Merge pull request #236 from dustman9000/termination-message-policy

SREP-4556: Add terminationMessagePolicy for OCP 4.21 conformance

Author: openshift-merge-bot[bot]

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: boilerplate
   namespace: openshift
-  tag: image-v8.3.4
+  tag: image-v8.3.5

OWNERS_ALIASES

@@ -61,7 +61,6 @@ aliases:
     - casey-williams-rh
     - boranx
   srep-functional-team-thor:
-    - a7vicky
     - diakovnec
     - MitaliBhalla
     - feichashao
@@ -92,5 +91,4 @@ aliases:
     - maorfr
     - rogbas
   srep-architects:
-    - jharrington22
     - cblecker

boilerplate/_data/backing-image-tag

@@ -1 +1 @@
-image-v8.3.4
+image-v8.3.5

boilerplate/_data/last-boilerplate-commit

@@ -1 +1 @@
-0613e5c5f79aec861fd0afe53b6a9373b8d169d7
+294b1978042a939fb940bc8ae89e498991a7ca43

boilerplate/openshift/golang-osd-operator/OWNERS_ALIASES

@@ -61,7 +61,6 @@ aliases:
     - casey-williams-rh
     - boranx
   srep-functional-team-thor:
-    - a7vicky
     - diakovnec
     - MitaliBhalla
     - feichashao
@@ -92,5 +91,4 @@ aliases:
     - maorfr
     - rogbas
   srep-architects:
-    - jharrington22
     - cblecker

boilerplate/openshift/golang-osd-operator/README.md

@@ -119,6 +119,18 @@ Checks consist of:
 - `go generate`. This is a no-op if you have no `//go:generate`
   directives in your code.
 
+## PKO (Package Operator) fixture validation
+
+Operators deployed via [Package Operator](https://package-operator.run/) can define snapshot test fixtures that validate `.gotmpl` template rendering. If `deploy_pko/manifest.yaml` exists and contains a `test:` section, the following targets are available:
+
+- `make validate-pko-fixtures` validates that committed fixtures in `deploy_pko/.test-fixtures/` match the current template output. This runs automatically as part of `make validate` (and therefore `make container-validate`). Repos without PKO test fixtures are silently skipped.
+- `make generate-pko-fixtures` regenerates fixtures after intentional changes to `.gotmpl` files or `manifest.yaml` config. Review the diff and commit the updated fixtures alongside the template changes.
+- `make container-generate-pko-fixtures` runs fixture generation inside the boilerplate backing container, which has `kubectl-package` pre-installed. Useful if you don't have `kubectl-package` installed locally. The repository is bind-mounted into the container, so the generated fixtures appear directly in your local `deploy_pko/.test-fixtures/` directory — no manual copy step needed.
+
+Both targets require `kubectl-package`. If it is not found, the target fails with installation instructions. The backing container image includes `kubectl-package`, so `make container-validate` and `make container-generate-pko-fixtures` always work.
+
+**Important:** Buildah's `COPY *` includes dotfiles and dotdirs (contrary to standard glob behavior), so `deploy_pko/.test-fixtures/` will be included in the PKO OCI image unless excluded. `make generate-pko-fixtures` automatically creates a `deploy_pko/.dockerignore` with `.test-fixtures` to prevent this. `make validate-pko-fixtures` verifies the exclusion exists. Without it, PKO will see duplicate objects and fail to deploy the ClusterPackage.
+
 ## FIPS (Federal Information Processing Standards)
 
 To enable FIPS in your build there is a `make ensure-fips` target.

boilerplate/openshift/golang-osd-operator/ensure.sh

@@ -31,6 +31,23 @@ golangci-lint)
     fi
     ;;
 
+kubectl-package)
+    KUBECTL_PACKAGE_VERSION="v1.18.6"
+    GOPATH=$(go env GOPATH)
+    if which kubectl-package ; then
+        exit
+    else
+        mkdir -p "${GOPATH}/bin"
+        if ! echo "${PATH}" | grep -q "${GOPATH}/bin"; then
+            echo "${GOPATH}/bin not in $PATH"
+            exit 1
+        fi
+        DOWNLOAD_URL="https://github.com/package-operator/package-operator/releases/download/${KUBECTL_PACKAGE_VERSION}/kubectl-package_${GOOS}_amd64"
+        curl -sfL "${DOWNLOAD_URL}" -o "${GOPATH}/bin/kubectl-package"
+        chmod +x "${GOPATH}/bin/kubectl-package"
+    fi
+    ;;
+
 opm)
     mkdir -p .opm/bin
     cd .opm/bin

boilerplate/openshift/golang-osd-operator/standard.mk

@@ -309,10 +309,72 @@ prow-config:
 # Targets used by prow
 ######################
 
+# validate-pko-fixtures: Validate PKO package templates against committed snapshot fixtures.
+# Silently skips if deploy_pko/ has no manifest.yaml with a test section.
+# Requires kubectl-package; see https://github.com/package-operator/package-operator/releases
+.PHONY: validate-pko-fixtures
+validate-pko-fixtures:
+	@if [ -d deploy_pko ] && grep -q '^test:' deploy_pko/manifest.yaml 2>/dev/null; then \
+		${CONVENTION_DIR}/ensure.sh kubectl-package; \
+		echo "Validating PKO package fixtures..."; \
+		kubectl-package validate deploy_pko/ || \
+			(echo "ERROR: PKO fixture validation failed. Rendered templates do not match committed fixtures." >&2; \
+			 echo "If you intentionally changed a deploy_pko/ .gotmpl or manifest.yaml config, regenerate fixtures:" >&2; \
+			 echo "  make generate-pko-fixtures" >&2; \
+			 echo "  git diff deploy_pko/.test-fixtures/" >&2; \
+			 echo "Review the diff to confirm only your intended changes are reflected, then commit the updated fixtures." >&2; \
+			 echo "If you did NOT intend to change template output, your modifications may have introduced an unintended" >&2; \
+			 echo "regression in the rendered deployment manifests. Review your changes to deploy_pko/ carefully." >&2; \
+			 exit 1); \
+		if [ -d deploy_pko/.test-fixtures ]; then \
+			ignore_file=""; \
+			if [ -f deploy_pko/.containerignore ]; then \
+				ignore_file="deploy_pko/.containerignore"; \
+			elif [ -f deploy_pko/.dockerignore ]; then \
+				ignore_file="deploy_pko/.dockerignore"; \
+			fi; \
+			if [ -z "$$ignore_file" ]; then \
+				echo "ERROR: deploy_pko/.test-fixtures/ exists but no .dockerignore or .containerignore found in deploy_pko/." >&2; \
+				echo "Without it, test fixtures will be included in the PKO OCI image, causing Duplicate Object errors." >&2; \
+				echo "Fix: run 'make generate-pko-fixtures' to auto-create deploy_pko/.dockerignore" >&2; \
+				exit 1; \
+			elif ! grep -q '\.test-fixtures' "$$ignore_file"; then \
+				echo "ERROR: $$ignore_file exists but does not exclude .test-fixtures." >&2; \
+				echo "Without this exclusion, test fixtures will be included in the PKO OCI image." >&2; \
+				echo "Fix: add '.test-fixtures' to $$ignore_file" >&2; \
+				exit 1; \
+			fi; \
+		fi; \
+	fi
+
+# generate-pko-fixtures: Regenerate PKO snapshot fixtures after template changes.
+# Requires kubectl-package; see https://github.com/package-operator/package-operator/releases
+.PHONY: generate-pko-fixtures
+generate-pko-fixtures:
+	@if [ -d deploy_pko ] && grep -q '^test:' deploy_pko/manifest.yaml 2>/dev/null; then \
+		${CONVENTION_DIR}/ensure.sh kubectl-package; \
+		echo "Regenerating PKO test fixtures..."; \
+		rm -rf deploy_pko/.test-fixtures; \
+		kubectl-package validate deploy_pko/ && \
+		if [ ! -f deploy_pko/.dockerignore ] && [ ! -f deploy_pko/.containerignore ]; then \
+			echo ".test-fixtures" > deploy_pko/.dockerignore; \
+			echo "Created deploy_pko/.dockerignore to exclude .test-fixtures from PKO image."; \
+		elif [ -f deploy_pko/.dockerignore ] && ! grep -q '\.test-fixtures' deploy_pko/.dockerignore; then \
+			echo ".test-fixtures" >> deploy_pko/.dockerignore; \
+			echo "Added .test-fixtures to deploy_pko/.dockerignore."; \
+		elif [ -f deploy_pko/.containerignore ] && ! grep -q '\.test-fixtures' deploy_pko/.containerignore; then \
+			echo ".test-fixtures" >> deploy_pko/.containerignore; \
+			echo "Added .test-fixtures to deploy_pko/.containerignore."; \
+		fi; \
+		echo "Fixtures regenerated. Review with 'git diff deploy_pko/.test-fixtures/' and commit."; \
+	else \
+		echo "No PKO test configuration found in deploy_pko/manifest.yaml, nothing to generate."; \
+	fi
+
 # validate: Ensure code generation has not been forgotten; and ensure
 # generated and boilerplate code has not been modified.
 .PHONY: validate
-validate: boilerplate-freeze-check generate-check
+validate: boilerplate-freeze-check generate-check validate-pko-fixtures
 
 # lint: Perform static analysis.
 .PHONY: lint
@@ -396,6 +458,10 @@ container-validate:
 container-coverage:
 	${BOILERPLATE_CONTAINER_MAKE} coverage
 
+.PHONY: container-generate-pko-fixtures
+container-generate-pko-fixtures:
+	${BOILERPLATE_CONTAINER_MAKE} generate-pko-fixtures
+
 # Run all container-* validation targets in sequence.
 # Set NONINTERACTIVE=true to skip debug shells and fail fast for CI/automation.
 .PHONY: container-all

build/Dockerfile

@@ -1,4 +1,4 @@
-FROM quay.io/redhat-services-prod/openshift/boilerplate:image-v8.3.4 AS builder
+FROM quay.io/redhat-services-prod/openshift/boilerplate:image-v8.3.5 AS builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -18,7 +18,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -mod=mod -a -o
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1773939694
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1776833838
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER nonroot:nonroot

build/Dockerfile.olm-registry

@@ -4,7 +4,7 @@ COPY ${SAAS_OPERATOR_DIR} manifests
 RUN initializer --permissive
 
 # ubi-micro does not work for clusters with fips enabled unless we make OpenSSL available
-FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1773939694
+FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1776833838
 
 COPY --from=builder /bin/registry-server /bin/registry-server
 COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe