Skip to content

Conversation

openshift-bot
Copy link

@openshift-bot openshift-bot commented Sep 11, 2025

The downstream repository has been updated with the following following upstream commits:

Date Commit Author Message
2025-09-11 23:22:05 operator-framework/operator-controller@6e22e2b Todd Short Use old and new pod selectors during kustomize-to-helm transition (#2214)
2025-09-11 17:19:53 operator-framework/operator-controller@febdb59 Anik migrate containers libs to new mono-repo (#2195)
2025-09-11 14:45:30 operator-framework/operator-controller@3f782fd dependabot[bot] 🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35 operator-framework/operator-controller@6957436 dependabot[bot] 🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38 operator-framework/operator-controller@1821160 dependabot[bot] 🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39 operator-framework/operator-controller@c8dff76 Todd Short Rename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45 operator-framework/operator-controller@46e1163 Todd Short ⚠️ OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31 operator-framework/operator-controller@67098e7 Joe Lanford 🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24 operator-framework/operator-controller@1ffa845 Todd Short Restart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

Date Commit Author Message
2025-09-09 10:45:51 openshift/operator-framework-operator-controller@d4a90c7 dtfranz UPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54 openshift/operator-framework-operator-controller@fd3a2d3 Todd Short UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57 openshift/operator-framework-operator-controller@d0f9efd Todd Short UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00 openshift/operator-framework-operator-controller@af129a0 Catherine Chan-Tse UPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02 openshift/operator-framework-operator-controller@d07b505 Todd Short UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05 openshift/operator-framework-operator-controller@9269c12 Jian Zhang UPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08 openshift/operator-framework-operator-controller@60e4974 Camila Macedo UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11 openshift/operator-framework-operator-controller@c8f61e4 Camila Macedo UPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14 openshift/operator-framework-operator-controller@fb415ce Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17 openshift/operator-framework-operator-controller@38871a8 Todd Short UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19 openshift/operator-framework-operator-controller@abe3ad4 Todd Short UPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22 openshift/operator-framework-operator-controller@541b9a3 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25 openshift/operator-framework-operator-controller@2d5c51d Camila Macedo UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27 openshift/operator-framework-operator-controller@b8adee9 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30 openshift/operator-framework-operator-controller@fc94c3e Camila Macedo UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33 openshift/operator-framework-operator-controller@40945ac Camila Macedo UPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36 openshift/operator-framework-operator-controller@a2277ea Camila Macedo UPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38 openshift/operator-framework-operator-controller@920370c Camila Macedo UPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41 openshift/operator-framework-operator-controller@8a9859e Camila Macedo UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44 openshift/operator-framework-operator-controller@4609149 Jian Zhang UPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47 openshift/operator-framework-operator-controller@7631e01 Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50 openshift/operator-framework-operator-controller@f9b9bbf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52 openshift/operator-framework-operator-controller@25c0ed2 Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55 openshift/operator-framework-operator-controller@6762adf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58 openshift/operator-framework-operator-controller@a2fc1cc Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00 openshift/operator-framework-operator-controller@2fb741c Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03 openshift/operator-framework-operator-controller@84fd312 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06 openshift/operator-framework-operator-controller@1e2f565 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08 openshift/operator-framework-operator-controller@a318e4b Todd Short UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11 openshift/operator-framework-operator-controller@2c92f30 Camila Macedo UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15 openshift/operator-framework-operator-controller@4c09740 Camila Macedo UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20 openshift/operator-framework-operator-controller@594ce33 Todd Short UPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25 openshift/operator-framework-operator-controller@767e2a4 Camila Macedo UPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30 openshift/operator-framework-operator-controller@05e5f34 Todd Short UPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35 openshift/operator-framework-operator-controller@ed4e724 Todd Short UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40 openshift/operator-framework-operator-controller@ddc5201 Camila Macedo UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45 openshift/operator-framework-operator-controller@4175b5a Todd Short UPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47 openshift/operator-framework-operator-controller@cf60db4 Todd Short UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52 openshift/operator-framework-operator-controller@64840b7 Camila Macedo UPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57 openshift/operator-framework-operator-controller@31bd723 Camila Macedo UPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02 openshift/operator-framework-operator-controller@8200935 Camila Macedo UPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07 openshift/operator-framework-operator-controller@f653ef6 Rashmi Gottipati UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13 openshift/operator-framework-operator-controller@c65e51c Ankita Thomas UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18 openshift/operator-framework-operator-controller@161381d Brett Tofel UPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24 openshift/operator-framework-operator-controller@4440699 Camila Macedo UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29 openshift/operator-framework-operator-controller@a0352ea Camila Macedo UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35 openshift/operator-framework-operator-controller@4f76f80 Camila Macedo UPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40 openshift/operator-framework-operator-controller@edc6a6a Camila Macedo UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45 openshift/operator-framework-operator-controller@b197164 Camila Macedo UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50 openshift/operator-framework-operator-controller@c75cf8e Todd Short UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56 openshift/operator-framework-operator-controller@06386d2 Todd Short UPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01 openshift/operator-framework-operator-controller@75dca2a Luke Meyer UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06 openshift/operator-framework-operator-controller@d0fe31d Camila Macedo UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11 openshift/operator-framework-operator-controller@c574d2f Todd Short UPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16 openshift/operator-framework-operator-controller@4b5fb34 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21 openshift/operator-framework-operator-controller@2139f4c Camila Macedo UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26 openshift/operator-framework-operator-controller@b869beb Camila Macedo UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31 openshift/operator-framework-operator-controller@beb8726 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36 openshift/operator-framework-operator-controller@adbfccf Camila Macedo UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41 openshift/operator-framework-operator-controller@e09eade Camila Macedo UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46 openshift/operator-framework-operator-controller@4ce333f grokspawn UPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51 openshift/operator-framework-operator-controller@0553e0f Camila Macedo UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56 openshift/operator-framework-operator-controller@4eb8ab9 Camila Macedo UPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01 openshift/operator-framework-operator-controller@1bbf658 Forrest Babcock UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06 openshift/operator-framework-operator-controller@dac2f1d Camila Macedo UPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11 openshift/operator-framework-operator-controller@b65f351 Todd Short UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54 openshift/operator-framework-operator-controller@861cba4 Jian Zhang UPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17 openshift/operator-framework-operator-controller@4f4b107 Per Goncalves da Silva UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

tmshort and others added 8 commits September 9, 2025 18:47
This fixes a downstream bug

There was a problem downstream where the OpenShift servivce-ca was not yet available,
and due to the way the manifests were set up, the service-ca was considered to be
part of the SystemCertPool. The problem is that the SystemCertPool, once initialized,
will never reload itself.

We can get into this situation when we use SSL_CERT_DIR and SSL_CERT_FILE to provide
OpenShift CAs to be used by containers/image for pulling. These environment variables
change the source of the SystemCertPool. The CertPoolWatcher then watches these
locations, and tries to update the pool it provides to the HTTPS client connecting to
catalogd. But the SystemCertPool is never updated. (It did not help that there was
no explicit CertPoolWatcher for the pull CAs.)

I tried to fix this downstream by removing SSL_CERT_DIR, and specifying the
`--pull-cas-dir` option. This means that containers/image would directly use
certificates that we specify, rather than the default location.

But this breaks the use of custom CAs for local image registries.

The containers/image package does not provide a way to manipulate the certificate
locations beyond a simple directory setting, and we need to leave that directory
setting as the default in downstream because it (i.e. /etc/docker/certs.d) is a host-
mounted directory that contains certificates for local image registries. And it is
possible to configure a custom CA for a local image registry, so that directory
must be included, ALONG with the OpenShift provided CAs and service-ca, which is
defined by SSL_CERT_DIR.

But because of the use of SSL_CERT_DIR to include the OpenShift service-ca, if the
service-ca was not available at startup, but became available later, it was not
possible to reload the SystemCertPool. Which could cause problems in operator-controller
when it tried to connect to catalogd.

The fundamental problem is that there's no way to refresh the SystemCertPool,
which will become more and more of an issue as certificate lifetimes decrease.

Using SSL_CERT_DIR allows us to use the CertPoolWatcher to notice changes to the
SystemCertPool. This will allow us to restart the process when certificates
change (e.g. OpenShift service-ca becomes available).

Changes:
* Update CertPoolWatcher to restart on changes to SSL_CERT_DIR and SSL_CERT_FILE
* Update CertPoolWatcher to use a Runnable interface, so that it can be added to
the manager, and started later, which may improve the changes that the service-ca
is ready.
* Update CertPoolWatcher to not be created when there's nothing to watch.
* Add CertPoolWatcher to catalogd for pull CAs
* Add CertPoolWatcher to operator-controller for pull CAs
* Improve logging

With this, my downstream manifest change should be reverted.


Assisted-by: Claude Code (alternatives)

Signed-off-by: Todd Short <tshort@redhat.com>
…ot module (#2202)

* retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module

* fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module

* fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module

Signed-off-by: Todd Short <tshort@redhat.com>

---------

Signed-off-by: Todd Short <tshort@redhat.com>
Co-authored-by: Todd Short <tshort@redhat.com>
* Move to a helm-based configuration

This does not remove the kustomize config, but instead puts a helm chart
into the repo, that should give very close (but not identical) results.

* Adds a new chart: helm/olmv1/
  - standard
  - experimental
  - openshift
  - cert-manager
  - e2e
  - tilt
* Adds "values" files in helm/
* Adds helm executable to .bingo/
* Updates documents int docs/drafts/
* Update tests in tests/
* Update `make manifests` to use helm chart
  - Update the checked-in manifests
  - Use a tool like `dyff` to properly diff the manifests
* Pull RBAC and WebHook config out of the goland code
  - controller-tools is not longer used to generate RBAC/Wehbooks
  - These resources are not part of the helm chart
  - The CRDs are still generated via kubebuilder

Significant changes to the resulting manifests are listed in the RFC.

Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)

* Move files into directories

Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)

* Add variable settings to Makefile to control Helm charts

Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)

* Add prometheus Helm chart

This is currently separate due to the ordering of application.
If we change the order, this could be included in the main Helm Chart.

Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)

* Add lint-helm target and CI

Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)

* Add Boxcutter support

Signed-off-by: Todd Short <tshort@redhat.com>

* Update catalogs to use 4.20

Signed-off-by: Todd Short <tshort@redhat.com>

* Remove clusterextension editor role

Signed-off-by: Todd Short <tshort@redhat.com>

* Remove configmaps from leader election role

Signed-off-by: Todd Short <tshort@redhat.com>

* Remove stale comment from config manager role

Signed-off-by: Todd Short <tshort@redhat.com>

* Add templating failure for featureSet

Signed-off-by: Todd Short <tshort@redhat.com>

---------

Signed-off-by: Todd Short <tshort@redhat.com>
Signed-off-by: Todd Short <tshort@redhat.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pkg.package-operator.run/boxcutter](https://github.com/package-operator/boxcutter) from 0.6.0 to 0.7.0.
- [Release notes](https://github.com/package-operator/boxcutter/releases)
- [Commits](package-operator/boxcutter@v0.6.0...v0.7.0)

---
updated-dependencies:
- dependency-name: pkg.package-operator.run/boxcutter
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.36.0 to 0.37.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@openshift-bot openshift-bot added tide/merge-method-merge Denotes a PR that should use a standard merge by tide when it merges. kind/sync labels Sep 11, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 11, 2025
@openshift-bot openshift-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 11, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Sep 11, 2025

@openshift-bot: This pull request explicitly references no jira issue.

In response to this:

The downstream repository has been updated with the following following upstream commits:

Date Commit Author Message
2025-09-11 14:45:30 operator-framework/operator-controller@3f782fd dependabot[bot] 🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35 operator-framework/operator-controller@6957436 dependabot[bot] 🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38 operator-framework/operator-controller@1821160 dependabot[bot] 🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39 operator-framework/operator-controller@c8dff76 Todd Short Rename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45 operator-framework/operator-controller@46e1163 Todd Short ⚠️ OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31 operator-framework/operator-controller@67098e7 Joe Lanford 🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24 operator-framework/operator-controller@1ffa845 Todd Short Restart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

Date Commit Author Message
2025-09-09 10:45:51 openshift/operator-framework-operator-controller@d4a90c7 dtfranz UPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54 openshift/operator-framework-operator-controller@fd3a2d3 Todd Short UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57 openshift/operator-framework-operator-controller@d0f9efd Todd Short UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00 openshift/operator-framework-operator-controller@af129a0 Catherine Chan-Tse UPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02 openshift/operator-framework-operator-controller@d07b505 Todd Short UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05 openshift/operator-framework-operator-controller@9269c12 Jian Zhang UPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08 openshift/operator-framework-operator-controller@60e4974 Camila Macedo UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11 openshift/operator-framework-operator-controller@c8f61e4 Camila Macedo UPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14 openshift/operator-framework-operator-controller@fb415ce Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17 openshift/operator-framework-operator-controller@38871a8 Todd Short UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19 openshift/operator-framework-operator-controller@abe3ad4 Todd Short UPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22 openshift/operator-framework-operator-controller@541b9a3 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25 openshift/operator-framework-operator-controller@2d5c51d Camila Macedo UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27 openshift/operator-framework-operator-controller@b8adee9 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30 openshift/operator-framework-operator-controller@fc94c3e Camila Macedo UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33 openshift/operator-framework-operator-controller@40945ac Camila Macedo UPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36 openshift/operator-framework-operator-controller@a2277ea Camila Macedo UPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38 openshift/operator-framework-operator-controller@920370c Camila Macedo UPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41 openshift/operator-framework-operator-controller@8a9859e Camila Macedo UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44 openshift/operator-framework-operator-controller@4609149 Jian Zhang UPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47 openshift/operator-framework-operator-controller@7631e01 Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50 openshift/operator-framework-operator-controller@f9b9bbf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52 openshift/operator-framework-operator-controller@25c0ed2 Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55 openshift/operator-framework-operator-controller@6762adf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58 openshift/operator-framework-operator-controller@a2fc1cc Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00 openshift/operator-framework-operator-controller@2fb741c Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03 openshift/operator-framework-operator-controller@84fd312 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06 openshift/operator-framework-operator-controller@1e2f565 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08 openshift/operator-framework-operator-controller@a318e4b Todd Short UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11 openshift/operator-framework-operator-controller@2c92f30 Camila Macedo UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15 openshift/operator-framework-operator-controller@4c09740 Camila Macedo UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20 openshift/operator-framework-operator-controller@594ce33 Todd Short UPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25 openshift/operator-framework-operator-controller@767e2a4 Camila Macedo UPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30 openshift/operator-framework-operator-controller@05e5f34 Todd Short UPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35 openshift/operator-framework-operator-controller@ed4e724 Todd Short UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40 openshift/operator-framework-operator-controller@ddc5201 Camila Macedo UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45 openshift/operator-framework-operator-controller@4175b5a Todd Short UPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47 openshift/operator-framework-operator-controller@cf60db4 Todd Short UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52 openshift/operator-framework-operator-controller@64840b7 Camila Macedo UPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57 openshift/operator-framework-operator-controller@31bd723 Camila Macedo UPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02 openshift/operator-framework-operator-controller@8200935 Camila Macedo UPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07 openshift/operator-framework-operator-controller@f653ef6 Rashmi Gottipati UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13 openshift/operator-framework-operator-controller@c65e51c Ankita Thomas UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18 openshift/operator-framework-operator-controller@161381d Brett Tofel UPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24 openshift/operator-framework-operator-controller@4440699 Camila Macedo UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29 openshift/operator-framework-operator-controller@a0352ea Camila Macedo UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35 openshift/operator-framework-operator-controller@4f76f80 Camila Macedo UPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40 openshift/operator-framework-operator-controller@edc6a6a Camila Macedo UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45 openshift/operator-framework-operator-controller@b197164 Camila Macedo UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50 openshift/operator-framework-operator-controller@c75cf8e Todd Short UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56 openshift/operator-framework-operator-controller@06386d2 Todd Short UPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01 openshift/operator-framework-operator-controller@75dca2a Luke Meyer UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06 openshift/operator-framework-operator-controller@d0fe31d Camila Macedo UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11 openshift/operator-framework-operator-controller@c574d2f Todd Short UPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16 openshift/operator-framework-operator-controller@4b5fb34 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21 openshift/operator-framework-operator-controller@2139f4c Camila Macedo UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26 openshift/operator-framework-operator-controller@b869beb Camila Macedo UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31 openshift/operator-framework-operator-controller@beb8726 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36 openshift/operator-framework-operator-controller@adbfccf Camila Macedo UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41 openshift/operator-framework-operator-controller@e09eade Camila Macedo UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46 openshift/operator-framework-operator-controller@4ce333f grokspawn UPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51 openshift/operator-framework-operator-controller@0553e0f Camila Macedo UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56 openshift/operator-framework-operator-controller@4eb8ab9 Camila Macedo UPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01 openshift/operator-framework-operator-controller@1bbf658 Forrest Babcock UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06 openshift/operator-framework-operator-controller@dac2f1d Camila Macedo UPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11 openshift/operator-framework-operator-controller@b65f351 Todd Short UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54 openshift/operator-framework-operator-controller@861cba4 Jian Zhang UPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17 openshift/operator-framework-operator-controller@4f4b107 Per Goncalves da Silva UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot openshift-bot added the lgtm Indicates that a PR is ready to be merged. label Sep 11, 2025
Copy link
Contributor

openshift-ci bot commented Sep 11, 2025

@openshift-bot: GitHub didn't allow me to request PR reviews from the following users: openshift/openshift-team-operator-framework.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

The downstream repository has been updated with the following following upstream commits:

Date Commit Author Message
2025-09-11 14:45:30 operator-framework/operator-controller@3f782fd dependabot[bot] 🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35 operator-framework/operator-controller@6957436 dependabot[bot] 🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38 operator-framework/operator-controller@1821160 dependabot[bot] 🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39 operator-framework/operator-controller@c8dff76 Todd Short Rename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45 operator-framework/operator-controller@46e1163 Todd Short ⚠️ OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31 operator-framework/operator-controller@67098e7 Joe Lanford 🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24 operator-framework/operator-controller@1ffa845 Todd Short Restart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

Date Commit Author Message
2025-09-09 10:45:51 openshift/operator-framework-operator-controller@d4a90c7 dtfranz UPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54 openshift/operator-framework-operator-controller@fd3a2d3 Todd Short UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57 openshift/operator-framework-operator-controller@d0f9efd Todd Short UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00 openshift/operator-framework-operator-controller@af129a0 Catherine Chan-Tse UPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02 openshift/operator-framework-operator-controller@d07b505 Todd Short UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05 openshift/operator-framework-operator-controller@9269c12 Jian Zhang UPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08 openshift/operator-framework-operator-controller@60e4974 Camila Macedo UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11 openshift/operator-framework-operator-controller@c8f61e4 Camila Macedo UPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14 openshift/operator-framework-operator-controller@fb415ce Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17 openshift/operator-framework-operator-controller@38871a8 Todd Short UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19 openshift/operator-framework-operator-controller@abe3ad4 Todd Short UPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22 openshift/operator-framework-operator-controller@541b9a3 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25 openshift/operator-framework-operator-controller@2d5c51d Camila Macedo UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27 openshift/operator-framework-operator-controller@b8adee9 Camila Macedo UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30 openshift/operator-framework-operator-controller@fc94c3e Camila Macedo UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33 openshift/operator-framework-operator-controller@40945ac Camila Macedo UPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36 openshift/operator-framework-operator-controller@a2277ea Camila Macedo UPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38 openshift/operator-framework-operator-controller@920370c Camila Macedo UPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41 openshift/operator-framework-operator-controller@8a9859e Camila Macedo UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44 openshift/operator-framework-operator-controller@4609149 Jian Zhang UPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47 openshift/operator-framework-operator-controller@7631e01 Todd Short UPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50 openshift/operator-framework-operator-controller@f9b9bbf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52 openshift/operator-framework-operator-controller@25c0ed2 Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55 openshift/operator-framework-operator-controller@6762adf Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58 openshift/operator-framework-operator-controller@a2fc1cc Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00 openshift/operator-framework-operator-controller@2fb741c Camila Macedo UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03 openshift/operator-framework-operator-controller@84fd312 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06 openshift/operator-framework-operator-controller@1e2f565 AOS Automation Release Team UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08 openshift/operator-framework-operator-controller@a318e4b Todd Short UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11 openshift/operator-framework-operator-controller@2c92f30 Camila Macedo UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15 openshift/operator-framework-operator-controller@4c09740 Camila Macedo UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20 openshift/operator-framework-operator-controller@594ce33 Todd Short UPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25 openshift/operator-framework-operator-controller@767e2a4 Camila Macedo UPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30 openshift/operator-framework-operator-controller@05e5f34 Todd Short UPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35 openshift/operator-framework-operator-controller@ed4e724 Todd Short UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40 openshift/operator-framework-operator-controller@ddc5201 Camila Macedo UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45 openshift/operator-framework-operator-controller@4175b5a Todd Short UPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47 openshift/operator-framework-operator-controller@cf60db4 Todd Short UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52 openshift/operator-framework-operator-controller@64840b7 Camila Macedo UPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57 openshift/operator-framework-operator-controller@31bd723 Camila Macedo UPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02 openshift/operator-framework-operator-controller@8200935 Camila Macedo UPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07 openshift/operator-framework-operator-controller@f653ef6 Rashmi Gottipati UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13 openshift/operator-framework-operator-controller@c65e51c Ankita Thomas UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18 openshift/operator-framework-operator-controller@161381d Brett Tofel UPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24 openshift/operator-framework-operator-controller@4440699 Camila Macedo UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29 openshift/operator-framework-operator-controller@a0352ea Camila Macedo UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35 openshift/operator-framework-operator-controller@4f76f80 Camila Macedo UPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40 openshift/operator-framework-operator-controller@edc6a6a Camila Macedo UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45 openshift/operator-framework-operator-controller@b197164 Camila Macedo UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50 openshift/operator-framework-operator-controller@c75cf8e Todd Short UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56 openshift/operator-framework-operator-controller@06386d2 Todd Short UPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01 openshift/operator-framework-operator-controller@75dca2a Luke Meyer UPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06 openshift/operator-framework-operator-controller@d0fe31d Camila Macedo UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11 openshift/operator-framework-operator-controller@c574d2f Todd Short UPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16 openshift/operator-framework-operator-controller@4b5fb34 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21 openshift/operator-framework-operator-controller@2139f4c Camila Macedo UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26 openshift/operator-framework-operator-controller@b869beb Camila Macedo UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31 openshift/operator-framework-operator-controller@beb8726 Camila Macedo UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36 openshift/operator-framework-operator-controller@adbfccf Camila Macedo UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41 openshift/operator-framework-operator-controller@e09eade Camila Macedo UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46 openshift/operator-framework-operator-controller@4ce333f grokspawn UPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51 openshift/operator-framework-operator-controller@0553e0f Camila Macedo UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56 openshift/operator-framework-operator-controller@4eb8ab9 Camila Macedo UPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01 openshift/operator-framework-operator-controller@1bbf658 Forrest Babcock UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06 openshift/operator-framework-operator-controller@dac2f1d Camila Macedo UPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11 openshift/operator-framework-operator-controller@b65f351 Todd Short UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54 openshift/operator-framework-operator-controller@861cba4 Jian Zhang UPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17 openshift/operator-framework-operator-controller@4f4b107 Per Goncalves da Silva UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copy link
Contributor

openshift-ci bot commented Sep 11, 2025

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

1 similar comment
Copy link
Contributor

openshift-ci bot commented Sep 11, 2025

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tmshort
Copy link
Contributor

tmshort commented Sep 11, 2025

/test openshift-e2e-aws
/test openshift-e2e-aws-techpreview

tmshort and others added 12 commits September 11, 2025 23:22
…214)

