From 9994d1ad1101bf728ab1c2ec1feb7a21256a178f Mon Sep 17 00:00:00 2001
From: Stefan Reimer <stefan@zero-downtime.net>
Date: Thu, 18 Jul 2024 18:58:33 +0000
Subject: [PATCH] feat: First v1.29 basic control plane working

---
 Dockerfile                                    |   4 +--
 Makefile                                      |   7 ++--
 kubezero/aws-iam-authenticator/APKBUILD       |   4 +--
 kubezero/aws-neuron-driver/APKBUILD           |   4 +--
 kubezero/cri-o/APKBUILD                       |   7 ++--
 kubezero/cri-o/makefile-fix-install.patch     |  20 ++---------
 kubezero/cri-tools/APKBUILD                   |   4 +--
 kubezero/ecr-credential-provider/APKBUILD     |   4 +--
 kubezero/falco/APKBUILD                       |   5 +++
 kubezero/falco/falco.initd                    |  10 ++++++
 kubezero/kubernetes/APKBUILD                  |   4 +--
 kubezero/kubezero/APKBUILD                    |  14 ++++----
 kubezero/nvidia-container-toolkit/.gitignore  |   2 ++
 kubezero/nvidia-container-toolkit/APKBUILD    |   8 ++---
 .../etc/nvidia-container-runtime/config.toml  |  32 -----------------
 .../lib/x86_64-linux-gnu/libpsx.so.2          |   1 -
 .../lib/x86_64-linux-gnu/libpsx.so.2.66       | Bin 22592 -> 0 bytes
 kubezero/nvidia-drivers/APKBUILD              |   4 +--
 kubezero/nvidia-open-gpu/APKBUILD             |   4 +--
 kubezero/otelcol/APKBUILD                     |  34 ++++++++++++++++++
 kubezero/otelcol/otelcol-zdt.yaml             |  22 ++++++++++++
 kubezero/zdt-base/APKBUILD                    |  10 ++----
 kubezero/zdt-base/common.sh                   |   1 -
 kubezero/zdt-base/profile                     |   4 ---
 kubezero/zdt-base/syslog-ng.conf              |   6 +++-
 kubezero/zdt-base/zdt-base.post-install       |   8 ++++-
 kubezero/zdt-base/zdt-sysctl.conf             |   1 +
 27 files changed, 126 insertions(+), 98 deletions(-)
 create mode 100644 kubezero/falco/falco.initd
 create mode 100644 kubezero/nvidia-container-toolkit/.gitignore
 delete mode 100644 kubezero/nvidia-container-toolkit/etc/nvidia-container-runtime/config.toml
 delete mode 120000 kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2
 delete mode 100644 kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2.66
 create mode 100644 kubezero/otelcol/APKBUILD
 create mode 100644 kubezero/otelcol/otelcol-zdt.yaml
 delete mode 100644 kubezero/zdt-base/profile

diff --git a/Dockerfile b/Dockerfile
index 6a13c51..cbe19ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-FROM    alpine:3.19
-ARG     ALPINE="v3.19"
+FROM    alpine:3.20
+ARG     ALPINE="v3.20"
 ARG     BUILDUSER=alpine
 
 RUN     echo "http://dl-cdn.alpinelinux.org/alpine/${ALPINE}/main" > /etc/apk/repositories && \
diff --git a/Makefile b/Makefile
index 7ecff09..ab3f366 100644
--- a/Makefile
+++ b/Makefile
@@ -4,14 +4,14 @@ REGION := us-east-1
 
 include .ci/podman.mk
 
-BUILDER := v3.19.1
+BUILDER := v3.20.1
 PKG := '*'
 CF_DIST := E11OFTOA3L8IVY
 
 BUILDER_RELEASE = $(shell echo $(BUILDER) | sed -e 's/-.*$$//')
 RELEASE := $(shell echo $(BUILDER_RELEASE) | sed -e 's/\.[0-9]$$//')
 
-.PHONY: aarch64-toolchain packages distfiles aports apk
+.PHONY: aarch64-toolchain packages distfiles aports apk init_apk_repo
 
 aarch64-toolchain:
 	podman run -it --rm \
@@ -57,3 +57,6 @@ upload: invalidate_cdn
 	#aws s3 sync --delete packages/kubezero/aarch64/ s3://zero-downtime-web-cdn/alpine/$(RELEASE)/kubezero/aarch64/ --exclude APKINDEX.tar.gz
 	aws s3 cp packages/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(RELEASE)/kubezero/x86_64/ --cache-control max-age=1
 	#aws s3 cp packages/kubezero/aarch64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(RELEASE)/kubezero/aarch64/ --cache-control max-age=1
+
+init_apk_repo:
+	aws s3 cp s3://zero-downtime-web-cdn/alpine/v3.19/kubezero/x86_64/APKINDEX.tar.gz s3://zero-downtime-web-cdn/alpine/$(RELEASE)/kubezero/x86_64/APKINDEX.tar.gz
diff --git a/kubezero/aws-iam-authenticator/APKBUILD b/kubezero/aws-iam-authenticator/APKBUILD
index 5577f6a..87849ab 100644
--- a/kubezero/aws-iam-authenticator/APKBUILD
+++ b/kubezero/aws-iam-authenticator/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=aws-iam-authenticator
-pkgver=0.6.14
+pkgver=0.6.22
 pkgrel=0
 pkgdesc="AWS aws-iam-authenticator"
 url="https://github.com/kubernetes-sigs/aws-iam-authenticator"
@@ -20,5 +20,5 @@ package() {
 }
 
 sha512sums="
-26a6b394fbe767910f605a356032338a4ec254b81cd470796e3137e3595fef338bd213dee8d956c8d23e16f5508741e78664cd0f8b1acd97321d2fb5b7b723af  aws-iam-authenticator-0.6.14.tar.gz
+5a80f9bdaad86f3ff1140e49bd7b1dc1cceaa4e8885a4f60bb638e64ce542f0177641bb47c6b2cb5e95dabede30d385bce320bb466d627760630270969cf6876  aws-iam-authenticator-0.6.22.tar.gz
 "
diff --git a/kubezero/aws-neuron-driver/APKBUILD b/kubezero/aws-neuron-driver/APKBUILD
index 3fcb2ee..ca3fdba 100644
--- a/kubezero/aws-neuron-driver/APKBUILD
+++ b/kubezero/aws-neuron-driver/APKBUILD
@@ -5,7 +5,7 @@
 # Todo: needs fix of https://github.com/aws-neuron/aws-neuron-sdk/issues/843
 #
 pkgname=aws-neuron-driver
-pkgver=2.16.7.0
+pkgver=2.17.17.0
 pkgrel=0
 pkgdesc="Linux Kernel module for AWS Neuron INF instances"
 url="https://awsdocs-neuron.readthedocs-hosted.com/en/latest/release-notes/index.html#"
@@ -47,5 +47,5 @@ package() {
 }
 
 sha512sums="
-968eb60bcd6826fa7dba827c29eda0033c626e016c7a57389a821f64c966d076a85da885f772e937098885853fe50765013a1368aab8b0ca85d732c34e60a26e  aws-neuron-driver-2.16.7.0.deb
+e14531f50bb7b4c2854a6e1c53e8a4d5a639abc2657b6f5458e5f9f4f54f4f1e55bbd240e2bf96779ec0ec52fdfe4ab4148b7fa888bbed6f3ddcb9d20c2c742f  aws-neuron-driver-2.17.17.0.deb
 "
diff --git a/kubezero/cri-o/APKBUILD b/kubezero/cri-o/APKBUILD
index f8f62d9..2341a36 100644
--- a/kubezero/cri-o/APKBUILD
+++ b/kubezero/cri-o/APKBUILD
@@ -3,7 +3,7 @@
 # Contributor: TBK <alpine@jjtc.eu>
 # Maintainer: ungleich <foss@ungleich.ch>
 pkgname=cri-o
-pkgver=1.28.4
+pkgver=1.29.6
 pkgrel=0
 pkgdesc="OCI-based implementation of Kubernetes Container Runtime Interface"
 url="https://github.com/cri-o/cri-o/"
@@ -41,6 +41,7 @@ subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
 	$pkgname-zsh-completion
+	$pkgname-fish-completion
 	$pkgname-openrc
 	"
 	#$pkgname-fish-completion
@@ -103,12 +104,12 @@ package() {
 }
 
 sha512sums="
-8d27211a4baad86d5251faa396a23d78d2962de894124be851172d6e85fbf3c0da57ec08f70840c7d8526dc6daa93999485a8d92a1d2c33b374eff84b1e063ae  cri-o-1.28.4.tar.gz
+619478265d2fe4ef3ba8f74e755cc5618be9a578af6c9db8fdaf536c27953735a6001d9a0312ea52bb638a3e3379474dbe78ab8ff23ea20b47649a51b2c7fb71  cri-o-1.29.6.tar.gz
 1f60719677295c9c5c615eb25d9159bde0af68a132eee67747f57fe76642d457c98c896c6189f85637d7b4ac24ba55fd9eaeb1699f43c3c5077b645f72a479fb  crio.conf
 e9149cc2ddd24328c5290d3aea895c01e2798e066897535384f615a556496acdd52a603a0f4ac3c4c70bd5c363592f23c8b4d1987bf738300112fc62e1def555  crio.initd
 1115228546a696eeebeb6d4b3e5c3152af0c99a2559097fc5829d8b416d979c457b4b1789e0120054babf57f585d3f63cbe49949d40417ae7aab613184bf4516  crio.logrotated
 0a567dfa431ab1e53f2a351689be8d588a60cc5fcdbda403ec4f8b6ab9b1c18ad425f6c47f9a5ab1491e3a61a269dc4efa6a59e91e7521fa2b6bb165074aa8e0  cni-plugins-path.patch
-f9577aa7b1c90c6809010e9e406e65092251b6e82f6a0adbc3633290aa35f2a21895e1a8b6ba4b6375dcad3e02629b49a34ab16387e1c36eeb32c8f4dac74706  makefile-fix-install.patch
+09025bff1fed5004a15696cbc7c63260ae7c206ffe2c8506e6063e8889b7aa98bd5c7df2f0c109860d8432ddf5f3b6326dbfd46589d05cf87f26c38e4bdadb9c  makefile-fix-install.patch
 b0fdaf2280968a69e05ef72288bbf6fc03787616c6b6fca1e4398f9849167f4773e5e6e72bf1738d1fff2a84e97aa00f23aabcd50898ba8ed130969f50363006  fix-test.patch
 ae7e4a43f18076f19f3ae37d7302bfdf7a3befadf33e46bc9b1b14d50b605e8ba0d06d479568c24e8bf68f17c80ae48798068b2a46c3bcab565a5d225779f30e  remove-systemd-files.patch
 79e1a7c6183ba56f55d923e9d738be945564494042bc011d31e9195f66c268d702ee5c86711d4b46618285fc1b10b59ea55c321390feca770cfc7de334e103bd  crictl.yaml
diff --git a/kubezero/cri-o/makefile-fix-install.patch b/kubezero/cri-o/makefile-fix-install.patch
index 8b44339..82bb188 100644
--- a/kubezero/cri-o/makefile-fix-install.patch
+++ b/kubezero/cri-o/makefile-fix-install.patch
@@ -23,15 +23,13 @@
  CONTAINER_RUNTIME ?= podman
  BUILD_PATH := $(shell pwd)/build
  BUILD_BIN_PATH := ${BUILD_PATH}/bin
-@@ -420,68 +420,70 @@
- install: .gopathok install.bin install.man install.completions install.systemd install.config
+@@ -420,60 +420,62 @@
+ install: install.bin install.man install.completions install.systemd install.config
  
  install.bin-nobuild:
 -	install ${SELINUXOPT} -D -m 755 bin/crio $(BINDIR)/crio
--	install ${SELINUXOPT} -D -m 755 bin/crio-status $(BINDIR)/crio-status
 -	install ${SELINUXOPT} -D -m 755 bin/pinns $(BINDIR)/pinns
 +	install ${SELINUXOPT} -D -m 755 bin/crio ${DESTDIR}$(BINDIR)/crio
-+	install ${SELINUXOPT} -D -m 755 bin/crio-status ${DESTDIR}$(BINDIR)/crio-status
 +	install ${SELINUXOPT} -D -m 755 bin/pinns ${DESTDIR}$(BINDIR)/pinns
  
  install.bin: binaries install.bin-nobuild
@@ -70,18 +68,12 @@
 -	install ${SELINUXOPT} -D -m 644 -t ${BASHINSTALLDIR} completions/bash/crio
 -	install ${SELINUXOPT} -D -m 644 -t ${FISHINSTALLDIR} completions/fish/crio.fish
 -	install ${SELINUXOPT} -D -m 644 -t ${ZSHINSTALLDIR}  completions/zsh/_crio
--	install ${SELINUXOPT} -D -m 644 -t ${BASHINSTALLDIR} completions/bash/crio-status
--	install ${SELINUXOPT} -D -m 644 -t ${FISHINSTALLDIR} completions/fish/crio-status.fish
--	install ${SELINUXOPT} -D -m 644 -t ${ZSHINSTALLDIR}  completions/zsh/_crio-status
 +	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${BASHINSTALLDIR}
 +	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${FISHINSTALLDIR}
 +	install ${SELINUXOPT} -d -m 755 ${DESTDIR}${ZSHINSTALLDIR}
 +	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${BASHINSTALLDIR} completions/bash/crio
 +	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${FISHINSTALLDIR} completions/fish/crio.fish
 +	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${ZSHINSTALLDIR}  completions/zsh/_crio
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${BASHINSTALLDIR} completions/bash/crio-status
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${FISHINSTALLDIR} completions/fish/crio-status.fish
-+	install ${SELINUXOPT} -D -m 644 -t ${DESTDIR}${ZSHINSTALLDIR}  completions/zsh/_crio-status
  
  install.systemd:
 -	install ${SELINUXOPT} -D -m 644 contrib/systemd/crio.service $(PREFIX)/lib/systemd/system/crio.service
@@ -91,10 +83,8 @@
  
  uninstall:
 -	rm -f $(BINDIR)/crio
--	rm -f $(BINDIR)/crio-status
 -	rm -f $(BINDIR)/pinns
 +	rm -f $(DESTDIR)$(BINDIR)/crio
-+	rm -f $(DESTDIR)$(BINDIR)/crio-status
 +	rm -f $(DESTDIR)$(BINDIR)/pinns
  	for i in $(filter %.5,$(MANPAGES)); do \
 -		rm -f $(MANDIR)/man5/$$(basename $${i}); \
@@ -107,9 +97,6 @@
 -	rm -f ${BASHINSTALLDIR}/crio
 -	rm -f ${FISHINSTALLDIR}/crio.fish
 -	rm -f ${ZSHINSTALLDIR}/_crio
--	rm -f ${BASHINSTALLDIR}/crio-status
--	rm -f ${FISHINSTALLDIR}/crio-status.fish
--	rm -f ${ZSHINSTALLDIR}/_crio-status
 -	rm -f $(PREFIX)/lib/systemd/system/crio-wipe.service
 -	rm -f $(PREFIX)/lib/systemd/system/crio.service
 -	rm -f $(PREFIX)/lib/systemd/system/cri-o.service
@@ -121,9 +108,6 @@
 +	rm -f $(DESTDIR)${BASHINSTALLDIR}/crio
 +	rm -f $(DESTDIR)${FISHINSTALLDIR}/crio.fish
 +	rm -f $(DESTDIR)${ZSHINSTALLDIR}/_crio
-+	rm -f $(DESTDIR)${BASHINSTALLDIR}/crio-status
-+	rm -f $(DESTDIR)${FISHINSTALLDIR}/crio-status.fish
-+	rm -f $(DESTDIR)${ZSHINSTALLDIR}/_crio-status
 +	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio-wipe.service
 +	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/crio.service
 +	rm -f $(DESTDIR)$(PREFIX)/lib/systemd/system/cri-o.service
diff --git a/kubezero/cri-tools/APKBUILD b/kubezero/cri-tools/APKBUILD
index aa24db7..bd89246 100644
--- a/kubezero/cri-tools/APKBUILD
+++ b/kubezero/cri-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Francesco Colista <fcolista@alpinelinux.org>
 # Maintainer: Francesco Colista <fcolista@alpinelinux.org>
 pkgname=cri-tools
-pkgver=1.28.0
+pkgver=1.29.0
 pkgrel=0
 pkgdesc="CLI tool for Kubelet Container Runtime Interface (CRI)"
 url="https://github.com/kubernetes-sigs/cri-tools"
@@ -27,5 +27,5 @@ package() {
 }
 
 sha512sums="
-222d3785dc7e8485538b4745766494be02d359347eb1337c9dd04839e19269d768922ff04f07d1fb72291c3554ecf91b382307253a288c9376079135a625cc0c  cri-tools-1.28.0.tar.gz
+8e18e21017ea3140baaae7fedc85811738f1793962d5a9494117d5d0dd7f3f01468ca4768066be0bd80760b494c0c69d426603cc0326b9f95070db2547b6b8c2  cri-tools-1.29.0.tar.gz
 "
diff --git a/kubezero/ecr-credential-provider/APKBUILD b/kubezero/ecr-credential-provider/APKBUILD
index fa1549b..675615d 100644
--- a/kubezero/ecr-credential-provider/APKBUILD
+++ b/kubezero/ecr-credential-provider/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=ecr-credential-provider
-pkgver=1.28.1
+pkgver=1.29.5
 pkgrel=0
 pkgdesc="AWS Kubernetes ecr-credential-provider"
 url="https://github.com/kubernetes/cloud-provider-aws"
@@ -24,5 +24,5 @@ package() {
 }
 
 sha512sums="
-b9adc389be9301dc4be36c6bf546f354b9f2895cbad13d28d074dbab77f9aecec8d5fd02590d21c2a4acc91b559371adfe9702898c7880d92aea6657b315a539  ecr-credential-provider-1.28.1.tar.gz
+4ffe2c2f4cdd42d0fb20dc1937088c89b4e7cf816493c8a89f16d95f8090faf780e9e60ffe1c38ffde2f74593f9c6b77927f38c4443aa62e44c7eb35c333017c  ecr-credential-provider-1.29.5.tar.gz
 "
diff --git a/kubezero/falco/APKBUILD b/kubezero/falco/APKBUILD
index e1b7164..a522e5d 100644
--- a/kubezero/falco/APKBUILD
+++ b/kubezero/falco/APKBUILD
@@ -29,6 +29,7 @@ source="
   $pkgname-$pkgver.tar.gz::https://github.com/falcosecurity/falco/archive/refs/tags/$pkgver.tar.gz
   falco.patch
   rules.patch
+  falco.initd
   "
 
 prepare() {
@@ -69,10 +70,14 @@ package() {
   rm -rf $pkgdir/usr/src
   rm -rf $pkgdir/usr/lib
   rm -rf $pkgdir/usr/include
+
+  install -Dm755 "$srcdir"/$pkgname.initd \
+    "$pkgdir"/etc/init.d/$pkgname
 }
 
 sha512sums="
 f76b228328a3cf29f5795f7239393d7d05101f488e6ff09f5434237e906ec04a0139a5c91089c36cf3d01058584773b8fe0b1742e760a3e4953237fbc49e834f  falco-0.38.1.tar.gz
 b152fcf6cd81895efa37797ab7ff1aac7350b5f51f2648aa9e3cce9d5ece55791ddf82c396e9da216293e2379a785a294cc972f28a91162dc5bc88ab09e1ab08  falco.patch
 487b8b64d2399fd7b706be29e3722983bcdfde3ab5cf0f78b2e9fe1055a4ad958976f591e739491e25a06d7cdf6894c1e153e892a87b83c7a962e23c9a104528  rules.patch
+9d1292a99bab7792bfe344940fa41ccf01318d5f30f854b01457e9f53ccca27f7f334466c061a11fbe8ebf918aeeb7f723b16a233c9e3bd60dd632d831ae9f5c  falco.initd
 "
diff --git a/kubezero/falco/falco.initd b/kubezero/falco/falco.initd
new file mode 100644
index 0000000..9543fb1
--- /dev/null
+++ b/kubezero/falco/falco.initd
@@ -0,0 +1,10 @@
+#!/sbin/openrc-run
+supervisor=supervise-daemon
+
+name=falco
+command="/usr/bin/falco"
+command_args="$falco_opts"
+
+depend() {
+	need logger
+}
diff --git a/kubezero/kubernetes/APKBUILD b/kubezero/kubernetes/APKBUILD
index 57f310c..3ae4239 100644
--- a/kubezero/kubernetes/APKBUILD
+++ b/kubezero/kubernetes/APKBUILD
@@ -5,7 +5,7 @@
 # Contributor: Dave <dj.2dixx@gmail.com>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=kubernetes
-pkgver=1.28.9
+pkgver=1.29.7
 pkgrel=0
 pkgdesc="Container Cluster Manager"
 url="https://kubernetes.io/"
@@ -205,7 +205,7 @@ _do_zshcomp() {
 }
 
 sha512sums="
-cb10da770f8bb035c98b2c02b9ff202194ae69983d7c4d5052b03f5f5522e57f70a88105039265e1892039c566cfd7d043fcb44ad958823be0f5bee352f864a0  kubernetes-1.28.9.tar.gz
+bce18d12164704f4d55d7566737bdff8305c5613af7a8df4b49cfa5f90f6b51f879159c4da7fbe436fdf7c4fcf5331f3f35e63f8dbc4c833559e6e2b1a61d08f  kubernetes-1.29.7.tar.gz
 5427c2e653504cfd5b0bcaf195d4734ee40947ddfebc9f155cd96dddccfc27692c29d94af4ac99f1018925b52995c593b584c5d7a82df2f185ebce1a9e463c40  make-e2e_node-run-over-distro-bins.patch
 94d07edfe7ca52b12e85dd9e29f4c9edcd144abc8d120fb71e2a0507f064afd4bac5dde30da7673a35bdd842b79a4770a03a1f3946bfae361c01dd4dc4903c64  make-test-cmd-run-over-hyperkube-based-kubectl.patch
 e690daff2adb1013c92124f32e71f8ed9a18c611ae6ae5fcb5ce9674768dbf9d911a05d7e4028488cda886e63b82e8ac0606d14389a05844c1b5538a33dd09d1  kube-apiserver.initd
diff --git a/kubezero/kubezero/APKBUILD b/kubezero/kubezero/APKBUILD
index ae92482..f7d0821 100644
--- a/kubezero/kubezero/APKBUILD
+++ b/kubezero/kubezero/APKBUILD
@@ -1,9 +1,9 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=kubezero
-pkgver=1.28.9
-_crio=1.28.4
-_ecr=1.28.1
+pkgver=1.29.7
+_crio=1.29.6
+_ecr=1.29.5
 
 pkgrel=0
 pkgdesc="KubeZero release package"
@@ -18,7 +18,7 @@ depends="
         kubelet~$pkgver
         kubectl~$pkgver
         ecr-credential-provider~$_ecr
-        aws-iam-authenticator~0.6.14
+        aws-iam-authenticator~0.6.22
         "
 options="!check"
 #install="$pkgname.post-install"
@@ -28,7 +28,7 @@ subpackages="
         "
 
 IMAGES="
-       quay.io/cilium/cilium:v1.15.3
+       quay.io/cilium/cilium:v1.15.7
        ghcr.io/k8snetworkplumbingwg/multus-cni:v3.9.3
        "
 
@@ -74,11 +74,11 @@ package() {
 
 # Preload container images all nodes need to speed up boot time and reduce data transfer
 imagecache() {
-  mkdir -p "$subpkgdir/mnt/zdt/cache"
+  mkdir -p "$subpkgdir/var/cache/zdt"
 
   for i in $IMAGES; do
     IMAGE_NAME=$(echo $i | sed -e 's/.*\///' -e 's/:.*//')
-    install -Dm644 "$srcdir"/$IMAGE_NAME.tar.xz "$subpkgdir/mnt/zdt/cache/$IMAGE_NAME.tar.xz"
+    install -Dm644 "$srcdir"/$IMAGE_NAME.tar.xz "$subpkgdir/var/cache/zdt/$IMAGE_NAME.tar.xz"
   done
 }
 
diff --git a/kubezero/nvidia-container-toolkit/.gitignore b/kubezero/nvidia-container-toolkit/.gitignore
new file mode 100644
index 0000000..b289cfd
--- /dev/null
+++ b/kubezero/nvidia-container-toolkit/.gitignore
@@ -0,0 +1,2 @@
+etc
+lib
diff --git a/kubezero/nvidia-container-toolkit/APKBUILD b/kubezero/nvidia-container-toolkit/APKBUILD
index ecaf739..0b1ec85 100644
--- a/kubezero/nvidia-container-toolkit/APKBUILD
+++ b/kubezero/nvidia-container-toolkit/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 # https://github.com/NVIDIA/nvidia-container-toolkit
 pkgname=nvidia-container-toolkit
-pkgver=1.15.0
+pkgver=1.16.0
 pkgrel=0
 pkgdesc="NVIDIA Container toolkit incl. cri hooks"
 url="https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/overview.html"
@@ -68,9 +68,9 @@ package() {
 }
 
 sha512sums="
-36adc14f49b3827ba5b86fdf75b2eb91fd2b2621e9be3a02c2f7f94b2c30e47b9f9d7482ae4f788cee804b12b359e4dc597878171f6e68f7287c18b3d3dfdf8d  libnvidia-container1_1.15.0-1_amd64.deb
-686a642649104379710056740dd0e9004a20809729231d88557c85844fe83ea5b279fe6ac49e890bcc8727b050c285f4d1b2cba584b12be1158c5b7af48d27a3  libnvidia-container-tools_1.15.0-1_amd64.deb
-f8507ca4d5b4678c6afaa271b5930f856d33d2ab92ed70fbd2a5047eb6fe7635f55758047117119f8656270d96667ddb154bb95074d58a34ad37ffb7832ce951  nvidia-container-toolkit_1.15.0-1_amd64.deb
+fbe354a472a4fe391ba2dcea0931278b4b4f1ef98737fda9e25bb44c4864542af509915276427be6fc38780563136c8fc9a3a5ef13f18f456f40172043b51e54  libnvidia-container1_1.16.0-1_amd64.deb
+47955e2d9a4323158e572dc359b6009f74052897524f600aaa58f2bf8dbd952f07f61620b2b8407516fb0a64fb70e5aa648ff4a6236ce976bf29c11f6c545127  libnvidia-container-tools_1.16.0-1_amd64.deb
+5928d53a4eb82da9b81ada7662b5b09c6ff2c4957c26f603c126ff8c309049ba1dfb95ecdc7b8ac14d00d133ad6b35028e865c84a0453260bd3d5a90ecd64866  nvidia-container-toolkit_1.16.0-1_amd64.deb
 5a4eaa96e6e774948889909d618a8ed44a82f649cbba11622dc7b4478098bea006995d5a5a60ca026a57b76ad866d1e2c6caebd154a26eb6bd7e15291b558057  libseccomp2_2.3.3-4_amd64.deb
 cc9109cdcf51dc40db732e10ac3eda7e4ac73299ad51d2ec619d7f4cff3f0311be0937530d2175e5486c393bc9e91c709072094fad510573785739afaad831f1  libcap2_2.44-1_amd64.deb
 040ac2e3f58549dc09e5bce0d694e4be2f6aae736014bf0ee90042646562d5f1ef1f5990eb9f2c2a2fdf504587b82f4aa0eb99d04c5d3e407670e4012e3edd4e  config.toml
diff --git a/kubezero/nvidia-container-toolkit/etc/nvidia-container-runtime/config.toml b/kubezero/nvidia-container-toolkit/etc/nvidia-container-runtime/config.toml
deleted file mode 100644
index 225ec45..0000000
--- a/kubezero/nvidia-container-toolkit/etc/nvidia-container-runtime/config.toml
+++ /dev/null
@@ -1,32 +0,0 @@
-disable-require = false
-#swarm-resource = "DOCKER_RESOURCE_GPU"
-#accept-nvidia-visible-devices-envvar-when-unprivileged = true
-#accept-nvidia-visible-devices-as-volume-mounts = false
-
-[nvidia-container-cli]
-#root = "/run/nvidia/driver"
-#path = "/usr/bin/nvidia-container-cli"
-environment = []
-#debug = "/var/log/nvidia-container-toolkit.log"
-#ldcache = "/etc/ld.so.cache"
-load-kmods = true
-#no-cgroups = false
-#user = "root:video"
-ldconfig = "@/sbin/ldconfig"
-
-[nvidia-container-runtime]
-#debug = "/var/log/nvidia-container-runtime.log"
-log-level = "info"
-
-# Specify the runtimes to consider. This list is processed in order and the PATH
-# searched for matching executables unless the entry is an absolute path.
-runtimes = [
-    "docker-runc",
-    "runc",
-]
-
-mode = "auto"
-
-    [nvidia-container-runtime.modes.csv]
-
-    mount-spec-path = "/etc/nvidia-container-runtime/host-files-for-container.d"
diff --git a/kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2 b/kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2
deleted file mode 120000
index 019a2e2..0000000
--- a/kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2
+++ /dev/null
@@ -1 +0,0 @@
-libpsx.so.2.66
\ No newline at end of file
diff --git a/kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2.66 b/kubezero/nvidia-container-toolkit/lib/x86_64-linux-gnu/libpsx.so.2.66
deleted file mode 100644
index 89d3e121f6b77a1c51e55dd36f8d2d510425ff8b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 22592
zcmeHPdw5jUwLh6;AO@Hjl}LEWh=WCekN}B^I+BD0&fr8N0wRdRB$*)tlZP{BAgE|G
z337TEj4k!j-g--0%ja#i7Zok#T8#z?R`0!tZ|j3v#516PRuQQ(_qX=hdvX$){?q=|
zFPm>>?e*Jht-bczkF)m<XYQ)<&b4G@NFrrQS4+f|U2Y&{yrAuRo&hP7N~B@<9xIKJ
zhJepvm{DG45R@9J!P1{*b37B2^iGr;z(6{V%L(e>Jo!d?>5}6-qeM`NE0Ug-ik$R?
z<YeC|nmgLy1vTrj`pUTc0D6i7fF!6{kBVe3E0*M&`_pa;08%#B7kU&ff|hW-C0tL?
z6VwnSK}9^tNBTU><2{hNNC`<$lBHDhky20j;T4Si4t?5yB|(MW_0SWpbCJJGME@<|
z^`(o;E*=*_d2?CYMxq8Po_Fmcsk!#XqNByD^xtLeKJoS^z4r{c?N24-0F@WwLwe-j
zoE?*-iBj7z!e-!8jL$`{etF@--`<}0a_0D(U%qfw?JM{^^z*6Lt#O`wytV0<GtQUZ
zyb)q&O}#+*5bIaIC=Gri`r~Z!6c1-V3kLHWkh96Zng)M4jr}nQz}f7ap9Zf>gC9s^
z|LrvRdujZPrLq5d8k{=tZ2sHP!Dqu`Y5dXB*jbv!Pg<|eX8*c0_+x48pjyd^&%pF_
z8au}zc(!`W)A;|hH29u0_CJIC#DUI$KbS`TiZr;A#?Ob+;FdJ~^++1|jcMw=FAY8w
zcAWSOO#huGKL3>l_rt*1;=eeJ{9MRS99Sv%KcumfpT<sC8u`1?-gD1l|5JwBQ_szD
zT;@R*pW)JeTHugs4I&NYc-u4s$mRHGj<<06OE`WB$G35OBFFCrJy#kfm8~!U@f?^b
z<hlLBXeT8P$GfH*{0IDD@fgR&{$e|qmwdjJjm=HIsN#<(KA+_CEUfm`2O@!$p{Npw
zEUcarZf*)J^w)+1M%md*e08mUUoh0<4~K3GNWn-TAl3Q9;pRH2MQMlx{Pn)Zm=b99
zg_=T23W^58L8&F$>hsqrA^5O5u+CJbL|X!Np<oCm0+C2_MDhh%p&SjZ3^cYV>!Jac
z_t)3+TuY?6uF)S|O%jGdv<=OwTkWfBSnUh?L*bP5y5^?({=T4YUmYA(0@BKW(h{mq
z$%5_kq+esuywxc&qkXZaeqeJ`T_7dFDqZV01;Eg$4@8wnb6?Y$92$XOrgXuwwxLC#
zm1yv)#ul_r#8&i)ug;GO!={p0)88vw8$uYG0<Gv0^g_59-4tCHrH+d-gflbEOfjsl
zjrdzqmGh{<8`$6)kU^g{HN$3|pZYe{kkz4ZSc=v)1nPb3LV<9-6jd<VB2sW|B!t-e
ze8HATs7VP@pBdE#6kjyZ6b&h%H6djkB%;m6XqAG^ErF)uSrWR94K)lqf4vl}3pYmt
zup0>nnjmhn2d`QKbu^ZJ^<mcD0EQJCyXbftT|QqbUVbIm99b=eL$!7J(dPVO%Atvr
zpCQfjdMf7lX5`PzpVgP|gH51WxDTF@UqtiM!v1A&nhBc4@>YCj;vaGJp%M!o%?3Aw
zAwxN8*cggZL(2FzbTWVr{5M3p2+szwFH}Z{&XJ^{(&Zd`{Qd{9VhoYyaDHScG=g^U
z*K$6><g=tDoZrdhGo^aY$HtI7i_{FBlGuNX{ql~B4ZMc$uLa)1acPB7E^xtj`wX0x
zGrmMJV4n#WYa<oxH{r9Gr1ABZ3C}a(2TeHZ8eXQG@b8)APnd9e7K(Jrgck@9bj2+O
zGZaKDy@WKFa4gZO)MCOjQ>Y}hns9cm;$>|noG<yTWTOeEx<%?T;i*`oaH|PNN2by?
z6P}YoaqcnU!%X-N6F%I8?=s;SSgF))!fh#3lJ=Q!y9wWK!o^so;<rq=`8j^jgtG$+
zx22nK^FHK+2|wRd?<o^b=b}{N{Z26!&w47$HsKefgfah2_$U*eXTtf>n3XzB_!yJ?
zWD`Etgcq1_u~(tu5)(e&BwuF2FErt@37=rXYfQM)gfB7S7n$%CCVZj^Z!qCv383N@
z6Yes}x0>)tCcMprUt+>Hn()acyvu}NYQndg@XJj2HWNO@gg<P;`BsdT?l9r`Ciz_^
zoNv)grGweQ2n<GGFam=S7>vMR1O_887=ghE3`Sru0)r9wSBrq${z<m1S^sA?uE;vO
z6-#oz+`cEfC)Lbk(PdXlQgYH%eA_3KAxC@zl_w4+ktR(fp01J-`x!rmc)CJLbTj@u
z;_2!rv4inB#M2d7VjJTv#M2d0qKomT-Qel!DAC6F&xxn&j6@6Lj}T8+MTr%R|B!gP
zB1+US{vG1!YA8|0_yfe#l~AI9@qZ+qu7VOy#y?LyT>&K=jNeT>UHv2^#y?IxUHK$V
zoB=TD*TmCRPvRise?dH5@g(*${wKuK6;7g?@joD*u5J=L82^3Z>B=Utjq&#oPggaG
zF2>(RJYCTw+87@po~~vREsS49JY5+kRxrMnc)FrV)G&T2@pLtlC}aEr;^|5zQNZ~5
z#M4zw!pZmw;>Q#3VEh%tUr4;f_!-1cApXR+)c(tecM^Y)@e_%sE0)B5#*ZPMu2vG=
zj6aWfx>8B(V0;eobd{3W#&`?ybcK@WV*Kf=z|+-9qK)yN6aPKpTNr<Yc)CJKtYG|y
z#M9MDqK5JB5KmVoi896?AfB#D5(SJW`@t^oEXi?q1{{#%R>I}dQ%WwT!*3~%>2OZ+
zpnXCc3HERb`B$hgUi3#Im!6T;6Y_J%X3Ni=%9Jzq%CDSJM#4ax8^}%`4B97D_UZrC
ze&Ojh_peYa#ilHh+uf@uE2|$V!)49g1V+CJQP%76wb!~He8zIrovNSo6Khe({kcKb
z#<yYy^;$QREZOR{)&Za-cm7Gaz^GqVKajPtdi6KSB+%H2WjzLd!!t`D_$(>v6hCV9
zJUQN)S9nrZd-U}f0{SV!)%Rs}jss2m{*{uXmFT}j3Ak@4cxoo8Wy$K2Y*~FvR>vO(
zx~vDWdJqFo-v@o8hGTzACWFCz`-Bd14-1O4=mz=jPaa0~^|F>ViMmx*J6u}<6n4w%
zU*z~Bt~LgKp#K@ZYenaynP`ljN%gBo;8$T%55lhIJ_XO@_!bw1q41=BKS1>Budx=%
zr5y~lckG9;puO2(;owLzr)_a{K}S}t-@*inH@O_(k=f#M8kwKE3Xrj%YmGty1rNE(
zjDkm8HOR<nE{#hR>~yVQf+Ln1{L`)$L$Jfu#tL$;M}hs^@l<X<cTycA)544t#Taql
z$%yq{5d8>i+c-E@cmTt088W@rxABcNG*5rzbTSECJ@zaux%zUjvStLZUY=q^G?pXZ
zy@z7FY<Z7<6cVN`p!FYJ9d|Fg0_vL)V#dXY>!JW^?jM)3aDGUp<GC6QhIo++wL|Ms
zEbRI&taiQDHBg~tLcf&8%tK7fy&hia8(H}Rl*0#!Jzp^Rj3FSaZVw7NPue%%k3z3@
zo>$GC4W#`{hP~r|NnWeKsItyvm_@l$*5*58b;K0LXDYW-3%puIUaxf)AgaNuT60-x
zmeT6g<~zOWh!Kpp+B-Heiwh>R=boDTE!yT)-&i24&lh&<&D6y9J$XHSLo{eV-d)&T
zRd@hh|1g9xyB-ChRQO`A^*Nr0KFkz$C#J##JtraeBVJZj_+sIKqnr6W?6n4je)rMG
zx(W{@ZpCa)#iP_c1I4ktN^L|VGF6=~Vqxe!sSItuGyAkMx(ie8GvI8#VQuLW>r(kb
z%%t{DoZ2l2&O%q7dWUPItSYW-efKHqMdUO<r9HBSQhO&wzf!YW$(A<aef%jx)^h)k
zk)m!!+>e1&b#~i3H&SD}_3OWeA@v1#a4-IIAeMj{vaI%yFH5}f6?tCuWBm>ap}Jar
zb~jV%ol^!X>ABEFu{x&)@pUd+UVd|;0#K0Ja}jUPNKu4#rIrYRiFQ)IC5z_5HLo_}
za*)DquV%dj8T~Ql&I?PHCTIoa>*FGf)jVS?-h_H?kmKWTh4*rNH5&r@Bdk#$=zBoF
zvi=%H81zYHLf`nrx_4af{ECV-UK~sGTJJ)hb}h6Ptz{t|e*#|6`iJ$kB(VWySl?uA
zPPW|nsWMwutB~ndZjsf=a{Tr@Jpz-Yy!#}mW_^MwAC<K!a_L*KeX=_3=Y$yQvFAv2
zsN74zg!53JN$S|D!NjuVi5QHq=L{<w#ZCKw9{uGKO#9UMqIhJ}Lm=+<z&^#pkH2G5
zSoLizfFJ0)K(*Xo0PZ}XTuh-d^#?r%j_XvPX1$9<x?@Lst+yhF6@g7|!=pO*K<hi|
z+sYPV_uGgV)%O|xu9=GeR9<H#XuEqFnNdbj+>Clgpq_U31q8=F>9yt{Ly27Y0gCzp
z@C7)Ucjb#b>bIB-a(tSKdQji;Q{H%80iH5jq1f*!!^id4<U+jYbGE*@XTnQat;EE+
zpGEPw{-2;n&lAso^%xEF*q89@_7$12;|QdTih8Y0_@<<PjWVD);PvHj%M*_|3J>u0
znRu-VYtC`1#DP3|u+o*MKk)@=-QjZL$@LYa5Z48AJnV8(Ti*a6WB%sJ8kDd{C-okE
zHq`_;TdzXJwC+=r`quqPSof*b7?d>S%9msIlk_OUs4o3eSkT`>)ndGt-{_6IKgMJz
zUtGS(8=vMv#LE|Y)Nj~>dNP*Rej&^QfCqK_W|zYo-|3=l6^-d)nDwfkqZ5tieh|D?
zv;=<ur&1ZMp=TB^^iV6}<KLM{OYs>*Mju7Z#fAkVPoILkmYWMz48{w(__+A;uQdLW
zP%*~eXUK`!m_TzpXkDI+MKD`GLguO2<-L`zN_sx%y^tt8;8jl=ow5%sulYd|hKo;v
zw!8m>tSWhIJvYYVdeqzQ-at5w$J>yhM15p|6;fSA6kS1~>FbK~&=nLtqaVs|Dfjj0
zD_{&W-!p>@3`OobmK)MzdOnxmNF6}~T7CTnS$zrPn9RuPRW24<w#Gk0aX(AH=yy^L
zSi(DK>p|NyFGiHZqweYJtjP#Cy8H_o?D6r7;DO!>El+$Qx)j?AC`$TvAX?E@6jJwW
zWbyhuRk{(Sh#$uMNyJ0Hi3j3VP%U>El+bhIs5ATKb<yY4f3vBKtsjNR(HW5fcqub?
ztndIfcGHk&4=-7}%H>u6j19;btX}#e;N|KIo!xg`ZR*G*tbQl-_Rb%ZVI%yNs&485
z_+$8eHT=ekaaSSS{|QwIHy#IVcmF$}Ol5p({p8~>_8Ar4Nrf~HBFIppac~+%q+bhX
zXsLMTL^7GU5f2r_=N$(s_&o}Yu>K!%`claEt*@#6rhV}~W^#*b8&Pah8C5sA9%lGX
z7tL)iw#z#h-Q?N@+HV*bE1Vqf;4^cfYYEvg^ebI5m1MJ_vCy@GN@)K?>roknkxDRU
zO0rpXimS$pk_NBpb+ynQqm_2*Z76F$HN<{z7LM$dntONw8Tgy}LRDwd-r0mc#nSq3
zY=*nvqVQfxVTn)r1b=j<=y<_aYDGm*tHL&Cv{yY$b9b_SKEhV1O&iAwK8=0cYaM|s
zJYs5A1WoUzp29e-QIAo;A7gVD>!aL$DycXswef#JB~_h&vUhHV8vL*ue$<d3Prw2>
z@DgaddnY6_l)PY9s{S7yC;X>`$Bv-u>X7TTs`#d)kA!=qeh27x7G8U&9g7iLt1<5O
zLEbdzjD4W~>M?S@=nk4JarYls*m^Vx5uU1#;=WC1zU49B#u<7k|NaX7cK0{<n?C&O
zwVptRP5|VS4%d6FmysH|T1qa)i_SA@x`Ea7g8l?=z)M6m_bkBG=(3I-P?6P}UD-#k
zp>@xzex+}PJ#Xo>b0I>{E_+9Wj#Su?WP7wlczo3u6tg^2RxPCQ0Gy+h;{8vPNmx~G
zs#d?P)@FN38y(8=>Ua!W#jo`1QFE2HsIt7bs*D`1>O2tZ@@VTFT2Ve)qrbw8e1+%S
zC^$gfxE8Yr=3<Za%@<jNtJG+U2L|gn7-IfAjd-EqquDTVFGW1`KTuO3{W>U4&Q}A&
zcFo>V1P7`LKRsH^HoR|=4SLdgO6SU6HCc&X$+rKf+x}GdIjBOv7j;#lJi9961v+D|
z_TcHDjrEi^vF6>0<|XwAs;JVgt*p}KmeDr;R|Hm5o31R{i}rc6A@+_(sU{<mYY@p6
zL=qGe0g)U+3SLBzg0<xnIE;<ukI4I>uu|3eslDTSa9dvok;F*0<t@V~r}?l~e+cu6
z?JyFzVE5Y>FOPPoqwpj(XtLhIY$vI4`cCBOkU-6vjMG@hMKB0Y$8k?P7qbcwTI)H0
z67zU{aEH3UsYhX;*ZL&?KWKQ~jzdQ+fwigVf(I~=G0NY>|4dOc^%4pKno$GV?k<Ij
z#oqB_EbDAN7V{qsZg-EP!q}0-?X+c8t(##WagT8VtuSo11JVz(mVB(Ap;i=qf!m(W
zld(}$$Gb3-SOaI7mx-m+Ds9>s+z;)hq4Eq3Jb1PY7la<IT4M3mMjV3$j6|vPMSI8R
zkVqE21_URLM?q-6lY0m^jLD*>z%mm!gM1(PWYJIYjRRGTG56wI&w)>LiXrp6X(<(T
zUNj6Q<3%$-^w;4gX5nwqT$(R)*$gC?9em&ERZn38$)ybrWr9~LlRc$xDHmvR4S9*3
z7PE;n+Jmq|Gh{!T7gQ)~UYDb=n^&6qB>dLbve>?iAmEJs29E2`(7~M^UdxXnTzlwh
zg`KnZLWB-jBc4PCZQKrm#?Q|Yt<Xkjfb>gX5a+JZh^~G*0d34g2bg59bO9_U-of5l
zzx7Bm*#*0f^54@|t$Y_<@)mZll2&D`vaHHnm8Jg-5(rg^>HJN8m}OR3R}D!jE?JKn
zva)%zgz>{p!P)Ie%i1c8y9+S~)xY7%z8)8Z=;p=LA-_i(sjaUVR2{zuh58e)hn{WU
zlTF8^)cI4Ng60^l*hLLG`d(idt&eoRx%V7qyq$>pk$8gRIDY7aeigY%JFw{(X&!ZN
zRpFuXXPsy`tv1=guIh}WM}5x|Uz<Ve<+UWuPSo~}p-}Lur{~A7a(dOzj8S&!hx$u8
zHfI@os!P9#_EhZ6x|prdCjrinS6+-g*fq)BG^W|k7AMKbSYsV*E6Hd-fa95-A(!rp
zeb)YbhFo|085)lIO=zJ<?PXp*380+S1^=o$4=K0s@dr1iT%+Fc)hSQ=-VFT#)K?u3
zTQjOlKZ+dkXcI6f6c{tMr17Hd$YZsV?NzU0P;R9Wfd};dk7?c~^?jh&+r2`t=8*B+
z$VC(*LLVAI6dipRMkfF~`XPF*6dC<4z|}ZRW5GYJ-vcYgHfkdoio3rik(()xy6RJ<
ztAO<N8E!ew!DVvc$wUR=xPKV&H7=VIBhexnYcv3Q5QM=r7=ghE3`Sru0)r9wSB^le
ziC#l;D$P#u!jTg%7dadJP4!{Clq4y5#p;Sl;d-aPaK_A8MaAxAV5Xksvph$lSK9)R
zRGh}^X-@V^7JKWe@0Bdn6ODxxXMHFb3`C;&IsL2XXCF2V>F5=bbFIHg3Dmo9N8Rgl
zB<Ccal@>OHqE5UM74b*bNs(G<I=z55o!;r2Ue{P34mAa&zDBnABhi4<A6Xe|3^XZG
zNtzUOLS1PHIHL{z2)yT(oNM45T)%<<L}c2G{Nm#LoErj&6@<N^I=l-Oa0bz0C*IFO
zbMT^9s5V9~nK?sEfEw8gXZbnR&5?i^aY8^b`Aqfu*C2GPBZ86U#w&7ioJb9d(h|L5
z`gFW<7KrArY;Il|4&>K0H!@&)FcuE4tMj*z*7Q{D(U0sMG`vRUYz#CuN7ga#(BL)3
zD4vey6wjI-uAhd;#9F7dmK0Abo@KmDmN7Q-O1eU#E&Is#lgZaW4;@S<zX9F(=VWpu
zHkMz2(qBTA50gpy!{--&NhaHfKa@<;Uu`=+N+!EOUpt&kx^PW!2>Y-lpbN3TY6IN^
zO218zg`MspPz9UtS-2(ILYr~W4xE;@g4W}<VmSVyumyA$=pIn|p@Lbs!r20P2-m_-
zgVMeKYoPQWDkx>#wm`~gb!3bkJ~X=vez<_qL9gV!WO6_1lWdN;w!HcFVQaJ7q}gMx
zylkdxB2cDZ33~8@WD@(xRLVo{W_-3H4)_})cE>hHyQS4eGGw<EpQllVslv-FOLJ`5
z<v7$yILt{~@fnAh#o!C+Zm^Ww^4c@!*}5|`>oam}dBDoKJhfpTK4HXmEvQs!b66s_
zY-+<nd|m@irvk|`*XCGb%e%(ryw;X&nPYP-v1QlT94k;ncXm&sPdp@do6WI_>f4Z6
zZgaM0Rocodzsj*W%X?7mUYn!hWn1>VVKoB~@32Zjm}eEXY<XCvO`dD3xydG%+sY)|
z0ZC!lei;4Dd|_?6j@opc&1rcaErQo*(fnZxMdQf-ZP1~y(TKbe2d0B2SY)9>a{D0n
zGUUSj<;eCNAy<O36ObE;F;)U9RoEPHOO-8e6SZ?gmTa5cZoSUdonbkdW1C#b8UqnD
zrhJ$e;!`mW@-Qx2xbA%xk1cO=W`)fe&+^zNZ?aa}3N{QWx0SRHoo72}$-El<R8np$
zD7Q_9Ooc5^7=tYbK6k)g3C49U@|38KE?||w*!$3szs~|aUPlGh0ec&UR8k%Dsg4q=
z1N9E5qmsr^3qA*7?+{Kb>^<tV_PEb&mdw3p_j%s1%$=FGjh4l>F3SSjR!g;Q8yeqc
zu{;iNF2E3IIRNU5g_wsmxTM4Rh{j@G4K*GiD5$WNRM^TqGzq4n=nlv&f!stx&H+&t
zr#{gNn_OwDAqA3ugv-~GeBYcvN3Bmyh-;|fNaV-6klzaX>|JptfBlFd)%Rs?&Wc+%
z4QU@rax{0cvLwlgdoLRSJW>CQ1D*$bxBv&~U<3vuFc^Ws2>jC`Al|1J@6Xetl@h(<
zPf4uFQ#hYmi=C`k8etG=IR29krO^gSy|+J>^I~r{hV$b6ecFpr66If>Nj4MD_I#jp
z<4kEI7ofXmN_pHL+-S3OJLmc1N22{7B@RpSEe4OrF-uN7TPTVBCwmxyr~hI>=>%_>
zz;)hm;V13aDB<pyB~jmnoELKVFEp$@BCfciXM8KShpXv+<#=2&K8u&*e{?Wjw1b=f
zrxEe{WCINrI}Kzmr;9laa=M1o4V*r}>2^+^;&d;kZ*Y2;)03PIxkzH^0!}aCw3ySm
zoG#`x$mtqRH*op@r`tJwiqpNEzQO5XPET?=gl&FscH;CBPK!C6%jsfHgPgA6bOWak
zaJrq-r#Riq=^LCL=G18QKk&W6(48KOM(Aufy*^MITRA<ye(i13aW?c7&*BHgl}#}!
z$BA=BK9j-!4i9bjw0I`G7I<NM!O%%1_ILH!Qt^zU%V!n^YG)P~`vWDlmlw>c^#=>;
zO9ORvmzT^aD8AfZUpupeTR_!E9(k`u%8xeS^sM-6rTnI5C6JH0@@r!u98&T7H;ilW
zM;oO4`gKjwb&Up9B1Q>6r}txgD2oKbep2AMmarn_vtRwmM;51Pu=uGJeB;-GLJ(@M
z_bYx9!LJRqNcn*VUohft4EP%AVN7s_37<a_@vk#9MIJTz8}S=K`G%R=Xq0(`pD;o=
z{b2>C?bRlPvHw7?rBrF18j6pFBXqW=Bq;5l&518pDTvk?9HE<qzF02>mARx?H^h1*
z3`|Cbd=UC#Jr%TtFT7N520lVxtaEgpB-=t?tj~gq^%x>7kqvXAvmmW~LSL+Rf+}2C
z_%GxHtwK4irGgjhsi1WBqBPKd1H~DMmkE8bz6&bWcTxYq_S55pY*%oD;&~ycc)pN6
zoi7LKHvprUi07H)1VhQmzEjU3gEQ(9d7^drnDw1bLZR+tB=!6>xW3=(p>q|bCVb5L
zCnhpj5>)tWpnd)eeC+^z>0&O)>2SJ?G9^*3fYu{pu3zjQ1QpL!AwO{Zw{v~`|1%?%
z^`}S4xG4$01+1Zr@}mFK{f?<HG0^`X4$vR?JDg7oMNS9$|MLO*`}jZ-v|xaO@L!ny
z4KlPh%jAIgoh0%5oCD<rFX-=}XE*7K{aB6HFev1>`PBFocn=C_?27uuK0^HdDc$o>
z63q~LB93(LMj}FA?9b$DNlTJ;aeagP?)ZBd1!jF|1(&QbsHl&lDgOn302z`I^*dJ>
zCD~lRKnx56mYkdl@+L9^Tx3N;f1VKJbf9b^jeZTUf7Sqf5k~>{Yr6nJJGlNS6GqvA
G_5VMp4ixSH

diff --git a/kubezero/nvidia-drivers/APKBUILD b/kubezero/nvidia-drivers/APKBUILD
index 1af2541..24cfe28 100644
--- a/kubezero/nvidia-drivers/APKBUILD
+++ b/kubezero/nvidia-drivers/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=nvidia-drivers
-pkgver=550.76
+pkgver=555.58.02
 pkgrel=0
 pkgdesc="NVIDIA Driver"
 url="https://www.nvidia.com/download/index.aspx"
@@ -55,5 +55,5 @@ package() {
 }
 
 sha512sums="
-a3804501b220d4acbda9633b92c4515bb14d0b5233f3ffd5e173290d310efdb1ed9a9602f727c117c1d0746d596c1125c51cc3e1fde65c79905e60e1d35f50ec  NVIDIA-Linux-x86_64-550.76.run
+7a8c84c15d87d2cf5f6261b12d3d683e0a7a1847d7c5461b3995f78b8dd862272fd11be07018593a8d5ef5d8274040f15b9e6fe92e9212dcd7a97be668852433  NVIDIA-Linux-x86_64-555.58.02.run
 "
diff --git a/kubezero/nvidia-open-gpu/APKBUILD b/kubezero/nvidia-open-gpu/APKBUILD
index eea8a76..b179542 100644
--- a/kubezero/nvidia-open-gpu/APKBUILD
+++ b/kubezero/nvidia-open-gpu/APKBUILD
@@ -7,7 +7,7 @@
 #   remove coreutils from makedepends
 
