-
Notifications
You must be signed in to change notification settings - Fork 31
NO-ISSUE: Synchronize From Upstream Repositories #470
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This fixes a downstream bug There was a problem downstream where the OpenShift servivce-ca was not yet available, and due to the way the manifests were set up, the service-ca was considered to be part of the SystemCertPool. The problem is that the SystemCertPool, once initialized, will never reload itself. We can get into this situation when we use SSL_CERT_DIR and SSL_CERT_FILE to provide OpenShift CAs to be used by containers/image for pulling. These environment variables change the source of the SystemCertPool. The CertPoolWatcher then watches these locations, and tries to update the pool it provides to the HTTPS client connecting to catalogd. But the SystemCertPool is never updated. (It did not help that there was no explicit CertPoolWatcher for the pull CAs.) I tried to fix this downstream by removing SSL_CERT_DIR, and specifying the `--pull-cas-dir` option. This means that containers/image would directly use certificates that we specify, rather than the default location. But this breaks the use of custom CAs for local image registries. The containers/image package does not provide a way to manipulate the certificate locations beyond a simple directory setting, and we need to leave that directory setting as the default in downstream because it (i.e. /etc/docker/certs.d) is a host- mounted directory that contains certificates for local image registries. And it is possible to configure a custom CA for a local image registry, so that directory must be included, ALONG with the OpenShift provided CAs and service-ca, which is defined by SSL_CERT_DIR. But because of the use of SSL_CERT_DIR to include the OpenShift service-ca, if the service-ca was not available at startup, but became available later, it was not possible to reload the SystemCertPool. Which could cause problems in operator-controller when it tried to connect to catalogd. The fundamental problem is that there's no way to refresh the SystemCertPool, which will become more and more of an issue as certificate lifetimes decrease. Using SSL_CERT_DIR allows us to use the CertPoolWatcher to notice changes to the SystemCertPool. This will allow us to restart the process when certificates change (e.g. OpenShift service-ca becomes available). Changes: * Update CertPoolWatcher to restart on changes to SSL_CERT_DIR and SSL_CERT_FILE * Update CertPoolWatcher to use a Runnable interface, so that it can be added to the manager, and started later, which may improve the changes that the service-ca is ready. * Update CertPoolWatcher to not be created when there's nothing to watch. * Add CertPoolWatcher to catalogd for pull CAs * Add CertPoolWatcher to operator-controller for pull CAs * Improve logging With this, my downstream manifest change should be reverted. Assisted-by: Claude Code (alternatives) Signed-off-by: Todd Short <tshort@redhat.com>
…ot module (#2202) * retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module * fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module * fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module Signed-off-by: Todd Short <tshort@redhat.com> --------- Signed-off-by: Todd Short <tshort@redhat.com> Co-authored-by: Todd Short <tshort@redhat.com>
* Move to a helm-based configuration This does not remove the kustomize config, but instead puts a helm chart into the repo, that should give very close (but not identical) results. * Adds a new chart: helm/olmv1/ - standard - experimental - openshift - cert-manager - e2e - tilt * Adds "values" files in helm/ * Adds helm executable to .bingo/ * Updates documents int docs/drafts/ * Update tests in tests/ * Update `make manifests` to use helm chart - Update the checked-in manifests - Use a tool like `dyff` to properly diff the manifests * Pull RBAC and WebHook config out of the goland code - controller-tools is not longer used to generate RBAC/Wehbooks - These resources are not part of the helm chart - The CRDs are still generated via kubebuilder Significant changes to the resulting manifests are listed in the RFC. Signed-off-by: Todd Short <tshort@redhat.com> Assisted-by: Gemini (research) Assisted-by: Claude Code (analysis) * Move files into directories Signed-off-by: Todd Short <tshort@redhat.com> Assisted-by: Gemini (research) Assisted-by: Claude Code (analysis) * Add variable settings to Makefile to control Helm charts Signed-off-by: Todd Short <tshort@redhat.com> Assisted-by: Gemini (research) Assisted-by: Claude Code (analysis) * Add prometheus Helm chart This is currently separate due to the ordering of application. If we change the order, this could be included in the main Helm Chart. Signed-off-by: Todd Short <tshort@redhat.com> Assisted-by: Gemini (research) Assisted-by: Claude Code (analysis) * Add lint-helm target and CI Signed-off-by: Todd Short <tshort@redhat.com> Assisted-by: Gemini (research) Assisted-by: Claude Code (analysis) * Add Boxcutter support Signed-off-by: Todd Short <tshort@redhat.com> * Update catalogs to use 4.20 Signed-off-by: Todd Short <tshort@redhat.com> * Remove clusterextension editor role Signed-off-by: Todd Short <tshort@redhat.com> * Remove configmaps from leader election role Signed-off-by: Todd Short <tshort@redhat.com> * Remove stale comment from config manager role Signed-off-by: Todd Short <tshort@redhat.com> * Add templating failure for featureSet Signed-off-by: Todd Short <tshort@redhat.com> --------- Signed-off-by: Todd Short <tshort@redhat.com>
Signed-off-by: Todd Short <tshort@redhat.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pkg.package-operator.run/boxcutter](https://github.com/package-operator/boxcutter) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/package-operator/boxcutter/releases) - [Commits](package-operator/boxcutter@v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: pkg.package-operator.run/boxcutter dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.36.0 to 0.37.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@openshift-bot: This pull request explicitly references no jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
@openshift-bot: GitHub didn't allow me to request PR reviews from the following users: openshift/openshift-team-operator-framework. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: openshift-bot The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 similar comment
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: openshift-bot The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/test openshift-e2e-aws |
…214) Downstream e2es are failing because the old selectors are still being used.
Signed-off-by: dtfranz <dfranz@redhat.com> UPSTREAM: <carry>: Update generate-manifests to handle new directory The `default` directory was renamed `base`. Signed-off-by: Todd Short <todd.short@me.com> The `base` directory was moved to `base\operator-controller`. Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Drop commitchecker Signed-off-by: Alexander Greene <greene.al1991@gmail.com> UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml UPSTREAM: <carry>: update owners * Remove alumni from owners * Add m1kola to approvers Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> UPSTREAM: <carry>: Add pointer to tooling README UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16 Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream * This reverts commit 3f079c4. * Includes Validating Admission Policy manifests Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> UPSTREAM: <carry>: manifests: set required-scc for openshift workloads UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17 Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml UPSTREAM: <carry>: add everettraven to approvers+reviewers Signed-off-by: everettraven <everettraven@gmail.com> UPSTREAM: <carry>: add openshift kustomize overlay to enable TLS communication with catalogd. Configure the CA certs using the configmap injection method via service-ca-operator Signed-off-by: everettraven <everettraven@gmail.com> UPSTREAM: <carry>: Add tmshort to approvers Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18 Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml UPSTREAM: <carry>: Properly copy and call kustomize Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release. Signed-off-by: dtfranz <dfranz@redhat.com> UPSTREAM: <carry>: Add downstream verify makefile target Signed-off-by: dtfranz <dfranz@redhat.com> UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Add global-pull-secret flag Pass global-pull-secret to the manager container. Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> UPSTREAM: <carry>: Update openshift CAs to operator-controller The /run/secrets/kubernetes.io/serviceaccount/ directory is projected into the pod and contains the following CA certificates: * configmap/kube-root-ca.crt as ca.crt * configmap/openshift-service-ca.crt as service-ca.crt Update the --ca-certs-dir argument to reference the directory. Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Add HowTo for origin tests Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Add e2e registry Dockerfile Signed-off-by: dtfranz <dfranz@redhat.com> UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch Signed-off-by: everettraven <everettraven@gmail.com> UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Enable downstream e2e Signed-off-by: dtfranz <dfranz@redhat.com> UPSTREAM: <carry>: Remove m1kola from owners Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com> UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19 Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml UPSTREAM: <carry>: generate and mount service-ca server cert Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Add support for proxy trustedCAs Just map the list of trusted ca certs into the deployment Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Fix error to build the image Copy correct (new) executable name for operator-controller Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Fix make verify for mac os envs Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Move operator-controller openshift files to its own dir UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19 UPSTREAM: <carry>: Add Openshift's catalogd manifests - Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift - Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments This allows for use of the any image.config.openshift.io trusted CAs Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: fixup catalogd.Dockerfile paths Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations" This reverts commit 548caa4. UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations Signed-off-by: Joe Lanford <joe.lanford@gmail.com> UPSTREAM: <carry>: Remove vet from openshift verify The `vet` target was removed upstream. Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Skip another upstream test Signed-off-by: Todd Short <todd.short@me.com> UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests UPSTREAM: <carry>: Enable OCP metrics collection by default Enables OCP to collect Prometheus metrics for both catalogd and operator-controller by default. This is accomplished via ServiceMonitor CRs which are now created for both projects.
The root catalogd directory has been removed Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Catherine Chan-Tse <cchantse@redhat.com> (cherry picked from commit 9b4a113)
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Jian Zhang <jiazha@redhat.com>
Signed-off-by: Todd Short <todd.short@me.com>
This reverts commit a98980b.
…er for clusterextensions
Migrated OLMv1 operator preflight checks from using external YAML files to defining ClusterRole permissions directly in Go structs. This improves test reliability and simplifies test setup by removing file dependencies. The changes ensure precise replication of original test scenarios, including specific permission omissions for services, create verbs, ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs. Assisted-by: Gemini
… certificate rotation This change is a refactor of code from openshift/origin#30059. Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
…ate with new tests
Signed-off-by: grokspawn <jordan@nimblewidget.com>
This commit migrates the olmv1_catalog set of tests from openshift/origin to OTE as part the broad effort to migrate all tests. Assisted-by: Gemini
This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations. Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present. This reverts commit 0bb1953. UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation This reverts commit e9e3220.
This reverts commit 9cc13d8.
…rator Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com>
379c104
to
3690186
Compare
New changes are detected. LGTM label has been removed. |
I'm going to test this launch 4.21,openshift/operator-framework-operator-controller#470 aws However, it failed to create the cluster, see: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/release-openshift-origin-installer-launch-aws-modern/1966319922455777280. The same as ci/prow/images test failure. { error occurred handling build olm-catalogd-amd64: the build olm-catalogd-amd64 failed after 10m51s with reason DockerBuildFailed: Dockerfile build strategy has failed.}
{ error occurred handling build olm-operator-controller-amd64: the build olm-operator-controller-amd64 failed after 10m43s with reason DockerBuildFailed: Dockerfile build strategy has failed.} /hold |
Is this even us? That reads like a podman C language dependency that double-declares a symbol. |
Retest it since I can build this image successfully in my local now. [cloud-user@preserve-olm-env2 operator-framework-operator-controller]$ podman build -t quay.io/olmqe/operator-controller:v1 -f openshift/operator-controller.Dockerfile .
WARN[0000] missing "SOURCE_GIT_COMMIT" build argument. Try adding "--build-arg SOURCE_GIT_COMMIT=<VALUE>" to the command line
[1/2] STEP 1/6: FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder
Trying to pull registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20...
Getting image source signatures
Copying blob 1e43cdc096de done |
Copying blob f0977858ab1b skipped: already exists
Copying blob 5e09f8650bc2 skipped: already exists
Copying config 5f1b0cd84d done |
Writing manifest to image destination
[1/2] STEP 2/6: ARG SOURCE_GIT_COMMIT
--> 1fd45a2583c9
[1/2] STEP 3/6: ENV GIT_COMMIT=${SOURCE_GIT_COMMIT}
--> 05a3d9560fa7
[1/2] STEP 4/6: WORKDIR /build
--> dc6b440a0233
[1/2] STEP 5/6: COPY . .
--> 222ab83b18ec
[1/2] STEP 6/6: RUN make -f openshift/Makefile go-build-local && cd openshift/tests-extension && make build && mkdir -p /tmp/build && cp ./bin/olmv1-tests-ext /tmp/build/olmv1-tests-ext && gzip -f /tmp/build/olmv1-tests-ext
make -f Makefile go-build-local
make[1]: Entering directory '/build'
Makefile:71: Could not find docker or podman in path! This may result in targets requiring a container runtime failing!
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \" \"" when the git commit is empty.
go build -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/operator-controller ./cmd/operator-controller
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \" \"" when the git commit is empty.
go build -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/catalogd ./cmd/catalogd
make[1]: Leaving directory '/build'
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.CommitFromGit=4f4b107d' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.BuildDate=2025-09-12T07:09:38Z' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.GitTreeState=dirty'" -mod=vendor -o /build/openshift/tests-extension/bin/olmv1-tests-ext ./cmd/...
--> fdcf402cd349
[2/2] STEP 1/8: FROM registry.ci.openshift.org/ocp/4.21:base-rhel9
[2/2] STEP 2/8: USER 1001
--> Using cache 9efcff62cb82a8c5bf285e8942465ec2b3b145a6ec1f61d1c3f14865e0459dc7
--> 9efcff62cb82
[2/2] STEP 3/8: COPY --from=builder /build/bin/operator-controller /operator-controller
--> c424263231fd
[2/2] STEP 4/8: COPY --from=builder /tmp/build/olmv1-tests-ext.gz /usr/bin/olmv1-tests-ext.gz
--> 53483b7312db
[2/2] STEP 5/8: COPY openshift/operator-controller/cp-manifests /cp-manifests
--> 61eccd540174
[2/2] STEP 6/8: COPY openshift/operator-controller/manifests /openshift/manifests
--> 7625d2c22c2c
[2/2] STEP 7/8: COPY openshift/operator-controller/manifests-experimental /openshift/manifests-experimental
--> 9c0220d5bc68
[2/2] STEP 8/8: LABEL io.k8s.display-name="OpenShift Operator Lifecycle Manager Operator Controller" io.k8s.description="This is a component of OpenShift Container Platform that allows operator installation."
[2/2] COMMIT quay.io/olmqe/operator-controller:v1
--> 738c0d967633
Successfully tagged quay.io/olmqe/operator-controller:v1
738c0d96763352db2458cad82c682382a32bccfbf41fcd3c1577f1f3c0d46c28 |
/retest-required |
@openshift-bot: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Still failing, raise this issue to the DPTP team: https://redhat-internal.slack.com/archives/CBN38N3MW/p1757664135331509 |
This is due to operator-framework/operator-controller#2195.
Reverting PR2195 resolves the issue. |
/close |
@tmshort: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
The downstream repository has been updated with the following following upstream commits:
The
vendor/
directory has been updated and the following commits were carried:This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.
/cc @openshift/openshift-team-operator-framework