Skip to content

NO-ISSUE: Synchronize From Upstream Repositories - #470

Closed
openshift-bot wants to merge 81 commits into
openshift:mainfrom
openshift-bot:synchronize-upstream
Closed

NO-ISSUE: Synchronize From Upstream Repositories#470
openshift-bot wants to merge 81 commits into
openshift:mainfrom
openshift-bot:synchronize-upstream

Conversation

@openshift-bot

@openshift-botopenshift-bot commented Sep 11, 2025

Copy link
Copy Markdown

The downstream repository has been updated with the following following upstream commits:

DateCommitAuthorMessage
2025-09-11 23:22:05operator-framework/operator-controller@6e22e2bTodd ShortUse old and new pod selectors during kustomize-to-helm transition (#2214)
2025-09-11 17:19:53operator-framework/operator-controller@febdb59Anikmigrate containers libs to new mono-repo (#2195)
2025-09-11 14:45:30operator-framework/operator-controller@3f782fddependabot[bot]🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35operator-framework/operator-controller@6957436dependabot[bot]🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38operator-framework/operator-controller@1821160dependabot[bot]🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39operator-framework/operator-controller@c8dff76Todd ShortRename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45operator-framework/operator-controller@46e1163Todd Short⚠️OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31operator-framework/operator-controller@67098e7Joe Lanford🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24operator-framework/operator-controller@1ffa845Todd ShortRestart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

DateCommitAuthorMessage
2025-09-09 10:45:51openshift/operator-framework-operator-controller@d4a90c7dtfranzUPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54openshift/operator-framework-operator-controller@fd3a2d3Todd ShortUPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57openshift/operator-framework-operator-controller@d0f9efdTodd ShortUPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00openshift/operator-framework-operator-controller@af129a0Catherine Chan-TseUPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02openshift/operator-framework-operator-controller@d07b505Todd ShortUPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05openshift/operator-framework-operator-controller@9269c12Jian ZhangUPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08openshift/operator-framework-operator-controller@60e4974Camila MacedoUPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11openshift/operator-framework-operator-controller@c8f61e4Camila MacedoUPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14openshift/operator-framework-operator-controller@fb415ceTodd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17openshift/operator-framework-operator-controller@38871a8Todd ShortUPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19openshift/operator-framework-operator-controller@abe3ad4Todd ShortUPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22openshift/operator-framework-operator-controller@541b9a3Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25openshift/operator-framework-operator-controller@2d5c51dCamila MacedoUPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27openshift/operator-framework-operator-controller@b8adee9Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30openshift/operator-framework-operator-controller@fc94c3eCamila MacedoUPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33openshift/operator-framework-operator-controller@40945acCamila MacedoUPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36openshift/operator-framework-operator-controller@a2277eaCamila MacedoUPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38openshift/operator-framework-operator-controller@920370cCamila MacedoUPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41openshift/operator-framework-operator-controller@8a9859eCamila MacedoUPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44openshift/operator-framework-operator-controller@4609149Jian ZhangUPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47openshift/operator-framework-operator-controller@7631e01Todd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50openshift/operator-framework-operator-controller@f9b9bbfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52openshift/operator-framework-operator-controller@25c0ed2Camila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55openshift/operator-framework-operator-controller@6762adfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58openshift/operator-framework-operator-controller@a2fc1ccCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00openshift/operator-framework-operator-controller@2fb741cCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03openshift/operator-framework-operator-controller@84fd312AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06openshift/operator-framework-operator-controller@1e2f565AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08openshift/operator-framework-operator-controller@a318e4bTodd ShortUPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11openshift/operator-framework-operator-controller@2c92f30Camila MacedoUPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15openshift/operator-framework-operator-controller@4c09740Camila MacedoUPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20openshift/operator-framework-operator-controller@594ce33Todd ShortUPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25openshift/operator-framework-operator-controller@767e2a4Camila MacedoUPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30openshift/operator-framework-operator-controller@05e5f34Todd ShortUPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35openshift/operator-framework-operator-controller@ed4e724Todd ShortUPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40openshift/operator-framework-operator-controller@ddc5201Camila MacedoUPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45openshift/operator-framework-operator-controller@4175b5aTodd ShortUPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47openshift/operator-framework-operator-controller@cf60db4Todd ShortUPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52openshift/operator-framework-operator-controller@64840b7Camila MacedoUPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57openshift/operator-framework-operator-controller@31bd723Camila MacedoUPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02openshift/operator-framework-operator-controller@8200935Camila MacedoUPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07openshift/operator-framework-operator-controller@f653ef6Rashmi GottipatiUPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13openshift/operator-framework-operator-controller@c65e51cAnkita ThomasUPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18openshift/operator-framework-operator-controller@161381dBrett TofelUPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24openshift/operator-framework-operator-controller@4440699Camila MacedoUPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29openshift/operator-framework-operator-controller@a0352eaCamila MacedoUPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35openshift/operator-framework-operator-controller@4f76f80Camila MacedoUPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40openshift/operator-framework-operator-controller@edc6a6aCamila MacedoUPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45openshift/operator-framework-operator-controller@b197164Camila MacedoUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50openshift/operator-framework-operator-controller@c75cf8eTodd ShortUPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56openshift/operator-framework-operator-controller@06386d2Todd ShortUPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01openshift/operator-framework-operator-controller@75dca2aLuke MeyerUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06openshift/operator-framework-operator-controller@d0fe31dCamila MacedoUPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11openshift/operator-framework-operator-controller@c574d2fTodd ShortUPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16openshift/operator-framework-operator-controller@4b5fb34Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21openshift/operator-framework-operator-controller@2139f4cCamila MacedoUPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26openshift/operator-framework-operator-controller@b869bebCamila MacedoUPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31openshift/operator-framework-operator-controller@beb8726Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36openshift/operator-framework-operator-controller@adbfccfCamila MacedoUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41openshift/operator-framework-operator-controller@e09eadeCamila MacedoUPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46openshift/operator-framework-operator-controller@4ce333fgrokspawnUPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51openshift/operator-framework-operator-controller@0553e0fCamila MacedoUPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56openshift/operator-framework-operator-controller@4eb8ab9Camila MacedoUPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01openshift/operator-framework-operator-controller@1bbf658Forrest BabcockUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06openshift/operator-framework-operator-controller@dac2f1dCamila MacedoUPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11openshift/operator-framework-operator-controller@b65f351Todd ShortUPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54openshift/operator-framework-operator-controller@861cba4Jian ZhangUPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17openshift/operator-framework-operator-controller@4f4b107Per Goncalves da SilvaUPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

