Add hub-spoke trust config, root CA monitoring, and kubeconfig guidance

Hub-spoke CA trust distribution via KlusterletConfig and CA ConfigMap.
Root CA expiration monitoring via ACM Policy with PrometheusRule alerts.
CertificatePolicy expanded to monitor cert-manager namespace.
Kubeconfig trust documentation added to all profile READMEs.

ACME remains the reference recommendation for ClusterIssuers. Other
issuer types (e.g., CA issuer) are noted as allowable alternatives
but no reference CRs are shipped for non-ACME issuers.

Also includes: Konflux reference updates, observabilityRoutePolicy
refactoring, MetalLB configuration state move to core-overlay,
nftables firewall node disruption policy, container-mount-namespace
netns race fix (OCPBUGS-83562), CPE version bump to 5.0, and
Tekton pipeline 4.22->5.0 rename.

Author: sebrandon1

.tekton/build-pipeline-telco-core-rds.yaml

@@ -161,7 +161,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:d30f13dd15daf89dd6dc645243b3444d35570d13f7840c3fd65e366022515205
       - name: kind
         value: task
       resolver: bundles
@@ -209,7 +209,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:3dc78afbf3a441e0280067433cb28ea3d2d0088ec214c73bf063f145b4f273ef
       - name: kind
         value: task
       resolver: bundles
@@ -302,7 +302,7 @@ spec:
       - name: name
         value: build-image-index
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:b33bfa8dc27dbf459f0779598ba45dcaa490bcc9f8efe1652bcf360ec8cb5582
       - name: kind
         value: task
       resolver: bundles
@@ -392,7 +392,7 @@ spec:
       - name: name
         value: ecosystem-cert-preflight-checks
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:9c300728a03f41beee9a689422d66513d32ab5f804664fe561b11cebacd07799
       - name: kind
         value: task
       resolver: bundles
@@ -649,7 +649,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213
       - name: kind
         value: task
       resolver: bundles

.tekton/build-pipeline-telco-hub-rds.yaml

@@ -154,7 +154,7 @@ spec:
       - name: name
         value: git-clone-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:13d49df7dc9ae301627e45f95a236011422996152f1bea46cd60217b0f057407
+        value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:d30f13dd15daf89dd6dc645243b3444d35570d13f7840c3fd65e366022515205
       - name: kind
         value: task
       resolver: bundles
@@ -202,7 +202,7 @@ spec:
       - name: name
         value: prefetch-dependencies-oci-ta
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:a2efbcdcecfa5293a622eb356a18f5c88e5714046b214fe8730b43b1a7dbb77d
+        value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3@sha256:3dc78afbf3a441e0280067433cb28ea3d2d0088ec214c73bf063f145b4f273ef
       - name: kind
         value: task
       resolver: bundles
@@ -291,7 +291,7 @@ spec:
       - name: name
         value: build-image-index
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:550afde50349e22ec11191ea0db9a49395ab46fef4e8317d820b6e946677ebeb
+        value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3@sha256:b33bfa8dc27dbf459f0779598ba45dcaa490bcc9f8efe1652bcf360ec8cb5582
       - name: kind
         value: task
       resolver: bundles
@@ -381,7 +381,7 @@ spec:
       - name: name
         value: ecosystem-cert-preflight-checks
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:e2bcf1174a6dae9969b8f12e94babe2a5881bc77a509f10823b6a9eac6392850
+        value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:9c300728a03f41beee9a689422d66513d32ab5f804664fe561b11cebacd07799
       - name: kind
         value: task
       resolver: bundles
@@ -638,7 +638,7 @@ spec:
       - name: name
         value: rpms-signature-scan
       - name: bundle
-        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cfdb76c67f27bc498132431f5a24fbc17dac1981d6f6e3da5cf5964ac5abdd20
+        value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:41720da9dfe26f33b0bdc46bbf8667a27dae4790d8e5c5f4412224658de7b213
       - name: kind
         value: task
       resolver: bundles

…on/telco-core-rds-4-22-pull-request.yaml …ton/telco-core-rds-5-0-pull-request.yaml.tekton/telco-core-rds-4-22-pull-request.yaml renamed to .tekton/telco-core-rds-5-0-pull-request.yaml .tekton/telco-core-rds-4-22-pull-request.yaml renamed to .tekton/telco-core-rds-5-0-pull-request.yaml

@@ -11,15 +11,15 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: |
       event == "pull_request" &&
       target_branch == "main" &&
-      (".tekton/telco-core-rds-4-22-pull-request.yaml".pathChanged() ||
+      (".tekton/telco-core-rds-5-0-pull-request.yaml".pathChanged() ||
       ".tekton/build-pipeline-telco-core-rds.yaml".pathChanged() ||
        "telco-core/***".pathChanged())
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: telco-core-rds-4-22
-    appstudio.openshift.io/component: telco-core-rds-4-22
+    appstudio.openshift.io/application: telco-core-rds-5-0
+    appstudio.openshift.io/component: telco-core-rds-5-0
     pipelines.appstudio.openshift.io/type: build
-  name: telco-core-rds-4-22-on-pull-request
+  name: telco-core-rds-5-0-on-pull-request
   namespace: telco-5g-tenant
 spec:
   params:
@@ -28,7 +28,7 @@ spec:
   - name: revision
     value: '{{revision}}'
   - name: output-image
-    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-core-rds-4-22:on-pr-{{revision}}
+    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-core-rds-5-0:on-pr-{{revision}}
   - name: image-expires-after
     value: 5d
   - name: build-platforms
@@ -49,7 +49,7 @@ spec:
   pipelineRef:
     name: build-pipeline-telco-core-rds
   taskRunTemplate:
-    serviceAccountName: build-pipeline-telco-core-rds-4-22
+    serviceAccountName: build-pipeline-telco-core-rds-5-0
   workspaces:
   - name: git-auth
     secret:

.tekton/telco-core-rds-4-22-push.yaml .tekton/telco-core-rds-5-0-push.yaml.tekton/telco-core-rds-4-22-push.yaml renamed to .tekton/telco-core-rds-5-0-push.yaml

@@ -10,15 +10,15 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: |
       event == "push" &&
       target_branch == "main" &&
-      (".tekton/telco-core-rds-4-22-push.yaml".pathChanged() ||
+      (".tekton/telco-core-rds-5-0-push.yaml".pathChanged() ||
        ".tekton/build-pipeline-telco-core-rds.yaml".pathChanged() ||
        "telco-core/***".pathChanged())
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: telco-core-rds-4-22
-    appstudio.openshift.io/component: telco-core-rds-4-22
+    appstudio.openshift.io/application: telco-core-rds-5-0
+    appstudio.openshift.io/component: telco-core-rds-5-0
     pipelines.appstudio.openshift.io/type: build
-  name: telco-core-rds-4-22-on-push
+  name: telco-core-rds-5-0-on-push
   namespace: telco-5g-tenant
 spec:
   params:
@@ -27,7 +27,7 @@ spec:
   - name: revision
     value: '{{revision}}'
   - name: output-image
-    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-core-rds-4-22:{{revision}}
+    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-core-rds-5-0:{{revision}}
   - name: build-platforms
     value:
     - linux/x86_64
@@ -46,7 +46,7 @@ spec:
   pipelineRef:
     name: build-pipeline-telco-core-rds
   taskRunTemplate:
-    serviceAccountName: build-pipeline-telco-core-rds-4-22
+    serviceAccountName: build-pipeline-telco-core-rds-5-0
   workspaces:
   - name: git-auth
     secret:

…ton/telco-hub-rds-4-22-pull-request.yaml …kton/telco-hub-rds-5-0-pull-request.yaml.tekton/telco-hub-rds-4-22-pull-request.yaml renamed to .tekton/telco-hub-rds-5-0-pull-request.yaml .tekton/telco-hub-rds-4-22-pull-request.yaml renamed to .tekton/telco-hub-rds-5-0-pull-request.yaml

@@ -11,15 +11,15 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: |
       event == "pull_request" &&
       target_branch == "main" &&
-      (".tekton/telco-hub-rds-4-22-pull-request.yaml".pathChanged() ||
+      (".tekton/telco-hub-rds-5-0-pull-request.yaml".pathChanged() ||
       ".tekton/build-pipeline-telco-hub-rds.yaml".pathChanged() ||
        "telco-hub/***".pathChanged())
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: telco-hub-rds-4-22
-    appstudio.openshift.io/component: telco-hub-rds-4-22
+    appstudio.openshift.io/application: telco-hub-rds-5-0
+    appstudio.openshift.io/component: telco-hub-rds-5-0
     pipelines.appstudio.openshift.io/type: build
-  name: telco-hub-rds-4-22-on-pull-request
+  name: telco-hub-rds-5-0-on-pull-request
   namespace: telco-5g-tenant
 spec:
   params:
@@ -28,7 +28,7 @@ spec:
   - name: revision
     value: '{{revision}}'
   - name: output-image
-    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-hub-rds-4-22:on-pr-{{revision}}
+    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-hub-rds-5-0:on-pr-{{revision}}
   - name: image-expires-after
     value: 5d
   - name: build-platforms
@@ -49,7 +49,7 @@ spec:
   pipelineRef:
     name: build-pipeline-telco-hub-rds
   taskRunTemplate:
-    serviceAccountName: build-pipeline-telco-hub-rds-4-22
+    serviceAccountName: build-pipeline-telco-hub-rds-5-0
   workspaces:
   - name: git-auth
     secret:

.tekton/telco-hub-rds-4-22-push.yaml .tekton/telco-hub-rds-5-0-push.yaml.tekton/telco-hub-rds-4-22-push.yaml renamed to .tekton/telco-hub-rds-5-0-push.yaml

@@ -10,15 +10,15 @@ metadata:
     pipelinesascode.tekton.dev/on-cel-expression: |
       event == "push" &&
       target_branch == "main" &&
-      (".tekton/telco-hub-rds-4-22-push.yaml".pathChanged() ||
+      (".tekton/telco-hub-rds-5-0-push.yaml".pathChanged() ||
        ".tekton/build-pipeline-telco-hub-rds.yaml".pathChanged() ||
        "telco-hub/***".pathChanged())
   creationTimestamp: null
   labels:
-    appstudio.openshift.io/application: telco-hub-rds-4-22
-    appstudio.openshift.io/component: telco-hub-rds-4-22
+    appstudio.openshift.io/application: telco-hub-rds-5-0
+    appstudio.openshift.io/component: telco-hub-rds-5-0
     pipelines.appstudio.openshift.io/type: build
-  name: telco-hub-rds-4-22-on-push
+  name: telco-hub-rds-5-0-on-push
   namespace: telco-5g-tenant
 spec:
   params:
@@ -27,7 +27,7 @@ spec:
   - name: revision
     value: '{{revision}}'
   - name: output-image
-    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-hub-rds-4-22:{{revision}}
+    value: quay.io/redhat-user-workloads/telco-5g-tenant/telco-hub-rds-5-0:{{revision}}
   - name: build-platforms
     value:
     - linux/x86_64
@@ -46,7 +46,7 @@ spec:
   pipelineRef:
     name: build-pipeline-telco-hub-rds
   taskRunTemplate:
-    serviceAccountName: build-pipeline-telco-hub-rds-4-22
+    serviceAccountName: build-pipeline-telco-hub-rds-5-0
   workspaces:
   - name: git-auth
     secret:

telco-core/Dockerfile.telco-core

@@ -11,7 +11,7 @@ CMD ["-c", "tar -cf - --directory /usr/share telco-core-rds | base64 -w0"]
 
 LABEL com.redhat.component="openshift-telco-core-rds-container" \
     name="openshift4/openshift-telco-core-rds-rhel9" \
-    cpe="cpe:/a:redhat:openshift:4.22::el9" \
+    cpe="cpe:/a:redhat:openshift:5.0::el9" \
     summary="Telco Core RDS manifests" \
     io.openshift.expose-services="" \
     io.openshift.tags="" \

telco-core/configuration/core-baseline.yaml

@@ -71,7 +71,6 @@ policies:
         patches:
         - spec:
             installPlanApproval: Manual
-      - path: reference-crs/required/networking/metallb/configurationstate.yaml
       - path: reference-crs/required/scheduling/NROPSubscriptionNS.yaml
       - path: reference-crs/required/scheduling/NROPSubscriptionOperGroup.yaml
       - path: reference-crs/required/scheduling/NROPSubscription.yaml
@@ -104,6 +103,9 @@ policies:
 
       - path: reference-crs/required/networking/NMState.yaml
 
+      # Firewall node disruption policy
+      - path: reference-crs/optional/networking/firewall/node-disruption-policy.yaml
+
       # Scheduling
       - path: reference-crs/required/scheduling/sched.yaml
         patches:

telco-core/configuration/core-overlay.yaml

@@ -206,6 +206,8 @@ policies:
             nodeSelector:
               node-role.kubernetes.io/worker: ""
 
+      - path: reference-crs/required/networking/metallb/configurationstate.yaml
+
       # - path: reference-crs/required/networking/metallb/bfd-profile.yaml
       # - path: reference-crs/required/networking/metallb/addr-pool.yaml
       #   patches:

telco-core/configuration/reference-crs-kube-compare/metadata.yaml

@@ -94,6 +94,11 @@ parts:
           - path: optional/networking/multus/tap_cni/mc_rootless_pods_selinux.yaml
           - path: required/networking/metallb/community.yaml
           - path: optional/networking/nodeNetworkConfigurationPolicy.yaml
+      - name: networking-firewall
+        anyOf:
+          - path: optional/networking/firewall/node-disruption-policy.yaml
+            config:
+              ignore-unspecified-fields: true
   - name: required-other
     components:
       - name: disconnected-registry
@@ -224,6 +229,7 @@ templateFunctionFiles:
   - version_match.tmpl
   - unordered_list.tmpl
   - validate_base64_list.tmpl
+  - required-object-list.tmpl
 
 fieldsToOmit:
   defaultOmitRef: all