 pkgname=nvidia-open-gpu
-pkgver=550.76
+pkgver=555.58.02
 pkgrel=0
 pkgdesc="NVIDIA Linux open GPU kernel modules"
 url="https://github.com/NVIDIA/open-gpu-kernel-modules"
@@ -53,7 +53,7 @@ package() {
 }
 
 sha512sums="
-5126d3b8e3f0635b5b044db4faf0d483e70bb43418bbd21325bb175aaca948e19bd81038fbef9118a95387da65ff0ff3d1592fc54c0d6815a2448b32024468ac  nvidia-550.76.tar.gz
+5cc927d994ba5ec79333b21534dbc60904b5e1ce746d231d29764648d6f6ffd8e7646b69f32b3d28f9ef8c407df5a04e5a94ff26d503201ec8fd17028bf3ccc9  nvidia-555.58.02.tar.gz
 b16b86ded8601ff802477e2b191c5728290014f90bb85ad6ec0e5b7e84f8004c467f5b6c66b80dc5d205fb70a3900ac286764a3829ca3ad3b8a3a5fd0b73a702  91-nvidia.rules
 8335bd69c482da1f67b5cddd31a0b40d01b5c627aeca137b40ac7776cb3e7475767bec808a972ed739c26914207aca264324c41496f6fb579d910c8477f7cc1c  create-nvidia-uvm-dev-node.sh
 "
diff --git a/kubezero/otelcol/APKBUILD b/kubezero/otelcol/APKBUILD
new file mode 100644
index 0000000..0df49e4
--- /dev/null
+++ b/kubezero/otelcol/APKBUILD
@@ -0,0 +1,34 @@
+# Contributor: Stefan Reimer <stefan@zero-downtime.net>
+# Maintainer: Stefan Reimer <stefan@zero-downtime.net>
+pkgname=otelcol
+pkgver=0.105.0
+pkgrel=0
+pkgdesc="The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data"
+url="https://github.com/open-telemetry/opentelemetry-collector"
+arch="x86_64 aarch64"
+license="AGPL-3.0"
+makedepends="go bash"
+options="!check chmod-clean"
+source="ocb::https://github.com/open-telemetry/opentelemetry-collector/releases/download/cmd%2Fbuilder%2Fv"$pkgver"/ocb_"$pkgver"_linux_amd64
+        otelcol-zdt.yaml
+       "
+
+#builddir="$srcdir/etcdhelper"
+
+prepare() {
+  chmod +x ./ocb
+}
+
+build() {
+  ./ocb --config otelcol-zdt.yaml --skip-compilation
+  bash
+}
+
+package() {
+	echo
+}
+
+sha512sums="
+6928fdd8ac2a7335b9a3446db68a9bfcb1fb2ea3d435612e83a6ff61bbb424e8828b1504ce6564825e5729e2228ceae020112fdcad01e18e1e72651ed36cbe65  ocb
+660ba67bb2c034a08dd2766f4366e72587935aedf467169fda1ed1b74038479ee334b599343c0de85a65a63c33660f01b4ad18929c61b44fbdf7fc75c495c5ef  otelcol-zdt.yaml
+"
diff --git a/kubezero/otelcol/otelcol-zdt.yaml b/kubezero/otelcol/otelcol-zdt.yaml
new file mode 100644
index 0000000..f5eb64e
--- /dev/null
+++ b/kubezero/otelcol/otelcol-zdt.yaml
@@ -0,0 +1,22 @@
+dist:
+  name: otelcol-zdt
+  description: ZeroDownTime OpenTelemetry Collector
+  output_path: .
+extensions:
+  # Contrib
+  - gomod: github.com/open-telemetry/opentelemetry-collector-contrib/extension/basicauthextension v0.105.0
+  - gomod: github.com/open-telemetry/opentelemetry-collector-contrib/extension/jaegerremotesampling v0.105.0
+  - gomod: github.com/open-telemetry/opentelemetry-collector-contrib/extension/oauth2clientauthextension v0.105.0
+  - gomod: github.com/open-telemetry/opentelemetry-collector-contrib/extension/storage v0.105.0
+
+exporters:
+  - gomod: go.opentelemetry.io/collector/exporter/debugexporter v0.105.0
+  - gomod: go.opentelemetry.io/collector/exporter/otlpexporter v0.105.0
+  - gomod: go.opentelemetry.io/collector/exporter/otlphttpexporter v0.105.0
+
+receivers:
+  - gomod: go.opentelemetry.io/collector/receiver/otlpreceiver v0.105.0
+
+processors:
+  - gomod: go.opentelemetry.io/collector/processor/batchprocessor v0.105.0
+  - gomod: go.opentelemetry.io/collector/processor/memorylimiterprocessor v0.105.0
diff --git a/kubezero/zdt-base/APKBUILD b/kubezero/zdt-base/APKBUILD
index 0d5d955..4217ddd 100644
--- a/kubezero/zdt-base/APKBUILD
+++ b/kubezero/zdt-base/APKBUILD
@@ -1,7 +1,7 @@
 # Contributor: Stefan Reimer <stefan@zero-downtime.net>
 # Maintainer: Stefan Reimer <stefan@zero-downtime.net>
 pkgname=zdt-base
-pkgver=0.3.19
+pkgver=0.3.20
 pkgrel=0
 pkgdesc="ZeroDownTime Alpine additions and customizations"
 url="https://git.zero-downtime.net/ZeroDownTime/alpine-overlay/src/branch/master/kubezero/zdt-base"
@@ -31,7 +31,6 @@ source="
         monit_alert.sh.aws
         neofetch.conf
         zdt-ascii.txt
-        profile
         route53.py
         get_iam_sshkeys.py
         uniq_hostname.py
@@ -47,10 +46,6 @@ package() {
   install -Dm755 "$srcdir/boot.sh" "$pkgdir/usr/lib/cloudbender/boot.sh"
   install -Dm755 "$srcdir/common.sh" "$pkgdir/usr/lib/cloudbender/common.sh"
 
-  # convienience
-  mkdir -p "$pkgdir/home/alpine"
-  install -Dm644 "$srcdir/profile" "$pkgdir/home/alpine/.profile"
-
   # set mtu on interface via dhcpcd
   install -Dm644 "$srcdir/dhcpcd-mtu.hook" "$pkgdir/usr/lib/dhcpcd/dhcpcd-hooks/10-mtu"
 
@@ -119,7 +114,7 @@ cac71c605324ad8e60b72f54b8c39ee0924205fcd1f072af9df92b0e8216bcde887ffec677eb2f0e
 3a84b728d4169b92356f1da52922c6110efd5bdc2df90b64abe59f89a5de57cc85a81936bdead0cae5071c1ba1735bda1bd866018b5c3f7fd4ef155d0606ac2d  cloud-nocloud.sh
 06102e56c847637f705d0b29b05b07fbbb2bda9ba69f0a7fe1d716126d3b1c7922fb0df159199809908fa0dc143209775edb1dd5976faa84244dbcaa45f00364  zdt-sysctl.conf
 76e6a4f309f31bfa07de2d3b1faebe5670722752e18157b69d6e868cbe9e85eda393aed0728b0347a01a810eee442844c78259f86ff71e3136a013f4cbfaaea4  ps_mem.py
-b86dec8c059642309b2f583191457b7fac7264b75dc5f4a06ad641de6b76589c0571b8b72b51519516ba7e68a128fe2da29b4a2a6dc77c252204675c51b2d128  syslog-ng.conf
+74727352a8ac334964c6cca9d52b3dfc8165d6f9c25e7dd589dda91dfe2d00c32ea0e9b4c37100525703c730a0d48eec3d244aa4626b6ad6b52d3707d776c52b  syslog-ng.conf
 484bdcf001b71ce5feed26935db437c613c059790b99f3f5a3e788b129f3e22ba096843585309993446a88c0ab5d60fd0fa530ef3cfb6de1fd34ffc828172329  syslog-ng.logrotate.conf
 e86eed7dd2f4507b04050b869927b471e8de26bc7d97e7064850478323380a0580a92de302509901ea531d6e3fa79afcbf24997ef13cd0496bb3ee719ad674ee  syslog-ng.apparmor
 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e  cloudbender.stop
@@ -129,7 +124,6 @@ e00a8f296c76446fe1241bf804c0108f47a2676f377a413ee9fede0943362a6582cad30fe13edd93
 c955dabe692c0a4a2fa2b09ab9096f6b14e83064b34ae8d22697096daf6551f00b590d837787d66ea1d0030a7cc30bef583cc4c936c980465663e73aec5fa2dc  monit_alert.sh.aws
 2c02a1d454881dd7197548286c6cf24c1453dd9d726f3e5445703c12414853b0e12205e5b6a0c3ae09b76097d2bdfcfd6e1bc9a122dd9f66c6d6d03ab41f748a  neofetch.conf
 532b8e2eb04942ab20bdc36b5dea1c60239fcbfcb85706123f3e05c18d65c938b85e9072d964ae5793177625a8db47b532db1f5bd5ed5ecbb70d5a331666ff54  zdt-ascii.txt
-c3e72cd92936b03f2b9eab5e97e9a12fcddcdf2c943342e42e7702e2d2407e00859c62dc9b4de3378688d2f05458aa5c104272af7ab13e53a62f1676d1a9a1b4  profile
 816049360aa442f9e9aa4d6525795913cfe3dc7c6c14dc4ccad59c0880500f9d42f198edc442fe036bc84ba2690d9c5bc8ae622341d8276b3f14947db6b879b1  route53.py
 7da28446762a36a6737c5b30becbce78775bd943b4d0c5ef938a50f49b4f51f66708434aa79004c19d16c56c83f54c8d6d68e1502ebc250c73f8aae12bed83c0  get_iam_sshkeys.py
 ae1941fc45e61fa8d211f5ef7eff2dd01510a6d364c4302cab267812321a10e7434ecc8d8c9263d8671ce5604d04d6531601bf42886a55fb6aec7f321651e1dc  uniq_hostname.py
diff --git a/kubezero/zdt-base/common.sh b/kubezero/zdt-base/common.sh
index 64ba744..17ad80d 100644
--- a/kubezero/zdt-base/common.sh
+++ b/kubezero/zdt-base/common.sh
@@ -417,7 +417,6 @@ enable_ip_forwarding() {
 net.ipv4.ip_forward=1
 net.ipv4.ip_local_port_range = 1024 65535
 net.ipv4.conf.all.send_redirects=0
-net.ipv4.conf.all.rp_filter = 1
 net.ipv4.conf.all.accept_redirects = 0
 net.ipv6.conf.default.forwarding = 1
 net.ipv6.conf.all.forwarding = 1
diff --git a/kubezero/zdt-base/profile b/kubezero/zdt-base/profile
deleted file mode 100644
index 5f256e8..0000000
--- a/kubezero/zdt-base/profile
+++ /dev/null
@@ -1,4 +0,0 @@
-alias sudo='doas'
-alias cu='doas cat /var/log/user-data.log'
-alias cl="doas cat /var/log/messages | jq -r '\"\(.time): \(.message)\"'"
-alias tl="doas tail -f /var/log/messages | jq -r '\"\(.time): \(.message)\"'"
diff --git a/kubezero/zdt-base/syslog-ng.conf b/kubezero/zdt-base/syslog-ng.conf
index d9c2e0e..0551ece 100644
--- a/kubezero/zdt-base/syslog-ng.conf
+++ b/kubezero/zdt-base/syslog-ng.conf
@@ -20,4 +20,8 @@ destination d_mesg { file("/var/log/messages" template("$(format-json time=\"$UN
 # filter f_drop_ipvs_ratelimit { not (facility(kern) and match("net_ratelimit:.*callbacks suppressed" value("MESSAGE"))); };
 # log { source(s_sys); filter(f_drop_ipvs); filter(f_drop_ipvs_ratelimit); destination(d_mesg); };
 
-log { source(s_sys); destination(d_mesg); };
+log {
+  source(s_sys);
+
+  destination(d_mesg);
+};
diff --git a/kubezero/zdt-base/zdt-base.post-install b/kubezero/zdt-base/zdt-base.post-install
index f7cda20..2d3a709 100644
--- a/kubezero/zdt-base/zdt-base.post-install
+++ b/kubezero/zdt-base/zdt-base.post-install
@@ -35,4 +35,10 @@ echo 'Enable monit via inittab'
 [ -f /etc/profile.d/color_prompt.sh.disabled ] && mv /etc/profile.d/color_prompt.sh.disabled /etc/profile.d/color_prompt.sh
 ln -sf /etc/profile.d/color_prompt.sh /etc/bash/color_prompt.sh
 
-echo 'alias rs="doas bash"' > /etc/profile.d/alias.sh
+cat <<EOF > /etc/profile.d/zdt-alias.sh
+alias rs='doas bash'
+alias sudo='doas'
+alias cu='doas cat /var/log/user-data.log'
+alias cl="doas cat /var/log/messages | jq -r '\"\(.time): \(.message)\"'"
+alias tl="doas tail -f /var/log/messages | jq -r '\"\(.time): \(.message)\"'"
+EOF
diff --git a/kubezero/zdt-base/zdt-sysctl.conf b/kubezero/zdt-base/zdt-sysctl.conf
index 78d208d..0c201ab 100644
--- a/kubezero/zdt-base/zdt-sysctl.conf
+++ b/kubezero/zdt-base/zdt-sysctl.conf
@@ -10,6 +10,7 @@ net.ipv4.tcp_retries2 = 9
 net.ipv4.tcp_slow_start_after_idle = 0
 net.ipv4.ip_no_pmtu_disc = 0
 net.ipv4.ip_forward_use_pmtu = 0
+net.ipv4.conf.all.rp_filter = 0
 kernel.panic = 10
 kernel.panic_on_oops = 1
 vm.oom_dump_tasks = 0