Skip to content

Conversation

@camilamacedo86
Copy link
Contributor

@camilamacedo86 camilamacedo86 commented Jun 13, 2025

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
$ make build
# GO_COMPLIANCE_POLICY="exempt_all" must only be used for test related binaries.
# It prevents various FIPS compliance policies from being applied to this compilation.
# Do not set globally.
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.CommitFromGit=d02df2ca' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.BuildDate=2025-07-01T16:42:33Z' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.GitTreeState=dirty'" -o /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/bin/operator-controller-tests-ext ./cmd/...
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata
$ ./bin/olmv1-tests-ext info
{
    "apiVersion": "v1.1",
    "source": {
        "commit": "a43dca9a",
        "build_date": "2025-07-04T13:15:48Z",
        "git_tree_state": "clean"
    },
    "component": {
        "product": "openshift",
        "type": "payload",
        "name": "olmv1"
    },
    "suites": [
        {
            "name": "olmv1/parallel",
            "description": "",
            "parents": [
                "openshift/conformance/parallel"
            ],
            "qualifiers": [
                "(source == \"openshift:payload:olmv1\") \u0026\u0026 (!(name.contains(\"[Serial]\") || name.contains(\"[Slow]\")))"
            ]
        },
        {
            "name": "olmv1/serial",
            "description": "",
            "parents": [
                "openshift/conformance/serial"
            ],
            "qualifiers": [
                "(source == \"openshift:payload:olmv1\") \u0026\u0026 (name.contains(\"[Serial]\"))"
            ]
        },
        {
            "name": "olmv1/slow",
            "description": "",
            "parents": [
                "openshift/optional/slow"
            ],
            "qualifiers": [
                "(source == \"openshift:payload:olmv1\") \u0026\u0026 (name.contains(\"[Slow]\"))"
            ]
        },
        {
            "name": "olmv1/all",
            "description": "",
            "parents": [
                "openshift/conformance/serial"
            ]
        }
    ],
    "images": null
}

  • Confirm list outputs tests properly filtered by environment
$ ./bin/operator-controller-tests-ext list
[
  {
    "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
    "labels": {},
    "resources": {
      "isolation": {}
    },
    "source": "olm:payload:olmv1-tests-extension",
    "codeLocations": [
      "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:12",
      "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13"
    ],
    "lifecycle": "blocking",
    "environmentSelector": {}
  }
]

  • Confirm run-test produces valid JSONL test results
  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
 $ ./bin/olmv1-tests-ext run-suite olmv1/all
  Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
  ===============================================================================================================
  Random Seed: 1751635012 - will randomize all specs

  Will run 1 of 1 specs
  ------------------------------
  [sig-olmv1] OLMv1 should pass a trivial sanity check
  /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
  • [0.000 seconds]
  ------------------------------

  Ran 1 of 1 Specs in 0.000 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-olmv1] OLMv1 should pass a trivial sanity check",
    "lifecycle": "blocking",
    "duration": 0,
    "startTime": "2025-07-04 13:16:52.960749 UTC",
    "endTime": "2025-07-04 13:16:52.961643 UTC",
    "result": "passed",
    "output": ""
  }
]

./my-component-tests run-test -n

$ ./bin/olmv1-tests-ext run-test -n "[sig-olmv1] OLMv1 should pass a trivial sanity check"
  Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
  ===============================================================================================================
  Random Seed: 1751635078 - will randomize all specs

  Will run 1 of 1 specs
  ------------------------------
  [sig-olmv1] OLMv1 should pass a trivial sanity check
  /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
  • [0.000 seconds]
  ------------------------------

  Ran 1 of 1 Specs in 0.000 seconds
  SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
  {
    "name": "[sig-olmv1] OLMv1 should pass a trivial sanity check",
    "lifecycle": "blocking",
    "duration": 0,
    "startTime": "2025-07-04 13:17:58.677690 UTC",
    "endTime": "2025-07-04 13:17:58.678274 UTC",
    "result": "passed",
    "output": ""
  }
]

Blocks

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 13, 2025
@camilamacedo86 camilamacedo86 changed the title WIP Add OTE for origin tests WIP OPRUN-3962: Add OTE for origin tests Jun 13, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 13, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Jun 13, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@camilamacedo86 camilamacedo86 force-pushed the extended-tests-bin branch 2 times, most recently from 5893e18 to 039e348 Compare June 30, 2025 19:09
@camilamacedo86 camilamacedo86 changed the title WIP OPRUN-3962: Add OTE for origin tests OPRUN-3962: Add OTE for origin tests Jun 30, 2025
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 30, 2025
@camilamacedo86 camilamacedo86 changed the title OPRUN-3962: Add OTE for origin tests OPRUN-3962: Add structure to allow move the orgin tests using OTE Jun 30, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Jun 30, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata

  • Confirm list outputs tests properly filtered by environment

  • Confirm run-test produces valid JSONL test results

  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
    ./my-component-tests run-test -n

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jun 30, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata

  • Confirm list outputs tests properly filtered by environment

  • Confirm run-test produces valid JSONL test results

  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
    ./my-component-tests run-test -n

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jun 30, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
$ make build
# GO_COMPLIANCE_POLICY="exempt_all" must only be used for test related binaries.
# It prevents various FIPS compliance policies from being applied to this compilation.
# Do not set globally.
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.CommitFromGit=039e348a' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.BuildDate=2025-06-30T19:15:25Z' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.GitTreeState=clean'" -o /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/bin/tests-extension ./cmd/...
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata
$ ./bin/tests-extension  info
{
   "apiVersion": "v1.1",
   "source": {
       "commit": "",
       "build_date": "",
       "git_tree_state": ""
   },
   "component": {
       "product": "operator-framework",
       "type": "payload",
       "name": "olmv1-tests-extension"
   },
   "suites": [
       {
           "name": "olmv1/tests",
           "description": "",
           "parents": [
               "openshift/conformance/parallel"
           ]
       }
   ],
   "images": null
}
  • Confirm list outputs tests properly filtered by environment
$ ./bin/tests-extension list
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "labels": {},
   "resources": {
     "isolation": {}
   },
   "source": "operator-framework:payload:olmv1-tests-extension",
   "codeLocations": [
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:12",
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13"
   ],
   "lifecycle": "blocking",
   "environmentSelector": {}
 }
]
  • Confirm run-test produces valid JSONL test results

  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite

$ ./bin/tests-extension  run-suite olmv1/tests
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751311042 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.001 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 1,
   "startTime": "2025-06-30 19:17:22.643924 UTC",
   "endTime": "2025-06-30 19:17:22.644987 UTC",
   "result": "passed",
   "output": ""
 }
]

./my-component-tests run-test -n

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jun 30, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
$ make build
# GO_COMPLIANCE_POLICY="exempt_all" must only be used for test related binaries.
# It prevents various FIPS compliance policies from being applied to this compilation.
# Do not set globally.
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.CommitFromGit=039e348a' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.BuildDate=2025-06-30T19:15:25Z' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.GitTreeState=clean'" -o /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/bin/tests-extension ./cmd/...
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata
$ ./bin/tests-extension  info
{
   "apiVersion": "v1.1",
   "source": {
       "commit": "",
       "build_date": "",
       "git_tree_state": ""
   },
   "component": {
       "product": "operator-framework",
       "type": "payload",
       "name": "olmv1-tests-extension"
   },
   "suites": [
       {
           "name": "olmv1/tests",
           "description": "",
           "parents": [
               "openshift/conformance/parallel"
           ]
       }
   ],
   "images": null
}
  • Confirm list outputs tests properly filtered by environment
$ ./bin/tests-extension list
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "labels": {},
   "resources": {
     "isolation": {}
   },
   "source": "operator-framework:payload:olmv1-tests-extension",
   "codeLocations": [
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:12",
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13"
   ],
   "lifecycle": "blocking",
   "environmentSelector": {}
 }
]
  • Confirm run-test produces valid JSONL test results
  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
$ ./bin/tests-extension  run-suite olmv1/tests
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751311042 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.001 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 1,
   "startTime": "2025-06-30 19:17:22.643924 UTC",
   "endTime": "2025-06-30 19:17:22.644987 UTC",
   "result": "passed",
   "output": ""
 }
]

