[openshift_setup] Add catalog registry auth and signature policy bypass - #4087
[openshift_setup] Add catalog registry auth and signature policy bypass#4087rebtoor wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
When cifmw_openshift_setup_catalog_registry_credentials is defined: - Merge the auth into the cluster pull-secret so nodes can pull from the Konflux image-rbac-proxy registry. - Add the catalog registry to insecure and allowed registries to bypass image signature validation for Konflux-built FBC catalogs. - Wait for MachineConfigPools to settle after IDMS + pull-secret changes before proceeding. Related-Issue: #OSPCIX-1431 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
af8785f to
2dcb13c
Compare
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 57m 07s |
2 participants
Summary
When
cifmw_openshift_setup_catalog_registry_credentialsis defined:openshift-config/pull-secretso nodes can pull from the Konfluximage-rbac-proxyregistry.insecureRegistriesandallowedRegistriesto bypass image signature validation for Konflux-built FBC catalogs.All three actions are gated on
cifmw_openshift_setup_catalog_registry_credentials— jobs that don't set it are completely unaffected.Context
Architecture-update jobs on OCP 4.18 need
openstack-operator.v1.0.7from a Konflux FBC catalog behindimage-rbac-proxy. The cluster needs pull-secret credentials AND signature policy bypass for that registry before the CatalogSource pod can pull.Related-Issue: #ANVIL-159