Bumps [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) from 1.9.0 to 1.10.0.
- [Release notes](https://github.com/fsnotify/fsnotify/releases)
- [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md)
- [Commits](fsnotify/fsnotify@v1.9.0...v1.10.0)

---
updated-dependencies:
- dependency-name: github.com/fsnotify/fsnotify
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/add-to-project](https://github.com/actions/add-to-project) from 1.0.2 to 2.0.0.
- [Release notes](https://github.com/actions/add-to-project/releases)
- [Commits](actions/add-to-project@v1.0.2...v2.0.0)

---
updated-dependencies:
- dependency-name: actions/add-to-project
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.5 to 1.18.6.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.18.5...v1.18.6)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.18.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Update generate-manifests to handle new directory

The `default` directory was renamed `base`.

Signed-off-by: Todd Short <[email protected]>

The `base` directory was moved to `base\operator-controller`.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Drop commitchecker

Signed-off-by: Alexander Greene <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART
Reconciling with https://github.com/openshift/ocp-build-data/tree/4022cd290f00a44d667dda03f2d78d84a488c7ed/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: update owners

* Remove alumni from owners
* Add m1kola to approvers

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Add pointer to tooling README

UPSTREAM: <carry>: Disable Validating Admission Policy APIs downstream

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.16
Reconciling with https://github.com/openshift/ocp-build-data/tree/6250d54c4686a708ca5985afb73080e8ca9a1f7f/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Enable Validating Admission Policy APIs downstream

* This reverts commit 3f079c4.
* Includes Validating Admission Policy manifests

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: manifests: set required-scc for openshift workloads

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.17
Reconciling with https://github.com/openshift/ocp-build-data/tree/4c1326094222f9209876f06833179a1b9178faf7/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: add everettraven to approvers+reviewers

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: add openshift kustomize overlay

to enable TLS communication with catalogd. Configure the CA certs
using the configmap injection method via service-ca-operator

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: Add tmshort to approvers

Also `s/runtime/framework/g` in the DOWNSTREAM_OWNERS

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.18
Reconciling with https://github.com/openshift/ocp-build-data/tree/dd68246f3237db5db458127566fc7b05b55e1660/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Properly copy and call kustomize

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: manifests: add hostPath mount for /etc/containers

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add test-e2e target for downstream Makefile to be run by openshift/release.

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Add downstream verify makefile target

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: openshift: template log verbosity to be managed by cluster-olm-operator

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add global-pull-secret flag

Pass global-pull-secret to the manager container.

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Update openshift CAs to operator-controller

The /run/secrets/kubernetes.io/serviceaccount/ directory is projected
into the pod and contains the following CA certificates:

* configmap/kube-root-ca.crt as ca.crt
* configmap/openshift-service-ca.crt as service-ca.crt

Update the --ca-certs-dir argument to reference the directory.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add HowTo for origin tests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add e2e registry Dockerfile

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: add nodeSelector and tolerations to operator-controller deployment via kustomize patch

Signed-off-by: everettraven <[email protected]>

UPSTREAM: <carry>: namespace: use privileged PSA for audit and warn levels

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Enable downstream e2e

Signed-off-by: dtfranz <[email protected]>

UPSTREAM: <carry>: Remove m1kola from owners

Signed-off-by: Mikalai Radchuk <[email protected]>

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.19
Reconciling with https://github.com/openshift/ocp-build-data/tree/a39508c86497b4e5e463d7b2c78e51e577be9e7d/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: generate and mount service-ca server cert

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add support for proxy trustedCAs

Just map the list of trusted ca certs into the deployment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix error to build the image

Copy correct (new) executable name for operator-controller

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Fix make verify for mac os envs

Joe Lanford <[email protected]>

UPSTREAM: <carry>: Move operator-controller openshift files to its own dir

UPSTREAM: <carry>: Upgrade OCP images from 4.18 to 4.19

UPSTREAM: <carry>: Add Openshift's catalogd manifests

- Move to openshift/catalogd the specific manifest under: https://github.com/openshift/operator-framework-catalogd/tree/main/openshift
- Add call to generate catalogd manifest to 'make manifest'. Make verify test is now done for catalogd and operator-controller Openshift's manifests

UPSTREAM: <carry>: resolve issue with pre-mature mounting of trusted CA configmap

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Add /etc/docker to the operator-controller and catalogd deployments

This allows for use of the any image.config.openshift.io trusted CAs

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: fixup catalogd.Dockerfile paths

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Resolve issue with pre-mature mounting of service CA configmap

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"

This reverts commit 548caa4.

UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations

Signed-off-by: Joe Lanford <[email protected]>

UPSTREAM: <carry>: Remove vet from openshift verify

The `vet` target was removed upstream.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Skip another upstream test

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Cleanup openshift/Makefile by removing no longer required comments regards catalogd e2e tests

UPSTREAM: <carry>: Enable OCP metrics collection by default

Enables OCP to collect Prometheus metrics for both catalogd and
operator-controller by default. This is accomplished
via ServiceMonitor CRs which are now created for both projects.

UPSTREAM: <carry>: Fix catalogd.Dockerfile to use new paths

The root catalogd directory has been removed

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update DOWNSTREAM_OWNERS_ALIASES

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add openshift node selector annotation

Signed-off-by: Catherine Chan-Tse <[email protected]>
(cherry picked from commit 9b4a113)

UPSTREAM: <carry>: Add caalogd-cas-dir option to op-con

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: set the SElinux type

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Add initial stack to run tests to validate the catalogs

UPSTREAM: <carry>: Add vendor files for the catalog-sync tests

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: revert "Bump catalog versions to 4.19"

This reverts commit a98980b.

UPSTREAM: <carry>: Update HOWTO-origin-tests

techpreview is no longer a required option.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [DefaultCatalogTests]: Allow to pass auth path for docker credentials"

UPSTREAM: <carry>: fix: set NoLchown=true to allow image unpack on OCPci

UPSTREAM: <carry>: [DefaultCatalogTests]: Moving parse of ENVVAR to the caller (follow-up 345)

UPSTREAM: <carry>: [Default Catalog]: Create tmp dir to extract layers with right permissions to avoid issues scenarios

UPSTREAM: <carry>: [Default Catalog](cleanp) Remove hack directory which is not used

UPSTREAM: <carry>: Change code implementation to extract layers in OCP env

UPSTREAM: <carry>: Add vendor files for change in the extract code implementation

UPSTREAM: <carry>: [Default Catalog Tests]: Final cleanups and enhancements of initial implementation

UPSTREAM: <carry>: SELinux type for operator-controller

Signed-off-by: Jian Zhang <[email protected]>

UPSTREAM: <carry>: Bump catalog versions to 4.19

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check for executable files in filesystem

Checks if given paths exist and point to executable files or valid symlinks.

UPSTREAM: <carry>: [Default Catalog Consistency Test]: fix junit output format to allow generate xml

UPSTREAM: <carry>: [Default Catalog Consistency Test] (feat) add check to validate multi-arch support

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Enable CatalogChecks

UPSTREAM: <carry>: [Default Catalog Consistency Test]: Rename Tests suite and small cleanups

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.20
Reconciling with https://github.com/openshift/ocp-build-data/tree/dfb5c7d531490cfdc61a3b88bc533702b9624997/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: Update e2e registry to use 1.24/4.20

Update the e2e registry Dockerfile to use golang 1.24/OCP 4.20

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [Catalog Default Tests]: Upgrade go version to 1.24.3, dependencies and fix new lint issue

UPSTREAM: <carry>: Add structure to allow move the orgin tests using OTE

This commit introduces a binary and supporting structure to enable the
execution of OpenShift origin (olmv1) tests using the Open Test Environment (OTE).

It lays the groundwork for moving origin test in openshift/origin to
be executed from this repository using OTE.

UPSTREAM: <carry>: Add support for experimental manifests

Update the openshift kustomize configuration for both operator-controller
and catalogd.

Update the manifest generation scripts to put the core generation code
into a function (ignore-whitespace will help with the review), so that
it can be called twice; once for standard, and once for experimental.

Move around some of the kustomization directives to
* Create a patch kustomization (Component) file and move the patch directives from olmv1-ns there. This allows it to be referenced from a different directory.
* Add a kustomization file for tusted-ca. This allows it to be referenced from a different directory.
* Move the setting of the namePrefix for operator-controller; this makes the generation compatible with upstream feature components.
* Define experimental kustomization files that reference existing components.
* Reference the correct CRDs (standard or experimental).
* Add references to upstream feature components into the experimental manifests.

This *will* add `--feature-gates` options from the upstream feature
components to the experimental manifests. The cluster-olm-operator will
strip those arguments from the deployments before adding the enabled
feature gates.

Update the Dockerfiles to include the experimental manifests and a copy
script (`cp-manifests`) into the image containers. The complexity of
having multiple sets of manifests mean that the simple initContainer
copy mechanism found in cluster-olm-operator is no longer sufficient.

This attempts to keep backwards compatibility with older versions of
cluster-olm-operator, specifically by keeping the original (standard)
manifests in the original location, and adding the experimental
manifests in a new directory. The new `cp-manifests` script is used
by newer versions of cluster-olm-operator.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - chore: follow up openshift#383 – remove unreachable target call

UPSTREAM: <carry>: Remove build of test image registry

Upstream now uses a different image

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add test-experimental-e2e target to openshift Makefile

This adds a test-experimental-e2e target to allow the CI to run the
experimental e2e test.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE]: Add binary in the operator controller image to allow proper integration with OCP tests

UPSTREAM: <carry>: Fix experimental manifest copying

The standard manifest was being copied rather than the experimental
manifest. This meant that the expected feature-flags are not present.
This is failing now that we are doing a check for those feature-flags.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update manifest generation for upstream rbac/webhooks

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] - Add tracking mechanism

UPSTREAM: <carry>: Update OTE dep to get fix

UPSTREAM: <carry>: [OTE] Add Readme

UPSTREAM: <carry>: set GIT_COMMIT env from SOURCE_GIT_COMMIT in Dockerfiles for operator-controller and catalogd

Signed-off-by: Rashmi Gottipati <[email protected]>

UPSTREAM: <carry>: add openshift specific build target to pass commit info downstream

Signed-off-by: Ankita Thomas <[email protected]>

UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

UPSTREAM: <carry>: OTE add first test from openshift/origin olmv1.go

UPSTREAM: <carry>: Migrate tasks from openshift/origin olm v1.go file which are remaining

This commit moves the final OLMv1 tests from openshift/origin/test/extended/olm/olmv1.go to their proper location in this repository. This migration is part of a larger effort to streamline development by co-locating tests with the component they validate. This will reduce CI overhead and allow for faster, more atomic changes.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE - How to test locally with OCP instances

UPSTREAM: <carry>: [OTE] Refac: refac helper and olmv1 test to create namespace instead to use pre-existent

UPSTREAM: <carry>: [OTE] add webhook tests

Migrates OLMv1 webhook operator tests from using external YAML files to
defining resources in Go structs. This change removes file dependencies,
improving test reliability and simplifying test setup.

The migration is a refactoring of code from openshift/origin#30059.
The new code uses better naming conventions and adapts the tests to work
with a controller-runtime client, enhancing test consistency and maintainability.

The migration covers all core test scenarios:
- Validating, mutating, and conversion webhooks.
- Certificate and secret rotation tolerance.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE: rewrite the upgrade incompatible operator test

This test replaces the existing upgrade incompatible test.
The main change is that operator and catalog bundles are created on-the-fly
to support OCP 4.20. This means we are no longer dependent on public
operators for this test.

This creates new bundles in the OCP ImageRegistry, this requires using
a number of OCP APIs, including using a raw API URL to invoke the build.
This is done by invoking an external k8s client (either `oc` or `kubectl`),
and passing it a tarball of the bundle to be created. So, it can't be done
by the golang k8sClient normally available (i.e. the create input is a
tarball not a YAML file).

This introduces the use of go-bindata to store the bundle contents.

It also pulls in openshift mage, buld and operator APIs.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Handle service-ca cert availability/rotation

There is problem when the service-ca certificate is not available at pod start.
This is an issue because the SystemCertPool is created from SSL_CERT_DIR,
which may include the empty service-ca. The SystemCertPool is never regenerated
during the lifetime of the program execution, so it will never get updated when
the service-ca is filled. Thus, we need to use --pull-cas-dir to reference the
CAs that we want to use. This will also allow OLMv1 to reload the service-ca
when it is reloaded (after 2 years, mind you). Removing the SSL_CERT_DIR setting,
and adding the --pull-cas-dir flag ought to be equivalent to what we have now
(i.e. SSL_CERT_DIR and no --pull-cas-dir), except that rotation will be handled
better.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] add webhook tests

Revert "UPSTREAM: <carry>: [OTE] add webhook tests"

This reverts commit 9963614.

UPSTREAM: <carry>: Upgrade OCP Catalog images from 4.19 to 4.20

UPSTREAM: <carry>: Remove bindata generation from build

Using go-bindata is causing problems with ART builds.

This removes the use of go-bindata from the builds.