./my-component-tests run-test -n

$ ./bin/tests-extension run-test -n "[sig-operator] OLMv1 should pass a trivial sanity check"
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751311251 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.000 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 0,
   "startTime": "2025-06-30 19:20:51.745159 UTC",
   "endTime": "2025-06-30 19:20:51.745651 UTC",
   "result": "passed",
   "output": ""
 }
]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@camilamacedo86 camilamacedo86 force-pushed the extended-tests-bin branch 2 times, most recently from 8bf2366 to c7c197d Compare June 30, 2025 19:35
@kuiwang02
Copy link
Contributor

@camilamacedo86 thanks. I will review it.

@kuiwang02
Copy link
Contributor

I will finish review tomorrow because I need to take more time review it.
please keep the PR unchanged, thanks

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jul 1, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
$ make build
# GO_COMPLIANCE_POLICY="exempt_all" must only be used for test related binaries.
# It prevents various FIPS compliance policies from being applied to this compilation.
# Do not set globally.
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.CommitFromGit=d02df2ca' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.BuildDate=2025-07-01T16:42:33Z' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.GitTreeState=dirty'" -o /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/bin/operator-controller-tests-ext ./cmd/...
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata
$ ./bin/operator-controller-tests-ext info
{
   "apiVersion": "v1.1",
   "source": {
       "commit": "",
       "build_date": "",
       "git_tree_state": ""
   },
   "component": {
       "product": "olm",
       "type": "payload",
       "name": "olmv1-tests-extension"
   },
   "suites": [
       {
           "name": "olmv1/tests",
           "description": "",
           "parents": [
               "openshift/conformance/parallel"
           ]
       }
   ],
   "images": null
}

  • Confirm list outputs tests properly filtered by environment
$ ./bin/operator-controller-tests-ext list
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "labels": {},
   "resources": {
     "isolation": {}
   },
   "source": "olm:payload:olmv1-tests-extension",
   "codeLocations": [
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:12",
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13"
   ],
   "lifecycle": "blocking",
   "environmentSelector": {}
 }
]

  • Confirm run-test produces valid JSONL test results
  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
./bin/operator-controller-tests-ext run-suite olmv1/tests
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751388026 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.000 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 0,
   "startTime": "2025-07-01 16:40:26.670869 UTC",
   "endTime": "2025-07-01 16:40:26.671756 UTC",
   "result": "passed",
   "output": ""
 }
]

./my-component-tests run-test -n

$ ./bin/operator-controller-tests-ext run-test -n "[sig-operator] OLMv1 should pass a trivial sanity check" 
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751388091 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.000 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 0,
   "startTime": "2025-07-01 16:41:31.679220 UTC",
   "endTime": "2025-07-01 16:41:31.679747 UTC",
   "result": "passed",
   "output": ""
 }
]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@camilamacedo86 camilamacedo86 force-pushed the extended-tests-bin branch 2 times, most recently from f8cf6f6 to bd7b074 Compare July 1, 2025 16:51
@camilamacedo86
Copy link
Contributor Author

Hi @kuiwang02

@camilamacedo86 thanks. I will review it.
I will finish review tomorrow because I need to take more time review it.
please keep the PR unchanged, thanks

Thank you for checking the PR! 😊

I needed to change it because now we can use Go 1.24. So, I rebased it and also renamed the bin to match the others — like in this example: https://github.com/openshift/origin/pull/29949/files.

Please note: this PR only adds the bin. There are no tests.
To try it, just pull the PR and run make build — that will give you the bin locally.
(You can also check the PR description.)

I didn’t understand the concern, since we are not using OCP, mocks, or special test cases here.
I just wanted to let you know, so you can fetch it again if needed.

Thanks a lot for your help and understanding! 🙏

@openshift-ci-robot
Copy link

openshift-ci-robot commented Jul 1, 2025

@camilamacedo86: This pull request references OPRUN-3962 which is a valid jira issue.

