cicd: release Network Operator v25.10.0-beta.1 (#1760)

heyvister1 · web-flow · commit c938d3200cd2 · 2025-10-12T18:56:48.000+03:00
Created by the [*create-release-pr* job](https://github.com/Mellanox/network-operator/actions/runs/18405352911).
diff --git a/deployment/network-operator/Chart.yaml b/deployment/network-operator/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: network-operator
-version: 25.7.0-beta.3
+version: 25.10.0-beta.1
 kubeVersion: '>= 1.21.0'
-appVersion: v25.7.0-beta.3
+appVersion: v25.10.0-beta.1
 description: Nvidia network operator
 type: application
 keywords:
diff --git a/deployment/network-operator/charts/maintenance-operator-chart/templates/metrics-service.yaml b/deployment/network-operator/charts/maintenance-operator-chart/templates/metrics-service.yaml
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/_helpers.tpl b/deployment/network-operator/charts/node-feature-discovery/templates/_helpers.tpl
@@ -105,3 +105,22 @@ Create the name of the service account which nfd-gc will use
     {{ default "default" .Values.gc.serviceAccount.name }}
 {{- end -}}
 {{- end -}}
+
+{{/*
+imagePullSecrets helper - uses local values or falls back to global values
+*/}}
+{{- define "node-feature-discovery.imagePullSecrets" -}}
+{{- $imagePullSecrets := list -}}
+{{- if .Values.imagePullSecrets -}}
+  {{- range .Values.imagePullSecrets -}}
+    {{- $imagePullSecrets = append $imagePullSecrets . -}}
+  {{- end -}}
+{{- else if and .Values.global .Values.global.imagePullSecrets -}}
+  {{- range .Values.global.imagePullSecrets -}}
+    {{- $imagePullSecrets = append $imagePullSecrets . -}}
+  {{- end -}}
+{{- end -}}
+{{- if $imagePullSecrets -}}
+{{- $imagePullSecrets | toJson }}
+{{- end -}}
+{{- end -}}
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/master.yaml b/deployment/network-operator/charts/node-feature-discovery/templates/master.yaml
@@ -33,10 +33,7 @@ spec:
     {{- with .Values.priorityClassName }}
       priorityClassName: {{ . }}
     {{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
+      imagePullSecrets: {{ include "node-feature-discovery.imagePullSecrets" . }}
       serviceAccountName: {{ include "node-feature-discovery.master.serviceAccountName" . }}
       enableServiceLinks: false
       securityContext:
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/nfd-gc.yaml b/deployment/network-operator/charts/node-feature-discovery/templates/nfd-gc.yaml
@@ -33,10 +33,7 @@ spec:
     {{- with .Values.priorityClassName }}
       priorityClassName: {{ . }}
     {{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
+      imagePullSecrets: {{ include "node-feature-discovery.imagePullSecrets" . }}
       securityContext:
         {{- toYaml .Values.gc.podSecurityContext | nindent 8 }}
       hostNetwork: {{ .Values.gc.hostNetwork }}
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/post-delete-job.yaml b/deployment/network-operator/charts/node-feature-discovery/templates/post-delete-job.yaml
@@ -67,10 +67,7 @@ spec:
         role: prune
     spec:
       serviceAccountName: {{ include "node-feature-discovery.fullname" . }}-prune
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
+      imagePullSecrets: {{ include "node-feature-discovery.imagePullSecrets" . }}
       containers:
         - name: nfd-master
           securityContext:
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/topologyupdater.yaml b/deployment/network-operator/charts/node-feature-discovery/templates/topologyupdater.yaml
@@ -33,10 +33,7 @@ spec:
     {{- with .Values.priorityClassName }}
       priorityClassName: {{ . }}
     {{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
+      imagePullSecrets: {{ include "node-feature-discovery.imagePullSecrets" . }}
       securityContext:
         {{- toYaml .Values.topologyUpdater.podSecurityContext | nindent 8 }}
       hostNetwork: {{ .Values.topologyUpdater.hostNetwork }}
diff --git a/deployment/network-operator/charts/node-feature-discovery/templates/worker.yaml b/deployment/network-operator/charts/node-feature-discovery/templates/worker.yaml
@@ -36,10 +36,7 @@ spec:
     {{- with .Values.priorityClassName }}
       priorityClassName: {{ . }}
     {{- end }}
-    {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
+      imagePullSecrets: {{ include "node-feature-discovery.imagePullSecrets" . }}
       serviceAccountName: {{ include "node-feature-discovery.worker.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.worker.podSecurityContext | nindent 8 }}
diff --git a/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworknodepolicies.yaml b/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworknodepolicies.yaml
@@ -61,6 +61,13 @@ spec:
                             description: IDs to inject to external_ids field in the
                               Bridge table in OVSDB
                             type: object
+                          failMode:
+                            description: configure fail_mode field in the Bridge table
+                              in OVSDB (optional). 'secure' or 'standalone'.
+                            enum:
+                            - secure
+                            - standalone
+                            type: string
                           otherConfig:
                             additionalProperties:
                               type: string
diff --git a/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworknodestates.yaml b/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworknodestates.yaml
@@ -74,6 +74,13 @@ spec:
                               description: IDs to inject to external_ids field in
                                 the Bridge table in OVSDB
                               type: object
+                            failMode:
+                              description: configure fail_mode field in the Bridge
+                                table in OVSDB (optional). 'secure' or 'standalone'.
+                              enum:
+                              - secure
+                              - standalone
+                              type: string
                             otherConfig:
                               additionalProperties:
                                 type: string
@@ -180,14 +187,6 @@ spec:
                 type: array
               system:
                 properties:
-                  ovsConfig:
-                    additionalProperties:
-                      type: string
-                    default:
-                      hw-offload: "true"
-                    description: OVS config. It will be provided for ovs-vswitchd
-                      service as other_config option
-                    type: object
                   rdmaMode:
                     description: RDMA subsystem. Allowed value "shared", "exclusive".
                     enum:
@@ -221,6 +220,13 @@ spec:
                               description: IDs to inject to external_ids field in
                                 the Bridge table in OVSDB
                               type: object
+                            failMode:
+                              description: configure fail_mode field in the Bridge
+                                table in OVSDB (optional). 'secure' or 'standalone'.
+                              enum:
+                              - secure
+                              - standalone
+                              type: string
                             otherConfig:
                               additionalProperties:
                                 type: string
@@ -362,14 +368,6 @@ spec:
                 type: string
               system:
                 properties:
-                  ovsConfig:
-                    additionalProperties:
-                      type: string
-                    default:
-                      hw-offload: "true"
-                    description: OVS config. It will be provided for ovs-vswitchd
-                      service as other_config option
-                    type: object
                   rdmaMode:
                     description: RDMA subsystem. Allowed value "shared", "exclusive".
                     enum:
diff --git a/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworkpoolconfigs.yaml b/deployment/network-operator/charts/sriov-network-operator/crds/sriovnetwork.openshift.io_sriovnetworkpoolconfigs.yaml
@@ -112,14 +112,6 @@ spec:
                       On OpenShift:
                       Name is the name of MachineConfigPool to be enabled with OVS hardware offload
                     type: string
-                  otherConfig:
-                    additionalProperties:
-                      type: string
-                    default:
-                      hw-offload: "true"
-                    description: OVS config. It will be provided for ovs-vswitchd
-                      service as other_config option
-                    type: object
                 type: object
               rdmaMode:
                 description: RDMA subsystem. Allowed value "shared", "exclusive".
diff --git a/deployment/network-operator/charts/sriov-network-operator/templates/operator.yaml b/deployment/network-operator/charts/sriov-network-operator/templates/operator.yaml
@@ -47,6 +47,14 @@ spec:
             requests:
               cpu: 100m
               memory: 100Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
           env:
             - name: WATCH_NAMESPACE
               valueFrom:
@@ -78,6 +86,8 @@ spec:
               value: {{ .Values.operator.metricsExporter.certificates.secretName }}
             - name: METRICS_EXPORTER_KUBE_RBAC_PROXY_IMAGE
               value: {{ .Values.images.metricsExporterKubeRbacProxy }}
+            - name: USE_MAINTENANCE_OPERATOR_DRAINER
+              value: {{ .Values.operator.maintenanceOperatorDrainer.enabled | quote }}
             {{- if .Values.operator.metricsExporter.prometheusOperator.enabled }}
             - name: METRICS_EXPORTER_PROMETHEUS_OPERATOR_ENABLED
               value: {{ .Values.operator.metricsExporter.prometheusOperator.enabled | quote}}
@@ -113,6 +123,10 @@ spec:
             - name: STALE_NODE_STATE_CLEANUP_DELAY_MINUTES
               value: "{{ .Values.operator.staleNodeStateCleanupDelayMinutes }}"
         {{- if .Values.operator.admissionControllers.enabled }}
+            - name: OPERATOR_WEBHOOK_NETWORK_POLICY_PORT
+              value: "{{ .Values.operator.admissionControllers.networkPolicy.operator.port }}"
+            - name: INJECTOR_WEBHOOK_NETWORK_POLICY_PORT
+              value: "{{ .Values.operator.admissionControllers.networkPolicy.injector.port }}"
             - name: ADMISSION_CONTROLLERS_CERTIFICATES_OPERATOR_SECRET_NAME
               value: {{ .Values.operator.admissionControllers.certificates.secretNames.operator }}
             - name: ADMISSION_CONTROLLERS_CERTIFICATES_INJECTOR_SECRET_NAME
diff --git a/deployment/network-operator/charts/sriov-network-operator/templates/pre-delete-webooks.yaml b/deployment/network-operator/charts/sriov-network-operator/templates/pre-delete-webooks.yaml
@@ -23,6 +23,14 @@ spec:
       containers:
         - name: cleanup
           image: {{ .Values.images.operator }}
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
           command:
             - sriov-network-operator-config-cleanup
           args:
diff --git a/deployment/network-operator/charts/sriov-network-operator/templates/role.yaml b/deployment/network-operator/charts/sriov-network-operator/templates/role.yaml
@@ -144,4 +144,4 @@ rules:
     resources:
       - configmaps
     verbs:
-      - get
+      - get
diff --git a/deployment/network-operator/charts/sriov-network-operator/values.yaml b/deployment/network-operator/charts/sriov-network-operator/values.yaml
@@ -40,8 +40,16 @@ operator:
       serviceAccount: "prometheus-k8s"
       namespace: "monitoring"
       deployRules: false
+  # use external drain controller, utilizing NVIDIA maintenance operator
+  maintenanceOperatorDrainer:
+    enabled: false
   admissionControllers:
     enabled: false
+    networkPolicy:
+      operator:
+        port: "6443"
+      injector:
+        port: "6443"
     certificates:
       secretNames:
         operator: "operator-webhook-cert"
diff --git a/deployment/network-operator/values.yaml b/deployment/network-operator/values.yaml
@@ -45,7 +45,7 @@ node-feature-discovery:
 
   image:
     repository: nvcr.io/nvstaging/mellanox/node-feature-discovery
-    tag: network-operator-v25.7.0
+    tag: network-operator-v25.10.0-beta.1
     pullPolicy: IfNotPresent
   # imagePullSecrest for node-feature-discovery Network Operator related images
   #imagePullSecrets: []
@@ -157,15 +157,15 @@ sriov-network-operator:
 
   # Image URIs for sriov-network-operator components.
   images:
-    operator: nvcr.io/nvstaging/mellanox/sriov-network-operator:network-operator-v25.7.0
-    sriovConfigDaemon: nvcr.io/nvstaging/mellanox/sriov-network-operator-config-daemon:network-operator-v25.7.0
-    sriovCni: nvcr.io/nvstaging/mellanox/sriov-cni:network-operator-v25.7.0
-    ibSriovCni: nvcr.io/nvstaging/mellanox/ib-sriov-cni:network-operator-v25.7.0
-    ovsCni: nvcr.io/nvstaging/mellanox/ovs-cni-plugin:network-operator-v25.7.0
-    # rdmaCni: nvcr.io/nvstaging/mellanox/rdma-cni:network-operator-v25.7.0
-    sriovDevicePlugin: nvcr.io/nvstaging/mellanox/sriov-network-device-plugin:network-operator-v25.7.0
+    operator: nvcr.io/nvstaging/mellanox/sriov-network-operator:network-operator-v25.10.0-beta.1
+    sriovConfigDaemon: nvcr.io/nvstaging/mellanox/sriov-network-operator-config-daemon:network-operator-v25.10.0-beta.1
+    sriovCni: nvcr.io/nvstaging/mellanox/sriov-cni:network-operator-v25.10.0-beta.1
+    ibSriovCni: nvcr.io/nvstaging/mellanox/ib-sriov-cni:network-operator-v25.10.0-beta.1
+    ovsCni: nvcr.io/nvstaging/mellanox/ovs-cni-plugin:network-operator-v25.10.0-beta.1
+    # rdmaCni: nvcr.io/nvstaging/mellanox/rdma-cni:network-operator-v25.10.0-beta.1
+    sriovDevicePlugin: nvcr.io/nvstaging/mellanox/sriov-network-device-plugin:network-operator-v25.10.0-beta.1
     resourcesInjector: ghcr.io/k8snetworkplumbingwg/network-resources-injector:v1.7.0
-    webhook: nvcr.io/nvstaging/mellanox/sriov-network-operator-webhook:network-operator-v25.7.0
+    webhook: nvcr.io/nvstaging/mellanox/sriov-network-operator-webhook:network-operator-v25.10.0-beta.1
   # imagePullSecrest for SR-IOV Network Operator related images
   # imagePullSecrets: []
   sriovOperatorConfig:
@@ -190,7 +190,7 @@ maintenance-operator-chart:
     image:
       repository: nvcr.io/nvstaging/mellanox
       name: maintenance-operator
-      tag: network-operator-v25.7.0
+      tag: network-operator-v25.10.0-beta.1
     admissionController:
       # -- enable admission controller of the operator
       enable: false
@@ -316,7 +316,7 @@ operator:
