Skip to content

Commit 3b22e24

Browse files
gpontejos-csgpontejos-cs
committed
multiple fixes for validation
1 parent c109080 commit 3b22e24

3 files changed

Lines changed: 119 additions & 36 deletions

File tree

‎Makefile‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,12 @@
33
# To re-generate a bundle for another specific version without changing the standard setup, you can:
44
# - use the VERSION as arg of the bundle target (e.g make bundle VERSION=0.0.2)
55
# - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
6-
VERSION ?= 1.5.0
6+
VERSION ?= 1.13.0
7+
8+
# PREVIOUS_VERSION defines the version that this release replaces.
9+
# Update this value when you bump VERSION to the next release.
10+
# This is used to set spec.replaces in the OpenShift bundle CSV.
11+
PREVIOUS_VERSION ?= 1.12.1
712

813
# CHANNELS define the bundle channels used in the bundle.
914
# Add a new line here if you would like to change its default config. (E.g CHANNELS = "candidate,fast,stable")

‎hack/patch-openshift-bundle.sh‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,23 +58,34 @@ yq -i '.metadata.annotations."operators.openshift.io/valid-subscription" = "Not
5858
# Step 3: Fetch and add relatedImages
5959
echo "Fetching latest image digests for relatedImages..."
6060

61+
# Read VERSION and PREVIOUS_VERSION from Makefile
62+
VERSION=$(grep -E '^VERSION\s*\?=' "${PROJECT_ROOT}/Makefile" | awk '{print $3}')
63+
if [ -z "$VERSION" ]; then
64+
echo "Error: VERSION not found in Makefile" >&2
65+
exit 1
66+
fi
67+
68+
PREVIOUS_VERSION=$(grep -E '^PREVIOUS_VERSION\s*\?=' "${PROJECT_ROOT}/Makefile" | awk '{print $3}')
69+
if [ -z "$PREVIOUS_VERSION" ]; then
70+
echo "Error: PREVIOUS_VERSION not found in Makefile" >&2
71+
exit 1
72+
fi
73+
74+
echo "Using VERSION=${VERSION} and PREVIOUS_VERSION=${PREVIOUS_VERSION} from Makefile"
75+
6176
echo " Fetching falcon-operator image..."
6277
eval "$("$GET_IMAGE_SCRIPT" falcon-operator)"
6378
OPERATOR_DIGEST="$manifest_list_digest"
64-
OPERATOR_VERSION="$tag"
65-
66-
# Save the current version before updating (for replaces field)
67-
PREVIOUS_VERSION=$(yq '.spec.version' "$CSV_FILE")
6879

6980
# Update containerImage annotation with operator image and digest
7081
echo "Updating containerImage annotation..."
7182
yq -i ".metadata.annotations.containerImage = \"registry.connect.redhat.com/crowdstrike/falcon-operator@${OPERATOR_DIGEST}\"" "$CSV_FILE"
7283

73-
# Update spec.version with the latest operator version
74-
echo "Updating spec.version to ${OPERATOR_VERSION}..."
75-
yq -i ".spec.version = \"${OPERATOR_VERSION}\"" "$CSV_FILE"
84+
# Update spec.version with the VERSION from Makefile
85+
echo "Updating spec.version to ${VERSION}..."
86+
yq -i ".spec.version = \"${VERSION}\"" "$CSV_FILE"
7687

77-
# Update spec.replaces with the previous version
88+
# Update spec.replaces with the PREVIOUS_VERSION from Makefile
7889
echo "Updating spec.replaces to falcon-operator.v${PREVIOUS_VERSION}..."
7990
yq -i ".spec.replaces = \"falcon-operator.v${PREVIOUS_VERSION}\"" "$CSV_FILE"
8091

‎hack/validate-openshift-bundle.sh‎

Lines changed: 94 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -73,36 +73,71 @@ echo ""
7373
# --- Section 2: SCC Permissions ---
7474
echo "SCC Permissions:"
7575

76-
SCC_SA=$(yq '.spec.install.spec.clusterPermissions[] | select(.serviceAccountName == "falcon-operator-node-sensor") | .serviceAccountName' "$CSV_FILE")
77-
check_eq "SCC serviceAccount present" "$SCC_SA" "falcon-operator-node-sensor"
76+
SCC_PATCH_FILE="${PROJECT_ROOT}/hack/patch-openshift-scc.yaml"
77+
if [ ! -f "$SCC_PATCH_FILE" ]; then
78+
fail "patch-openshift-scc.yaml not found"
79+
else
80+
# Read expected values from patch file
81+
EXPECTED_SCC_SA=$(yq '.[0].serviceAccountName' "$SCC_PATCH_FILE")
82+
EXPECTED_SCC_APIGROUP=$(yq '.[0].rules[0].apiGroups[0]' "$SCC_PATCH_FILE")
83+
EXPECTED_SCC_RESOURCE=$(yq '.[0].rules[0].resources[0]' "$SCC_PATCH_FILE")
84+
EXPECTED_SCC_VERB=$(yq '.[0].rules[0].verbs[0]' "$SCC_PATCH_FILE")
85+
EXPECTED_SCC_RESNAME=$(yq '.[0].rules[0].resourceNames[0]' "$SCC_PATCH_FILE")
86+
87+
# Validate against CSV
88+
SCC_SA=$(yq ".spec.install.spec.clusterPermissions[] | select(.serviceAccountName == \"${EXPECTED_SCC_SA}\") | .serviceAccountName" "$CSV_FILE")
89+
check_eq "SCC serviceAccount present" "$SCC_SA" "$EXPECTED_SCC_SA"
7890

79-
SCC_APIGROUP=$(yq '.spec.install.spec.clusterPermissions[] | select(.serviceAccountName == "falcon-operator-node-sensor") | .rules[].apiGroups[]' "$CSV_FILE")
80-
check_eq "SCC apiGroup" "$SCC_APIGROUP" "security.openshift.io"
91+
SCC_APIGROUP=$(yq ".spec.install.spec.clusterPermissions[] | select(.serviceAccountName == \"${EXPECTED_SCC_SA}\") | .rules[].apiGroups[]" "$CSV_FILE")
92+
check_eq "SCC apiGroup" "$SCC_APIGROUP" "$EXPECTED_SCC_APIGROUP"
8193

82-
SCC_RESOURCE=$(yq '.spec.install.spec.clusterPermissions[] | select(.serviceAccountName == "falcon-operator-node-sensor") | .rules[].resources[]' "$CSV_FILE")
83-
check_eq "SCC resource" "$SCC_RESOURCE" "securitycontextconstraints"
94+
SCC_RESOURCE=$(yq ".spec.install.spec.clusterPermissions[] | select(.serviceAccountName == \"${EXPECTED_SCC_SA}\") | .rules[].resources[]" "$CSV_FILE")
95+
check_eq "SCC resource" "$SCC_RESOURCE" "$EXPECTED_SCC_RESOURCE"
8496

85-
SCC_VERB=$(yq '.spec.install.spec.clusterPermissions[] | select(.serviceAccountName == "falcon-operator-node-sensor") | .rules[].verbs[]' "$CSV_FILE")
86-
check_eq "SCC verb" "$SCC_VERB" "use"
97+
SCC_VERB=$(yq ".spec.install.spec.clusterPermissions[] | select(.serviceAccountName == \"${EXPECTED_SCC_SA}\") | .rules[].verbs[]" "$CSV_FILE")
98+
check_eq "SCC verb" "$SCC_VERB" "$EXPECTED_SCC_VERB"
8799

88-
SCC_RESNAME=$(yq '.spec.install.spec.clusterPermissions[] | select(.serviceAccountName == "falcon-operator-node-sensor") | .rules[].resourceNames[]' "$CSV_FILE")
89-
check_eq "SCC resourceName" "$SCC_RESNAME" "privileged"
100+
SCC_RESNAME=$(yq ".spec.install.spec.clusterPermissions[] | select(.serviceAccountName == \"${EXPECTED_SCC_SA}\") | .rules[].resourceNames[]" "$CSV_FILE")
101+
check_eq "SCC resourceName" "$SCC_RESNAME" "$EXPECTED_SCC_RESNAME"
102+
fi
90103

91104
echo ""
92105

93106
# --- Section 3: Version and Replaces ---
94107
echo "Version and Replaces:"
95108

109+
# Validate spec.version format
96110
VERSION=$(yq '.spec.version' "$CSV_FILE")
97111
if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
98112
pass "spec.version is semver ($VERSION)"
99113
else
100114
fail "spec.version is not valid semver (got: $VERSION)"
101115
fi
102116

117+
# Validate spec.version matches Makefile VERSION
118+
MAKEFILE_VERSION=$(grep -E '^VERSION\s*\?=' "${PROJECT_ROOT}/Makefile" | awk '{print $3}')
119+
check_eq "spec.version matches Makefile VERSION" "$VERSION" "$MAKEFILE_VERSION"
120+
121+
# Validate spec.replaces exists and format
103122
REPLACES=$(yq '.spec.replaces' "$CSV_FILE")
104-
if echo "$REPLACES" | grep -qE '^falcon-operator\.v[0-9]+\.[0-9]+\.[0-9]+'; then
123+
if [ -z "$REPLACES" ] || [ "$REPLACES" = "null" ]; then
124+
fail "spec.replaces is missing (bundle needs to be patched)"
125+
elif echo "$REPLACES" | grep -qE '^falcon-operator\.v[0-9]+\.[0-9]+\.[0-9]+'; then
105126
pass "spec.replaces follows naming convention ($REPLACES)"
127+
128+
# Extract version from replaces
129+
REPLACES_VERSION=$(echo "$REPLACES" | sed 's/^falcon-operator\.v//')
130+
131+
# Validate replaces version differs from current version
132+
if [ "$VERSION" = "$REPLACES_VERSION" ]; then
133+
fail "spec.replaces version ($REPLACES_VERSION) must not match spec.version ($VERSION)"
134+
else
135+
pass "spec.replaces version differs from spec.version"
136+
fi
137+
138+
# Validate replaces version matches Makefile PREVIOUS_VERSION
139+
MAKEFILE_PREVIOUS_VERSION=$(grep -E '^PREVIOUS_VERSION\s*\?=' "${PROJECT_ROOT}/Makefile" | awk '{print $3}')
140+
check_eq "spec.replaces matches Makefile PREVIOUS_VERSION" "$REPLACES_VERSION" "$MAKEFILE_PREVIOUS_VERSION"
106141
else
107142
fail "spec.replaces should match falcon-operator.vX.Y.Z (got: $REPLACES)"
108143
fi
@@ -151,12 +186,30 @@ RELATED_COUNT=$(yq '.spec.relatedImages | length' "$CSV_FILE")
151186
check_eq "relatedImages count" "$RELATED_COUNT" "5"
152187

153188
EXPECTED_NAMES=("operator" "node-sensor" "sidecar-sensor" "admission-controller" "image-analyzer")
154-
for name in "${EXPECTED_NAMES[@]}"; do
189+
EXPECTED_REGISTRIES=(
190+
"registry.connect.redhat.com/crowdstrike/falcon-operator"
191+
"registry.crowdstrike.com/falcon-sensor/release/falcon-sensor"
192+
"registry.crowdstrike.com/falcon-container/release/falcon-container"
193+
"registry.crowdstrike.com/falcon-kac/release/falcon-kac"
194+
"registry.crowdstrike.com/falcon-imageanalyzer/release/falcon-imageanalyzer"
195+
)
196+
197+
for i in "${!EXPECTED_NAMES[@]}"; do
198+
name="${EXPECTED_NAMES[$i]}"
199+
expected_registry="${EXPECTED_REGISTRIES[$i]}"
200+
155201
IMG=$(yq ".spec.relatedImages[] | select(.name == \"${name}\") | .image" "$CSV_FILE")
156202
if [ -z "$IMG" ] || [ "$IMG" = "null" ]; then
157203
fail "relatedImages entry '$name' not found"
158204
elif echo "$IMG" | grep -q "@sha256:"; then
159205
pass "relatedImages '$name' uses digest"
206+
207+
# Validate the registry/repo path
208+
if echo "$IMG" | grep -q "^${expected_registry}@sha256:"; then
209+
pass "relatedImages '$name' uses correct registry"
210+
else
211+
fail "relatedImages '$name' should use ${expected_registry} (got: $IMG)"
212+
fi
160213
else
161214
fail "relatedImages '$name' should use digest (got: $IMG)"
162215
fi
@@ -167,24 +220,38 @@ echo ""
167220
# --- Section 7: Skips ---
168221
echo "Skips:"
169222

170-
SKIPS_COUNT=$(yq '.spec.skips | length' "$CSV_FILE")
171-
if [ "$SKIPS_COUNT" -gt 0 ]; then
172-
pass "spec.skips present ($SKIPS_COUNT entries)"
223+
SKIPS_PATCH_FILE="${PROJECT_ROOT}/hack/patch-openshift-skips.yaml"
224+
if [ ! -f "$SKIPS_PATCH_FILE" ]; then
225+
fail "patch-openshift-skips.yaml not found"
173226
else
174-
fail "spec.skips should have entries"
227+
# Read expected skips from patch file
228+
mapfile -t EXPECTED_SKIPS < <(yq '.[]' "$SKIPS_PATCH_FILE")
229+
EXPECTED_COUNT="${#EXPECTED_SKIPS[@]}"
230+
231+
# Validate count
232+
SKIPS_COUNT=$(yq '.spec.skips | length' "$CSV_FILE")
233+
check_eq "skips count matches patch file" "$SKIPS_COUNT" "$EXPECTED_COUNT"
234+
235+
# Validate each skip entry
236+
for skip in "${EXPECTED_SKIPS[@]}"; do
237+
FOUND=$(yq ".spec.skips[] | select(. == \"${skip}\")" "$CSV_FILE")
238+
if [ "$FOUND" = "$skip" ]; then
239+
pass "skips contains '$skip'"
240+
else
241+
fail "skips missing '$skip'"
242+
fi
243+
done
244+
245+
# Validate format of all entries
246+
while IFS= read -r skip_entry; do
247+
if echo "$skip_entry" | grep -qE '^falcon-operator\.v[0-9]+\.[0-9]+\.[0-9]+$'; then
248+
pass "skip entry '$skip_entry' follows naming convention"
249+
else
250+
fail "skip entry '$skip_entry' should match falcon-operator.vX.Y.Z"
251+
fi
252+
done < <(yq '.spec.skips[]' "$CSV_FILE")
175253
fi
176254

177-
# Verify expected skips entries
178-
EXPECTED_SKIPS=("falcon-operator.v1.3.0" "falcon-operator.v1.12.0")
179-
for skip in "${EXPECTED_SKIPS[@]}"; do
180-
FOUND=$(yq ".spec.skips[] | select(. == \"${skip}\")" "$CSV_FILE")
181-
if [ "$FOUND" = "$skip" ]; then
182-
pass "skips contains '$skip'"
183-
else
184-
fail "skips missing '$skip'"
185-
fi
186-
done
187-
188255
echo ""
189256

190257
# --- Section 8: Bundle Metadata Annotations ---

0 commit comments

Comments
 (0)