Uh oh!
There was an error while loading. Please reload this page.
HYPERFLEET-1412 - feat: Support disconnected installs#19
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| # Source of truth for the images deployable by the bundle CSV. | ||
Contributor There was a problem hiding this comment. Collaborator There was a problem hiding this comment. No this is not true, I left the api and operator image as latest, because they get updated in the konflux dockerfile There were 3 scenarios I was thinking of:
I don't think having another source of truth is a great idea. Collaborator There was a problem hiding this comment. the bundle.Dockerfile gets autogenerated each time a user runs | ||
| images: | ||
| - name: hyperfleet-operator | ||
| image: quay.io/redhat-user-workloads/hyperfleet-tenant/hyperfleet/hyperfleet-operator@sha256:31e365d312b6f3d483913d4029eba565abd64ab38a6d117658324afe225f708d | ||
| - name: hyperfleet-api | ||
| image: quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet/hyperfleet-api@sha256:8533d0d875480f31f5112e454659a095a5d2e993c139a9045a06be6b67b829ca | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| # Disconnected mirroring with oc-mirror v2 | ||
| This is the minimal disk-to-registry procedure for the HyperFleet Operator. | ||
| Use a released bundle, operator image, and API image identified by immutable | ||
| `@sha256:<64 lowercase hex characters>` pullspecs. | ||
| ## Prerequisites | ||
| * `oc-mirror` v2 on the connected and disconnected hosts | ||
| * read access to the source registries | ||
| * write access to the disconnected registry | ||
| * transfer media with enough space for the archive | ||
| * an auth file and registry trust configured on both hosts | ||
| Do not put credentials in the configuration file: | ||
| ```bash | ||
| export REGISTRY_AUTH_FILE=$HOME/.config/containers/auth.json | ||
| ``` | ||
| ## 1. Create one ImageSetConfiguration | ||
Collaborator There was a problem hiding this comment. For mirroring, I would assume we want to mirror the catalog and operator within it, not specific images? That was my assumption | ||
| Set up the mirror workspace and copy [`docs/examples/imageset-config-standalone.yaml`](examples/imageset-config-standalone.yaml): | ||
| ```bash | ||
| export MIRROR_ROOT="$HOME/hyperfleet-mirror" | ||
| rm -rf "$MIRROR_ROOT" | ||
| mkdir -p "$MIRROR_ROOT" | ||
| cp docs/examples/imageset-config-standalone.yaml "$MIRROR_ROOT/imageset-config.yaml" | ||
| ``` | ||
| Edit `$MIRROR_ROOT/imageset-config.yaml` to replace its three example pullspecs | ||
| with the released bundle, operator, and API image digests. The file uses | ||
| `additionalImages` intentionally: it transfers exactly the three listed | ||
| artifacts and does not discover a catalog or CSV. | ||
| Run the image check before mirroring: | ||
| ```bash | ||
| make verify-related-images | ||
| ``` | ||
| It verifies this equality: | ||
| ```text | ||
| deployable-images.yaml == CSV manager image + RELATED_IMAGE_* values == CSV spec.relatedImages | ||
| ``` | ||
| ## 2. Mirror to disk on the connected host | ||
| ```bash | ||
| oc-mirror --v2 \ | ||
| --config "$MIRROR_ROOT/imageset-config.yaml" \ | ||
| file://"$MIRROR_ROOT/archive" | ||
| ``` | ||
| Keep the complete `archive` directory. Transfer it and the configuration to the | ||
| disconnected mirroring host using approved media: | ||
| ```bash | ||
| tar -C "$MIRROR_ROOT" \ | ||
| -czf /media/transfer/hyperfleet-mirror.tgz \ | ||
| archive imageset-config.yaml | ||
| mkdir -p /var/tmp/hyperfleet-mirror | ||
| tar -C /var/tmp/hyperfleet-mirror \ | ||
| -xzf /media/transfer/hyperfleet-mirror.tgz | ||
| ``` | ||
| ## 3. Mirror from disk into the disconnected registry | ||
| ```bash | ||
| export DESTINATION='mirror.example.com:8443/hyperfleet' | ||
| oc-mirror --v2 \ | ||
| --config /var/tmp/hyperfleet-mirror/imageset-config.yaml \ | ||
| --from file:///var/tmp/hyperfleet-mirror/archive \ | ||
| docker://"$DESTINATION" | ||
| ``` | ||
| Save the command output. Apply any generated mirror resources to the cluster | ||
| before installing the bundle, for example: | ||
| ```bash | ||
| CLUSTER_RESOURCES="$(find /var/tmp/hyperfleet-mirror \ | ||
| -type d -path '*/working-dir/cluster-resources' | head -1)" | ||
| oc apply -f "$CLUSTER_RESOURCES" | ||
| ``` | ||
| Use the mirrored bundle with the normal installation procedure. The | ||
