From 190b5445be375a0f888073b051c2d060837055cc Mon Sep 17 00:00:00 2001 From: Moritz Clasmeier Date: Fri, 6 Feb 2026 11:31:57 +0100 Subject: [PATCH 1/4] Support using konflux built images using --konflux flag --- cmd/deploy.go | 18 ++++++ cmd/main.go | 1 + internal/deployer/deployer.go | 6 ++ internal/deployer/operator.go | 102 ++++++++++++++++++++++++++++++++++ 4 files changed, 127 insertions(+) diff --git a/cmd/deploy.go b/cmd/deploy.go index 320e4e79..826f8ce3 100644 --- a/cmd/deploy.go +++ b/cmd/deploy.go @@ -33,6 +33,7 @@ Examples: cmd.Flags().BoolVar(&helm, "helm", false, "Deploy using Helm charts instead of operator") _ = cmd.Flags().MarkHidden("helm") cmd.Flags().BoolVar(&olm, "olm", false, "Deploy operator via OLM (requires OLM installed)") + cmd.Flags().BoolVar(&konflux, "konflux", false, "Use Konflux images") cmd.Flags().BoolVar(&deployOperator, "deploy-operator", true, "Deploy and check operator (set to false to skip operator deployment/checks)") cmd.Flags().BoolVar(&portForwarding, "port-forwarding", false, "Enable localhost port-forward for Central") cmd.Flags().BoolVar(&pauseReconciliation, "pause-reconciliation", false, "Pause reconciliation after deployment") @@ -114,6 +115,16 @@ func runDeploy(cmd *cobra.Command, args []string) error { return errors.New("cannot use both --helm and --olm flags together") } + if konflux { + if helm { + return errors.New("cannot use both --helm and --konflux flags together (Konflux requires operator-based deployment)") + } + clusterType := env.GetCurrentClusterType() + if clusterType != env.InfraOpenShift4 { + return fmt.Errorf("--konflux flag is only supported on OpenShift 4 clusters (current cluster type: %s)", clusterType.String()) + } + } + if !deployOperator && olm { return errors.New("cannot use --deploy-operator=false with --olm (OLM requires operator deployment)") } @@ -149,6 +160,13 @@ func runDeploy(cmd *cobra.Command, args []string) error { } } + if konflux { + if err := d.SetUseKonflux(true); err != nil { + return err + } + + } + d.SetDeployOperator(deployOperator) d.SetVerbose(verbose) diff --git a/cmd/main.go b/cmd/main.go index 40e0e822..07982b71 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -13,6 +13,7 @@ var ( earlyReadiness bool helm bool olm bool + konflux bool deployOperator bool portForwarding bool pauseReconciliation bool diff --git a/internal/deployer/deployer.go b/internal/deployer/deployer.go index e049f817..43a5b1d6 100644 --- a/internal/deployer/deployer.go +++ b/internal/deployer/deployer.go @@ -112,6 +112,7 @@ type Deployer struct { envrcFile string useHelm bool useOLM bool + useKonflux bool shouldDeployOperator bool verbose bool earlyReadiness bool @@ -701,6 +702,11 @@ func (d *Deployer) SetUseOLM(useOLM bool) error { return nil } +func (d *Deployer) SetUseKonflux(useKonflux bool) error { + d.useKonflux = useKonflux + return nil +} + func (d *Deployer) SetVerbose(verbose bool) { d.verbose = verbose } diff --git a/internal/deployer/operator.go b/internal/deployer/operator.go index 505db6b1..fe2900ff 100644 --- a/internal/deployer/operator.go +++ b/internal/deployer/operator.go @@ -15,6 +15,7 @@ import ( "gopkg.in/yaml.v3" + "github.com/stackrox/roxie/internal/env" "github.com/stackrox/roxie/internal/helpers" ) @@ -27,6 +28,15 @@ const ( // deployOperator deploys the RHACS operator func (d *Deployer) deployOperator(ctx context.Context) error { d.logger.Infof("Operator tag: %s", d.operatorTag) + if d.useKonflux { + if err := d.ensureKonfluxImageRewriting(ctx); err != nil { + return