This will subsequently require that users MANUALLY run
the `bindata` target to refresh the bindata, or use
the `build-update` target.

This is a quickfix to put out the fire.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: [OTE] Add webhook tests

- Add dumping of container logs and `kubectl describe pods` output for better diagnostics.
- Include targeted certificate details dump (`tls.crt` parse) when failures occur.
- Add additional check to verify webhook responsiveness after certificate rotation.

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: OTE add logs and dumps for olmv1 test and fix helper for clusterextensions

UPSTREAM: <carry>: [OTE] Migrate preflight checks from openshift/origin

Migrated OLMv1 operator preflight checks from using external YAML files to
defining ClusterRole permissions directly in Go structs. This improves test
reliability and simplifies test setup by removing file dependencies.

The changes ensure precise replication of original test scenarios,
including specific permission omissions for services, create verbs,
ClusterRoleBindings, ConfigMap resourceNames, and escalate/bind verbs.

Assisted-by: Gemini

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This change is a refactor of code from openshift/origin#30059.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

UPSTREAM: <carry>: [OTE] - Readme:Add info to help use payload-aggregate with new tests

UPSTREAM: <carry>: remove obsolete owners

Signed-off-by: grokspawn <[email protected]>

UPSTREAM: <carry>: [OTE] add catalog tests from openshift/origin

This commit migrates the olmv1_catalog set of tests from openshift/origin
to OTE as part the broad effort to migrate all tests.

Assisted-by: Gemini

UPSTREAM: <carry>: Migrate single/own namespace tests

This commit migrates the OLMv1 single and own namespace watch mode tests from openshift/origin/test/extended/olm/olmv1-singleownnamespace.go to this repository. This is part of the effort to move component-specific tests into their respective downstream locations.

Assisted-by: Gemini

UPSTREAM: <carry>: Adds ResourceVersion checks to the tls secret deletion test, mirroring the logic used in the certificate rotation test. This makes the test more robust by ensuring a new secret is created, not just that an existing one is still present.

This reverts commit 0bb1953.

UPSTREAM: <carry>: [OTE] Add webhook to validate openshift-service-ca certificate rotation

This reverts commit e9e3220.

UPSTREAM: <carry>: Ensure unique name for bad-catalog tests

UPSTREAM: <carry>: Revert "Handle service-ca cert availability/rotation"

This reverts commit 9cc13d8.

UPSTREAM: <carry>: grant QE approver permission for OTE

UPSTREAM: <carry>: Update webhook ote tests to use latest webhook-operator

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: update operator-controller to v1.5.1

UPSTREAM: <carry>: configure watchnamespace using spec.config for OTE tests

UPSTREAM: <carry>: add jiazha to approvers

UPSTREAM: <carry>: Create combined manifests for comparison

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Use Helm charts for openshift manifests

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: add support for tests-private cases and add the case

UPSTREAM: <carry>: Fix cp-manifests copying of helm charts

The method used to copy the helm charts is including an extra `helm`
directory in the destination path, that is making the cluster-olm-operator
code just a bit more complicated than it needs to be.

This fixes the copy location.

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Remove kustomize manifests from images and repo

Now that helm manifests are being used to dynamically generate the
manifests, the pre-generated manifests are no longer needed. So,
we can remove them from the repo and the images.

However, because we still want to verify the manifests are "good",
we are still creating a "single-file" version of the manifests
for verification purposes, and to allow us to see what changes
are happening to the manifests (from upstream and/or downstream
sources).

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Add pedjak and trgeiger as reviewers

UPSTREAM: <carry>: migrate more cases from tests-private and enhance suites with filters

UPSTREAM: <carry>: Updating ose-olm-operator-controller-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-operator-controller.yml

UPSTREAM: <carry>: Updating ose-olm-catalogd-container image to be consistent with ART for 4.21
Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-olm-catalogd.yml

UPSTREAM: <carry>: OTE: Enable disconnected environment and build test operator controller image

Signed-off-by: Per Goncalves da Silva <[email protected]>

UPSTREAM: <carry>: for incompatible test add func to wait builder and deployer SA creation by OCP controller

UPSTREAM: <carry>: Fix VERSION replacement in catalog bindata

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: check kubeconfig only run-test and run-suite

UPSTREAM: <carry>: Clean up cp-manifests

There is no longer a need to copy conditionally

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: Update does-not-exist and simple install to work in a disconnected environment

Signed-off-by: Todd Short <[email protected]>

UPSTREAM: <carry>: support webhook case in disconnected

UPSTREAM: <carry>: Consolidate build API

This consolidates the in-cluster building of a bundle and catalog.
The catalog and bundle bindata are inputs, along with a set of
replacements so that catalog and bundle templates can be used to
create the images.

This can be done in the BeforeEach() for a set of tests that use the
same data.

Signed-off-by: Todd Short <[email protected]>

…images from openshift/catalogd/manifests.yaml

Signed-off-by: Todd Short <[email protected]>

…oss to avoid flakes

Signed-off-by: Todd Short <[email protected]>

…uess and waiting for k8s cleanups

Co-Author: [email protected]

Signed-off-by: Todd Short <[email protected]>

…64 support

Signed-off-by: Daniel Franz <[email protected]>

Signed-off-by: Todd Short <[email protected]>

…t in OTE tests

Update all remaining references to ClusterExtensionRevision in
openshift/tests-extension to use ClusterObjectSet, matching the
upstream rename in operator-framework/operator-controller#2589.

Files updated:
- test/qe/specs/olmv1_ce.go: RBAC resource names and comments
- test/olmv1-preflight.go: scenario constants, test names, RBAC rules
- .openshift-tests-extension/openshift_payload_olmv1.json: test name
- pkg/bindata/qe/bindata.go: embedded RBAC templates
- test/qe/testdata/olm/sa-nginx-limited-boxcutter.yaml: RBAC resources
- test/qe/testdata/olm/sa-nginx-insufficient-operand-rbac-boxcutter.yaml: RBAC resources

Signed-off-by: Camila Macedo <[email protected]>
Made-with: Cursor

…s ClusterObjectSet

The upstream rename of ClusterExtensionRevision to ClusterObjectSet
(operator-framework/operator-controller#2589) breaks the incompatible
operator detection in cluster-olm-operator. The cluster-olm-operator
binary still reads ClusterExtensionRevision resources to find operators
with olm.maxOpenShiftVersion, so after the rename it never detects
incompatible operators and InstalledOLMOperatorsUpgradeable stays True.

Skip this test when NewOLMBoxCutterRuntime feature gate is enabled
until cluster-olm-operator is updated to read ClusterObjectSet.

Signed-off-by: Camila Macedo <[email protected]>
Made-with: Cursor

Signed-off-by: Francesco Giudici <[email protected]>

…rename of CER

… test

Signed-off-by: Todd Short <[email protected]>

…to run outside of OCP

…ables

…ffinity for HA topology

Rolling updates in HighlyAvailable clusters leave catalogd and
operator-controller unavailable when the only running pod is evicted
before its replacement is ready.

Fix by defaulting replicas=1 and PDB disabled in the static Helm values
(safe for SNO/External topologies, passes the SNO conformance test that
asserts exactly one replica in SingleReplica topology mode). Add pod
anti-affinity to prefer scheduling replicas on different nodes.

cluster-olm-operator detects the cluster's ControlPlaneTopology at
startup and overrides these values to replicas=2 and PDB enabled when a
HighlyAvailable topology is detected, then re-renders the manifests
before starting controllers. When a topology change is observed at
runtime (exceedingly rare), the operator exits so its deployment
controller restarts it, triggering a fresh Helm render with the correct
values for the new topology.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Signed-off-by: Todd Short <[email protected]>

…etween both-watch-modes scenarios

The both-watch-modes test loops over two scenarios (singlens, ownns) inside
a single It block and was blocking on full namespace deletion between them.
This caused flaky 300s timeouts on GCP techpreview clusters where master
nodes run at 94-99% CPU, which starves the namespace controller and makes
namespace termination arbitrarily slow.

The wait was not guarding anything real:
- EnsureCleanupClusterExtension already ensures the CE and CRD are gone;
  since CE deletion uses ForegroundPropagation, the ClusterObjectSet teardown
  must complete before the CE disappears, meaning all managed resources
  (Deployments, Services, etc.) are already deleted at that point.
- The singleown bundle installs no ValidatingWebhookConfiguration or
  MutatingWebhookConfiguration, so there is no webhook admission risk.
- Each scenario generates unique namespace names and CRD group suffixes via
  rand.String(4), so a terminating namespace from scenario 1 cannot collide
  with or interfere with scenario 2's resources.

Trigger both namespace deletions and proceed without waiting. The DeferCleanup
registrations that already exist will handle any residual cleanup after the
spec exits.

Fixes: OCPBUGS-84943

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Signed-off-by: Todd Short <[email protected]>