-07-14T15:05:48Z" name: kube-root-ca.crt namespace: openshift-multus resourceVersion: "2650" uid: 07744f91-bc2d-474f-83c5-44bb9144b596 - apiVersion: v1 data: daemon-config.json: | { "cniVersion": "0.3.1", "chrootDir": "/hostroot", "logToStderr": true, "logLevel": "verbose", "binDir": "/var/lib/cni/bin", "perNodeCertificate": { "enabled": true, "bootstrapKubeconfig": "/var/lib/kubelet/kubeconfig", "certDir": "/etc/cni/multus/certs", "certDuration": "24h" }, "cniConfigDir": "/host/etc/cni/net.d", "multusConfigFile": "auto", "multusAutoconfigDir": "/host/run/multus/cni/net.d", "namespaceIsolation": true, "globalNamespaces": "default,openshift-multus,openshift-sriov-network-operator,openshift-cnv", "readinessindicatorfile": "/host/run/multus/cni/net.d/10-ovn-kubernetes.conf", "daemonSocketDir": "/run/multus/socket", "socketDir": "/host/run/multus/socket", "auxiliaryCNIChainName": "vendor-cni-chain" } kind: ConfigMap metadata: creationTimestamp: "2026-07-14T15:05:35Z" labels: app: multus tier: node managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:daemon-config.json: {} f:metadata: f:labels: f:app: {} f:tier: {} f:ownerReferences: k:{"uid":"b66a3911-a210-4e14-b380-ec7d5423889c"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-14T15:05:35Z" name: multus-daemon-config namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: b66a3911-a210-4e14-b380-ec7d5423889c resourceVersion: "2359" uid: 095615d5-a171-4f36-86be-913b2ccda63b - apiVersion: v1 data: cabundle.crt: |- -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIII2vQOuuXeS8wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4NDA0MTg5MzAe Fw0yNjA3MTQxNTExMzJaFw0yODA5MTExNTExMzNaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODQwNDE4OTMwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2lqyGuLBaybD0iZn/C3skDZf3vK6ImVJa mbtiS3oCN2+hn4jTU+kcFBZZTFKI0SC4j3SEAIE6/7hlfePKVUxsy802/hn3v3o/ lm1T0gcvONRCT2pMX3Noobtfz4D3a19C3I7utat1a+pLFlLIydfHQYyGxbCKXVTg wISEB4acr42Woq1YmkzTbjyS1jO2ygS22DXaSk6uPL4+OCF5bOR/zdKI/ggiB0eN tjjTuW1WbCnIOCUbg2O2o6/YB3h/cA1QEj/3FS+TWwDvgwJz8TqOebjwVh+MV01x Y4Hvr6a02LUadT1j1fCiGBNXxG/4lWHy3bHX5HRY6rc04dKbxM5VAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSiEzmI 2vmU/WU1zvbYiGoq0ILOPzAfBgNVHSMEGDAWgBSiEzmI2vmU/WU1zvbYiGoq0ILO PzANBgkqhkiG9w0BAQsFAAOCAQEAfJqeyCZeCTZV2WmokkbBKqrYlMJ5dw7yIYWy lKEj5tsxZDbH4MPiYpMDvVwXaNsQwfXsN39EzQe5mmDffoaMW2xvPpMwXjL/GnlG ZFuX4SEI2SiJnwteR0ngYujdzg9luD/BYXd1clDXJLaPmACSQB6dg2c8It9vbi/a qzP7OXzadT+fVvdDSWaBH4RZyiz2Lov5JnI2CMbTgZOKC7vnWVN7HI3KTpyrNBH3 qKwZIiQk7yPehhYrGbywWsS4JBo1DMLpREQjs8bubilJKr7t4BAsHnkKTMlBZkVg D+ktI7WeqCKqMwXILhsEq/lNOsxsEwA486pI+ER4e77EmIkasw== -----END CERTIFICATE----- kind: ConfigMap metadata: creationTimestamp: "2026-07-14T15:16:25Z" labels: opendatahub.io/managed: "true" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:cabundle.crt: {} f:metadata: f:labels: .: {} f:opendatahub.io/managed: {} manager: manager operation: Update time: "2026-07-14T15:16:25Z" name: odh-kserve-custom-ca-bundle namespace: openshift-multus resourceVersion: "14489" uid: 6defad6c-e00c-4415-870c-0f903e14ee93 - apiVersion: v1 data: service-ca.crt: | -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIII2vQOuuXeS8wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4NDA0MTg5MzAe Fw0yNjA3MTQxNTExMzJaFw0yODA5MTExNTExMzNaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODQwNDE4OTMwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2lqyGuLBaybD0iZn/C3skDZf3vK6ImVJa mbtiS3oCN2+hn4jTU+kcFBZZTFKI0SC4j3SEAIE6/7hlfePKVUxsy802/hn3v3o/ lm1T0gcvONRCT2pMX3Noobtfz4D3a19C3I7utat1a+pLFlLIydfHQYyGxbCKXVTg wISEB4acr42Woq1YmkzTbjyS1jO2ygS22DXaSk6uPL4+OCF5bOR/zdKI/ggiB0eN tjjTuW1WbCnIOCUbg2O2o6/YB3h/cA1QEj/3FS+TWwDvgwJz8TqOebjwVh+MV01x Y4Hvr6a02LUadT1j1fCiGBNXxG/4lWHy3bHX5HRY6rc04dKbxM5VAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSiEzmI 2vmU/WU1zvbYiGoq0ILOPzAfBgNVHSMEGDAWgBSiEzmI2vmU/WU1zvbYiGoq0ILO PzANBgkqhkiG9w0BAQsFAAOCAQEAfJqeyCZeCTZV2WmokkbBKqrYlMJ5dw7yIYWy lKEj5tsxZDbH4MPiYpMDvVwXaNsQwfXsN39EzQe5mmDffoaMW2xvPpMwXjL/GnlG ZFuX4SEI2SiJnwteR0ngYujdzg9luD/BYXd1clDXJLaPmACSQB6dg2c8It9vbi/a qzP7OXzadT+fVvdDSWaBH4RZyiz2Lov5JnI2CMbTgZOKC7vnWVN7HI3KTpyrNBH3 qKwZIiQk7yPehhYrGbywWsS4JBo1DMLpREQjs8bubilJKr7t4BAsHnkKTMlBZkVg D+ktI7WeqCKqMwXILhsEq/lNOsxsEwA486pI+ER4e77EmIkasw== -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: service.beta.openshift.io/inject-cabundle: "true" creationTimestamp: "2026-07-14T15:05:48Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: {} f:metadata: f:annotations: .: {} f:service.beta.openshift.io/inject-cabundle: {} manager: kube-controller-manager operation: Update time: "2026-07-14T15:05:48Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:service-ca.crt: {} manager: service-ca-operator operation: Update time: "2026-07-14T15:11:51Z" name: openshift-service-ca.crt namespace: openshift-multus resourceVersion: "8118" uid: 7500faf1-0c36-499d-a47f-6597020fb48c - apiVersion: v1 data: whereabouts.conf: | { "datastore": "kubernetes", "kubernetes": { "kubeconfig": "/etc/kubernetes/cni/net.d/whereabouts.d/whereabouts.kubeconfig" }, "reconciler_cron_expression": "30 4 * * *", "log_level": "verbose", "configuration_path": "/etc/kubernetes/cni/net.d/whereabouts.d" } kind: ConfigMap metadata: creationTimestamp: "2026-07-14T15:05:35Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:whereabouts.conf: {} f:metadata: f:ownerReferences: k:{"uid":"b66a3911-a210-4e14-b380-ec7d5423889c"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-14T15:05:35Z" name: whereabouts-flatfile-config namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: b66a3911-a210-4e14-b380-ec7d5423889c resourceVersion: "2357" uid: ab753573-44f2-4fa6-9c76-803224915cef kind: ConfigMapList metadata: resourceVersion: "28744"