tmshortand others added 8 commits September 9, 2025 18:47
This fixes a downstream bug
There was a problem downstream where the OpenShift servivce-ca was not yet available,
and due to the way the manifests were set up, the service-ca was considered to be
part of the SystemCertPool. The problem is that the SystemCertPool, once initialized,
will never reload itself.
We can get into this situation when we use SSL_CERT_DIR and SSL_CERT_FILE to provide
OpenShift CAs to be used by containers/image for pulling. These environment variables
change the source of the SystemCertPool. The CertPoolWatcher then watches these
locations, and tries to update the pool it provides to the HTTPS client connecting to
catalogd. But the SystemCertPool is never updated. (It did not help that there was
no explicit CertPoolWatcher for the pull CAs.)
I tried to fix this downstream by removing SSL_CERT_DIR, and specifying the
`--pull-cas-dir` option. This means that containers/image would directly use
certificates that we specify, rather than the default location.
But this breaks the use of custom CAs for local image registries.
The containers/image package does not provide a way to manipulate the certificate
locations beyond a simple directory setting, and we need to leave that directory
setting as the default in downstream because it (i.e. /etc/docker/certs.d) is a host-
mounted directory that contains certificates for local image registries. And it is
possible to configure a custom CA for a local image registry, so that directory
must be included, ALONG with the OpenShift provided CAs and service-ca, which is
defined by SSL_CERT_DIR.
But because of the use of SSL_CERT_DIR to include the OpenShift service-ca, if the
service-ca was not available at startup, but became available later, it was not
possible to reload the SystemCertPool. Which could cause problems in operator-controller
when it tried to connect to catalogd.
The fundamental problem is that there's no way to refresh the SystemCertPool,
which will become more and more of an issue as certificate lifetimes decrease.
Using SSL_CERT_DIR allows us to use the CertPoolWatcher to notice changes to the
SystemCertPool. This will allow us to restart the process when certificates
change (e.g. OpenShift service-ca becomes available).
Changes:
* Update CertPoolWatcher to restart on changes to SSL_CERT_DIR and SSL_CERT_FILE
* Update CertPoolWatcher to use a Runnable interface, so that it can be added to
the manager, and started later, which may improve the changes that the service-ca
is ready.
* Update CertPoolWatcher to not be created when there's nothing to watch.
* Add CertPoolWatcher to catalogd for pull CAs
* Add CertPoolWatcher to operator-controller for pull CAs
* Improve logging
With this, my downstream manifest change should be reverted.
Assisted-by: Claude Code (alternatives)
Signed-off-by: Todd Short <tshort@redhat.com>
…ot module (#2202)
* retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module
* fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module
* fixup! retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module
Signed-off-by: Todd Short <tshort@redhat.com>
---------
Signed-off-by: Todd Short <tshort@redhat.com>
Co-authored-by: Todd Short <tshort@redhat.com>
* Move to a helm-based configuration
This does not remove the kustomize config, but instead puts a helm chart
into the repo, that should give very close (but not identical) results.
* Adds a new chart: helm/olmv1/
- standard
- experimental
- openshift
- cert-manager
- e2e
- tilt
* Adds "values" files in helm/
* Adds helm executable to .bingo/
* Updates documents int docs/drafts/
* Update tests in tests/
* Update `make manifests` to use helm chart
- Update the checked-in manifests
- Use a tool like `dyff` to properly diff the manifests
* Pull RBAC and WebHook config out of the goland code
- controller-tools is not longer used to generate RBAC/Wehbooks
- These resources are not part of the helm chart
- The CRDs are still generated via kubebuilder
Significant changes to the resulting manifests are listed in the RFC.
Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)
* Move files into directories
Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)
* Add variable settings to Makefile to control Helm charts
Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)
* Add prometheus Helm chart
This is currently separate due to the ordering of application.
If we change the order, this could be included in the main Helm Chart.
Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)
* Add lint-helm target and CI
Signed-off-by: Todd Short <tshort@redhat.com>
Assisted-by: Gemini (research)
Assisted-by: Claude Code (analysis)
* Add Boxcutter support
Signed-off-by: Todd Short <tshort@redhat.com>
* Update catalogs to use 4.20
Signed-off-by: Todd Short <tshort@redhat.com>
* Remove clusterextension editor role
Signed-off-by: Todd Short <tshort@redhat.com>
* Remove configmaps from leader election role
Signed-off-by: Todd Short <tshort@redhat.com>
* Remove stale comment from config manager role
Signed-off-by: Todd Short <tshort@redhat.com>
* Add templating failure for featureSet
Signed-off-by: Todd Short <tshort@redhat.com>
---------
Signed-off-by: Todd Short <tshort@redhat.com>
Signed-off-by: Todd Short <tshort@redhat.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v6)
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pkg.package-operator.run/boxcutter](https://github.com/package-operator/boxcutter) from 0.6.0 to 0.7.0.
- [Release notes](https://github.com/package-operator/boxcutter/releases)
- [Commits](package-operator/boxcutter@v0.6.0...v0.7.0)
---
updated-dependencies:
- dependency-name: pkg.package-operator.run/boxcutter
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.36.0 to 0.37.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.36.0...v0.37.0)
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@openshift-botopenshift-bot added tide/merge-method-merge Denotes a PR that should use a standard merge by tide when it merges. kind/sync labels Sep 11, 2025
@openshift-ci-robotopenshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 11, 2025
@openshift-botopenshift-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 11, 2025
@openshift-ci-robot

openshift-ci-robot commented Sep 11, 2025

Copy link
Copy Markdown

@openshift-bot: This pull request explicitly references no jira issue.

Details

In response to this:

The downstream repository has been updated with the following following upstream commits:

DateCommitAuthorMessage
2025-09-11 14:45:30operator-framework/operator-controller@3f782fddependabot[bot]🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35operator-framework/operator-controller@6957436dependabot[bot]🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38operator-framework/operator-controller@1821160dependabot[bot]🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39operator-framework/operator-controller@c8dff76Todd ShortRename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45operator-framework/operator-controller@46e1163Todd Short⚠️OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31operator-framework/operator-controller@67098e7Joe Lanford🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24operator-framework/operator-controller@1ffa845Todd ShortRestart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

DateCommitAuthorMessage
2025-09-09 10:45:51openshift/operator-framework-operator-controller@d4a90c7dtfranzUPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54openshift/operator-framework-operator-controller@fd3a2d3Todd ShortUPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57openshift/operator-framework-operator-controller@d0f9efdTodd ShortUPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00openshift/operator-framework-operator-controller@af129a0Catherine Chan-TseUPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02openshift/operator-framework-operator-controller@d07b505Todd ShortUPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05openshift/operator-framework-operator-controller@9269c12Jian ZhangUPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08openshift/operator-framework-operator-controller@60e4974Camila MacedoUPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11openshift/operator-framework-operator-controller@c8f61e4Camila MacedoUPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14openshift/operator-framework-operator-controller@fb415ceTodd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17openshift/operator-framework-operator-controller@38871a8Todd ShortUPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19openshift/operator-framework-operator-controller@abe3ad4Todd ShortUPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22openshift/operator-framework-operator-controller@541b9a3Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25openshift/operator-framework-operator-controller@2d5c51dCamila MacedoUPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27openshift/operator-framework-operator-controller@b8adee9Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30openshift/operator-framework-operator-controller@fc94c3eCamila MacedoUPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33openshift/operator-framework-operator-controller@40945acCamila MacedoUPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36openshift/operator-framework-operator-controller@a2277eaCamila MacedoUPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38openshift/operator-framework-operator-controller@920370cCamila MacedoUPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41openshift/operator-framework-operator-controller@8a9859eCamila MacedoUPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44openshift/operator-framework-operator-controller@4609149Jian ZhangUPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47openshift/operator-framework-operator-controller@7631e01Todd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50openshift/operator-framework-operator-controller@f9b9bbfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52openshift/operator-framework-operator-controller@25c0ed2Camila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55openshift/operator-framework-operator-controller@6762adfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58openshift/operator-framework-operator-controller@a2fc1ccCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00openshift/operator-framework-operator-controller@2fb741cCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03openshift/operator-framework-operator-controller@84fd312AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06openshift/operator-framework-operator-controller@1e2f565AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08openshift/operator-framework-operator-controller@a318e4bTodd ShortUPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11openshift/operator-framework-operator-controller@2c92f30Camila MacedoUPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15openshift/operator-framework-operator-controller@4c09740Camila MacedoUPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20openshift/operator-framework-operator-controller@594ce33Todd ShortUPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25openshift/operator-framework-operator-controller@767e2a4Camila MacedoUPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30openshift/operator-framework-operator-controller@05e5f34Todd ShortUPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35openshift/operator-framework-operator-controller@ed4e724Todd ShortUPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40openshift/operator-framework-operator-controller@ddc5201Camila MacedoUPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45openshift/operator-framework-operator-controller@4175b5aTodd ShortUPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47openshift/operator-framework-operator-controller@cf60db4Todd ShortUPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52openshift/operator-framework-operator-controller@64840b7Camila MacedoUPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57openshift/operator-framework-operator-controller@31bd723Camila MacedoUPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02openshift/operator-framework-operator-controller@8200935Camila MacedoUPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07openshift/operator-framework-operator-controller@f653ef6Rashmi GottipatiUPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13openshift/operator-framework-operator-controller@c65e51cAnkita ThomasUPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18openshift/operator-framework-operator-controller@161381dBrett TofelUPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24openshift/operator-framework-operator-controller@4440699Camila MacedoUPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29openshift/operator-framework-operator-controller@a0352eaCamila MacedoUPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35openshift/operator-framework-operator-controller@4f76f80Camila MacedoUPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40openshift/operator-framework-operator-controller@edc6a6aCamila MacedoUPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45openshift/operator-framework-operator-controller@b197164Camila MacedoUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50openshift/operator-framework-operator-controller@c75cf8eTodd ShortUPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56openshift/operator-framework-operator-controller@06386d2Todd ShortUPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01openshift/operator-framework-operator-controller@75dca2aLuke MeyerUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06openshift/operator-framework-operator-controller@d0fe31dCamila MacedoUPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11openshift/operator-framework-operator-controller@c574d2fTodd ShortUPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16openshift/operator-framework-operator-controller@4b5fb34Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21openshift/operator-framework-operator-controller@2139f4cCamila MacedoUPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26openshift/operator-framework-operator-controller@b869bebCamila MacedoUPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31openshift/operator-framework-operator-controller@beb8726Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36openshift/operator-framework-operator-controller@adbfccfCamila MacedoUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41openshift/operator-framework-operator-controller@e09eadeCamila MacedoUPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46openshift/operator-framework-operator-controller@4ce333fgrokspawnUPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51openshift/operator-framework-operator-controller@0553e0fCamila MacedoUPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56openshift/operator-framework-operator-controller@4eb8ab9Camila MacedoUPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01openshift/operator-framework-operator-controller@1bbf658Forrest BabcockUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06openshift/operator-framework-operator-controller@dac2f1dCamila MacedoUPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11openshift/operator-framework-operator-controller@b65f351Todd ShortUPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54openshift/operator-framework-operator-controller@861cba4Jian ZhangUPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17openshift/operator-framework-operator-controller@4f4b107Per Goncalves da SilvaUPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-botopenshift-bot added the lgtm Indicates that a PR is ready to be merged. label Sep 11, 2025
@openshift-ci

openshift-ciBot commented Sep 11, 2025

Copy link
Copy Markdown
Contributor

@openshift-bot: GitHub didn't allow me to request PR reviews from the following users: openshift/openshift-team-operator-framework.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

The downstream repository has been updated with the following following upstream commits:

DateCommitAuthorMessage
2025-09-11 14:45:30operator-framework/operator-controller@3f782fddependabot[bot]🌱 Bump golang.org/x/tools from 0.36.0 to 0.37.0 (#2212)
2025-09-11 14:25:35operator-framework/operator-controller@6957436dependabot[bot]🌱 Bump pkg.package-operator.run/boxcutter from 0.6.0 to 0.7.0 (#2211)
2025-09-11 04:13:38operator-framework/operator-controller@1821160dependabot[bot]🌱 Bump actions/setup-go from 5 to 6 (#2205)
2025-09-10 18:01:39operator-framework/operator-controller@c8dff76Todd ShortRename opcon manager CRB when boxcutter is enabled (#2209)
2025-09-09 21:53:45operator-framework/operator-controller@46e1163Todd Short⚠️OPRUN-4075: Move to a helm-based configuration (#2145)
2025-09-09 17:52:31operator-framework/operator-controller@67098e7Joe Lanford🐛 retract v1.5.0; exclude hack/kind-config/containerd/certs.d from root module (#2202)
2025-09-09 18:47:24operator-framework/operator-controller@1ffa845Todd ShortRestart when SystemCertPool should change (#2175)

The vendor/ directory has been updated and the following commits were carried:

