chore(config): bump component digests except ACM/hypershift/clusters-service (bisect e2e #5789)

[raelga]

Bisecting the e2e-parallel regression on the automated image-digest PR #5789. Follow-up split: this PR now excludes clusters-service (moved to its own PR) in addition to hypershift and ACM/MCE.

What

Applies the #5789 component digest bumps except hypershift, ACM/MCE, and clusters-service, on top of current main (which already has the merged ACM bump from #5911). Covers ~12 other components (acrpull, arobit fluent-bit/mdsd, kube-events, maestro, prometheus operator/prometheus, secrets-store, OADP velero + plugins, oc-mirror, etc.).

Why

Earlier bisect cleared hypershift (#5910 green) and ACM/MCE (#5911 merged). The remaining "rest" PR failed once with a different, transient signature (data-plane route-not-reachable, 2 tests) rather than the original 16× CreateHCPCluster provisioning timeout. Splitting clusters-service out isolates it from the other components so we can tell them apart.

Testing

Relies on ci/prow/e2e-parallel. make -C config/ detect-change is clean. Diagnostic bisect PR — not intended to merge as-is.

Special notes for your reviewer

Do not merge. Diagnostic bisect of #5789. Companion PR isolates clusters-service.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Copilot]

Pull request overview

This PR updates a broad set of component image digests to reproduce/bisect an e2e-parallel regression from automated digest bump PR #5789, while intentionally not changing hypershift and ACM/MCE to help isolate the culprit.

Changes:

• Bump default component image digests in config/config.yaml (acrpull, arobit, kube-events, secret-sync provider, velero + plugins, prometheus stack, maestro sidecar nginx, oc-mirror, etc.).
• Propagate those digest/version bumps into multiple rendered dev environment configs (westus3 + centralus CI), including istioctlVersion 1.30.1 → 1.30.2.
• Confirmed by search that the hypershift and ACM/MCE “suspect” digests from #5789 are not present in this branch’s config/ tree.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
config/config.yaml	Updates default digests/versions for the set of non-hypershift/non-ACM components under test.
config/rendered/dev/pers/westus3.yaml	Applies updated digests/versions to the pers rendered environment config.
config/rendered/dev/perf/westus3.yaml	Applies updated digests/versions to the perf rendered environment config.
config/rendered/dev/dev/westus3.yaml	Applies updated digests/versions to the dev rendered environment config.
config/rendered/dev/cspr/westus3.yaml	Applies updated digests/versions to the cspr rendered environment config.
config/rendered/dev/ci01/centralus.yaml	Applies updated digests/versions to the ci01 rendered environment config.
config/rendered/dev/ci00/centralus.yaml	Applies updated digests/versions to the ci00 rendered environment config.

[raelga]

/retest
Re-running: previous failure was a transient data-plane route-reachability flake (2 tests, route never reachable), not the #5789 provisioning regression.

[janboll]

/lgtm /approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: janboll, raelga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• config/OWNERS [janboll,raelga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[raelga]

/test e2e-parallel

Retesting — environmental shared-CI episode, not caused by this PR's new images.

Job pull-ci-Azure-ARO-HCP-main-e2e-parallel build 2073041446130159616: 1 of 80 specs failed —
Customer should not be able to perform various invalid operations on cluster resources at
test/e2e/simple_negative_cases.go:168:

failed to create NodePool np-1, caused by: timeout '20.000000' minutes exceeded during CreateNodePoolFromParam

Scope evidence this is a CI-fleet transient and not the component images this PR bumps:

• fix: Remove all cluster-service SLO alerts pending rework #5915 (edits only cluster-service alert YAML — no image bumps, cannot affect provisioning) failed concurrently with 9 specs of the same family: mass CreateHCPCluster/nodepool 20-min timeouts and route/API-POST timeouts.
• e2e-parallel is green concurrently on feat(e2e): add make target to apply slot-managed identity pool #5913 / chore(deps): bump ARO-Tools to enforce shellIdentity in pipeline schema (AROSLSRE-1380) #5917 / fix(swift-vnet): retry az login on transient DNS error at container cold start (ARO-28135) #5918 / Revert "feat: migrate maestro cert creation to CreateCertificate pipeline step" #5919.

The retest is the discriminator: if a bumped image had genuinely broken node-pool provisioning, the same spec would fail again; a green re-run confirms the flake.

[openshift-ci]

@raelga: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-parallel	94f21a2	link	true	/test e2e-parallel

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[raelga]

Closing as superseded by #5926. #5926 bumps the same components (all-except-clusters-service) and more, with newer digests where they differ (v5.0.4 rebuilt 2026-07-03 vs 06-29; imageSync 2026-07-03 vs 07-02), and pins clusters-service to the last-known-good 18b5a25 (root cause: AROSLSRE-1395). Nothing here is unique. The bisect confirmed the non-CS components were never the cause.