       # -- Init container image name.
       image: network-operator-init-container
       # -- Init container image version.
-      version: network-operator-v25.7.0
+      version: network-operator-v25.10.0-beta.1
 
 # -- An optional list of references to secrets to use for pulling any of the
 # Network Operator images.
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-full-ocp.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-full-ocp.yaml
@@ -45,7 +45,7 @@ spec:
   rdmaSharedDevicePlugin:
     image: k8s-rdma-shared-dev-plugin
     repository: nvcr.io/nvstaging/mellanox
-    version: network-operator-v25.7.0
+    version: network-operator-v25.10.0-beta.1
     # The config below directly propagates to k8s-rdma-shared-device-plugin configuration.
     # Replace 'devices' with your (RDMA capable) netdevice name.
     config: |
@@ -64,7 +64,7 @@ spec:
   sriovDevicePlugin:
     image: sriov-network-device-plugin
     repository: nvcr.io/nvstaging/mellanox
-    version: network-operator-v25.7.0
+    version: network-operator-v25.10.0-beta.1
     config: |
       {
         "resourceList": [
@@ -82,32 +82,32 @@ spec:
     ipoib:
       image: ipoib-cni
       repository: nvcr.io/nvstaging/mellanox
-      version: network-operator-v25.7.0
+      version: network-operator-v25.10.0-beta.1
   nvIpam:
     image: nvidia-k8s-ipam
     repository: nvcr.io/nvstaging/mellanox
-    version: network-operator-v25.7.0
+    version: network-operator-v25.10.0-beta.1
     enableWebhook: false
   ibKubernetes:
     image: ib-kubernetes
     repository: nvcr.io/nvstaging/mellanox
-    version: network-operator-v25.7.0
+    version: network-operator-v25.10.0-beta.1
     pKeyGUIDPoolRangeStart: "02:00:00:00:00:00:00:00"
     pKeyGUIDPoolRangeEnd: "02:FF:FF:FF:FF:FF:FF:FF"
     ufmSecret: ufm-secret
   nicFeatureDiscovery:
     image: nic-feature-discovery
     repository: nvcr.io/nvstaging/mellanox
-    version: network-operator-v25.7.0
+    version: network-operator-v25.10.0-beta.1
   nicConfigurationOperator:
     operator:
       image: nic-configuration-operator
       repository: nvcr.io/nvstaging/mellanox
-      version: network-operator-v25.7.0
+      version: network-operator-v25.10.0-beta.1
     configurationDaemon:
       image: nic-configuration-operator-daemon
       repository: nvcr.io/nvstaging/mellanox
-      version: network-operator-v25.7.0
+      version: network-operator-v25.10.0-beta.1
     nicFirmwareStorage:
       create: true
       pvcName: nic-fw-storage-pvc
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-full.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-full.yaml
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ipoib.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ipoib.yaml
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-nvidia-ipam.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-nvidia-ipam.yaml
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ocp-hostdev.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ocp-hostdev.yaml
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ocp.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr-ocp.yaml
diff --git a/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr.yaml b/example/crs/mellanox.com_v1alpha1_nicclusterpolicy_cr.yaml
diff --git a/hack/release.yaml b/hack/release.yaml