DateCommitAuthorMessage
2025-09-09 10:45:51openshift/operator-framework-operator-controller@d4a90c7dtfranzUPSTREAM: <carry>: Add OpenShift specific files
2025-09-09 10:45:54openshift/operator-framework-operator-controller@fd3a2d3Todd ShortUPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths
2025-09-09 10:45:57openshift/operator-framework-operator-controller@d0f9efdTodd ShortUPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES
2025-09-09 10:46:00openshift/operator-framework-operator-controller@af129a0Catherine Chan-TseUPSTREAM: <carry>: Add openshift node selector annotation
2025-09-09 10:46:02openshift/operator-framework-operator-controller@d07b505Todd ShortUPSTREAM: <carry>: Add caalogd-cas-dir option to op-con
2025-09-09 10:46:05openshift/operator-framework-operator-controller@9269c12Jian ZhangUPSTREAM: <carry>: set the SElinux type
2025-09-09 10:46:08openshift/operator-framework-operator-controller@60e4974Camila MacedoUPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs
2025-09-09 10:46:11openshift/operator-framework-operator-controller@c8f61e4Camila MacedoUPSTREAM: <carry>: Add vendor files for the catalog-sync tests
2025-09-09 10:46:14openshift/operator-framework-operator-controller@fb415ceTodd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:17openshift/operator-framework-operator-controller@38871a8Todd ShortUPSTREAM: <carry>: revert "Bump catalog versions to 4.19"
2025-09-09 10:46:19openshift/operator-framework-operator-controller@abe3ad4Todd ShortUPSTREAM: <carry>: Update HOWTO-origin-tests
2025-09-09 10:46:22openshift/operator-framework-operator-controller@541b9a3Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"
2025-09-09 10:46:25openshift/operator-framework-operator-controller@2d5c51dCamila MacedoUPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci
2025-09-09 10:46:27openshift/operator-framework-operator-controller@b8adee9Camila MacedoUPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)
2025-09-09 10:46:30openshift/operator-framework-operator-controller@fc94c3eCamila MacedoUPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios
2025-09-09 10:46:33openshift/operator-framework-operator-controller@40945acCamila MacedoUPSTREAM: <carry>: Default Catalog Remove hack directory which is not used
2025-09-09 10:46:36openshift/operator-framework-operator-controller@a2277eaCamila MacedoUPSTREAM: <carry>: Change code implementation to extract layers in OCP env
2025-09-09 10:46:38openshift/operator-framework-operator-controller@920370cCamila MacedoUPSTREAM: <carry>: Add vendor files for change in the extract code implementation
2025-09-09 10:46:41openshift/operator-framework-operator-controller@8a9859eCamila MacedoUPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation
2025-09-09 10:46:44openshift/operator-framework-operator-controller@4609149Jian ZhangUPSTREAM: <carry>: SELinux type for operator-controller
2025-09-09 10:46:47openshift/operator-framework-operator-controller@7631e01Todd ShortUPSTREAM: <carry>: Bump catalog versions to 4.19
2025-09-09 10:46:50openshift/operator-framework-operator-controller@f9b9bbfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem
2025-09-09 10:46:52openshift/operator-framework-operator-controller@25c0ed2Camila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml
2025-09-09 10:46:55openshift/operator-framework-operator-controller@6762adfCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support
2025-09-09 10:46:58openshift/operator-framework-operator-controller@a2fc1ccCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks
2025-09-09 10:47:00openshift/operator-framework-operator-controller@2fb741cCamila MacedoUPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups
2025-09-09 10:47:03openshift/operator-framework-operator-controller@84fd312AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml
2025-09-09 10:47:06openshift/operator-framework-operator-controller@1e2f565AOS Automation Release TeamUPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20 Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml
2025-09-09 10:47:08openshift/operator-framework-operator-controller@a318e4bTodd ShortUPSTREAM: <carry>: Update e2e registry to use 1.24/4.20
2025-09-09 10:47:11openshift/operator-framework-operator-controller@2c92f30Camila MacedoUPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue
2025-09-09 10:47:15openshift/operator-framework-operator-controller@4c09740Camila MacedoUPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE
2025-09-09 10:47:20openshift/operator-framework-operator-controller@594ce33Todd ShortUPSTREAM: <carry>: Add support for experimental manifests
2025-09-09 10:47:25openshift/operator-framework-operator-controller@767e2a4Camila MacedoUPSTREAM: <carry>: [OTE] - chore: follow up #383 – remove unreachable target call
2025-09-09 10:47:30openshift/operator-framework-operator-controller@05e5f34Todd ShortUPSTREAM: <carry>: Remove build of test image registry
