From f35f876aee79bd321e211a821443f7132a697ec6 Mon Sep 17 00:00:00 2001 From: Pratik Langde Date: Mon, 7 Sep 2026 21:09:35 +0530 Subject: [PATCH 1/2] Preserve non-OLM component image defaults when bundle CSV values are missing When USE_BUNDLE_IMG=true, extract_component_images_from_bundle_image unconditionally overwrote component image variables with yq output. Missing or empty CSV env vars produced empty image overrides and broke disconnected non-OLM install and upgrade paths. Only override each component image when the bundle CSV provides a non-empty value; otherwise keep script defaults. Fixes redhat-developer/gitops-operator#1262 Signed-off-by: Pratik Langde --- .../install-gitops-operator.sh | 38 +++++++++++++------ 1 file changed, 27 insertions(+), 11 deletions(-) diff --git a/hack/non-olm-install/install-gitops-operator.sh b/hack/non-olm-install/install-gitops-operator.sh index f0fb46a075c..a66e1ad3b89 100755 --- a/hack/non-olm-install/install-gitops-operator.sh +++ b/hack/non-olm-install/install-gitops-operator.sh @@ -268,23 +268,39 @@ spec: type: RuntimeDefault" > ${WORK_DIR}/security-context.yaml } +function apply_bundle_env_image_override() { + local var_name="$1" + local env_name="$2" + local bundle_value + + bundle_value=$(cat "${WORK_DIR}"/container.yaml | ${YQ} ".env[] | select(.name==\"${env_name}\").value") + if [ -n "${bundle_value}" ] && [ "${bundle_value}" != "null" ]; then + eval "${var_name}=\"${bundle_value}\"" + fi +} + function extract_component_images_from_bundle_image() { ${REGCTL} image get-file "${BUNDLE_IMG}" manifests/gitops-operator.clusterserviceversion.yaml "${WORK_DIR}"/gitops-operator.clusterserviceversion.yaml CONTAINER_YAML=$(cat "${WORK_DIR}"/gitops-operator.clusterserviceversion.yaml | ${YQ} '.spec.install.spec | .deployments[0].spec.template.spec.containers[0]' > "${WORK_DIR}"/container.yaml) # Get the operator image from the CSV of the operator bundle - OPERATOR_IMG=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.image') - - # Get the component images from the CSV of the operator bundle - ARGOCD_DEX_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="ARGOCD_DEX_IMAGE").value') - ARGOCD_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="ARGOCD_IMAGE").value') - ARGOCD_KEYCLOAK_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="ARGOCD_KEYCLOAK_IMAGE").value') - ARGOCD_REDIS_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="ARGOCD_REDIS_IMAGE").value') - ARGOCD_REDIS_HA_PROXY_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="ARGOCD_REDIS_HA_PROXY_IMAGE").value') - BACKEND_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="BACKEND_IMAGE").value') - GITOPS_CONSOLE_PLUGIN_IMAGE=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="GITOPS_CONSOLE_PLUGIN_IMAGE").value') - GITOPS_CONSOLE_PLUGIN_IMAGE_PF5=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.env[] | select(.name=="GITOPS_CONSOLE_PLUGIN_IMAGE_PF5").value') + local bundle_operator_img + bundle_operator_img=$(cat "${WORK_DIR}"/container.yaml | ${YQ} '.image') + if [ -n "${bundle_operator_img}" ] && [ "${bundle_operator_img}" != "null" ]; then + OPERATOR_IMG="${bundle_operator_img}" + fi + + # Get the component images from the CSV of the operator bundle. + # Preserve script defaults when the bundle CSV omits a variable or value is empty. + apply_bundle_env_image_override ARGOCD_DEX_IMAGE ARGOCD_DEX_IMAGE + apply_bundle_env_image_override ARGOCD_IMAGE ARGOCD_IMAGE + apply_bundle_env_image_override ARGOCD_KEYCLOAK_IMAGE ARGOCD_KEYCLOAK_IMAGE + apply_bundle_env_image_override ARGOCD_REDIS_IMAGE ARGOCD_REDIS_IMAGE + apply_bundle_env_image_override ARGOCD_REDIS_HA_PROXY_IMAGE ARGOCD_REDIS_HA_PROXY_IMAGE + apply_bundle_env_image_override BACKEND_IMAGE BACKEND_IMAGE + apply_bundle_env_image_override GITOPS_CONSOLE_PLUGIN_IMAGE GITOPS_CONSOLE_PLUGIN_IMAGE + apply_bundle_env_image_override GITOPS_CONSOLE_PLUGIN_IMAGE_PF5 GITOPS_CONSOLE_PLUGIN_IMAGE_PF5 } # Initialize a temporary work directory to store the artifacts and From 0c7d0c8e819152a0fc561a227a1a3c06040e5547 Mon Sep 17 00:00:00 2001 From: Pratik Langde Date: Mon, 7 Sep 2026 21:09:35 +0530 Subject: [PATCH 2/2] Avoid eval when applying bundle image overrides Use printf -v to assign bundle CSV image values without reparsing untrusted bundle content as shell. Signed-off-by: Pratik Langde --- hack/non-olm-install/install-gitops-operator.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hack/non-olm-install/install-gitops-operator.sh b/hack/non-olm-install/install-gitops-operator.sh index a66e1ad3b89..7d028cf563f 100755 --- a/hack/non-olm-install/install-gitops-operator.sh +++ b/hack/non-olm-install/install-gitops-operator.sh @@ -275,7 +275,7 @@ function apply_bundle_env_image_override() { bundle_value=$(cat "${WORK_DIR}"/container.yaml | ${YQ} ".env[] | select(.name==\"${env_name}\").value") if [ -n "${bundle_value}" ] && [ "${bundle_value}" != "null" ]; then - eval "${var_name}=\"${bundle_value}\"" + printf -v "$var_name" '%s' "$bundle_value" fi }