fmt.Errorf("failed to configure Konflux image rewriting: %w", err) + } + } else { + if err := d.removeKonfluxImageRewriting(ctx); err != nil { + return fmt.Errorf("failed to remove Konflux ImageContentSourcePolicy: %v", err) + } + } bundleImage := d.getOperatorBundleImage() bundleDir, err := d.downloadAndExtractOperatorBundle(ctx, bundleImage) @@ -210,9 +220,101 @@ func (d *Deployer) ensureCRDsInstalled(ctx context.Context) error { } func (d *Deployer) getOperatorBundleImage() string { + if d.useKonflux { + d.logger.Infof("Using Konflux-built operator bundle image") + return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s", d.operatorTag) + } return fmt.Sprintf("quay.io/rhacs-eng/stackrox-operator-bundle:v%s", d.operatorTag) } +// ensureKonfluxImageRewriting configures image rewriting for Konflux images +func (d *Deployer) ensureKonfluxImageRewriting(ctx context.Context) error { + if env.GetCurrentClusterType() != env.InfraOpenShift4 { + return errors.New("image rewriting for Konflux is only supported on OpenShift4 clusters") + } + + d.logger.Info("Configuring ImageContentSourcePolicy for Konflux images on OpenShift4...") + return d.applyImageContentSourcePolicy(ctx) +} + +// applyImageContentSourcePolicy creates the ImageContentSourcePolicy for Konflux image mirrors +func (d *Deployer) applyImageContentSourcePolicy(ctx context.Context) error { + // Define repository digest mirrors as Go data structures + rewrite := func(from, to string) map[string]interface{} { + source := fmt.Sprintf("registry.redhat.io/advanced-cluster-security/%s", from) + mirror := fmt.Sprintf("quay.io/rhacs-eng/%s", to) + if d.verbose { + d.logger.Dimf("Image rewriting rule: %s -> %s", source, mirror) + } + return map[string]interface{}{ + "source": source, + "mirrors": []string{mirror}, + } + } + repositoryDigestMirrors := []map[string]interface{}{ + rewrite("rhacs-operator-bundle", "release-operator-bundle"), + rewrite("rhacs-rhel8-operator", "release-operator"), + rewrite("rhacs-main-rhel8", "release-main"), + rewrite("rhacs-scanner-rhel8", "release-scanner"), + rewrite("rhacs-scanner-slim-rhel8", "release-scanner-slim"), + rewrite("rhacs-scanner-db-rhel8", "release-scanner-db"), + rewrite("rhacs-scanner-db-slim-rhel8", "release-scanner-db-slim"), + rewrite("rhacs-collector-slim-rhel8", "release-collector-slim"), + rewrite("rhacs-collector-rhel8", "release-collector"), + rewrite("rhacs-roxctl-rhel8", "release-roxctl"), + rewrite("rhacs-central-db-rhel8", "release-central-db"), + rewrite("rhacs-scanner-v4-db-rhel8", "release-scanner-v4-db"), + rewrite("rhacs-scanner-v4-rhel8", "release-scanner-v4"), + } + + icsp := map[string]interface{}{ + "apiVersion": "operator.openshift.io/v1alpha1", + "kind": "ImageContentSourcePolicy", + "metadata": map[string]interface{}{ + "name": "acs-konflux-builds", + }, + "spec": map[string]interface{}{ + "repositoryDigestMirrors": repositoryDigestMirrors, + }, + } + + yamlData, err := yaml.Marshal(icsp) + if err != nil { + return fmt.Errorf("failed to marshal ImageContentSourcePolicy: %w", err) + } + + d.logger.Dim("Applying ImageContentSourcePolicy...") + _, err = d.runKubectl(ctx, KubectlOptions{ + Args: []string{"apply", "-f", "-"}, + Stdin: bytes.NewReader(yamlData), + }) + if err != nil { + return fmt.Errorf("failed to apply ImageContentSourcePolicy: %w", err) + } + + d.logger.Successf("✓ ImageContentSourcePolicy 'acs-konflux-builds' applied") + d.logger.Info("Note: OpenShift nodes may need to restart to apply the image mirroring configuration") + + return nil +} + +// removeKonfluxImageRewriting removes the ImageContentSourcePolicy for Konflux images if it exists +func (d *Deployer) removeKonfluxImageRewriting(ctx context.Context) error { + if env.GetCurrentClusterType() != env.InfraOpenShift4 { + return nil + } + + d.logger.Dim("Removing Konflux ImageContentSourcePolicy if present...") + _, err := d.runKubectl(ctx, KubectlOptions{ + Args: []string{"delete", "imagecontentsourcepolicy", "acs-konflux-builds", "--ignore-not-found=true"}, + }) + if err != nil { + return fmt.Errorf("failed to delete ImageContentSourcePolicy: %w", err) + } + + return nil +} + // deployOperatorFromCSV deploys the operator from CSV func (d *Deployer) deployOperatorFromCSV(ctx context.Context, bundleDir string) error { csvFile := filepath.Join(bundleDir, "rhacs-operator.clusterserviceversion.yaml") From cf29cf404d4cbe40cdd0971aee346c494608bc76 Mon Sep 17 00:00:00 2001 From: Moritz Clasmeier Date: Fri, 6 Feb 2026 11:47:33 +0100 Subject: [PATCH 2/4] Don't forget -fast suffix for operator bundle --- internal/deployer/operator.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/deployer/operator.go b/internal/deployer/operator.go index fe2900ff..8d5e80db 100644 --- a/internal/deployer/operator.go +++ b/internal/deployer/operator.go @@ -222,7 +222,7 @@ func (d *Deployer) ensureCRDsInstalled(ctx context.Context) error { func (d *Deployer) getOperatorBundleImage() string { if d.useKonflux { d.logger.Infof("Using Konflux-built operator bundle image") - return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s", d.operatorTag) + return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s-fast", d.operatorTag) } return fmt.Sprintf("quay.io/rhacs-eng/stackrox-operator-bundle:v%s", d.operatorTag) } From cbb3e90a558c4910c58fbcf0561eb9833407dba3 Mon Sep 17 00:00:00 2001 From: Moritz Clasmeier Date: Fri, 6 Feb 2026 12:30:24 +0100 Subject: [PATCH 3/4] OLM check --- cmd/deploy.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cmd/deploy.go b/cmd/deploy.go index 826f8ce3..6dcf6678 100644 --- a/cmd/deploy.go +++ b/cmd/deploy.go @@ -119,6 +119,9 @@ func runDeploy(cmd *cobra.Command, args []string) error { if helm { return errors.New("cannot use both --helm and --konflux flags together (Konflux requires operator-based deployment)") } + if olm { + return errors.New("cannot use both --olm and --konflux flags together (not currently implemented)") + } clusterType := env.GetCurrentClusterType() if clusterType != env.InfraOpenShift4 { return fmt.Errorf("--konflux flag is only supported on OpenShift 4 clusters (current cluster type: %s)", clusterType.String()) From 20f9466d153b0216fb589a75b6ca2bde87cd3667 Mon Sep 17 00:00:00 2001 From: Moritz Clasmeier Date: Fri, 6 Feb 2026 14:12:35 +0100 Subject: [PATCH 4/4] Don't append -fast suffix for locating operator bundle --- internal/deployer/operator.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/deployer/operator.go b/internal/deployer/operator.go index 8d5e80db..fe2900ff 100644 --- a/internal/deployer/operator.go +++ b/internal/deployer/operator.go @@ -222,7 +222,7 @@ func (d *Deployer) ensureCRDsInstalled(ctx context.Context) error { func (d *Deployer) getOperatorBundleImage() string { if d.useKonflux { d.logger.Infof("Using Konflux-built operator bundle image") - return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s-fast", d.operatorTag) + return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s", d.operatorTag) } return fmt.Sprintf("quay.io/rhacs-eng/stackrox-operator-bundle:v%s", d.operatorTag) }