Downstream e2es are failing because the old selectors are still being used.
Signed-off-by: dtfranz <dfranz@redhat.com>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <todd.short@me.com>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <greene.al1991@gmail.com>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <everettraven@gmail.com>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <everettraven@gmail.com>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <dfranz@redhat.com>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <dfranz@redhat.com>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <dfranz@redhat.com>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <everettraven@gmail.com>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <dfranz@redhat.com>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <todd.short@me.com>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.
The root catalogd directory has been removed

Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Catherine Chan-Tse <cchantse@redhat.com>
(cherry picked from commit 9b4a113)
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Jian Zhang <jiazha@redhat.com>
Signed-off-by: Todd Short <todd.short@me.com>
camilamacedo86 and others added 16 commits September 12, 2025 00:09
Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini
… certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
Signed-off-by: grokspawn <jordan@nimblewidget.com>
This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini
This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.
…rator

Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com>
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 12, 2025
Copy link
Contributor

openshift-ci bot commented Sep 12, 2025

New changes are detected. LGTM label has been removed.

@jianzhangbjz
Copy link
Contributor

jianzhangbjz commented Sep 12, 2025

I'm going to test this Restart when SystemCertPool should change (#2175) PR, build OCP cluster via the cluster-bot, as follows,

launch 4.21,openshift/operator-framework-operator-controller#470 aws

However, it failed to create the cluster, see: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/release-openshift-origin-installer-launch-aws-modern/1966319922455777280. The same as ci/prow/images test failure.

{  error occurred handling build olm-catalogd-amd64: the build olm-catalogd-amd64 failed after 10m51s with reason DockerBuildFailed: Dockerfile build strategy has failed.}
{  error occurred handling build olm-operator-controller-amd64: the build olm-operator-controller-amd64 failed after 10m43s with reason DockerBuildFailed: Dockerfile build strategy has failed.}

/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 12, 2025
@grokspawn
Copy link
Contributor

Is this even us? That reads like a podman C language dependency that double-declares a symbol.

@jianzhangbjz
Copy link
Contributor

Retest it since I can build this image successfully in my local now.
/test images

[cloud-user@preserve-olm-env2 operator-framework-operator-controller]$ podman build -t quay.io/olmqe/operator-controller:v1 -f openshift/operator-controller.Dockerfile .
WARN[0000] missing "SOURCE_GIT_COMMIT" build argument. Try adding "--build-arg SOURCE_GIT_COMMIT=<VALUE>" to the command line 
[1/2] STEP 1/6: FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder
Trying to pull registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20...
Getting image source signatures
Copying blob 1e43cdc096de done   | 
Copying blob f0977858ab1b skipped: already exists  
Copying blob 5e09f8650bc2 skipped: already exists  
Copying config 5f1b0cd84d done   | 
Writing manifest to image destination
[1/2] STEP 2/6: ARG SOURCE_GIT_COMMIT
--> 1fd45a2583c9
[1/2] STEP 3/6: ENV GIT_COMMIT=${SOURCE_GIT_COMMIT}
--> 05a3d9560fa7
[1/2] STEP 4/6: WORKDIR /build
--> dc6b440a0233
[1/2] STEP 5/6: COPY . .
--> 222ab83b18ec
[1/2] STEP 6/6: RUN make -f openshift/Makefile go-build-local &&     cd openshift/tests-extension &&        make build &&        mkdir -p /tmp/build &&        cp ./bin/olmv1-tests-ext /tmp/build/olmv1-tests-ext &&        gzip -f /tmp/build/olmv1-tests-ext
make -f Makefile go-build-local
make[1]: Entering directory '/build'
Makefile:71: Could not find docker or podman in path! This may result in targets requiring a container runtime failing!
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \" \"" when the git commit is empty.
go build   -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/operator-controller ./cmd/operator-controller
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \" \"" when the git commit is empty.
go build   -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/catalogd ./cmd/catalogd
make[1]: Leaving directory '/build'
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.CommitFromGit=4f4b107d' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.BuildDate=2025-09-12T07:09:38Z' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.GitTreeState=dirty'" -mod=vendor -o /build/openshift/tests-extension/bin/olmv1-tests-ext ./cmd/...
--> fdcf402cd349
[2/2] STEP 1/8: FROM registry.ci.openshift.org/ocp/4.21:base-rhel9
[2/2] STEP 2/8: USER 1001
--> Using cache 9efcff62cb82a8c5bf285e8942465ec2b3b145a6ec1f61d1c3f14865e0459dc7
--> 9efcff62cb82
[2/2] STEP 3/8: COPY --from=builder /build/bin/operator-controller /operator-controller
--> c424263231fd
[2/2] STEP 4/8: COPY --from=builder /tmp/build/olmv1-tests-ext.gz /usr/bin/olmv1-tests-ext.gz
--> 53483b7312db
[2/2] STEP 5/8: COPY openshift/operator-controller/cp-manifests /cp-manifests
--> 61eccd540174
[2/2] STEP 6/8: COPY openshift/operator-controller/manifests /openshift/manifests
--> 7625d2c22c2c
[2/2] STEP 7/8: COPY openshift/operator-controller/manifests-experimental /openshift/manifests-experimental
--> 9c0220d5bc68
[2/2] STEP 8/8: LABEL io.k8s.display-name="OpenShift Operator Lifecycle Manager Operator Controller"   io.k8s.description="This is a component of OpenShift Container Platform that allows operator installation."
[2/2] COMMIT quay.io/olmqe/operator-controller:v1
--> 738c0d967633
Successfully tagged quay.io/olmqe/operator-controller:v1
738c0d96763352db2458cad82c682382a32bccfbf41fcd3c1577f1f3c0d46c28

@jianzhangbjz
Copy link
Contributor

/retest-required

Copy link
Contributor

openshift-ci bot commented Sep 12, 2025

@openshift-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-images 3690186 link true /test okd-scos-images
ci/prow/e2e-aws-techpreview-olmv1-ext 3690186 link true /test e2e-aws-techpreview-olmv1-ext
ci/prow/okd-scos-e2e-aws-ovn 3690186 link false /test okd-scos-e2e-aws-ovn
ci/prow/openshift-e2e-aws 3690186 link true /test openshift-e2e-aws
ci/prow/openshift-e2e-aws-techpreview 3690186 link false /test openshift-e2e-aws-techpreview
ci/prow/images 3690186 link true /test images

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jianzhangbjz
Copy link
Contributor

Still failing, raise this issue to the DPTP team: https://redhat-internal.slack.com/archives/CBN38N3MW/p1757664135331509

@tmshort
Copy link
Contributor

tmshort commented Sep 12, 2025

This is due to operator-framework/operator-controller#2195.
Building locally works, but building the container fails:

podman build -f openshift/operator-controller.Dockerfile .

Reverting PR2195 resolves the issue.
It appears to be due to a conflict between operator-registry's use of github.com/containers/image/v5 and operator-controller's use of the new go.podman.io/image/v5 that conflict with each other.

@tmshort
Copy link
Contributor

tmshort commented Sep 12, 2025

/close
closing in favor of #471

@openshift-ci openshift-ci bot closed this Sep 12, 2025
Copy link
Contributor

openshift-ci bot commented Sep 12, 2025

@tmshort: Closed this PR.

In response to this:

/close
closing in favor of #471

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. kind/sync tide/merge-method-merge Denotes a PR that should use a standard merge by tide when it merges.
Projects
None yet
Development

Successfully merging this pull request may close these issues.