Support using konflux built images using --konflux flag

cmd/deploy.go

@@ -33,6 +33,7 @@ Examples:
 	cmd.Flags().BoolVar(&helm, "helm", false, "Deploy using Helm charts instead of operator")
 	_ = cmd.Flags().MarkHidden("helm")
 	cmd.Flags().BoolVar(&olm, "olm", false, "Deploy operator via OLM (requires OLM installed)")
+	cmd.Flags().BoolVar(&konflux, "konflux", false, "Use Konflux images")
 	cmd.Flags().BoolVar(&deployOperator, "deploy-operator", true, "Deploy and check operator (set to false to skip operator deployment/checks)")
 	cmd.Flags().BoolVar(&portForwarding, "port-forwarding", false, "Enable localhost port-forward for Central")
 	cmd.Flags().BoolVar(&pauseReconciliation, "pause-reconciliation", false, "Pause reconciliation after deployment")
@@ -114,6 +115,19 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		return errors.New("cannot use both --helm and --olm flags together")
 	}
 
+	if konflux {
+		if helm {
+			return errors.New("cannot use both --helm and --konflux flags together (Konflux requires operator-based deployment)")
+		}
+		if olm {
+			return errors.New("cannot use both --olm and --konflux flags together (not currently implemented)")
+		}
+		clusterType := env.GetCurrentClusterType()
+		if clusterType != env.InfraOpenShift4 {
+			return fmt.Errorf("--konflux flag is only supported on OpenShift 4 clusters (current cluster type: %s)", clusterType.String())
+		}
+	}
+
 	if !deployOperator && olm {
 		return errors.New("cannot use --deploy-operator=false with --olm (OLM requires operator deployment)")
 	}
@@ -149,6 +163,13 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		}
 	}
 
+	if konflux {
+		if err := d.SetUseKonflux(true); err != nil {
+			return err
+		}
+
+	}
+
 	d.SetDeployOperator(deployOperator)
 
 	d.SetVerbose(verbose)

cmd/main.go

@@ -13,6 +13,7 @@ var (
 	earlyReadiness         bool
 	helm                   bool
 	olm                    bool
+	konflux                bool
 	deployOperator         bool
 	portForwarding         bool
 	pauseReconciliation    bool

internal/deployer/deployer.go

@@ -112,6 +112,7 @@ type Deployer struct {
 	envrcFile              string
 	useHelm                bool
 	useOLM                 bool
+	useKonflux             bool
 	shouldDeployOperator   bool
 	verbose                bool
 	earlyReadiness         bool
@@ -701,6 +702,11 @@ func (d *Deployer) SetUseOLM(useOLM bool) error {
 	return nil
 }
 
+func (d *Deployer) SetUseKonflux(useKonflux bool) error {
+	d.useKonflux = useKonflux
+	return nil
+}
+
 func (d *Deployer) SetVerbose(verbose bool) {
 	d.verbose = verbose
 }

internal/deployer/operator.go

@@ -15,6 +15,7 @@ import (
 
 	"gopkg.in/yaml.v3"
 
+	"github.com/stackrox/roxie/internal/env"
 	"github.com/stackrox/roxie/internal/helpers"
 )
 
@@ -27,6 +28,15 @@ const (
 // deployOperator deploys the RHACS operator
 func (d *Deployer) deployOperator(ctx context.Context) error {
 	d.logger.Infof("Operator tag: %s", d.operatorTag)
+	if d.useKonflux {
+		if err := d.ensureKonfluxImageRewriting(ctx); err != nil {
+			return fmt.Errorf("failed to configure Konflux image rewriting: %w", err)
+		}
+	} else {
+		if err := d.removeKonfluxImageRewriting(ctx); err != nil {
+			return fmt.Errorf("failed to remove Konflux ImageContentSourcePolicy: %v", err)
+		}
+	}
 	bundleImage := d.getOperatorBundleImage()
 
 	bundleDir, err := d.downloadAndExtractOperatorBundle(ctx, bundleImage)
@@ -210,9 +220,101 @@ func (d *Deployer) ensureCRDsInstalled(ctx context.Context) error {
 }
 
 func (d *Deployer) getOperatorBundleImage() string {
+	if d.useKonflux {
+		d.logger.Infof("Using Konflux-built operator bundle image")
+		return fmt.Sprintf("quay.io/rhacs-eng/release-operator-bundle:v%s", d.operatorTag)
+	}
 	return fmt.Sprintf("quay.io/rhacs-eng/stackrox-operator-bundle:v%s", d.operatorTag)
 }
 
+// ensureKonfluxImageRewriting configures image rewriting for Konflux images
+func (d *Deployer) ensureKonfluxImageRewriting(ctx context.Context) error {
+	if env.GetCurrentClusterType() != env.InfraOpenShift4 {
+		return errors.New("image rewriting for Konflux is only supported on OpenShift4 clusters")
+	}
+
+	d.logger.Info("Configuring ImageContentSourcePolicy for Konflux images on OpenShift4...")
+	return d.applyImageContentSourcePolicy(ctx)
+}
+
+// applyImageContentSourcePolicy creates the ImageContentSourcePolicy for Konflux image mirrors
+func (d *Deployer) applyImageContentSourcePolicy(ctx context.Context) error {
+	// Define repository digest mirrors as Go data structures
+	rewrite := func(from, to string) map[string]interface{} {
+		source := fmt.Sprintf("registry.redhat.io/advanced-cluster-security/%s", from)
+		mirror := fmt.Sprintf("quay.io/rhacs-eng/%s", to)
+		if d.verbose {
+			d.logger.Dimf("Image rewriting rule: %s -> %s", source, mirror)
+		}
+		return map[string]interface{}{
+			"source":  source,
+			"mirrors": []string{mirror},
+		}
+	}
+	repositoryDigestMirrors := []map[string]interface{}{
+		rewrite("rhacs-operator-bundle", "release-operator-bundle"),
+		rewrite("rhacs-rhel8-operator", "release-operator"),
+		rewrite("rhacs-main-rhel8", "release-main"),
+		rewrite("rhacs-scanner-rhel8", "release-scanner"),
+		rewrite("rhacs-scanner-slim-rhel8", "release-scanner-slim"),
+		rewrite("rhacs-scanner-db-rhel8", "release-scanner-db"),
+		rewrite("rhacs-scanner-db-slim-rhel8", "release-scanner-db-slim"),
+		rewrite("rhacs-collector-slim-rhel8", "release-collector-slim"),
+		rewrite("rhacs-collector-rhel8", "release-collector"),
+		rewrite("rhacs-roxctl-rhel8", "release-roxctl"),
+		rewrite("rhacs-central-db-rhel8", "release-central-db"),
+		rewrite("rhacs-scanner-v4-db-rhel8", "release-scanner-v4-db"),
+		rewrite("rhacs-scanner-v4-rhel8", "release-scanner-v4"),
+	}
+
+	icsp := map[string]interface{}{
+		"apiVersion": "operator.openshift.io/v1alpha1",
+		"kind":       "ImageContentSourcePolicy",
+		"metadata": map[string]interface{}{
+			"name": "acs-konflux-builds",
+		},
+		"spec": map[string]interface{}{
+			"repositoryDigestMirrors": repositoryDigestMirrors,
+		},
+	}
+
+	yamlData, err := yaml.Marshal(icsp)
+	if err != nil {
+		return fmt.Errorf("failed to marshal ImageContentSourcePolicy: %w", err)
+	}
+
+	d.logger.Dim("Applying ImageContentSourcePolicy...")
+	_, err = d.runKubectl(ctx, KubectlOptions{
+		Args:  []string{"apply", "-f", "-"},
+		Stdin: bytes.NewReader(yamlData),
+	})
+	if err != nil {
+		return fmt.Errorf("failed to apply ImageContentSourcePolicy: %w", err)
+	}
+
+	d.logger.Successf("✓ ImageContentSourcePolicy 'acs-konflux-builds' applied")
+	d.logger.Info("Note: OpenShift nodes may need to restart to apply the image mirroring configuration")
+
+	return nil
+}
+
+// removeKonfluxImageRewriting removes the ImageContentSourcePolicy for Konflux images if it exists
+func (d *Deployer) removeKonfluxImageRewriting(ctx context.Context) error {
+	if env.GetCurrentClusterType() != env.InfraOpenShift4 {
+		return nil
+	}
+
+	d.logger.Dim("Removing Konflux ImageContentSourcePolicy if present...")
+	_, err := d.runKubectl(ctx, KubectlOptions{
+		Args: []string{"delete", "imagecontentsourcepolicy", "acs-konflux-builds", "--ignore-not-found=true"},
+	})
+	if err != nil {
+		return fmt.Errorf("failed to delete ImageContentSourcePolicy: %w", err)
+	}
+
+	return nil
+}
+
 // deployOperatorFromCSV deploys the operator from CSV
 func (d *Deployer) deployOperatorFromCSV(ctx context.Context, bundleDir string) error {
 	csvFile := filepath.Join(bundleDir, "rhacs-operator.clusterserviceversion.yaml")