Update module github.com/coreos/ignition to v2 by red-hat-konflux-kflux-prd-rh02[bot] · Pull Request #1275 · ComplianceAsCode/compliance-operator

Support the native Apple Hypervisor
Support Hetzner Cloud
A GRUB configuration suitable for use with https://github.com/coreos/bootupd
can now be installed; use make install-grub-for-bootupd to install it

Changes

Require Go 1.19+

Bug fixes

Prevent races with udev after disk editing
Don't fail to wipe partition table if it's corrupted

`v2.16.2`

Compare Source

Bug fixes

Fix Dracut module installation on arches other than x86 and aarch64

`v2.16.1`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 38 key.

Ignition v2.16.0 included a build regression on 32-bit machines and was not released. These notes include all changes since v2.15.0.

Features

Support Hyper-V platform
Automatically generate spec docs

Changes

Clarify spec terminology for contents of CA bundles, files, and key files
Improve rendering of spec docs on docs site

Bug fixes

Fix failure disabling nonexistent unit with systemd ≥ 252
Don't relabel a mount point that already exists
Document that hash fields describe decompressed data
Clarify documentation of passwordHash fields
Correctly document Tang advertisement field as optional

Test changes

Support and require xfsprogs ≥ 5.19 in blackbox tests

`v2.16.0`

Compare Source

`v2.15.0`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 37 key.

Features

Support offline Tang provisioning via pre-shared advertisement (3.4.0)
Allow enabling discard passthrough on LUKS devices (3.4.0)
Allow specifying arbitrary LUKS open options (3.4.0)
Ship aarch64 macOS ignition-validate binary in GitHub release artifacts

Changes

Mark the 3.4.0 config spec as stable
No longer accept configs with version 3.4.0-experimental
Create new 3.5.0-experimental config spec from 3.4.0
Fail if files/links/dirs conflict with systemd units or dropins
Warn if template for enabled systemd instance unit has no Install section
Warn if filesystem overwrites partitioned disk
Warn if wipeTable overwrites a filesystem that would otherwise be reused
Warn if user/group specified for hard link
Install ignition-apply in /usr/libexec
Allow distros to add Ignition command-line arguments from a unit drop-in
Convert NEWS to Markdown and move to docs site
Require Go 1.18+

Bug fixes

Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false
Request network when custom Clevis config has needsNetwork set
Fix creating LUKS volume with custom Clevis config that uses TPM2
Avoid logging spurious error when a LUKS volume wasn't previously formatted
Fix version string in ignition-validate release container
Fix reproducibility of systemd preset file in ignition-apply output
Document that user/group fields aren't applied to hard links
Clarify spec docs for files/directories/links group fields

`v2.14.0`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 36 key.

Features:

Support KubeVirt platform
Support AWS arn: URLs for S3 objects and access points (3.4.0-exp)
Support reading configs from Azure IMDS "user data"
Support S3 fetch via IPv6
Add ignition-apply entrypoint to apply an Ignition config in a container

Changes:

Delete userdata after provisioning on VirtualBox and VMware by default (see operator notes for details) (GHSA-hj57-j5cw-2mwp, CVE-2022-1706)
Support setting setuid/setgid/sticky mode bits (3.4.0-exp)
Warn if setuid/setgid/sticky mode bits specified (3.0.0 - 3.3.0)
Support UEFI Secure Boot on VMware
Add arm64 support to ignition-validate container
Document S3 fetch semantics in operator notes
Document considerations for handling secrets in operator notes

Bug Fixes:

Fix disabling systemd units with pre-existing enablement symlinks
Fix reuse of statically keyed LUKS volumes (2.12.0 regression)
Fix gs:// fetch in GCE instances configured without a service account
Fix error reading VirtualBox guest properties that have flags
Fix infinite loop if -root command-line argument is a relative path

`v2.13.0`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 35 key.

Features:

Add Nutanix provider
Switch VirtualBox provider to read from /Ignition/Config guest property

Changes:

Improve QEMU fw_cfg read performance
Warn when QEMU fw_cfg config is too large for reasonable performance
Move Ignition report to /etc/.ignition-result.json
Improve resilience to filesystem unmount failures
Run mkfs.fat instead of its alias mkfs.vfat
Refresh supported platform documentation

Bug Fixes:

Make ignition.version required in JSON schema (3.4.0-exp)
Disallow null noProxy array entries in JSON schema (3.4.0-exp)

`v2.12.0`

Compare Source

Features:

Support Azure generation 2 VMs
Write info about Ignition’s execution to /var/lib/ignition/result.json

Changes:

Access GCP metadata service by IP address to mitigate DNS poisoning attacks
Document storage.luks.clevis.threshold default
Document minimum Ignition release for each spec version

Bug Fixes:

Fix permissions of mountpoints inside user home directories
Apply SELinux labels to newly-created ext4 filesystems

Internal Changes:

Drop ignition-setup-user.service and ignition-firstboot-complete.service in favor of distro-provided code
Persist some state between Ignition stages using a file in /run
Add command-line flag specifying path to neednet flag file
Drop -clear-cache command-line flag
Fix reboot race in example kargs helper
Drop support for Go 1.13 and 1.14

`v2.11.0`

Compare Source

Breaking Changes:

Convert ClevisCustom.Config, ClevisCustom.Pin, LinkEmbedded1.Target, and Raid.Level Go fields to pointers (3.3.0)

Features:

Accept none in storage.filesystems.format (3.3.0)
Add ParseCompatibleVersion() Go functions to parse any config up to the selected version
Add powervs platform

Changes:

Mark the 3.3.0 config spec as stable
No longer accept configs with version 3.3.0-experimental
Create new 3.4.0-experimental config spec from 3.3.0
Report specific reason an existing LUKS device cannot be reused
Validate that storage.raid.devices is non-empty
Don't sequence ignition-setup-user.service before multipathd.service

Bug Fixes:

Fix misleading error message if spares are requested for a RAID level that doesn't support them

`v2.10.1`

Compare Source

Note: v2.10.0 was tagged, but not released, this includes notes for both. See the NEWS file for which changes are in which tag.

Starting with this release, ignition-validate binaries are signed with the Fedora 34 key.

Breaking Changes:

Rename Custom struct to ClevisCustom (3.3.0-exp)
Embed Clevis and ClevisCustom structs in parents (3.3.0-exp)
Always include interior nodes in merge transcript

Features:

Add kernel argument support (3.3.0-exp)

Bug Fixes:

Fix fetching userdata on AWS when IMDSv1 is disabled
Fix creating Tang-based LUKS volumes before network is up
Document storage.filesystems.wipeFilesystem default
Fix file mode of ignition-kargs-helper script

`v2.10.0`

Compare Source

`v2.9.0`

Compare Source

Changes:

Require storage.filesystems.format if wipeFilesystem or mountOptions is specified
Refactor code to address golangci-lint warnings

Bug Fixes:

Fix fetching configs from S3 resources when running on non-default AWS partitions
Fix fetching userdata from IMDSv2 on AWS
Fix crash on partitions with no number or label
Correctly document storage.filesystems.path as optional
Clarify documented semantics of systemd.units.name

`v2.8.1`

Compare Source

Bug Fixes:

Correctly merge config fields behind a struct pointer (e.g. clevis)

`v2.8.0`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 33 key.

Features:

Support unmasking systemd units

Changes:

Switch system base config from single file to .d directory
Add Go merge API that produces a transcript of merge operations

`v2.7.0`

Compare Source

Features:

Support resizing existing partitions (3.2.0)
Support reusing LUKS devices not bound to Clevis (3.2.0)

Changes:

Mark the 3.2.0 config spec as stable
No longer accept configs with version 3.2.0-experimental
Create new 3.3.0-experimental config spec from 3.2.0
Require presence of a config source on CloudStack/OpenStack, and wait indefinitely for it to appear
When executing in non-default AWS partitions (GovCloud or AWS China), fetch s3:// resources from the same partition

Bug Fixes:

Fix bundled library unconditionally blocking for entropy at startup
Fix config fetching on AzureStack
Fix partition offset/length calculation on big-endian systems
Fix premature logging of successful config fetch

`v2.6.0`

Compare Source

Features:

Add release tag to ignition-validate container for latest release
Support creating ephemeral LUKS volumes (3.2.0-exp)
Support deleting users/groups (3.2.0-exp)

Bug Fixes:

Request network when needed on CloudStack/OpenStack

`v2.5.0`

Compare Source

Changes:

Merge ignition-dracut into the Ignition repository

Bug Fixes:

Fix udev race determining filesystem type when creating filesystem

`v2.4.1`

Compare Source

Changes:

Set LUKS key file directory to mode 700

Bug Fixes:

Fix nondeterministic config provider precedence causing fetch failures
Don't relabel symlink to home directory, since it might not be writable
Fix failure looking up users/groups

`v2.4.0`

Compare Source

Features:

Support creating LUKS volumes with Clevis or static key file (3.2.0-exp)
Support Google Cloud Storage (gs://) resource URLs
Support AWS IMDSv2
Allow specifying multiple CA certificates in one resource
Add Azure Stack platform
Allow OS to avoid starting network if the config doesn't need it

Changes:

When creating a filesystem, run wipefs on target device first
Warn if filesystem probe finds multiple filesystem signatures
Don't warn about unset file/directory mode in config
Fetch AWS metadata version 2019-10-01 instead of 2009-04-04
Refactor SELinux relabeling

Bug Fixes:

Fix compressed CA certificates
Fix hard links to files deeper than the hard link
Write empty systemd dropin if requested
Remember to relabel /etc/systemd/system-preset
Ensure configs are only fetched during fetch stage
Clarify docs about interaction between file contents and overwrite

`v2.3.0`

Compare Source

Starting with this release, ignition-validate binaries are signed with the Fedora 32 key.

Features:

Allow specifying HTTP headers when fetching remote resources (3.1.0)
Support compression for CA certs and merged/replaced configs (3.1.0)
Support sha256 verification hashes (3.1.0)
Support compression for data URIs
Log structured journal entry when user config is found
Log structured journal entry when SSH keys are written

Changes:

Unify CaReference, ConfigReference, FileContents structs into Resource (3.1.0)
Mark the 3.1.0 config spec as stable
No longer accept configs with version 3.1.0-experimental
Create new 3.2.0-experimental config spec from 3.1.0

Bug Fixes:

Fix ignition-validate for config versions other than 3.0.0
Fix config fetch and status reporting on Packet

`v2.2.1`

Compare Source

Bug Fixes:

Fix build failure on arches other than amd64, arm64, ppc64le, or s390x

`v2.2.0`

Compare Source

Features:

Add Exoscale and Vultr providers
On QEMU/s390x and QEMU/ppc64le, fetch Ignition config from a virtio block device (experimental)

Changes:

Don't relabel /root and /home

Bug Fixes:

Fix enabling systemd instantiated services
Fail if SSH keys cannot be written
Fix partition creation on s390x

No artifacts for this release.

`v2.1.1`

Compare Source

Note: v2.1.0 was tagged, but not released, this includes notes for both. See the NEWS file for which changes are in which tag.

Bug Fixes:

Fix panics when processes Ignition starts fail
Do not panic when filesystem paths are unspecified
Specify the correct config version HTTP Accept headers when fetching configs
Write the config cache file atomically
Relabel symlinks for masking systemd units
Fix bug where empty GPT labels were treated as errors
Do not generate warnings if mode is unset for files with only an append section
- Validate HTTP(S) proxy urls in spec 3.1.0-experimental

Features:

An ignition-validate container is now built and can be used instead of
the ignition-validate binaries
Ignition now logs the name of the stage it is running
Ignition now relabels files directly instead of writing systemd units to do so. Requires Linux 5.4.0+ or a patch. See operator notes for more details
Add optional "fetch" stage to cache the rendered config, but not apply any of it
Add support for aliyun cloud
Add support for zVM hypervisor
Add support for specifying mount options for filesystems in spec 3.1.0-experimental

Dependency Changes:

Ignition no longer needs the chroot or id binaries in the initramfs

`v2.1.0`

Compare Source

`v2.0.1`

Compare Source

Bug Fixes:

Fix getting AWS region when networking is slow to come up
Validate file/directory paths correctly

`v2.0.0`

Compare Source

Bug Fixes:

Use /run/ignition/dev_aliases instead of /dev_aliases when creating our
own symlinks to devices in /dev

Test Changes:

Rename tests to use dots.with.lowercase

Public Go API Changes:

Replace config/validate api with github.com/coreos/vcontext
Validate() functions in config/* now follow the vcontext validation interface

Configuration

📅 Schedule: (UTC)

Branch creation
- "every weekend"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>

openshift-ci · 2026-06-27T04:25:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux-kflux-prd-rh02[bot]
Once this PR has been reviewed and has the lgtm label, please assign xiaojiey for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-06-27T04:25:12Z

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-06-27T05:13:38Z

@red-hat-konflux-kflux-prd-rh02[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify	`31ad1c3`	link	true	`/test verify`
ci/prow/unit	`31ad1c3`	link	true	`/test unit`
ci/prow/images	`31ad1c3`	link	true	`/test images`
ci/prow/e2e-rosa	`31ad1c3`	link	true	`/test e2e-rosa`
ci/prow/e2e-aws-deployment	`31ad1c3`	link	true	`/test e2e-aws-deployment`
ci/prow/e2e-aws-serial	`31ad1c3`	link	true	`/test e2e-aws-serial`
ci/prow/e2e-aws-scan-config	`31ad1c3`	link	true	`/test e2e-aws-scan-config`
ci/prow/e2e-aws-parallel	`31ad1c3`	link	true	`/test e2e-aws-parallel`
ci/prow/e2e-aws-serial-arm	`31ad1c3`	link	true	`/test e2e-aws-serial-arm`
ci/prow/e2e-aws-parallel-arm	`31ad1c3`	link	true	`/test e2e-aws-parallel-arm`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Update module github.com/coreos/ignition to v2

31ad1c3

Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>

red-hat-konflux-kflux-prd-rh02 Bot added docs-approved ok-to-test px-approved qe-approved labels Jun 27, 2026

openshift-ci Bot requested review from Vincent056 and mrogers950 June 27, 2026 04:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module github.com/coreos/ignition to v2#1275

Update module github.com/coreos/ignition to v2#1275
red-hat-konflux-kflux-prd-rh02[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/github.com-coreos-ignition-2.x

red-hat-konflux-kflux-prd-rh02 Bot commented Jun 27, 2026

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux-kflux-prd-rh02 Bot commented Jun 27, 2026

Release Notes

Features

Bug fixes

Ignition 2.25.1 (2025-12-22)

Bug fixes

Features

Bug fixes

Features

Changes

Bug fixes

Features

Changes

Bug fixes

Features

Ignition 2.18.0

Breaking changes

Features

Changes

Features

Changes

Bug fixes

Bug fixes

Features

Changes

Bug fixes

Test changes

Features

Changes

Bug fixes

Configuration

Documentation

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

openshift-ci Bot commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants