vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update Kube-OVN to v1.15.3 (#2022)

Browse source 
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does


### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
Update Kube-OVN to v1.15.3
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * DNS name resolver support for improved service discovery.
  * Non-primary CNI mode configuration.

* **Improvements**
  * Enhanced RBAC and tighter secret-access scoping.
  * Added ephemeral-storage resource limits across components.
  * Better dual-stack and single-stack networking handling.
  * Expanded CRD schemas with richer descriptions and status fields.

* **Updates**
  * KubeOVN chart and app versions updated to v1.15.3.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Andrei Kvapil 2026-02-11 07:02:32 +01:00 • committed by GitHub
commit c9d2b54917
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
19 changed files with 696 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

8
packages/system/kubeovn/Makefile
View file

@ -1,5 +1,3 @@
KUBEOVN_TAG=v0.40.0
export NAME=kubeovn
export NAMESPACE=cozy-$(NAME)
@ -8,6 +6,6 @@ include ../../../hack/package.mk
update:
rm -rf charts values.yaml Chart.yaml
tag=$(KUBEOVN_TAG) && \
curl -sSL https://github.com/cozystack/kubeovn/archive/refs/tags/$${tag}.tar.gz | \
tar xzvf - --strip 2 kubeovn-$${tag#*v}/chart
tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kubeovn-chart | awk -F'[/^]' 'END{print $$3}') && \
curl -sSL https://github.com/cozystack/kubeovn-chart/archive/refs/tags/$${tag}.tar.gz | \
tar xzvf - --strip 2 kubeovn-chart-$${tag#*v}/chart

4
packages/system/kubeovn/charts/kube-ovn/Chart.yaml
View file

@ -15,12 +15,12 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: v1.14.25
version: v1.15.3
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using.
# It is recommended to use it with quotes.
appVersion: "1.14.25"
appVersion: "1.15.3"
kubeVersion: ">= 1.29.0-0"

4
packages/system/kubeovn/charts/kube-ovn/templates/_helpers.tpl
View file

@ -69,7 +69,9 @@ Number of master nodes
{{- $imageVersion := (index $ds.spec.template.spec.containers 0).image | splitList ":" | last | trimPrefix "v" -}}
{{- $versionRegex := `^(?P<major>0|[1-9]\d*)\.(?P<minor>0|[1-9]\d*)\.(?P<patch>0|[1-9]\d*)` -}}
{{- if and (ne $newChartVersion $chartVersion) (regexMatch $versionRegex $imageVersion) -}}
{{- if regexFind $versionRegex $imageVersion | semverCompare ">= 1.13.0" -}}
{{- if regexFind $versionRegex $imageVersion | semverCompare ">= 1.15.0" -}}
25.03
{{- else if regexFind $versionRegex $imageVersion | semverCompare ">= 1.13.0" -}}
24.03
{{- else if regexFind $versionRegex $imageVersion | semverCompare ">= 1.12.0" -}}
22.12

1
packages/system/kubeovn/charts/kube-ovn/templates/central-deploy.yaml
View file

@ -122,6 +122,7 @@ spec:
limits:
cpu: {{ index .Values "ovn-central" "limits" "cpu" }}
memory: {{ index .Values "ovn-central" "limits" "memory" }}
ephemeral-storage: {{ index .Values "ovn-central" "limits" "ephemeral-storage" }}
volumeMounts:
- mountPath: /var/run/ovn
name: host-run-ovn

48
packages/system/kubeovn/charts/kube-ovn/templates/controller-deploy.yaml
View file

@ -76,18 +76,43 @@ spec:
args:
- /kube-ovn/start-controller.sh
- --default-ls={{ .Values.networking.DEFAULT_SUBNET }}
- --default-cidr={{ .Values.ipv4.POD_CIDR }}
- --default-gateway={{ .Values.ipv4.POD_GATEWAY }}
- --default-cidr=
{{- if eq .Values.networking.NET_STACK "dual_stack" -}}
{{ .Values.dual_stack.POD_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv4" -}}
{{ .Values.ipv4.POD_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.POD_CIDR }}
{{- end }}
- --default-gateway=
{{- if eq .Values.networking.NET_STACK "dual_stack" -}}
{{ .Values.dual_stack.POD_GATEWAY }}
{{- else if eq .Values.networking.NET_STACK "ipv4" -}}
{{ .Values.ipv4.POD_GATEWAY }}
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.POD_GATEWAY }}
{{- end }}
- --default-gateway-check={{- .Values.func.CHECK_GATEWAY }}
- --default-logical-gateway={{- .Values.func.LOGICAL_GATEWAY }}
- --default-u2o-interconnection={{- .Values.func.U2O_INTERCONNECTION }}
- --default-exclude-ips={{- .Values.networking.EXCLUDE_IPS }}
- --cluster-router={{ .Values.networking.DEFAULT_VPC }}
- --node-switch={{ .Values.networking.NODE_SUBNET }}
- --node-switch-cidr={{ .Values.ipv4.JOIN_CIDR }}
- --service-cluster-ip-range={{ .Values.ipv4.SVC_CIDR }}
{{- if .Values.global.logVerbosity }}
- --v={{ .Values.global.logVerbosity }}
- --node-switch-cidr=
{{- if eq .Values.networking.NET_STACK "dual_stack" -}}
{{ .Values.dual_stack.JOIN_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv4" -}}
{{ .Values.ipv4.JOIN_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.JOIN_CIDR }}
{{- end }}
- --service-cluster-ip-range=
{{- if eq .Values.networking.NET_STACK "dual_stack" -}}
{{ .Values.dual_stack.SVC_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv4" -}}
{{ .Values.ipv4.SVC_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.SVC_CIDR }}
{{- end }}
- --network-type={{- .Values.networking.NETWORK_TYPE }}
- --default-provider-name={{ .Values.networking.vlan.PROVIDER_NAME }}
@ -100,6 +125,7 @@ spec:
- --pod-nic-type={{- .Values.networking.POD_NIC_TYPE }}
- --enable-lb={{- .Values.func.ENABLE_LB }}
- --enable-np={{- .Values.func.ENABLE_NP }}
- --np-enforcement={{- .Values.func.NP_ENFORCEMENT }}
- --enable-eip-snat={{- .Values.networking.ENABLE_EIP_SNAT }}
- --enable-external-vpc={{- .Values.func.ENABLE_EXTERNAL_VPC }}
- --enable-ecmp={{- .Values.networking.ENABLE_ECMP }}
@ -116,11 +142,14 @@ spec:
- --secure-serving={{- .Values.func.SECURE_SERVING }}
- --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }}
- --enable-anp={{- .Values.func.ENABLE_ANP }}
- --enable-dns-name-resolver={{- .Values.func.ENABLE_DNS_NAME_RESOLVER }}
- --ovsdb-con-timeout={{- .Values.func.OVSDB_CON_TIMEOUT }}
- --ovsdb-inactivity-timeout={{- .Values.func.OVSDB_INACTIVITY_TIMEOUT }}
- --enable-live-migration-optimize={{- .Values.func.ENABLE_LIVE_MIGRATION_OPTIMIZE }}
- --enable-ovn-lb-prefer-local={{- .Values.func.ENABLE_OVN_LB_PREFER_LOCAL }}
- --image={{ .Values.global.registry.address }}/{{ .Values.global.images.kubeovn.repository }}:{{ .Values.global.images.kubeovn.tag }}
- --skip-conntrack-dst-cidrs={{- .Values.networking.SKIP_CONNTRACK_DST_CIDRS }}
- --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }}
securityContext:
runAsUser: {{ include "kubeovn.runAsUser" . }}
privileged: false
@ -139,11 +168,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: KUBE_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: KUBE_NODE_NAME
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
@ -193,6 +218,7 @@ spec:
limits:
cpu: {{ index .Values "kube-ovn-controller" "limits" "cpu" }}
memory: {{ index .Values "kube-ovn-controller" "limits" "memory" }}
ephemeral-storage: {{ index .Values "kube-ovn-controller" "limits" "ephemeral-storage" }}
nodeSelector:
kubernetes.io/os: "linux"
volumes:

1
packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml
View file

@ -100,6 +100,7 @@ spec:
limits:
cpu: 3
memory: 1Gi
ephemeral-storage: 1Gi
volumeMounts:
- mountPath: /var/run/ovn
name: host-run-ovn

567
packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml
View file

File diff suppressed because it is too large Load diff

3
packages/system/kubeovn/charts/kube-ovn/templates/monitor-deploy.yaml
View file

@ -81,7 +81,7 @@ spec:
env:
- name: ENABLE_SSL
value: "{{ .Values.networking.ENABLE_SSL }}"
- name: KUBE_NODE_NAME
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
@ -110,6 +110,7 @@ spec:
limits:
cpu: {{ index .Values "kube-ovn-monitor" "limits" "cpu" }}
memory: {{ index .Values "kube-ovn-monitor" "limits" "memory" }}
ephemeral-storage: {{ index .Values "kube-ovn-monitor" "limits" "ephemeral-storage" }}
volumeMounts:
- mountPath: /var/run/ovn
name: host-run-ovn

43
packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml
View file

@ -48,10 +48,18 @@ rules:
- switch-lb-rules/status
- vpc-dnses
- vpc-dnses/status
- dnsnameresolvers
- dnsnameresolvers/status
- qos-policies
- qos-policies/status
verbs:
- "*"
- create
- get
- list
- update
- patch
- watch
- delete
- apiGroups:
- ""
resources:
@ -84,6 +92,8 @@ rules:
- network-attachment-definitions
verbs:
- get
- list
- watch
- apiGroups:
- ""
- networking.k8s.io
@ -166,7 +176,11 @@ rules:
resources:
- leases
verbs:
- "*"
- create
- update
- patch
- get
- watch
- apiGroups:
- "kubevirt.io"
resources:
@ -181,6 +195,7 @@ rules:
resources:
- adminnetworkpolicies
- baselineadminnetworkpolicies
- clusternetworkpolicies
verbs:
- get
- list
@ -276,7 +291,6 @@ rules:
verbs:
- get
- list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@ -355,12 +369,23 @@ rules:
- "list"
- "watch"
- "delete"
- apiGroups:
- ""
resources:
- "secrets"
verbs:
- "get"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: secret-reader-ovn-ipsec
namespace: {{ .Values.namespace }}
rules:
- apiGroups:
- ""
resources:
- "secrets"
resourceNames:
- "ovn-ipsec-ca"
verbs:
- "get"
- "list"
- "watch"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole

14
packages/system/kubeovn/charts/kube-ovn/templates/ovn-CRB.yaml
View file

@ -67,6 +67,20 @@ subjects:
namespace: {{ .Values.namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: kube-ovn-cni-secret-reader
namespace: {{ .Values.namespace }}
subjects:
- kind: ServiceAccount
name: kube-ovn-cni
namespace: {{ .Values.namespace }}
roleRef:
kind: Role
name: secret-reader-ovn-ipsec
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kube-ovn-app

2
packages/system/kubeovn/charts/kube-ovn/templates/ovn-dpdk-ds.yaml
View file

@ -54,7 +54,7 @@ spec:
value: "{{- .Values.networking.TUNNEL_TYPE }}"
- name: DPDK_TUNNEL_IFACE
value: "{{- .Values.networking.DPDK_TUNNEL_IFACE }}"
- name: KUBE_NODE_NAME
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName

17
packages/system/kubeovn/charts/kube-ovn/templates/ovncni-ds.yaml
View file

@ -98,9 +98,13 @@ spec:
- --mirror-iface={{- .Values.debug.MIRROR_IFACE }}
- --node-switch={{ .Values.networking.NODE_SUBNET }}
- --encap-checksum=true
- --service-cluster-ip-range={{ .Values.ipv4.SVC_CIDR }}
{{- if .Values.global.logVerbosity }}
- --v={{ .Values.global.logVerbosity }}
- --service-cluster-ip-range=
{{- if eq .Values.networking.NET_STACK "dual_stack" -}}
{{ .Values.dual_stack.SVC_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv4" -}}
{{ .Values.ipv4.SVC_CIDR }}
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.SVC_CIDR }}
{{- end }}
{{- if eq .Values.networking.NETWORK_TYPE "vlan" }}
- --iface=
@ -121,9 +125,7 @@ spec:
- --secure-serving={{- .Values.func.SECURE_SERVING }}
- --enable-ovn-ipsec={{- .Values.func.ENABLE_OVN_IPSEC }}
- --set-vxlan-tx-off={{- .Values.func.SET_VXLAN_TX_OFF }}
{{- with .Values.mtu }}
- --mtu={{ . }}
{{- end }}
- --non-primary-cni-mode={{- .Values.cni_conf.NON_PRIMARY_CNI }}
securityContext:
runAsUser: 0
privileged: false
@ -142,7 +144,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: KUBE_NODE_NAME
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
@ -226,6 +228,7 @@ spec:
limits:
cpu: {{ index .Values "kube-ovn-cni" "limits" "cpu" }}
memory: {{ index .Values "kube-ovn-cni" "limits" "memory" }}
ephemeral-storage: {{ index .Values "kube-ovn-cni" "limits" "ephemeral-storage" }}
nodeSelector:
kubernetes.io/os: "linux"
volumes:

3
packages/system/kubeovn/charts/kube-ovn/templates/ovsovn-ds.yaml
View file

@ -115,7 +115,7 @@ spec:
value: "{{- .Values.func.HW_OFFLOAD }}"
- name: TUNNEL_TYPE
value: "{{- .Values.networking.TUNNEL_TYPE }}"
- name: KUBE_NODE_NAME
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
@ -173,6 +173,7 @@ spec:
limits:
cpu: {{ index .Values "ovs-ovn" "limits" "cpu" }}
memory: {{ index .Values "ovs-ovn" "limits" "memory" }}
ephemeral-storage: {{ index .Values "ovs-ovn" "limits" "ephemeral-storage" }}
nodeSelector:
kubernetes.io/os: "linux"
volumes:

6
packages/system/kubeovn/charts/kube-ovn/templates/pinger-ds.yaml
View file

@ -73,7 +73,6 @@ spec:
{{- else if eq .Values.networking.NET_STACK "ipv6" -}}
{{ .Values.ipv6.PINGER_EXTERNAL_DOMAIN }}
{{- end }}
- --ds-namespace={{ .Values.namespace }}
- --logtostderr=false
- --alsologtostderr=true
- --log_file=/var/log/kube-ovn/kube-ovn-pinger.log
@ -102,6 +101,10 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: NODE_NAME
valueFrom:
fieldRef:
@ -133,6 +136,7 @@ spec:
limits:
cpu: {{ index .Values "kube-ovn-pinger" "limits" "cpu" }}
memory: {{ index .Values "kube-ovn-pinger" "limits" "memory" }}
ephemeral-storage: {{ index .Values "kube-ovn-pinger" "limits" "ephemeral-storage" }}
livenessProbe:
httpGet:
path: /metrics

8
packages/system/kubeovn/charts/kube-ovn/templates/post-delete-hook.yaml
View file

@ -120,6 +120,14 @@ spec:
- sh
- -c
- /kube-ovn/remove-finalizer.sh 2>&1 | tee -a /var/log/kube-ovn/remove-finalizer.log
resources:
requests:
cpu: 100m
memory: 200Mi
limits:
cpu: 1
memory: 500Mi
ephemeral-storage: 1Gi
volumeMounts:
- mountPath: /var/log/kube-ovn
name: kube-ovn-log

2
packages/system/kubeovn/charts/kube-ovn/templates/upgrade-ovs-ovn.yaml
View file

@ -31,6 +31,8 @@ rules:
- daemonsets
verbs:
- list
- get
- watch
- apiGroups:
- apps
resources:

2
packages/system/kubeovn/charts/kube-ovn/templates/vpc-nat-config.yaml
View file

@ -7,7 +7,7 @@ metadata:
kubernetes.io/description: |
kube-ovn vpc-nat common config
data:
image: {{ .Values.global.registry.address }}/{{ .Values.global.images.kubeovn.vpcRepository }}:{{ .Values.global.images.kubeovn.tag }}
image: {{ .Values.global.registry.address }}/{{ .Values.global.images.natgateway.repository }}:{{ or .Values.global.images.natgateway.tag .Values.global.images.kubeovn.tag }}
---
kind: ConfigMap

26
packages/system/kubeovn/charts/kube-ovn/values.yaml
View file

@ -8,10 +8,11 @@ global:
images:
kubeovn:
repository: kube-ovn
vpcRepository: vpc-nat-gateway
tag: v1.14.25
support_arm: true
thirdparty: true
tag: v1.15.3
natgateway:
repository: vpc-nat-gateway
# Falls back to the same tag as kubeovn if empty
tag: v1.15.3
image:
pullPolicy: IfNotPresent
@ -46,6 +47,8 @@ networking:
ENABLE_METRICS: true
# comma-separated string of nodelocal DNS ip addresses
NODE_LOCAL_DNS_IP: ""
# comma-separated list of destination IP CIDRs that should skip conntrack processing
SKIP_CONNTRACK_DST_CIDRS: ""
PROBE_INTERVAL: 180000
OVN_NORTHD_PROBE_INTERVAL: 5000
OVN_LEADER_PROBE_INTERVAL: 5
@ -57,6 +60,7 @@ networking:
func:
ENABLE_LB: true
ENABLE_NP: true
NP_ENFORCEMENT: standard
ENABLE_EXTERNAL_VPC: false
HW_OFFLOAD: false
ENABLE_LB_SVC: false
@ -73,6 +77,7 @@ func:
ENABLE_NAT_GW: true
ENABLE_OVN_IPSEC: false
ENABLE_ANP: false
ENABLE_DNS_NAME_RESOLVER: false
SET_VXLAN_TX_OFF: false
OVSDB_CON_TIMEOUT: 3
OVSDB_INACTIVITY_TIMEOUT: 10
@ -80,6 +85,10 @@ func:
ENABLE_OVN_LB_PREFER_LOCAL: false
ipv4:
POD_CIDR: "10.16.0.0/16"
POD_GATEWAY: "10.16.0.1"
SVC_CIDR: "10.96.0.0/12"
JOIN_CIDR: "100.64.0.0/16"
PINGER_EXTERNAL_ADDRESS: "1.1.1.1"
PINGER_EXTERNAL_DOMAIN: "kube-ovn.io."
@ -116,6 +125,7 @@ cni_conf:
CNI_CONF_FILE: "/kube-ovn/01-kube-ovn.conflist"
LOCAL_BIN_DIR: "/usr/local/bin"
MOUNT_LOCAL_BIN_DIR: false
NON_PRIMARY_CNI: false
kubelet_conf:
KUBELET_DIR: "/var/lib/kubelet"
@ -135,7 +145,7 @@ fullnameOverride: ""
HYBRID_DPDK: false
HUGEPAGE_SIZE_TYPE: hugepages-2Mi # Default
HUGEPAGES: 1Gi
DPDK_IMAGE_TAG: "v1.14.0-dpdk"
DPDK_IMAGE_TAG: "v1.15.0-dpdk"
DPDK_CPU: "1000m" # Default CPU configuration
DPDK_MEMORY: "2Gi" # Default Memory configuration
@ -146,6 +156,7 @@ ovn-central:
limits:
cpu: "3"
memory: "4Gi"
ephemeral-storage: 1Gi
ovs-ovn:
requests:
cpu: "200m"
@ -153,6 +164,7 @@ ovs-ovn:
limits:
cpu: "2"
memory: "1000Mi"
ephemeral-storage: 1Gi
kube-ovn-controller:
requests:
cpu: "200m"
@ -160,6 +172,7 @@ kube-ovn-controller:
limits:
cpu: "1000m"
memory: "1Gi"
ephemeral-storage: 1Gi
kube-ovn-cni:
requests:
cpu: "100m"
@ -167,6 +180,7 @@ kube-ovn-cni:
limits:
cpu: "1000m"
memory: "1Gi"
ephemeral-storage: 1Gi
kube-ovn-pinger:
requests:
cpu: "100m"
@ -174,6 +188,7 @@ kube-ovn-pinger:
limits:
cpu: "200m"
memory: "400Mi"
ephemeral-storage: 1Gi
kube-ovn-monitor:
requests:
cpu: "200m"
@ -181,3 +196,4 @@ kube-ovn-monitor:
limits:
cpu: "200m"
memory: "200Mi"
ephemeral-storage: 1Gi

2
packages/system/kubeovn/values.yaml
View file

@ -65,4 +65,4 @@ global:
images:
kubeovn:
repository: kubeovn
tag: v1.14.25@sha256:d0b29daaf36e81cac0f9fb15d0ea6b1b49f1abba81a14c73b88a2e60ffcc5978
tag: v1.15.3@sha256:fa53d5f254f640cb626329ad35d9e7aad647dd8e1e645e68f3f13c3659472a30