In response to this:

Description

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

Checklist from https://docs.google.com/document/d/1cFZj9QdzW8hbHc3H0Nce-2xrJMtpDJrwAse9H7hLiWk/edit?tab=t.0

  • Setup project with Dockerfile for CI
  • Initialize the extension
  • Build the binary (make build)
$ make build
# GO_COMPLIANCE_POLICY="exempt_all" must only be used for test related binaries.
# It prevents various FIPS compliance policies from being applied to this compilation.
# Do not set globally.
GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.CommitFromGit=d02df2ca' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.BuildDate=2025-07-01T16:42:33Z' -X 'github/operator-framework-operator-controller/openshift/extended-tests/pkg/version.GitTreeState=dirty'" -o /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/bin/operator-controller-tests-ext ./cmd/...
  • Test locally (following bellow)

Local Tests

  • Confirm info outputs correct API version, metadata
$ ./bin/operator-controller-tests-ext info
{
   "apiVersion": "v1.1",
   "source": {
       "commit": "",
       "build_date": "",
       "git_tree_state": ""
   },
   "component": {
       "product": "olm",
       "type": "payload",
       "name": "olmv1-tests-extension"
   },
   "suites": [
       {
           "name": "olmv1/tests",
           "description": "",
           "parents": [
               "openshift/conformance/parallel"
           ]
       }
   ],
   "images": null
}

  • Confirm list outputs tests properly filtered by environment
$ ./bin/operator-controller-tests-ext list
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "labels": {},
   "resources": {
     "isolation": {}
   },
   "source": "olm:payload:olmv1-tests-extension",
   "codeLocations": [
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:12",
     "/Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13"
   ],
   "lifecycle": "blocking",
   "environmentSelector": {}
 }
]

  • Confirm run-test produces valid JSONL test results
  • Confirm you can run suites and tests locally:
    ./my-component-tests run-suite
./bin/operator-controller-tests-ext run-suite olmv1/tests
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751388026 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.000 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 0,
   "startTime": "2025-07-01 16:40:26.670869 UTC",
   "endTime": "2025-07-01 16:40:26.671756 UTC",
   "result": "passed",
   "output": ""
 }
]

./my-component-tests run-test -n

$ ./bin/operator-controller-tests-ext run-test -n "[sig-operator] OLMv1 should pass a trivial sanity check" 
 Running Suite:  - /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension
 ===============================================================================================================
 Random Seed: 1751388091 - will randomize all specs

 Will run 1 of 1 specs
 ------------------------------
 [sig-operator] OLMv1 should pass a trivial sanity check
 /Users/camilam/go/src/github/operator-framework-operator-controller/openshift/tests-extension/test/olmv1.go:13
 • [0.000 seconds]
 ------------------------------

 Ran 1 of 1 Specs in 0.000 seconds
 SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 0 Skipped
[
 {
   "name": "[sig-operator] OLMv1 should pass a trivial sanity check",
   "lifecycle": "blocking",
   "duration": 0,
   "startTime": "2025-07-01 16:41:31.679220 UTC",
   "endTime": "2025-07-01 16:41:31.679747 UTC",
   "result": "passed",
   "output": ""
 }
]

Blocks

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link
Contributor

@anik120 anik120 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to check in the tests/extension/vendor folder? I understand that we are checking in the top level vendor folder for this repo, but that's probably because of some downstream-ing process quirks.

It'll be cleaner to have the vendor folder git ignored, and then the Make recipes to include go mod vendor before building the binary, if possible

openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 4, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
tmshort pushed a commit to tmshort/operator-framework-operator-controller that referenced this pull request Oct 6, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 6, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 7, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 8, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 9, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 9, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 9, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 10, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 10, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 10, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case
tmshort pushed a commit to tmshort/operator-framework-operator-controller that referenced this pull request Oct 13, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 14, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 16, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 20, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 22, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 22, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 23, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 23, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 24, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 24, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 24, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 24, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 28, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 29, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 30, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Oct 31, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Nov 1, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
openshift-bot pushed a commit to openshift-bot/operator-framework-operator-controller that referenced this pull request Nov 4, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
tmshort pushed a commit to tmshort/operator-framework-operator-controller that referenced this pull request Nov 5, 2025
Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants