[update] Retag customContainerImages in OpenStackVersion CR during minor update

Starting with openstack-operator FR4
(openstack-k8s-operators/openstack-operator#1569, merged Oct 2025),
the `OpenStackVersion` admission webhook rejects `targetVersion`
changes when `spec.customContainerImages` are identical to those
tracked for the previously deployed version.

During the update flow, `set_openstack_containers` updates the
operator CSV env vars with the new delorean tag, but nothing
updates the `OpenStackVersion` CR's `customContainerImages` -- they
still carry the tag from the initial greenfield deployment. When
`update_services` later patches `targetVersion`, the webhook
rejects the request because the custom images haven't changed.

Add a step after `set_openstack_containers` that reads the current
`customContainerImages` from the `OpenStackVersion` CR, replaces
every image tag with the new delorean md5 hash, and patches the
CR. This ensures the custom images reflect the new version before
`targetVersion` is changed, satisfying the webhook and guaranteeing
the update uses the correct container images.

Assisted-by: Cursor (claude-4.6-opus-high)
Signed-off-by: Roberto Alfieri <ralfieri@redhat.com>

Author: rebtoor

playbooks/update.yml

@@ -53,6 +53,48 @@
         name: set_openstack_containers
       when: cifmw_ci_gen_kustomize_values_deployment_version is not defined
 
+    - name: Update customContainerImages in OpenStackVersion CR with new tag
+      when: cifmw_ci_gen_kustomize_values_deployment_version is not defined
+      block:
+        - name: Get the OpenStackVersion CR
+          kubernetes.core.k8s_info:
+            kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+            api_key: "{{ cifmw_openshift_token | default(omit) }}"
+            context: "{{ cifmw_openshift_context | default(omit) }}"
+            api_version: core.openstack.org/v1beta1
+            kind: OpenStackVersion
+            namespace: "{{ cifmw_update_namespace | default('openstack') }}"
+          register: _cifmw_update_osv_info
+
+        - name: Build retagged customContainerImages
+          when:
+            - _cifmw_update_osv_info.resources | length > 0
+            - _cifmw_update_osv_info.resources[0].spec.customContainerImages is defined
+          ansible.builtin.set_fact:
+            _cifmw_update_retagged_images: >-
+              {{
+                _cifmw_update_osv_info.resources[0].spec.customContainerImages |
+                to_json |
+                regex_replace('(@sha256:[a-f0-9]+|:[a-zA-Z0-9._-]+)"',
+                              ':' ~ cifmw_set_openstack_containers_tag ~ '"') |
+                from_json
+              }}
+
+        - name: Patch OpenStackVersion CR with retagged customContainerImages
+          when: _cifmw_update_retagged_images is defined
+          kubernetes.core.k8s:
+            kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
+            api_key: "{{ cifmw_openshift_token | default(omit) }}"
+            context: "{{ cifmw_openshift_context | default(omit) }}"
+            api_version: core.openstack.org/v1beta1
+            kind: OpenStackVersion
+            name: "{{ _cifmw_update_osv_info.resources[0].metadata.name }}"
+            namespace: "{{ cifmw_update_namespace | default('openstack') }}"
+            state: patched
+            definition:
+              spec:
+                customContainerImages: "{{ _cifmw_update_retagged_images }}"
+
 - name: Sync repos for controller to compute
   hosts: computes
   gather_facts: true