| `additionalImages` configuration does not create a catalog. Do not manually | ||
| rewrite image digests. | ||
| ## Acceptance evidence | ||
| Exercise the connected disk export and disconnected import procedure once on an | ||
| isolated OpenShift cluster. Record the command output in the PR Test Plan, | ||
| including the cluster and OpenShift version, destination registry, mirrored | ||
| bundle digest, successful CSV/operator/API readiness, and runtime image IDs | ||
| ending in the expected digests. Do not include credentials or Secret values. | ||
| For a repeatable local transfer check, use the containerized oc-mirror runner: | ||
| ```bash | ||
| BUNDLE_IMAGE='quay.io/.../hyperfleet-operator-bundle@sha256:<bundle-digest>' \ | ||
| make test-disconnected-mirror | ||
| ``` | ||
| The runner is built from [`hack/oc-mirror.Dockerfile`](../hack/oc-mirror.Dockerfile) | ||
| and deliberately keeps oc-mirror in a container. This check exercises archive | ||
| transfer only; it is not a cluster installation framework. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # Standalone registry+v1 fallback. Replace every example with an authenticated | ||
| # released pullspec. additionalImages copies exactly these artifacts; it does | ||
| # not discover bundle relatedImages and does not create an OLM catalog. | ||
| apiVersion: mirror.openshift.io/v2alpha1 | ||
| kind: ImageSetConfiguration | ||
| mirror: | ||
| additionalImages: | ||
| - name: registry.example.com/hyperfleet/hyperfleet-operator-bundle@sha256:0000000000000000000000000000000000000000000000000000000000000000 | ||
| - name: registry.example.com/hyperfleet/hyperfleet-operator@sha256:0000000000000000000000000000000000000000000000000000000000000000 | ||
| - name: registry.example.com/hyperfleet/hyperfleet-api@sha256:0000000000000000000000000000000000000000000000000000000000000000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| CSV_FILE="${CSV_FILE:-bundle/manifests/hyperfleet-operator.clusterserviceversion.yaml}" | ||
| image="${HYPERFLEET_OPERATOR_IMAGE_PULLSPEC:-}" | ||
| allow_tag=false | ||
| case "${1:-}" in | ||
| "") ;; | ||
| --allow-tag) | ||
| allow_tag=true | ||
| ;; | ||
| *) | ||
| echo "usage: $0 [--allow-tag]" >&2 | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| if [[ "$image" =~ ^[^[:space:]]+@sha256:[0-9a-f]{64}$ ]]; then | ||
| : | ||
| elif [[ "$allow_tag" == true && "$image" =~ ^[^[:space:]@]+:[^[:space:]@/]+$ ]]; then | ||
| : | ||
| else | ||
| if [[ "$allow_tag" == true ]]; then | ||
| echo "error: HYPERFLEET_OPERATOR_IMAGE_PULLSPEC must be a sha256 digest pullspec or tagged pullspec" >&2 | ||
| else | ||
| echo "error: HYPERFLEET_OPERATOR_IMAGE_PULLSPEC must be a sha256 digest pullspec" >&2 | ||
| fi | ||
| exit 1 | ||
| fi | ||
| [[ -f "$CSV_FILE" ]] || { echo "error: CSV not found: $CSV_FILE" >&2; exit 1; } | ||
| # operator-sdk derives operand relatedImages from RELATED_IMAGE_* variables but | ||
| # does not include the manager image itself. Insert that one generated entry | ||
| # without reserializing the whole generated CSV. | ||
| if grep -q '^[[:space:]]*name: hyperfleet-operator$' "$CSV_FILE"; then | ||
| echo "error: CSV already contains a hyperfleet-operator relatedImages entry" >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ "$(grep -c '^ relatedImages:$' "$CSV_FILE")" -ne 1 ]]; then | ||
| echo "error: expected exactly one spec.relatedImages block in $CSV_FILE" >&2 | ||
| exit 1 | ||
| fi | ||
| tmp="$(mktemp "${CSV_FILE}.XXXXXX")" | ||
| trap 'rm -f "$tmp"' EXIT | ||
| awk -v image="$image" ' | ||
| /^ relatedImages:$/ { | ||
| print " - image: " image | ||
| print " name: hyperfleet-operator" | ||
| next | ||
| } | ||
| { print } | ||
| ' "$CSV_FILE" >"$tmp" | ||
| mv "$tmp" "$CSV_FILE" | ||
| trap - EXIT |
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-operator
Length of output: 13716
Injection (CWE-78): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploitability: Moderate
Quote and validate Make variables before shell execution.
CONTAINER_TOOLandOC_MIRROR_IMAGEcan be overridden through Make or the environment. Quote their expansions at lines 146 and 150, and validateCONTAINER_TOOLagainst an allowlist. Otherwise, shell metacharacters can execute commands. This is CWE-78.🤖 Prompt for AI Agents
Source: Path instructions