--- apiVersion: v1 items: - apiVersion: v1 data: cnibincopy.sh: |- #!/bin/bash set -e function log() { echo "$(date --iso-8601=seconds) [cnibincopy] ${1}" } DESTINATION_DIRECTORY=/host/opt/cni/bin/ # Perform validation of usage if [ -z "$RHEL8_SOURCE_DIRECTORY" ] || [ -z "$RHEL9_SOURCE_DIRECTORY" ] || [ -z "$DEFAULT_SOURCE_DIRECTORY" ]; then log "FATAL ERROR: You must set env variables: RHEL8_SOURCE_DIRECTORY, RHEL9_SOURCE_DIRECTORY, DEFAULT_SOURCE_DIRECTORY" exit 1 fi if [ ! -d "$DESTINATION_DIRECTORY" ]; then log "FATAL ERROR: Destination directory ($DESTINATION_DIRECTORY) does not exist" exit 1 fi # Collect host OS information . /host/etc/os-release rhelmajor= # detect which version we're using in order to copy the proper binaries case "${ID}" in rhcos|scos) RHEL_VERSION=$(echo "${CPE_NAME}" | cut -f 5 -d :) rhelmajor=$(echo $RHEL_VERSION | sed -E 's/([0-9]+)\.{1}[0-9]+(\.[0-9]+)?/\1/') ;; rhel|centos) rhelmajor=$(echo "${VERSION_ID}" | cut -f 1 -d .) ;; fedora) if [ "${VARIANT_ID}" == "coreos" ]; then rhelmajor=8 else log "FATAL ERROR: Unsupported Fedora variant=${VARIANT_ID}" exit 1 fi ;; *) log "FATAL ERROR: Unsupported OS ID=${ID}"; exit 1 ;; esac # Set which directory we'll copy from, detect if it exists sourcedir= founddir=false case "${rhelmajor}" in 8) if [ -d "${RHEL8_SOURCE_DIRECTORY}" ]; then sourcedir=${RHEL8_SOURCE_DIRECTORY} founddir=true fi ;; 9) if [ -d "${RHEL9_SOURCE_DIRECTORY}" ]; then sourcedir=${RHEL9_SOURCE_DIRECTORY} founddir=true fi ;; *) log "ERROR: RHEL Major Version Unsupported, rhelmajor=${rhelmajor}" ;; esac # When it doesn't exist, fall back to the original directory. if [ "$founddir" == false ]; then log "Source directory unavailable for OS version: ${rhelmajor}" sourcedir=$DEFAULT_SOURCE_DIRECTORY fi # Use a subdirectory called "upgrade" so we can atomically move fully copied files. # We now use --remove-destination after running into an issue with -f not working over symlinks UPGRADE_DIRECTORY=${DESTINATION_DIRECTORY}upgrade_$(uuidgen) rm -Rf $UPGRADE_DIRECTORY mkdir -p $UPGRADE_DIRECTORY cp -r --remove-destination ${sourcedir}* $UPGRADE_DIRECTORY if [ $? -eq 0 ]; then log "Successfully copied files in ${sourcedir} to $UPGRADE_DIRECTORY" else log "Failed to copy files in ${sourcedir} to $UPGRADE_DIRECTORY" rm -Rf $UPGRADE_DIRECTORY exit 1 fi mv -f $UPGRADE_DIRECTORY/* ${DESTINATION_DIRECTORY}/ if [ $? -eq 0 ]; then log "Successfully moved files in $UPGRADE_DIRECTORY to ${DESTINATION_DIRECTORY}" else log "Failed to move files in $UPGRADE_DIRECTORY to ${DESTINATION_DIRECTORY}" rm -Rf $UPGRADE_DIRECTORY exit 1 fi rm -Rf $UPGRADE_DIRECTORY kind: ConfigMap metadata: annotations: kubernetes.io/description: | This is a script used to copy CNI binaries based on host OS release.openshift.io/version: 4.21.23 creationTimestamp: "2026-07-07T17:22:03Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:cnibincopy.sh: {} f:metadata: f:annotations: f:kubernetes.io/description: {} f:release.openshift.io/version: {} f:ownerReferences: k:{"uid":"3a588c14-ffde-424f-9448-80256019f0d8"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-07T17:22:03Z" name: cni-copy-resources namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: 3a588c14-ffde-424f-9448-80256019f0d8 resourceVersion: "3040" uid: 74e93623-858f-430d-8fe0-f37a5733a4ca - apiVersion: v1 data: allowlist.conf: |- ^net.ipv4.conf.IFNAME.accept_redirects$ ^net.ipv4.conf.IFNAME.accept_source_route$ ^net.ipv4.conf.IFNAME.arp_accept$ ^net.ipv4.conf.IFNAME.arp_notify$ ^net.ipv4.conf.IFNAME.disable_policy$ ^net.ipv4.conf.IFNAME.secure_redirects$ ^net.ipv4.conf.IFNAME.send_redirects$ ^net.ipv6.conf.IFNAME.accept_ra$ ^net.ipv6.conf.IFNAME.accept_redirects$ ^net.ipv6.conf.IFNAME.accept_source_route$ ^net.ipv6.conf.IFNAME.arp_accept$ ^net.ipv6.conf.IFNAME.arp_notify$ ^net.ipv6.neigh.IFNAME.base_reachable_time_ms$ ^net.ipv6.neigh.IFNAME.retrans_time_ms$ kind: ConfigMap metadata: annotations: kubernetes.io/description: | Sysctl allowlist for nodes. release.openshift.io/version: 4.21.23 creationTimestamp: "2026-07-07T17:22:03Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:allowlist.conf: {} f:metadata: f:annotations: .: {} f:kubernetes.io/description: {} f:release.openshift.io/version: {} manager: network-operator operation: Update time: "2026-07-07T17:22:03Z" name: cni-sysctl-allowlist namespace: openshift-multus resourceVersion: "3017" uid: f69f5c28-4afe-4473-aca3-2fa2135835bd - apiVersion: v1 data: allowlist.conf: |- ^net.ipv4.conf.IFNAME.accept_redirects$ ^net.ipv4.conf.IFNAME.accept_source_route$ ^net.ipv4.conf.IFNAME.arp_accept$ ^net.ipv4.conf.IFNAME.arp_notify$ ^net.ipv4.conf.IFNAME.disable_policy$ ^net.ipv4.conf.IFNAME.secure_redirects$ ^net.ipv4.conf.IFNAME.send_redirects$ ^net.ipv6.conf.IFNAME.accept_ra$ ^net.ipv6.conf.IFNAME.accept_redirects$ ^net.ipv6.conf.IFNAME.accept_source_route$ ^net.ipv6.conf.IFNAME.arp_accept$ ^net.ipv6.conf.IFNAME.arp_notify$ ^net.ipv6.neigh.IFNAME.base_reachable_time_ms$ ^net.ipv6.neigh.IFNAME.retrans_time_ms$ kind: ConfigMap metadata: annotations: kubernetes.io/description: | Sysctl allowlist for nodes. release.openshift.io/version: 4.21.23 creationTimestamp: "2026-07-07T17:22:03Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:allowlist.conf: {} f:metadata: f:annotations: f:kubernetes.io/description: {} f:release.openshift.io/version: {} f:ownerReferences: k:{"uid":"3a588c14-ffde-424f-9448-80256019f0d8"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-07T17:22:03Z" name: default-cni-sysctl-allowlist namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: 3a588c14-ffde-424f-9448-80256019f0d8 resourceVersion: "3015" uid: 0d2cfbc8-0881-4c52-af1a-7ea9bd0bda0d - apiVersion: v1 data: ca.crt: | -----BEGIN CERTIFICATE----- MIIDPDCCAiSgAwIBAgIIRoNU4O/nQV8wDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MDcwNzE3MTkwMFoX DTM2MDcwNDE3MTkwMFowJjESMBAGA1UECxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdy b290LWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArW0vwKfsQeeJ Bsu7h54w2z9JfjBQA5tYmyLwbI0h56RwHVqnvK2mJyvKKiEkoSfpykJiG4oxgDde 8y61S90Aszm36ZegUm4iUA1txSoKEbmCvolL/jGEgpPE66WPBO0PmCzRT8oUHrXx J8udXhWxsbRdwvFc6eV33FdSwQeKl804N8HSFqlQh2d2a4/xLg1dvMe1NJcUQbEo +wlEiQldCKoHLCK0MQozk1q/Cm7NQywZnJhrTI+SAk6ed/zEwT6+E5oonY7fG0nh sWIihBWqAspD66fzfOPs/Pb21uQYu/2WulL6K+82b4wB7uRUSwKJ3MyVFsfKn9sU iq77w44rrQIDAQABo24wbDAOBgNVHQ8BAf8EBAMCAqQwDwYDVR0TAQH/BAUwAwEB /zBJBgNVHQ4EQgRARxUEoUilzWGo3Y8hyf9sr23G+JQHgtaK8VJ+ZHHKM352AFo/ 6F7zXufoFyXa30J6mb5Hwp8nQEacv1p9r13aEjANBgkqhkiG9w0BAQsFAAOCAQEA mwgGC76VblqY8gkj8TezCDL+Jevp0DPbL/QZ9WytZ8Y+JT8JXWU3JwJJVF+505jg k/56Oj6aDJlyk230baPDYt8GxMLphjC9nD+z/ULJAEP1I69m7QhJlNRr4z7BWQRB 5csc/+H1aks4uRkgbAKirWnuGz3BYf9WITwoODPZgpe722z6WYIAGM/mI3/6DYhK ecZSSmK6OLZuf81miKuTtHh9etCs3VN/qlhd4WnND9bdXOsD+cKb5fiHkVniCEYS I3ldhO4oicY3PxZQfQy0xOfQJEW71TdwdItIvhPs5R9YMtx/LC44LFLwrvvmvVOe CG9sX9+mKaLTZjPCVtU0iQ== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEADCCAuigAwIBAgIIQCdZcacmi2EwDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MDcwNzE3MTkzNFoX DTI3MDcwNzE3MTkzNFowMDESMBAGA1UEChMJb3BlbnNoaWZ0MRowGAYDVQQDExFv cGVuc2hpZnQtaW5ncmVzczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AM5pOKcfikJ2vuwIqPpC3T7rrDGDH/mDD9Tf+E+aizFEbNqe5JmyMXGNevyDFxMu jXInylHnKzChSv93dNBxR7BYFI4Pv1KJ1OthKJt+4Lj2dSX7EBH2PJdGSHqwkmcq Lgn0PIY3HngDekeorEbE8N2RUKjWsjJ8F8PeeBlLrNwf50jkmqpMvUxiOo5Kel5c nUtP3EZgChjma5btaZcF8MNz/1+UQOMcZ6n6gjea+yvp5vJfjKmElgvv2SL+Pct9 yPDgH92AXIm/wXDTidkwKXxFRgPCCmFUIHuqoBgPUQT8bq4gUzdToIT+3P73At3d DDFoXNcN8poL7RufXWSmR60CAwEAAaOCASYwggEiMA4GA1UdDwEB/wQEAwIFoDAd BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBJBgNV HQ4EQgRA3uyw2WIiIsb/0Vp2QDtHbai4/cQ5xb6AqeLX55uuVPr9MsWYIviPZE3G E1MRaHL07cOFmCj7d878PkhJbt2d3zBLBgNVHSMERDBCgEBHFQShSKXNYajdjyHJ /2yvbcb4lAeC1orxUn5kccozfnYAWj/oXvNe5+gXJdrfQnqZvkfCnydARpy/Wn2v XdoSMEsGA1UdEQREMEKCQCouYXBwcy4wNGEzOGUxYS1iMjNhLTQ1OGYtODQ5MC1i YTJhZmFkMDBmYTkucHJvZC5rb25mbHV4ZWFhcy5jb20wDQYJKoZIhvcNAQELBQAD ggEBAHD+g/aIyCMtNexLe947fx3dPugatiBpQ/Eg2prJpnUwYGUTC7VxohXDQdm0 sBsvOVyn6dYgtVLBuyGUvmb7lXdkwKAmJHOHXebaLyHtloFLpCboTnJq7PzduC2Q PHgCOH57h4rI7dRmq8P9mFeVpcql/mLCeDCuKkbN0rP7e4Agb66RPS0cdwfo/rvU 5I49iq7cEFJ+XU81mGV/WAl+LDTBHgcnZ+LXHChRsHVQFPAaNanNAw2XKWWB2Otw xgxZE9wOEbJ0kqXRBh1/k8marbujRFcfd0Jt7THi4DGbrQf6WYNl7odN3caWkZhl 7Wv0FAeiebHhmw+3rV3pXwyUM4g= -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: kubernetes.io/description: Contains a CA bundle that can be used to verify the kube-apiserver when using internal endpoints such as the internal service IP or kubernetes.default.svc. No other usage is guaranteed across distributions of Kubernetes clusters. creationTimestamp: "2026-07-07T17:22:18Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:ca.crt: {} f:metadata: f:annotations: .: {} f:kubernetes.io/description: {} manager: kube-controller-manager operation: Update time: "2026-07-07T17:22:18Z" name: kube-root-ca.crt namespace: openshift-multus resourceVersion: "3768" uid: 247447d2-2889-4803-82a4-ef7b1b8d77f3 - apiVersion: v1 data: daemon-config.json: | { "cniVersion": "0.3.1", "chrootDir": "/hostroot", "logToStderr": true, "logLevel": "verbose", "binDir": "/var/lib/cni/bin", "perNodeCertificate": { "enabled": true, "bootstrapKubeconfig": "/var/lib/kubelet/kubeconfig", "certDir": "/etc/cni/multus/certs", "certDuration": "24h" }, "cniConfigDir": "/host/etc/cni/net.d", "multusConfigFile": "auto", "multusAutoconfigDir": "/host/run/multus/cni/net.d", "namespaceIsolation": true, "globalNamespaces": "default,openshift-multus,openshift-sriov-network-operator,openshift-cnv", "readinessindicatorfile": "/host/run/multus/cni/net.d/10-ovn-kubernetes.conf", "daemonSocketDir": "/run/multus/socket", "socketDir": "/host/run/multus/socket", "auxiliaryCNIChainName": "vendor-cni-chain" } kind: ConfigMap metadata: creationTimestamp: "2026-07-07T17:22:04Z" labels: app: multus tier: node managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:daemon-config.json: {} f:metadata: f:labels: f:app: {} f:tier: {} f:ownerReferences: k:{"uid":"3a588c14-ffde-424f-9448-80256019f0d8"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-07T17:22:04Z" name: multus-daemon-config namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: 3a588c14-ffde-424f-9448-80256019f0d8 resourceVersion: "3124" uid: cc2bb27d-0d02-447b-b4a1-67926fb72321 - apiVersion: v1 data: cabundle.crt: |- -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIINJFLHfgzPB4wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4MzQ0NTI5MTAe Fw0yNjA3MDcxNzI4MTFaFw0yODA5MDQxNzI4MTJaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODM0NDUyOTEwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrKv0FjemYdYjHxMMqCrLnL9uM84bAvfgW JV6d2wprddB8lyHdFNs1xEWLbAZ+PQVk7H3BpU2hy1I9JUd0QUTaMBzzjDKhsUGj gxaUvSFo0Uo5L0v/3Oc6HJtCnrXIyk1hud4XECszkwzDwvFjS43nf9pBO65+olNX Fnq0Jyl2HkeqS33sTN+Bo7ZBQ++3VRpWOcDrgmhNq4lZok/gFkYaYCEEUDvQFgaL JErQviwHOA7cUgvgRg73DN8UZp8UNzoeVtDotnkG6UUcyTOaocde7Go0Wx2NBAoY ZfFARhvlohnZrQOItWI07lR2FGavdh1UO2mK/oKd6hn2usgcMm8fAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTi9a/y IEmgBOmTazx/aLB8gSDmVDAfBgNVHSMEGDAWgBTi9a/yIEmgBOmTazx/aLB8gSDm VDANBgkqhkiG9w0BAQsFAAOCAQEABRkVdiNxEyPlgQshviW06z4oaGmEeMKv5XuG oK36YVrF/7ISBjHXspEznZJOF1gsEJ+75lT7ybSnS048Rpl6N2t3eY9pg+DdXg5D iL+FOiyNoAeacAWsU/VNKHH7UqbsPKu0wKzLjpUX7DxiOAMywl76T/Mh2e9L8f9u 9nF+odmjtGwkUXZHobd2YnGTIz6mL4ui9+EWpH8G3VMcAzsbe5NWugxZByI5myLq b3KvPZIhsFfiS+CrCk1SjRGXSTsILoXCMiLSDwzhFG2JnGQS2CuC3wW32yuvpFJf +D6ilEMyV+Ev9bIOvUbPUBxY3BoD+CW238sLB+YBhuNLA5sbiA== -----END CERTIFICATE----- kind: ConfigMap metadata: creationTimestamp: "2026-07-07T17:33:05Z" labels: opendatahub.io/managed: "true" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:cabundle.crt: {} f:metadata: f:labels: .: {} f:opendatahub.io/managed: {} manager: manager operation: Update time: "2026-07-07T17:33:05Z" name: odh-kserve-custom-ca-bundle namespace: openshift-multus resourceVersion: "14466" uid: 5957e4a6-5940-4153-a2f0-5861e7623dbe - apiVersion: v1 data: service-ca.crt: | -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIINJFLHfgzPB4wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4MzQ0NTI5MTAe Fw0yNjA3MDcxNzI4MTFaFw0yODA5MDQxNzI4MTJaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODM0NDUyOTEwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrKv0FjemYdYjHxMMqCrLnL9uM84bAvfgW JV6d2wprddB8lyHdFNs1xEWLbAZ+PQVk7H3BpU2hy1I9JUd0QUTaMBzzjDKhsUGj gxaUvSFo0Uo5L0v/3Oc6HJtCnrXIyk1hud4XECszkwzDwvFjS43nf9pBO65+olNX Fnq0Jyl2HkeqS33sTN+Bo7ZBQ++3VRpWOcDrgmhNq4lZok/gFkYaYCEEUDvQFgaL JErQviwHOA7cUgvgRg73DN8UZp8UNzoeVtDotnkG6UUcyTOaocde7Go0Wx2NBAoY ZfFARhvlohnZrQOItWI07lR2FGavdh1UO2mK/oKd6hn2usgcMm8fAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTi9a/y IEmgBOmTazx/aLB8gSDmVDAfBgNVHSMEGDAWgBTi9a/yIEmgBOmTazx/aLB8gSDm VDANBgkqhkiG9w0BAQsFAAOCAQEABRkVdiNxEyPlgQshviW06z4oaGmEeMKv5XuG oK36YVrF/7ISBjHXspEznZJOF1gsEJ+75lT7ybSnS048Rpl6N2t3eY9pg+DdXg5D iL+FOiyNoAeacAWsU/VNKHH7UqbsPKu0wKzLjpUX7DxiOAMywl76T/Mh2e9L8f9u 9nF+odmjtGwkUXZHobd2YnGTIz6mL4ui9+EWpH8G3VMcAzsbe5NWugxZByI5myLq b3KvPZIhsFfiS+CrCk1SjRGXSTsILoXCMiLSDwzhFG2JnGQS2CuC3wW32yuvpFJf +D6ilEMyV+Ev9bIOvUbPUBxY3BoD+CW238sLB+YBhuNLA5sbiA== -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: service.beta.openshift.io/inject-cabundle: "true" creationTimestamp: "2026-07-07T17:22:18Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: {} f:metadata: f:annotations: .: {} f:service.beta.openshift.io/inject-cabundle: {} manager: kube-controller-manager operation: Update time: "2026-07-07T17:22:18Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:service-ca.crt: {} manager: service-ca-operator operation: Update time: "2026-07-07T17:28:24Z" name: openshift-service-ca.crt namespace: openshift-multus resourceVersion: "7981" uid: 65b5b69b-6b1a-4177-88da-af0b539b81ed - apiVersion: v1 data: whereabouts.conf: | { "datastore": "kubernetes", "kubernetes": { "kubeconfig": "/etc/kubernetes/cni/net.d/whereabouts.d/whereabouts.kubeconfig" }, "reconciler_cron_expression": "30 4 * * *", "log_level": "verbose", "configuration_path": "/etc/kubernetes/cni/net.d/whereabouts.d" } kind: ConfigMap metadata: creationTimestamp: "2026-07-07T17:22:04Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:whereabouts.conf: {} f:metadata: f:ownerReferences: k:{"uid":"3a588c14-ffde-424f-9448-80256019f0d8"}: {} manager: cluster-network-operator/operconfig operation: Apply time: "2026-07-07T17:22:04Z" name: whereabouts-flatfile-config namespace: openshift-multus ownerReferences: - apiVersion: operator.openshift.io/v1 blockOwnerDeletion: true controller: true kind: Network name: cluster uid: 3a588c14-ffde-424f-9448-80256019f0d8 resourceVersion: "3063" uid: bff534c5-3f22-46df-a6fd-f8083c2490a6 kind: ConfigMapList metadata: resourceVersion: "58579"