chore: bump sandboxed-containers-operator to v1.13.1 - #143
Open
butler54 wants to merge 1 commit into
Open
Conversation
Bumps the pinned OSC operator CSV from v1.13.0 to v1.13.1 in every topology values file: values-azure.yaml, values-baremetal.yaml, values-baremetal-hub.yaml, values-baremetal-spoke.yaml: v1.13.0 -> v1.13.1 values-azure-spoke.yaml was independently pinned to v1.12.0 (not 1.13.0 like every other topology) -- spoke should always track primary, so this also moves it to v1.13.1 directly, reconciling the drift rather than just bumping it in place. Also bumps airgap/imageset-config-4.22.yaml's sandboxed-containers-operator minVersion/maxVersion to "1.13.1" so the airgap oc-mirror bundle pin stays in sync with the values-file pin -- otherwise the airgap mirror would only ever carry 1.13.0 and the pin above would be unsatisfiable in that topology. Depends on validatedpatterns#142 (align refval collection with the pinned OSC version) for correct reference-value collection against this new pin -- without it, `make collect-azure-refvals` would need an explicit --osc-version override to avoid drifting to `latest` again. Note: sandboxed-containers-operator 1.13.1's companion osc-dm-verity-image was confirmed to exist and verify successfully (cosign) against registry.redhat.io. The operator bundle's presence in the redhat-operator-index:v4.22 catalog channel (relevant to the imageset-config-4.22.yaml change specifically) was not independently confirmed -- tooling available (skopeo, oc-mirror) either enumerated the full multi-thousand-tag catalog index or hit registry auth issues unrelated to the pull secret's validity. Please verify catalog channel availability before running an airgap mirror against this pin. Operational follow-up (not done here): after this merges, re-run `make collect-azure-refvals` / `make collect-firmware-refvals` and `make load-secrets` against the new pin on any existing deployment, since the reference-value hashes tied to 1.13.0 no longer match a 1.13.1 install.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the pinned
sandboxed-containers-operatorCSV fromv1.13.0tov1.13.1:values-azure.yamlv1.13.0v1.13.1values-azure-spoke.yamlv1.12.0v1.13.1values-baremetal.yamlv1.13.0v1.13.1values-baremetal-hub.yamlv1.13.0v1.13.1values-baremetal-spoke.yamlv1.13.0v1.13.1airgap/imageset-config-4.22.yaml(oc-mirror bundle pin)1.13.01.13.1values-azure-spoke.yamlwas independently pinned tov1.12.0— the onlyoutlier vs. every other topology's
v1.13.0. Per team decision, spoke shouldalways track primary (
values-azure.yaml), so this reconciles the driftdirectly to
v1.13.1rather than bumping it in place atv1.12.0.Depends on
#142 — without that fix,
make collect-azure-refvalswould resolve OSCversion via live-cluster auto-detect /
"latest"fallback rather than thispin, and could silently collect the wrong reference values again (the exact
bug #142 fixes).
Verification
osc-dm-verity-image:1.13.1confirmed to exist and verify successfully viacosign against
registry.redhat.io(used throughout fix: align refval collection with pinned OSC version, not live/latest #142's testing).sandboxed-containers-operator1.13.1 bundle is present in the
redhat-operator-index:v4.22catalog'sstablechannel (relevant to theimageset-config-4.22.yamlchange).skopeo inspecton the full catalog index enumerates several thousand tagsand wasn't practical to use for channel introspection;
oc-mirror list operatorshit a registry auth error unrelated to pull-secret validity.Please verify catalog channel availability before running an airgap
mirror against this pin.
Operational follow-up (not done in this PR)
On any existing deployment, after this merges:
make collect-azure-refvals # or collect-firmware-refvals for bare metal make load-secretsReference-value hashes tied to
1.13.0(e.g.snp_pcr09/snp_pcr12, theinitrd/cmdline PCR measurements) do not match a
1.13.1install.