Skip to content

Commit 3aaab58

Browse files
committed
update cert-manager images from opm
Signed-off-by: Evgeny Slutsky <[email protected]>
1 parent 7e1d604 commit 3aaab58

File tree

6 files changed

+157
-54
lines changed

6 files changed

+157
-54
lines changed
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: cert-manager-images
5+
namespace: system
6+
spec:
7+
containers:
8+
- name: cert-manager-webhook
9+
image: cert-manager-webhook:latest
10+
- name: cert-manager-ca-injector
11+
image: cert-manager-ca-injector:latest
12+
- name: cert-manager-controller
13+
image: cert-manager-controller:latest
14+
- name: cert-manager-acmesolver
15+
image: cert-manager-acmesolver:latest
16+
- name: cert-manager-istiocsr
17+
image: cert-manager-istiocsr:latest
18+
restartPolicy: Never
Lines changed: 72 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,75 @@
1-
resources:
2-
- manager.yaml
31
apiVersion: kustomize.config.k8s.io/v1beta1
42
kind: Kustomization
3+
resources:
4+
- manager.yaml
5+
- images.yaml
6+
replacements:
7+
- source:
8+
kind: Pod
9+
name: cert-manager-images
10+
fieldPath: spec.containers.[name=cert-manager-webhook].image
11+
targets:
12+
- select:
13+
kind: Deployment
14+
name: controller-manager
15+
fieldPaths:
16+
- spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_WEBHOOK].value
17+
- source:
18+
kind: Pod
19+
name: cert-manager-images
20+
fieldPath: spec.containers.[name=cert-manager-ca-injector].image
21+
targets:
22+
- select:
23+
kind: Deployment
24+
name: controller-manager
25+
fieldPaths:
26+
- spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_CA_INJECTOR].value
27+
- source:
28+
kind: Pod
29+
name: cert-manager-images
30+
fieldPath: spec.containers.[name=cert-manager-controller].image
31+
targets:
32+
- select:
33+
kind: Deployment
34+
name: controller-manager
35+
fieldPaths:
36+
- spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_CONTROLLER].value
37+
- source:
38+
kind: Pod
39+
name: cert-manager-images
40+
fieldPath: spec.containers.[name=cert-manager-acmesolver].image
41+
targets:
42+
- select:
43+
kind: Deployment
44+
name: controller-manager
45+
fieldPaths:
46+
- spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_ACMESOLVER].value
47+
- source:
48+
kind: Pod
49+
name: cert-manager-images
50+
fieldPath: spec.containers.[name=cert-manager-istiocsr].image
51+
targets:
52+
- select:
53+
kind: Deployment
54+
name: controller-manager
55+
fieldPaths:
56+
- spec.template.spec.containers.[name=cert-manager-operator].env.[name=RELATED_IMAGE_CERT_MANAGER_ISTIOCSR].value
557
images:
6-
- name: controller
7-
newName: registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256
8-
newTag: 4d5e238300ce6f427a1045d51d6b37a4e5c5633985208ebb44f91e7dd53897d9
58+
- name: controller
59+
newName: registry.redhat.io/cert-manager/cert-manager-operator-rhel9
60+
digest: sha256:4d5e238300ce6f427a1045d51d6b37a4e5c5633985208ebb44f91e7dd53897d9
61+
- name: cert-manager-istiocsr
62+
newName: registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
63+
digest: sha256:9ea2c29a384b964cef14f853278821df3cd30320f25afab8823897192f67fc7e
64+
- name: cert-manager-acmesolver
65+
newName: registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9
66+
digest: sha256:4f7c045819c39e176a6090efdaba6ec736edf772d88fc87dd1c6fb33d3b5b26b
67+
- name: cert-manager-webhook
68+
newName: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
69+
digest: sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
70+
- name: cert-manager-ca-injector
71+
newName: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
72+
digest: sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659
73+
- name: cert-manager-controller
74+
newName: registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
75+
digest: sha256:96d51e3a64bf30cbd92836c7cbd82f06edca16eef78ab1432757d34c16628659

scripts/auto-rebase/assets_cert_manager.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,13 @@ assets:
3131
- file: cainjection_in_certmanagers.yaml
3232
- file: webhook_in_certmanagers.yaml
3333
- dir: optional/cert-manager/manager/
34+
no_clean: True
3435
src: cert-manager-operator/config/manager/
3536
files:
3637
- file: kustomization.yaml
38+
ignore: "Provided by MicroShift"
39+
- file: images.yaml
40+
ignore: "Provided by MicroShift"
3741
- file: manager.yaml
3842
- dir: optional/cert-manager/rbac/
3943
src: cert-manager-operator/config/rbac/

scripts/auto-rebase/rebase.py

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
AMD64_RELEASE_ENV = "AMD64_RELEASE"
2828
ARM64_RELEASE_ENV = "ARM64_RELEASE"
2929
RHOAI_RELEASE_ENV = "RHOAI_RELEASE"
30+
OPM_VERSION_ENV = "OPM_RELEASE"
3031
JOB_NAME_ENV = "JOB_NAME"
3132
BUILD_ID_ENV = "BUILD_ID"
3233
DRY_RUN_ENV = "DRY_RUN"
@@ -101,6 +102,24 @@ def run_rebase_ai_model_serving_sh(release):
101102
logging.info(f"Script returned code: {result.returncode}. It ran for {end/60:.0f}m{end%60:.0f}s.")
102103
return RebaseScriptResult(success=result.returncode == 0, output=result.stdout)
103104

105+
def run_rebase_cert_manager_sh(release):
106+
"""Run the 'rebase_cert_manager.sh' script with the given release version and return the script's output."""
107+
script_dir = os.path.abspath(os.path.dirname(__file__))
108+
args = [f"{script_dir}/rebase_cert_manager.sh", "to", release]
109+
env = os.environ.copy()
110+
env["NO_BRANCH"] = "true"
111+
logging.info(f"Running: '{' '.join(args)}'")
112+
start = timer()
113+
result = subprocess.run(
114+
args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True, check=False,
115+
env=env)
116+
logging.info(f"Return code: {result.returncode}. Output:\n" +
117+
"==================================================\n" +
118+
f"{result.stdout}" +
119+
"==================================================\n")
120+
end = timer() - start
121+
logging.info(f"Script returned code: {result.returncode}. It ran for {end/60:.0f}m{end%60:.0f}s.")
122+
return RebaseScriptResult(success=result.returncode == 0, output=result.stdout)
104123

105124
def commit_str(commit):
106125
"""Returns the first 8 characters of the commit's SHA hash and the commit summary."""
@@ -477,6 +496,7 @@ def main():
477496
release_amd = try_get_env(AMD64_RELEASE_ENV)
478497
release_arm = try_get_env(ARM64_RELEASE_ENV)
479498
rhoai_release = try_get_env(RHOAI_RELEASE_ENV)
499+
opm_version = try_get_env(OPM_VERSION_ENV)
480500
base_branch_override = try_get_env(BASE_BRANCH_ENV, die=False)
481501

482502
global REMOTE_DRY_RUN
@@ -495,8 +515,9 @@ def main():
495515

496516
rebase_result = run_rebase_sh(release_amd, release_arm)
497517
ai_rebase_result = run_rebase_ai_model_serving_sh(rhoai_release)
518+
cert_manager_rebase_result = run_rebase_cert_manager_sh(opm_version)
498519

499-
rebases_succeeded = rebase_result.success and ai_rebase_result.success
520+
rebases_succeeded = rebase_result.success and ai_rebase_result.success and cert_manager_rebase_result.success
500521

501522
if rebases_succeeded:
502523
# TODO How can we inform team that rebase job ran successfully just there was nothing new?

scripts/auto-rebase/rebase_cert_manager.sh

Lines changed: 39 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -108,46 +108,56 @@ download_cert_manager(){
108108
# convert from cert-manager-operator.v1.16.0 to cert-manager-x.y
109109
branch_name=$(echo ${operator} | awk -F'[^0-9]*' '{print "cert-manager-"$2"."$3}')
110110
clone_repo "https://github.com/openshift/cert-manager-operator" "$branch_name" "."
111+
popd
111112

112113
}
113114

114-
# Updates the image digests in pkg/release/release*.go
115-
# update_images() {
116-
# if [ ! -f "${STAGING_DIR}/release_amd64.json" ] || [ ! -f "${STAGING_DIR}/release_arm64.json" ]; then
117-
# >&2 echo "No release found in ${STAGING_DIR}, you need to download one first."
118-
# exit 1
119-
# fi
120-
# pushd "${STAGING_DIR}" >/dev/null
121-
122-
123-
# }
124-
125-
115+
# helper to append an image mapping to kustomization.yaml, supporting digest or tag
116+
add_image_to_kustomize() {
117+
local alias_name="$1"
118+
local full_image_ref="$2"
119+
if [[ "${full_image_ref}" == *@sha256:* ]]; then
120+
local image_name_no_digest="${full_image_ref%@*}"
121+
local image_digest="${full_image_ref#*@}"
122+
yq -i ".images += [{\"name\": \"${alias_name}\", \"newName\": \"${image_name_no_digest}\", \"digest\": \"${image_digest}\"}]" "${cert_manager_kustomization_yaml}"
123+
else
124+
local image_name_no_tag="${full_image_ref%:*}"
125+
local image_tag="${full_image_ref##*:}"
126+
yq -i ".images += [{\"name\": \"${alias_name}\", \"newName\": \"${image_name_no_tag}\", \"newTag\": \"${image_tag}\"}]" "${cert_manager_kustomization_yaml}"
127+
fi
128+
}
126129

127130
write_cert_manager_images_for_arch() {
128131
local arch="$1"
129132
title "Updating images for ${arch}"
130-
#local csv_manifest="${arch_dir}/servicemeshoperator3.clusterserviceversion.yaml"
131-
#local kustomization_arch_file="${REPOROOT}/assets/optional/gateway-api/kustomization.${GOARCH_TO_UNAME_MAP[${arch}]}.yaml"
132133
local cert_manager_release_json="${REPOROOT}/assets/optional/cert-manager/release-cert-manager-${GOARCH_TO_UNAME_MAP[${arch}]}.json"
133134
local cert_manager_operator_yaml="${REPOROOT}/assets/optional/cert-manager/manager/manager.yaml"
134135
local cert_manager_kustomization_yaml="${REPOROOT}/assets/optional/cert-manager/manager/kustomization.yaml"
135136

136-
local base_release=4.20
137-
jq -n "{\"release\": {\"base\": \"${base_release}\"}, \"images\": {}}" > "${cert_manager_release_json}"
137+
local operatorVersion=$(yq '.properties[] | select(.type == "olm.package").value.version' "${OPERATOR_CERT_MANAGER_INDEX}")
138+
139+
jq -n "{\"release\": {\"base\": \"${operatorVersion}\"}, \"images\": {}}" > "${cert_manager_release_json}"
138140

139141
#containerImage
140-
local operatorImage=$(yq '.properties[] | select(.type == "olm.csv.metadata").value.annotations.containerImage' "${OPERATOR_CERT_MANAGER_INDEX}")
141-
142-
yq -i -o json ".images += {\"cert-manager-operator\": \"${operatorImage}\"}" "${cert_manager_release_json}"
143-
sed -i "s#newName:.*openshift.io\/cert-manager-operator.*#newName: ${operatorImage}#g" "${cert_manager_kustomization_yaml}"
142+
local operatorImageFull=$(yq '.properties[] | select(.type == "olm.csv.metadata").value.annotations.containerImage' "${OPERATOR_CERT_MANAGER_INDEX}")
143+
local operatorImage="${operatorImageFull%:*}"
144+
local operatorTag="${operatorImageFull#*:}"
145+
146+
yq -i -o json ".images += {\"cert-manager-operator\": \"${operatorImageFull}\"}" "${cert_manager_release_json}"
147+
148+
# reset and rebuild the images list in kustomization.yaml from opm output
149+
yq -i 'del(.images) | .images = []' "${cert_manager_kustomization_yaml}"
150+
151+
# add operator image to kustomization images (named 'controller')
152+
add_image_to_kustomize "controller" "${operatorImageFull}"
144153

145154
#relatedImages
146155
for index in $(yq '.relatedImages.[] | path | .[-1] ' "${OPERATOR_CERT_MANAGER_INDEX}"); do
147156
local image=$(yq ".relatedImages.${index}.image" "${OPERATOR_CERT_MANAGER_INDEX}" )
148157
local component=$(yq ".relatedImages.${index}.name" "${OPERATOR_CERT_MANAGER_INDEX}")
149158
if [[ -n "${component}" && "${OPERATOR_COMPONENTS}" == *"${component}"* ]]; then
150159
yq -i -o json ".images += {\"${component}\": \"${image}\"}" "${cert_manager_release_json}"
160+
add_image_to_kustomize "${component}" "${image}"
151161
sed -i "s#value:.*${component}.*#value: ${image}#g" "${cert_manager_operator_yaml}"
152162

153163
# handle special case istiocsr v istio-csr mismatch
@@ -183,34 +193,17 @@ copy_manifests() {
183193
"$REPOROOT/scripts/auto-rebase/handle_assets.py" "./scripts/auto-rebase/assets_cert_manager.yaml"
184194
}
185195

186-
187-
# Updates embedded component manifests by gathering these from various places
188-
# in the staged repos and copying them into the asset directorcay.
189-
update_cert_manager_manifests() {
190-
pushd "${STAGING_DIR}" >/dev/null
191-
192-
title "Modifying OpenShift manifests"
193-
194-
for index in $(yq '.[] | path | .[-1] ' "${OPERATOR_CERT_MANAGER_INDEX}")
195-
do
196-
image=$(yq ".${index}.image" "${OPERATOR_CERT_MANAGER_INDEX}")
197-
component=$(yq ".${index}.name" "${OPERATOR_CERT_MANAGER_INDEX}")
198-
199-
if [[ -n "${component}" && "${OPERATOR_COMPONENTS}" == *"${component}"* ]]; then
200-
#clone_repo "${repo}" "${commit}" "."
201-
#echo "${repo} embedded-component ${commit}" >> "${new_commits_file}"
202-
echo "${image} ${component}"
203-
fi
204-
done
205-
206-
207-
popd >/dev/null
196+
rebase_cert_manager_to(){
197+
local -r operator_bundle="${1}"
198+
download_cert_manager "${operator_bundle}"
199+
copy_manifests
200+
update_cert_manager_images
208201
}
209202

210203
usage() {
211204
echo "Usage:"
212-
echo "$(basename "$0") to RELEASE_IMAGE_INTEL RELEASE_IMAGE_ARM Performs all the steps to rebase to a release image. Specify both amd64 and arm64 OCP releases."
213-
echo "$(basename "$0") download RELEASE_IMAGE_INTEL RELEASE_IMAGE_ARM Downloads the content of a release image to disk in preparation for rebasing. Specify both amd64 and arm64 OCP releases."
205+
echo "$(basename "$0") to OPM_RELEASE_IMAGE Performs all the steps to rebase to a release image."
206+
echo "$(basename "$0") download OPM_RELEASE_IMAGE Downloads the content of a release image to disk in preparation for rebasing."
214207
echo "$(basename "$0") images Rebases the component images to the downloaded release"
215208
echo "$(basename "$0") manifests Rebases the component manifests to the downloaded release"
216209
exit 1
@@ -221,8 +214,8 @@ check_preconditions
221214
command=${1:-help}
222215
case "$command" in
223216
to)
224-
[[ $# -lt 3 ]] && usage
225-
rebase_to "$2" "$3"
217+
[[ $# -lt 2 ]] && usage
218+
rebase_cert_manager_to "$2"
226219
;;
227220
download)
228221
#[[ $# -lt 3 ]] && usage
@@ -235,7 +228,6 @@ case "$command" in
235228

236229
manifests)
237230
copy_manifests
238-
update_cert_manager_manifests
239231
;;
240232
*) usage;;
241233
esac

scripts/auto-rebase/rebase_job_entrypoint.sh

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,14 +93,15 @@ fi
9393
# New references can be obtained from:
9494
# https://catalog.redhat.com/software/containers/rhoai/odh-operator-bundle/659803ca929f3c931af06f28
9595
rhoai_release="registry.redhat.io/rhoai/odh-operator-bundle:v2.22"
96-
96+
opm_release="registry.redhat.io/redhat/redhat-operator-index:v4.20"
9797
APP_ID=$(cat /secrets/pr-creds/app_id) \
9898
KEY=/secrets/pr-creds/key.pem \
9999
ORG=${ORG:-openshift} \
100100
REPO=${REPO:-microshift} \
101101
AMD64_RELEASE=${PULLSPEC_RELEASE_AMD64} \
102102
ARM64_RELEASE=${PULLSPEC_RELEASE_ARM64} \
103103
RHOAI_RELEASE=${rhoai_release} \
104+
OPM_RELEASE=${opm_release} \
104105
./scripts/auto-rebase/rebase.py
105106

106107
# LVMS is not tracked in the OCP release image. Instead, rely on the

0 commit comments

Comments
 (0)