2025-09-09 10:47:35openshift/operator-framework-operator-controller@ed4e724Todd ShortUPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile
2025-09-09 10:47:40openshift/operator-framework-operator-controller@ddc5201Camila MacedoUPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests
2025-09-09 10:47:45openshift/operator-framework-operator-controller@4175b5aTodd ShortUPSTREAM: <carry>: Fix experimental manifest copying
2025-09-09 10:53:47openshift/operator-framework-operator-controller@cf60db4Todd ShortUPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks
2025-09-09 10:53:52openshift/operator-framework-operator-controller@64840b7Camila MacedoUPSTREAM: <carry>: [OTE] - Add tracking mechanism
2025-09-09 10:53:57openshift/operator-framework-operator-controller@31bd723Camila MacedoUPSTREAM: <carry>: Update OTE dep to get fix
2025-09-09 10:54:02openshift/operator-framework-operator-controller@8200935Camila MacedoUPSTREAM: <carry>: [OTE] Add Readme
2025-09-09 10:54:07openshift/operator-framework-operator-controller@f653ef6Rashmi GottipatiUPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd
2025-09-09 10:54:13openshift/operator-framework-operator-controller@c65e51cAnkita ThomasUPSTREAM: <carry>: add openshift specific build target to pass commit info downstream
2025-09-09 10:54:18openshift/operator-framework-operator-controller@161381dBrett TofelUPSTREAM: <carry>: add source commit into binaries when linking
2025-09-09 10:54:24openshift/operator-framework-operator-controller@4440699Camila MacedoUPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go
2025-09-09 10:54:29openshift/operator-framework-operator-controller@a0352eaCamila MacedoUPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining
2025-09-09 10:54:35openshift/operator-framework-operator-controller@4f76f80Camila MacedoUPSTREAM: <carry>: OTE - How to test locally with OCP instances
2025-09-09 10:54:40openshift/operator-framework-operator-controller@edc6a6aCamila MacedoUPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent
2025-09-09 10:54:45openshift/operator-framework-operator-controller@b197164Camila MacedoUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:54:50openshift/operator-framework-operator-controller@c75cf8eTodd ShortUPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test
2025-09-09 10:54:56openshift/operator-framework-operator-controller@06386d2Todd ShortUPSTREAM: <carry>: Handle service-ca cert availability/rotation
2025-09-09 10:55:01openshift/operator-framework-operator-controller@75dca2aLuke MeyerUPSTREAM: <carry>: [OTE] add webhook tests
2025-09-09 10:55:06openshift/operator-framework-operator-controller@d0fe31dCamila MacedoUPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20
2025-09-09 10:55:11openshift/operator-framework-operator-controller@c574d2fTodd ShortUPSTREAM: <carry>: Remove bindata generation from build
2025-09-09 10:55:16openshift/operator-framework-operator-controller@4b5fb34Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook tests
2025-09-09 10:55:21openshift/operator-framework-operator-controller@2139f4cCamila MacedoUPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions
2025-09-09 10:55:26openshift/operator-framework-operator-controller@b869bebCamila MacedoUPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin
2025-09-09 10:55:31openshift/operator-framework-operator-controller@beb8726Camila MacedoUPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
2025-09-09 10:55:36openshift/operator-framework-operator-controller@adbfccfCamila MacedoUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:55:41openshift/operator-framework-operator-controller@e09eadeCamila MacedoUPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests
2025-09-09 10:55:46openshift/operator-framework-operator-controller@4ce333fgrokspawnUPSTREAM: <carry>: remove obsolete owners
2025-09-09 10:55:51openshift/operator-framework-operator-controller@0553e0fCamila MacedoUPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin
2025-09-09 10:55:56openshift/operator-framework-operator-controller@4eb8ab9Camila MacedoUPSTREAM: <carry>: Migrate single/own namespace tests
2025-09-09 10:56:01openshift/operator-framework-operator-controller@1bbf658Forrest BabcockUPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
2025-09-09 10:56:06openshift/operator-framework-operator-controller@dac2f1dCamila MacedoUPSTREAM: <carry>: Ensure unique name for bad-catalog tests
2025-09-09 10:56:11openshift/operator-framework-operator-controller@b65f351Todd ShortUPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"
2025-09-09 10:59:54openshift/operator-framework-operator-controller@861cba4Jian ZhangUPSTREAM: <carry>: grant QE approver permission for OTE
2025-09-10 06:59:17openshift/operator-framework-operator-controller@4f4b107Per Goncalves da SilvaUPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

This pull request is expected to merge without any human intervention. If tests are failing here, changes must land upstream to fix any issues so that future downstreaming efforts succeed.

/cc @openshift/openshift-team-operator-framework

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

1 similar comment
@openshift-ci

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: openshift-bot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tmshort

Copy link
Copy Markdown
Contributor

/test openshift-e2e-aws
/test openshift-e2e-aws-techpreview

tmshortand others added 12 commits September 11, 2025 23:22
…214)
Downstream e2es are failing because the old selectors are still being used.
Signed-off-by: dtfranz <dfranz@redhat.com>
UPSTREAM: <carry>: Update generate-manifests to handle new directory
The `default` directory was renamed `base`.
Signed-off-by: Todd Short <todd.short@me.com>
The `base` directory was moved to `base\operator-controller`.
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Drop commitchecker
Signed-off-by: Alexander Greene <greene.al1991@gmail.com>
UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml
UPSTREAM: <carry>: update owners
* Remove alumni from owners
* Add m1kola to approvers
Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>
UPSTREAM: <carry>: Add pointer to tooling README
UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream
Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>
UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml
UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream
* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests
Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>
UPSTREAM: <carry>: manifests: set required-scc for openshift workloads
UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml
UPSTREAM: <carry>: add everettraven to approvers+reviewers
Signed-off-by: everettraven <everettraven@gmail.com>
UPSTREAM: <carry>: add openshift kustomize overlay
to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator
Signed-off-by: everettraven <everettraven@gmail.com>
UPSTREAM: <carry>: Add tmshort to approvers
Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml
UPSTREAM: <carry>: Properly copy and call kustomize
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.
Signed-off-by: dtfranz <dfranz@redhat.com>
UPSTREAM: <carry>: Add downstream verify makefile target
Signed-off-by: dtfranz <dfranz@redhat.com>
UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Add global-pull-secret flag
Pass global-pull-secret to the manager container.
Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>
UPSTREAM: <carry>: Update openshift CAs to operator-controller
The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:
* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt
Update the --ca-certs-dir argument to reference the directory.
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Add HowTo for origin tests
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Add e2e registry Dockerfile
Signed-off-by: dtfranz <dfranz@redhat.com>
UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch
Signed-off-by: everettraven <everettraven@gmail.com>
UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Enable downstream e2e
Signed-off-by: dtfranz <dfranz@redhat.com>
UPSTREAM: <carry>: Remove m1kola from owners
Signed-off-by: Mikalai Radchuk <mradchuk@redhat.com>
UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml
UPSTREAM: <carry>: generate and mount service-ca server cert
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Add support for proxy trustedCAs
Just map the list of trusted ca certs into the deployment
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Fix error to build the image
Copy correct (new) executable name for operator-controller
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Fix make verify for mac os envs
Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Move operator-controller openshift files to its own dir
UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19
UPSTREAM: <carry>: Add Openshift's catalogd manifests
- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests
UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments
This allows for use of the any image.config.openshift.io trusted CAs
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: fixup catalogd.Dockerfile paths
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"
This reverts commit 548caa4.
UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations
Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
UPSTREAM: <carry>: Remove vet from openshift verify
The `vet` target was removed upstream.
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Skip another upstream test
Signed-off-by: Todd Short <todd.short@me.com>
UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests
UPSTREAM: <carry>: Enable OCP metrics collection by default
Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.
The root catalogd directory has been removed
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Catherine Chan-Tse <cchantse@redhat.com>
(cherry picked from commit 9b4a113)
Signed-off-by: Todd Short <todd.short@me.com>
Signed-off-by: Jian Zhang <jiazha@redhat.com>
Signed-off-by: Todd Short <todd.short@me.com>
camilamacedo86and others added 16 commits September 12, 2025 00:09
Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.
The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.
Assisted-by: Gemini
… certificate rotation
This change is a refactor of code from openshift/origin#30059.
Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
Signed-off-by: grokspawn <jordan@nimblewidget.com>
This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.
Assisted-by: Gemini
This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.
Assisted-by: Gemini
…tion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.
This reverts commit 0bb1953.
UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation
This reverts commit e9e3220.
…rator
Signed-off-by: Per Goncalves da Silva <pegoncal@redhat.com>
@openshift-ciopenshift-ciBot removed the lgtm Indicates that a PR is ready to be merged. label Sep 12, 2025
@openshift-ci

Copy link
Copy Markdown
Contributor

New changes are detected. LGTM label has been removed.

@jianzhangbjz

jianzhangbjz commented Sep 12, 2025

Copy link
Copy Markdown
Contributor

I'm going to test this Restart when SystemCertPool should change (#2175) PR, build OCP cluster via the cluster-bot, as follows,

launch 4.21,openshift/operator-framework-operator-controller#470 aws

However, it failed to create the cluster, see: https://prow.ci.openshift.org/view/gs/test-platform-results/logs/release-openshift-origin-installer-launch-aws-modern/1966319922455777280. The same as ci/prow/images test failure.

{ error occurred handling build olm-catalogd-amd64: the build olm-catalogd-amd64 failed after 10m51s with reason DockerBuildFailed: Dockerfile build strategy has failed.}{ error occurred handling build olm-operator-controller-amd64: the build olm-operator-controller-amd64 failed after 10m43s with reason DockerBuildFailed: Dockerfile build strategy has failed.}

/hold

@openshift-ciopenshift-ciBot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 12, 2025
@grokspawn

Copy link
Copy Markdown
Contributor

Is this even us? That reads like a podman C language dependency that double-declares a symbol.

@jianzhangbjz

Copy link
Copy Markdown
Contributor

Retest it since I can build this image successfully in my local now.
/test images

[cloud-user@preserve-olm-env2 operator-framework-operator-controller]$ podman build -t quay.io/olmqe/operator-controller:v1 -f openshift/operator-controller.Dockerfile .WARN[0000] missing "SOURCE_GIT_COMMIT" build argument. Try adding "--build-arg SOURCE_GIT_COMMIT=<VALUE>" to the command line [1/2] STEP 1/6: FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builderTrying to pull registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20...Getting image source signaturesCopying blob 1e43cdc096de done | Copying blob f0977858ab1b skipped: already exists Copying blob 5e09f8650bc2 skipped: already exists Copying config 5f1b0cd84d done | Writing manifest to image destination[1/2] STEP 2/6: ARG SOURCE_GIT_COMMIT--> 1fd45a2583c9[1/2] STEP 3/6: ENV GIT_COMMIT=${SOURCE_GIT_COMMIT}--> 05a3d9560fa7[1/2] STEP 4/6: WORKDIR /build--> dc6b440a0233[1/2] STEP 5/6: COPY . .--> 222ab83b18ec[1/2] STEP 6/6: RUN make -f openshift/Makefile go-build-local && cd openshift/tests-extension && make build && mkdir -p /tmp/build && cp ./bin/olmv1-tests-ext /tmp/build/olmv1-tests-ext && gzip -f /tmp/build/olmv1-tests-extmake -f Makefile go-build-localmake[1]: Entering directory '/build'Makefile:71: Could not find docker or podman in path! This may result in targets requiring a container runtime failing!
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \"\"" when the git commit is empty.go build -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/operator-controller ./cmd/operator-controller
# use double quotes around -s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit=' to avoid conflicts with the
# single quotes that are embedded inside the variable itself. this prevents
# malformed arguments such as "malformed import path \"\"" when the git commit is empty.go build -tags 'containers_image_openpgp' -ldflags "-s -w -X 'github.com/operator-framework/operator-controller/internal/shared/version.version=1.24' -X 'github.com/operator-framework/operator-controller/internal/shared/version.gitCommit='" -gcflags 'all=-trimpath=/build' -asmflags 'all=-trimpath=/build' -o bin/catalogd ./cmd/catalogdmake[1]: Leaving directory '/build'GO_COMPLIANCE_POLICY="exempt_all" go build -ldflags "-X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.CommitFromGit=4f4b107d' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.BuildDate=2025-09-12T07:09:38Z' -X 'github.com/openshift-eng/openshift-tests-extension/pkg/version.GitTreeState=dirty'" -mod=vendor -o /build/openshift/tests-extension/bin/olmv1-tests-ext ./cmd/...--> fdcf402cd349[2/2] STEP 1/8: FROM registry.ci.openshift.org/ocp/4.21:base-rhel9[2/2] STEP 2/8: USER 1001--> Using cache 9efcff62cb82a8c5bf285e8942465ec2b3b145a6ec1f61d1c3f14865e0459dc7--> 9efcff62cb82[2/2] STEP 3/8: COPY --from=builder /build/bin/operator-controller /operator-controller--> c424263231fd[2/2] STEP 4/8: COPY --from=builder /tmp/build/olmv1-tests-ext.gz /usr/bin/olmv1-tests-ext.gz--> 53483b7312db[2/2] STEP 5/8: COPY openshift/operator-controller/cp-manifests /cp-manifests--> 61eccd540174[2/2] STEP 6/8: COPY openshift/operator-controller/manifests /openshift/manifests--> 7625d2c22c2c[2/2] STEP 7/8: COPY openshift/operator-controller/manifests-experimental /openshift/manifests-experimental--> 9c0220d5bc68[2/2] STEP 8/8: LABEL io.k8s.display-name="OpenShift Operator Lifecycle Manager Operator Controller" io.k8s.description="This is a component of OpenShift Container Platform that allows operator installation."[2/2] COMMIT quay.io/olmqe/operator-controller:v1--> 738c0d967633Successfully tagged quay.io/olmqe/operator-controller:v1738c0d96763352db2458cad82c682382a32bccfbf41fcd3c1577f1f3c0d46c28

@jianzhangbjz

Copy link
Copy Markdown
Contributor

/retest-required

@openshift-ci

Copy link
Copy Markdown
Contributor

@openshift-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test nameCommitDetailsRequiredRerun command
ci/prow/okd-scos-images3690186linktrue/test okd-scos-images
ci/prow/e2e-aws-techpreview-olmv1-ext3690186linktrue/test e2e-aws-techpreview-olmv1-ext
ci/prow/okd-scos-e2e-aws-ovn3690186linkfalse/test okd-scos-e2e-aws-ovn
ci/prow/openshift-e2e-aws3690186linktrue/test openshift-e2e-aws
ci/prow/openshift-e2e-aws-techpreview3690186linkfalse/test openshift-e2e-aws-techpreview
ci/prow/images3690186linktrue/test images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jianzhangbjz

Copy link
Copy Markdown
Contributor

Still failing, raise this issue to the DPTP team: https://redhat-internal.slack.com/archives/CBN38N3MW/p1757664135331509

@tmshort

tmshort commented Sep 12, 2025

Copy link
Copy Markdown
Contributor

This is due to operator-framework/operator-controller#2195.
Building locally works, but building the container fails:

podman build -f openshift/operator-controller.Dockerfile .

Reverting PR2195 resolves the issue.
It appears to be due to a conflict between operator-registry's use of github.com/containers/image/v5 and operator-controller's use of the new go.podman.io/image/v5 that conflict with each other.

@tmshort

Copy link
Copy Markdown
Contributor

/close
closing in favor of #471

@openshift-ciopenshift-ciBot closed this Sep 12, 2025
@openshift-ci

Copy link
Copy Markdown
Contributor

@tmshort: Closed this PR.

Details

In response to this:

/close
closing in favor of #471

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approvedIndicates a PR has been approved by an approver from all required OWNERS files.do-not-merge/holdIndicates that a PR should not merge because someone has issued a /hold command.jira/valid-referenceIndicates that this PR references a valid Jira ticket of any type.kind/synctide/merge-method-mergeDenotes a PR that should use a standard merge by tide when it merges.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

15 participants

@openshift-bot@openshift-ci-robot@tmshort@jianzhangbjz@grokspawn@joelanford@anik120@dtfranz@oceanc80@camilamacedo86@rashmigottipati@ankitathomas@bentito@sosiouxme@neisw