[openshift_setup] Add catalog registry auth and signature policy bypass#4068
Open
rebtoor wants to merge 1 commit into
Open
[openshift_setup] Add catalog registry auth and signature policy bypass#4068rebtoor wants to merge 1 commit into
rebtoor wants to merge 1 commit into
Conversation
Contributor
|
Skipping CI for Draft Pull Request. |
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
3 times, most recently
from
July 20, 2026 20:06
c740eb5 to
057ee3b
Compare
rebtoor
changed the title
rebtoor
marked this pull request as ready for review
July 20, 2026 20:08
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 21, 2026 12:17
057ee3b to
6043778
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 21, 2026 21:57
6043778 to
f2ab043
Compare
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 21, 2026 21:59
f2ab043 to
cae6b5b
Compare
rebtoor
changed the title
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 22, 2026 06:58
cae6b5b to
9fc3709
Compare
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 22, 2026 21:14
9fc3709 to
d5d286b
Compare
Contributor
|
New changes are detected. LGTM label has been removed. |
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 22, 2026 21:16
d5d286b to
362061c
Compare
rebtoor
changed the title
When cifmw_openshift_setup_catalog_registry_credentials is defined: - Merge the auth into the cluster pull-secret so nodes can pull from the Konflux image-rbac-proxy registry. - Add the catalog registry to insecure and allowed registries to bypass image signature validation for Konflux-built FBC catalogs. - Wait for MachineConfigPools to settle after IDMS + pull-secret changes before proceeding. Related-Issue: #OSPCIX-1431 Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Roberto Alfieri <ralfieri@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
rebtoor
force-pushed
the
DNM-OSPCIX-1431-catalog-source
branch
from
July 22, 2026 21:17
362061c to
5be28f2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
cifmw_openshift_setup_catalog_registry_credentialsis defined:openshift-config/pull-secretso nodes can pull from the Konfluximage-rbac-proxyregistry.insecureRegistriesandallowedRegistriesto bypass image signature validation for Konflux-built FBC catalogs.All three actions are gated on
cifmw_openshift_setup_catalog_registry_credentials— jobs that don't set it are completely unaffected.Context
Architecture-update jobs on OCP 4.18 need
openstack-operator.v1.0.7from a Konflux FBC catalog behindimage-rbac-proxy. The cluster needs pull-secret credentials AND signature policy bypass for that registry before the CatalogSource pod can pull.Related-Issue: #OSPCIX-1431