UPSTREAM: <carry>: Update catalogs for 4.23/5.0

Set catalog image tags to ocp-release and update the default-catalog-consistency
test to resolve that imagestream tag to a concrete version (e.g. v4.22) by querying
the cluster's ClusterVersion resource via oc/kubectl. Falls back to skipping when
the cluster is not accessible.

Fixes: OCPBUGS-85828

Assisted-by: Claude
Signed-off-by: Todd Short <tshort@redhat.com>

Author: tmshort

openshift/catalogd/manifests-experimental.yaml

@@ -1005,7 +1005,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/certified-operator-index:v4.22
+      ref: registry.redhat.io/redhat/certified-operator-index:ocp-release
 ---
 # Source: olmv1/templates/openshift-catalogs/clustercatalog-openshift-community-operators.yml
 apiVersion: olm.operatorframework.io/v1
@@ -1018,7 +1018,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/community-operator-index:v4.22
+      ref: registry.redhat.io/redhat/community-operator-index:ocp-release
 ---
 # Source: olmv1/templates/openshift-catalogs/clustercatalog-openshift-redhat-operators.yml
 apiVersion: olm.operatorframework.io/v1
@@ -1031,7 +1031,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/redhat-operator-index:v4.22
+      ref: registry.redhat.io/redhat/redhat-operator-index:ocp-release
 ---
 # Source: olmv1/templates/mutatingwebhookconfiguration-catalogd-mutating-webhook-configuration.yml
 apiVersion: admissionregistration.k8s.io/v1

openshift/catalogd/manifests.yaml

@@ -1004,7 +1004,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/certified-operator-index:v4.22
+      ref: registry.redhat.io/redhat/certified-operator-index:ocp-release
 ---
 # Source: olmv1/templates/openshift-catalogs/clustercatalog-openshift-community-operators.yml
 apiVersion: olm.operatorframework.io/v1
@@ -1017,7 +1017,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/community-operator-index:v4.22
+      ref: registry.redhat.io/redhat/community-operator-index:ocp-release
 ---
 # Source: olmv1/templates/openshift-catalogs/clustercatalog-openshift-redhat-operators.yml
 apiVersion: olm.operatorframework.io/v1
@@ -1030,7 +1030,7 @@ spec:
     type: Image
     image:
       pollIntervalMinutes: 10
-      ref: registry.redhat.io/redhat/redhat-operator-index:v4.22
+      ref: registry.redhat.io/redhat/redhat-operator-index:ocp-release
 ---
 # Source: olmv1/templates/mutatingwebhookconfiguration-catalogd-mutating-webhook-configuration.yml
 apiVersion: admissionregistration.k8s.io/v1

openshift/default-catalog-consistency/test/utils/utils.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -124,3 +125,27 @@ func ImageNameFromRef(ref string) string {
 	}
 	return last
 }
+
+// ClusterCatalogVersion queries the cluster's ClusterVersion resource and returns
+// the catalog image tag that corresponds to the running OCP release (e.g. "v4.22").
+// It tries oc then kubectl. Returns an empty string when the cluster is not
+// accessible or the version cannot be parsed.
+func ClusterCatalogVersion() string {
+	for _, cli := range []string{"oc", "kubectl"} {
+		out, err := exec.Command(cli, "get", "clusterversion", "version",
+			"-o", "jsonpath={.status.desired.version}").Output()
+		if err != nil {
+			continue
+		}
+		v := strings.TrimSpace(string(out))
+		if v == "" {
+			continue
+		}
+		// "4.22.0" or "4.22.0-0.nightly-2026-05-27-…" → "v4.22"
+		parts := strings.SplitN(v, ".", 3)
+		if len(parts) >= 2 {
+			return fmt.Sprintf("v%s.%s", parts[0], parts[1])
+		}
+	}
+	return ""
+}

openshift/default-catalog-consistency/test/validate/suite_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"strings"
 	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
@@ -29,6 +30,19 @@ var _ = Describe("OLM-Catalog-Validation", func() {
 	Expect(images).ToNot(BeEmpty(), "no images found")
 	authPath := os.Getenv("REGISTRY_AUTH_FILE")
 
+	// ocp-release is an OpenShift imagestream tag resolved cluster-side; it cannot be
+	// pulled directly from the external registry. Resolve it to a concrete tag by
+	// querying the cluster's ClusterVersion resource (e.g. "v4.22"). If the cluster
+	// is not accessible the tag stays as-is and the individual tests are skipped.
+	if catalogVersion := utils.ClusterCatalogVersion(); catalogVersion != "" {
+		fmt.Println("Resolved cluster catalog version:", catalogVersion)
+		for i, img := range images {
+			if strings.HasSuffix(img, ":ocp-release") {
+				images[i] = strings.TrimSuffix(img, ":ocp-release") + ":" + catalogVersion
+			}
+		}
+	}
+
 	sysCtx := &types.SystemContext{}
 	if authPath != "" {
 		fmt.Println("Using registry auth file:", authPath)
@@ -40,6 +54,9 @@ var _ = Describe("OLM-Catalog-Validation", func() {
 		ctx := context.Background()
 
 		It(fmt.Sprintf("validates multiarch support for image: %s", name), func() {
+			if strings.HasSuffix(url, ":ocp-release") {
+				Skip(fmt.Sprintf("cluster version unavailable; cannot resolve ocp-release tag for %s", url))
+			}
 			By(fmt.Sprintf("Validating image: %s", url))
 			err := check.ImageSupportsMultiArch(
 				url,
@@ -50,6 +67,9 @@ var _ = Describe("OLM-Catalog-Validation", func() {
 		})
 
 		It(fmt.Sprintf("validates image: %s", name), func() {
+			if strings.HasSuffix(url, ":ocp-release") {
+				Skip(fmt.Sprintf("cluster version unavailable; cannot resolve ocp-release tag for %s", url))
+			}
 			By(fmt.Sprintf("Validating image: %s", url))
 			// Force image resolution to Linux to avoid OS mismatch errors on macOS,
 			// like: "no image found for architecture 'arm64', OS 'darwin'".

openshift/helm/catalogd.yaml

@@ -16,7 +16,7 @@ options:
   openshift:
     enabled: true
     catalogs:
-      version: v4.22
+      version: ocp-release
 
 # The set of namespaces
 namespaces: