From 7a64ef01a3689f891c2c54ccdcb48bafc7f4999d Mon Sep 17 00:00:00 2001 From: Davide Bianchi <10374360+davidebianchi@users.noreply.github.com> Date: Thu, 16 Apr 2026 03:00:34 +0200 Subject: [PATCH 1/7] Feat/rename rhai xks chart (#76) --- charts/rhai-on-xks-chart/README.md | 2 +- .../helmtemplate-config-cloudmanager.yaml | 6 -- .../scripts/helmtemplate-config.yaml | 46 ++--------- ...ployment-azure-cloud-manager-operator.yaml | 8 ++ ...terrole-rhai-azure-cloud-manager-role.yaml | 11 --- ...ment-coreweave-cloud-manager-operator.yaml | 8 ++ ...ole-rhai-coreweave-cloud-manager-role.yaml | 11 --- .../hooks/post-install-gateway-job.yaml | 4 +- .../manager/deployment-rhods-operator.yaml | 45 +++++++++++ ...rator-mutating-webhook-configuration.yaml} | 7 +- ...ervice-rhai-operator-webhook-service.yaml} | 0 .../azure-with-pull-secret.snap.yaml | 79 ++++++++++++++----- .../azure-with-related-images.snap.yaml | 79 ++++++++++++++----- .../coreweave-with-pull-secret.snap.yaml | 79 ++++++++++++++----- .../test/snapshots/coreweave.snap.yaml | 79 ++++++++++++++----- .../snapshots/with-custom-namespace.snap.yaml | 79 ++++++++++++++----- 16 files changed, 362 insertions(+), 181 deletions(-) rename charts/rhai-on-xks-chart/templates/webhooks/{mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml => mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml} (83%) rename charts/rhai-on-xks-chart/templates/webhooks/{service-rhods-operator-webhook-service.yaml => service-rhai-operator-webhook-service.yaml} (100%) diff --git a/charts/rhai-on-xks-chart/README.md b/charts/rhai-on-xks-chart/README.md index 016b889b..30797a00 100644 --- a/charts/rhai-on-xks-chart/README.md +++ b/charts/rhai-on-xks-chart/README.md @@ -92,7 +92,7 @@ Phase 2 and 3 are necessary because the CRs depend on CRDs and resources that ar By default (`components.kserve.gateway.create: true`), the chart creates a Gateway CR named `inference-gateway` in the applications namespace. This gateway is required for KServe model inference traffic. The hook: 1. Waits for Gateway API CRDs to be installed (by the cloud manager) -2. Waits for the cert-manager CA secret (`opendatahub-ca`) +2. Waits for the cert-manager CA secret (`rhaii-ca`) 3. Creates a CA bundle ConfigMap (`rhaii-ca-bundle`) 4. Creates a gateway config ConfigMap (`inference-gateway-config`) with CA bundle mount for istio-proxy and Azure-specific health probe annotation (Azure only) 5. Waits for the `istio` GatewayClass (created by Sail Operator) diff --git a/charts/rhai-on-xks-chart/scripts/helmtemplate-config-cloudmanager.yaml b/charts/rhai-on-xks-chart/scripts/helmtemplate-config-cloudmanager.yaml index a148bec8..d7585e2d 100644 --- a/charts/rhai-on-xks-chart/scripts/helmtemplate-config-cloudmanager.yaml +++ b/charts/rhai-on-xks-chart/scripts/helmtemplate-config-cloudmanager.yaml @@ -44,12 +44,6 @@ rules: value: '{{ .Values.CLOUD_NAME.cloudManager.imagePullPolicy }}' - path: .spec.template.spec.containers[name=manager].env[name=RHAI_OPERATOR_NAMESPACE].value value: '{{ .Values.rhaiOperator.namespace }}' - # Update webhook cert secret name (rhods-operator to rhai-operator) TODO: we should change in opendatahub-operator instead - - path: .spec.template.spec.containers[name=manager].env[name=RHAI_WEBHOOK_CERT_SECRET_NAME].value - value: rhai-operator-controller-webhook-cert - # Update webhook service name (rhods-operator to rhai-operator) TODO: we should change in opendatahub-operator instead - - path: .spec.template.spec.containers[name=manager].env[name=RHAI_WEBHOOK_SERVICE_NAME].value - value: rhai-operator-webhook-service - match: kinds: diff --git a/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml b/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml index 9bc2bbdb..6820221a 100644 --- a/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml +++ b/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml @@ -121,6 +121,8 @@ rules: # Rename webhook cert secret in volume (rhods-operator to rhai-operator) - path: .spec.template.spec.volumes[name=cert].secret.secretName value: rhai-operator-controller-webhook-cert + - path: .spec.template.spec.initContainers[name=copy-manifests].image + value: '{{ .Values.rhaiOperator.image }}' # Rename ServiceAccount - match: @@ -177,15 +179,13 @@ rules: - path: .spec.selector.name value: rhai-operator - # Rename Webhook Service and update labels and selector + # Update Webhook Service labels and selector - match: kinds: - Service names: - - "rhods-operator-webhook-service" + - "rhai-operator-webhook-service" changes: - - path: .metadata.name - value: rhai-operator-webhook-service - path: .metadata.labels["app.kubernetes.io/created-by"] value: rhai-operator - path: .metadata.labels["app.kubernetes.io/instance"] @@ -197,47 +197,15 @@ rules: - path: .spec.selector.name value: rhai-operator - # Rename ValidatingWebhookConfiguration and update labels - - match: - kinds: - - ValidatingWebhookConfiguration - names: - - "rhods-operator-validating-webhook-configuration" - changes: - - path: .metadata.name - value: rhai-operator-validating-webhook-configuration - - path: .webhooks[*].clientConfig.service.name - value: rhai-operator-webhook-service - - path: .metadata.labels["app.kubernetes.io/created-by"] - value: rhai-operator - - path: .metadata.labels["app.kubernetes.io/instance"] - value: rhai-operator - - path: .metadata.labels["app.kubernetes.io/name"] - value: rhai-operator-validating-webhook-configuration - - path: .metadata.labels["app.kubernetes.io/part-of"] - value: rhai-operator - - # Rename MutatingWebhookConfiguration and update labels + # Update MutatingWebhookConfiguration cert annotation - match: kinds: - MutatingWebhookConfiguration names: - - "rhods-operator-mutating-webhook-configuration" + - "rhai-operator-mutating-webhook-configuration" changes: - - path: .metadata.name - value: rhai-operator-mutating-webhook-configuration - path: .metadata.annotations["cert-manager.io/inject-ca-from"] - value: '{{ .Values.rhaiOperator.namespace }}/opendatahub-operator-webhook-cert' - - path: .webhooks[*].clientConfig.service.name - value: rhai-operator-webhook-service - - path: .metadata.labels["app.kubernetes.io/created-by"] - value: rhai-operator - - path: .metadata.labels["app.kubernetes.io/instance"] - value: rhai-operator - - path: .metadata.labels["app.kubernetes.io/name"] - value: rhai-operator-mutating-webhook-configuration - - path: .metadata.labels["app.kubernetes.io/part-of"] - value: rhai-operator + value: '{{ .Values.rhaiOperator.namespace }}/rhai-operator-webhook-cert' # Add image pull secrets to ServiceAccount - match: diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml index bc812790..e9599c30 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml @@ -56,6 +56,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/rbac/clusterrole-rhai-azure-cloud-manager-role.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/rbac/clusterrole-rhai-azure-cloud-manager-role.yaml index 9b3aa391..039a33b7 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/rbac/clusterrole-rhai-azure-cloud-manager-role.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/rbac/clusterrole-rhai-azure-cloud-manager-role.yaml @@ -20,17 +20,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml index e14ce338..f85d6cf5 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml @@ -56,6 +56,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/rbac/clusterrole-rhai-coreweave-cloud-manager-role.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/rbac/clusterrole-rhai-coreweave-cloud-manager-role.yaml index ea44b90c..231aadad 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/rbac/clusterrole-rhai-coreweave-cloud-manager-role.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/rbac/clusterrole-rhai-coreweave-cloud-manager-role.yaml @@ -20,17 +20,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml index 7cb6c012..1d6c1c3f 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml @@ -72,7 +72,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -84,7 +84,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ diff --git a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml index 64481549..1163ca3b 100644 --- a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml @@ -98,6 +98,14 @@ spec: value: {{ .Chart.AppVersion | quote }} - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -144,10 +152,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: {{ .Values.rhaiOperator.image }} + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -159,4 +197,11 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp {{- end }} diff --git a/charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml b/charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml similarity index 83% rename from charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml rename to charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml index 35f8bb2e..b7903d29 100644 --- a/charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +++ b/charts/rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml @@ -3,14 +3,9 @@ apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: {{ .Values.rhaiOperator.namespace }}/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: {{ .Values.rhaiOperator.namespace }}/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: {{ .Values.rhaiOperator.namespace }} - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 diff --git a/charts/rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml b/charts/rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml similarity index 100% rename from charts/rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml rename to charts/rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml index 7b74ca38..31fa3c19 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml @@ -593,17 +593,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: @@ -2309,7 +2298,7 @@ spec: selector: name: rhai-operator --- -# Source: rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml +# Source: rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml apiVersion: v1 kind: Service metadata: @@ -2388,6 +2377,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2533,6 +2530,14 @@ spec: value: "3.4.0" - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2575,10 +2580,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: quay.io/opendatahub/opendatahub-operator:latest + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -2590,20 +2625,22 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp --- -# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: redhat-ods-operator/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: redhat-ods-operator/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: redhat-ods-operator - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 @@ -2914,7 +2951,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2926,7 +2963,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml index 62d7ed19..8f7907cf 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml @@ -455,17 +455,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: @@ -2171,7 +2160,7 @@ spec: selector: name: rhai-operator --- -# Source: rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml +# Source: rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml apiVersion: v1 kind: Service metadata: @@ -2250,6 +2239,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2395,6 +2392,14 @@ spec: value: "3.4.0" - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2439,10 +2444,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: quay.io/opendatahub/opendatahub-operator:latest + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -2454,20 +2489,22 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp --- -# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: redhat-ods-operator/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: redhat-ods-operator/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: redhat-ods-operator - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 @@ -2778,7 +2815,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2790,7 +2827,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml index 4a415b59..ccc55730 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml @@ -593,17 +593,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: @@ -2309,7 +2298,7 @@ spec: selector: name: rhai-operator --- -# Source: rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml +# Source: rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml apiVersion: v1 kind: Service metadata: @@ -2388,6 +2377,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2533,6 +2530,14 @@ spec: value: "3.4.0" - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2575,10 +2580,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: quay.io/opendatahub/opendatahub-operator:latest + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -2590,20 +2625,22 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp --- -# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: redhat-ods-operator/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: redhat-ods-operator/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: redhat-ods-operator - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 @@ -2914,7 +2951,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2926,7 +2963,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml index bb69eadb..73d48aee 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml @@ -455,17 +455,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: @@ -2171,7 +2160,7 @@ spec: selector: name: rhai-operator --- -# Source: rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml +# Source: rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml apiVersion: v1 kind: Service metadata: @@ -2250,6 +2239,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2395,6 +2392,14 @@ spec: value: "3.4.0" - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2437,10 +2442,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: quay.io/opendatahub/opendatahub-operator:latest + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -2452,20 +2487,22 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp --- -# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: redhat-ods-operator/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: redhat-ods-operator/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: redhat-ods-operator - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 @@ -2776,7 +2813,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2788,7 +2825,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ diff --git a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml index 896278af..f7dd8505 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml @@ -455,17 +455,6 @@ rules: - patch - update - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - update - - watch - apiGroups: - admissionregistration.k8s.io resources: @@ -2171,7 +2160,7 @@ spec: selector: name: rhai-operator --- -# Source: rhai-on-xks-chart/templates/webhooks/service-rhods-operator-webhook-service.yaml +# Source: rhai-on-xks-chart/templates/webhooks/service-rhai-operator-webhook-service.yaml apiVersion: v1 kind: Service metadata: @@ -2250,6 +2239,14 @@ spec: value: rhai-operator-controller-webhook-cert - name: RHAI_WEBHOOK_SERVICE_NAME value: rhai-operator-webhook-service + - name: RHAI_WEBHOOK_CERT_NAME + value: rhai-operator-webhook-cert + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2395,6 +2392,14 @@ spec: value: "3.4.0" - name: ODH_PLATFORM_TYPE value: XKS + - name: RHAI_CA_SECRET_NAME + value: rhaii-ca + - name: RHAI_CA_SECRET_NAMESPACE + value: cert-manager + - name: RHAI_ISSUER_REF_NAME + value: rhaii-ca-issuer + - name: RHAI_ISTIO_CA_CERTIFICATE_PATH + value: /var/run/secrets/rhaii/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2437,10 +2442,40 @@ spec: capabilities: drop: - ALL + readOnlyRootFilesystem: true volumeMounts: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + - mountPath: /opt/manifests + name: manifests + - mountPath: /tmp + name: tmp + initContainers: + - command: + - cp + - -r + - /opt/manifests-template/. + - /opt/manifests/ + image: quay.io/opendatahub/opendatahub-operator:latest + imagePullPolicy: Always + name: copy-manifests + resources: + limits: + cpu: 100m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /opt/manifests + name: manifests securityContext: runAsNonRoot: true seccompProfile: @@ -2452,20 +2487,22 @@ spec: secret: defaultMode: 420 secretName: rhai-operator-controller-webhook-cert + - emptyDir: + sizeLimit: 256Mi + name: manifests + - emptyDir: + medium: Memory + sizeLimit: 10Mi + name: tmp --- -# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhods-operator-mutating-webhook-configuration.yaml +# Source: rhai-on-xks-chart/templates/webhooks/mutatingwebhookconfiguration-rhai-operator-mutating-webhook-configuration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: - cert-manager.io/inject-ca-from: rhai-operator/opendatahub-operator-webhook-cert + cert-manager.io/inject-ca-from: rhai-operator/rhai-operator-webhook-cert name: rhai-operator-mutating-webhook-configuration namespace: rhai-operator - labels: - app.kubernetes.io/created-by: rhai-operator - app.kubernetes.io/instance: rhai-operator - app.kubernetes.io/name: rhai-operator-mutating-webhook-configuration - app.kubernetes.io/part-of: rhai-operator webhooks: - admissionReviewVersions: - v1 @@ -2776,7 +2813,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret opendatahub-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2788,7 +2825,7 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret opendatahub-ca -n cert-manager \ + kubectl get secret rhaii-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt kubectl create configmap rhaii-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ From 11f7541bba9b1ea912805af8173fa233c6583e53 Mon Sep 17 00:00:00 2001 From: Aneesh Puttur Date: Thu, 16 Apr 2026 04:17:24 -0400 Subject: [PATCH 2/7] Update sail-operator bundle to 3.2.3 (includes OSSM-12585 fix) (#77) Signed-off-by: Aneesh Puttur --- charts/dependencies/sail-operator/Chart.yaml | 2 +- charts/dependencies/sail-operator/api-docs.md | 4 +-- ...edefinition-istiocnis-sailoperator-io.yaml | 11 +++++--- ...nition-istiorevisions-sailoperator-io.yaml | 8 +++--- ...urcedefinition-istios-sailoperator-io.yaml | 14 +++++----- ...cedefinition-ztunnels-sailoperator-io.yaml | 18 ++++++++----- .../deployment-servicemesh-operator3.yaml | 27 ++++++++++++++----- .../test/snapshots/default.snap.yaml | 27 ++++++++++++++----- charts/dependencies/sail-operator/values.yaml | 2 +- 9 files changed, 78 insertions(+), 35 deletions(-) diff --git a/charts/dependencies/sail-operator/Chart.yaml b/charts/dependencies/sail-operator/Chart.yaml index 1c87717e..32fa0763 100644 --- a/charts/dependencies/sail-operator/Chart.yaml +++ b/charts/dependencies/sail-operator/Chart.yaml @@ -3,7 +3,7 @@ name: sail-operator description: Red Hat Sail Operator (OSSM 3.x) for Kubernetes type: application version: 1.0.0 -appVersion: "3.2.1" +appVersion: "3.2.3" keywords: - istio - service-mesh diff --git a/charts/dependencies/sail-operator/api-docs.md b/charts/dependencies/sail-operator/api-docs.md index af912d40..c8e7a851 100644 --- a/charts/dependencies/sail-operator/api-docs.md +++ b/charts/dependencies/sail-operator/api-docs.md @@ -1,6 +1,6 @@ # sail-operator -![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.2.1](https://img.shields.io/badge/AppVersion-3.2.1-informational?style=flat-square) +![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.2.3](https://img.shields.io/badge/AppVersion-3.2.3-informational?style=flat-square) Red Hat Sail Operator (OSSM 3.x) for Kubernetes @@ -18,7 +18,7 @@ Red Hat Sail Operator (OSSM 3.x) for Kubernetes | Key | Type | Default | Description | |-----|------|---------|-------------| -| bundle.version | string | `"3.2.1"` | | +| bundle.version | string | `"3.2.3"` | | | imagePullSecrets[0].name | string | `"rhaii-pull-secret"` | | | namespace | string | `"istio-system"` | | diff --git a/charts/dependencies/sail-operator/crds/customresourcedefinition-istiocnis-sailoperator-io.yaml b/charts/dependencies/sail-operator/crds/customresourcedefinition-istiocnis-sailoperator-io.yaml index daf4661b..0bd13261 100644 --- a/charts/dependencies/sail-operator/crds/customresourcedefinition-istiocnis-sailoperator-io.yaml +++ b/charts/dependencies/sail-operator/crds/customresourcedefinition-istiocnis-sailoperator-io.yaml @@ -21,7 +21,7 @@ spec: name: Namespace type: string - description: The selected profile (collection of value presets). - jsonPath: .spec.values.profile + jsonPath: .spec.profile name: Profile type: string - description: Whether the Istio CNI installation is ready to handle requests. @@ -65,7 +65,7 @@ spec: spec: default: namespace: istio-cni - version: v1.27.3 + version: v1.27.8 description: IstioCNISpec defines the desired state of IstioCNI properties: namespace: @@ -1370,14 +1370,17 @@ spec: type: object type: object version: - default: v1.27.3 + default: v1.27.8 description: |- Defines the version of Istio to install. - Must be one of: v1.27-latest, v1.27.3, v1.26-latest, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. + Must be one of: v1.27-latest, v1.27.8, v1.27.5, v1.27.3, v1.26-latest, v1.26.8, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. enum: - v1.27-latest + - v1.27.8 + - v1.27.5 - v1.27.3 - v1.26-latest + - v1.26.8 - v1.26.6 - v1.26.4 - v1.26.3 diff --git a/charts/dependencies/sail-operator/crds/customresourcedefinition-istiorevisions-sailoperator-io.yaml b/charts/dependencies/sail-operator/crds/customresourcedefinition-istiorevisions-sailoperator-io.yaml index 68dcc91f..89d87ac7 100644 --- a/charts/dependencies/sail-operator/crds/customresourcedefinition-istiorevisions-sailoperator-io.yaml +++ b/charts/dependencies/sail-operator/crds/customresourcedefinition-istiorevisions-sailoperator-io.yaml @@ -114,8 +114,7 @@ spec: x-kubernetes-preserve-unknown-fields: true gatewayClasses: description: Configuration for Gateway Classes - format: byte - type: string + x-kubernetes-preserve-unknown-fields: true global: description: Global configuration for Istio components. properties: @@ -9689,9 +9688,12 @@ spec: version: description: |- Defines the version of Istio to install. - Must be one of: v1.27.3, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24.6, v1.24.5, v1.24.4, v1.24.3. + Must be one of: v1.27.8, v1.27.5, v1.27.3, v1.26.8, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24.6, v1.24.5, v1.24.4, v1.24.3. enum: + - v1.27.8 + - v1.27.5 - v1.27.3 + - v1.26.8 - v1.26.6 - v1.26.4 - v1.26.3 diff --git a/charts/dependencies/sail-operator/crds/customresourcedefinition-istios-sailoperator-io.yaml b/charts/dependencies/sail-operator/crds/customresourcedefinition-istios-sailoperator-io.yaml index d80a8705..4d092652 100644 --- a/charts/dependencies/sail-operator/crds/customresourcedefinition-istios-sailoperator-io.yaml +++ b/charts/dependencies/sail-operator/crds/customresourcedefinition-istios-sailoperator-io.yaml @@ -21,7 +21,7 @@ spec: name: Namespace type: string - description: The selected profile (collection of value presets). - jsonPath: .spec.values.profile + jsonPath: .spec.profile name: Profile type: string - description: Total number of IstioRevision objects currently associated with this object. @@ -86,7 +86,7 @@ spec: namespace: istio-system updateStrategy: type: InPlace - version: v1.27.3 + version: v1.27.8 description: IstioSpec defines the desired state of Istio properties: namespace: @@ -184,8 +184,7 @@ spec: x-kubernetes-preserve-unknown-fields: true gatewayClasses: description: Configuration for Gateway Classes - format: byte - type: string + x-kubernetes-preserve-unknown-fields: true global: description: Global configuration for Istio components. properties: @@ -9757,14 +9756,17 @@ spec: type: object type: object version: - default: v1.27.3 + default: v1.27.8 description: |- Defines the version of Istio to install. - Must be one of: v1.27-latest, v1.27.3, v1.26-latest, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. + Must be one of: v1.27-latest, v1.27.8, v1.27.5, v1.27.3, v1.26-latest, v1.26.8, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. enum: - v1.27-latest + - v1.27.8 + - v1.27.5 - v1.27.3 - v1.26-latest + - v1.26.8 - v1.26.6 - v1.26.4 - v1.26.3 diff --git a/charts/dependencies/sail-operator/crds/customresourcedefinition-ztunnels-sailoperator-io.yaml b/charts/dependencies/sail-operator/crds/customresourcedefinition-ztunnels-sailoperator-io.yaml index 52bbed5b..4c2ddcc0 100644 --- a/charts/dependencies/sail-operator/crds/customresourcedefinition-ztunnels-sailoperator-io.yaml +++ b/charts/dependencies/sail-operator/crds/customresourcedefinition-ztunnels-sailoperator-io.yaml @@ -61,7 +61,7 @@ spec: spec: default: namespace: ztunnel - version: v1.27.3 + version: v1.27.8 description: ZTunnelSpec defines the desired state of ZTunnel properties: namespace: @@ -3228,14 +3228,17 @@ spec: type: object type: object version: - default: v1.27.3 + default: v1.27.8 description: |- Defines the version of Istio to install. - Must be one of: v1.27-latest, v1.27.3, v1.26-latest, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. + Must be one of: v1.27-latest, v1.27.8, v1.27.5, v1.27.3, v1.26-latest, v1.26.8, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. enum: - v1.27-latest + - v1.27.8 + - v1.27.5 - v1.27.3 - v1.26-latest + - v1.26.8 - v1.26.6 - v1.26.4 - v1.26.3 @@ -3348,7 +3351,7 @@ spec: default: namespace: ztunnel profile: ambient - version: v1.27.3 + version: v1.27.8 description: ZTunnelSpec defines the desired state of ZTunnel properties: namespace: @@ -6533,14 +6536,17 @@ spec: type: object type: object version: - default: v1.27.3 + default: v1.27.8 description: |- Defines the version of Istio to install. - Must be one of: v1.27-latest, v1.27.3, v1.26-latest, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. + Must be one of: v1.27-latest, v1.27.8, v1.27.5, v1.27.3, v1.26-latest, v1.26.8, v1.26.6, v1.26.4, v1.26.3, v1.26.2, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3. enum: - v1.27-latest + - v1.27.8 + - v1.27.5 - v1.27.3 - v1.26-latest + - v1.26.8 - v1.26.6 - v1.26.4 - v1.26.3 diff --git a/charts/dependencies/sail-operator/templates/deployment-servicemesh-operator3.yaml b/charts/dependencies/sail-operator/templates/deployment-servicemesh-operator3.yaml index 900d6dce..c3c82e24 100644 --- a/charts/dependencies/sail-operator/templates/deployment-servicemesh-operator3.yaml +++ b/charts/dependencies/sail-operator/templates/deployment-servicemesh-operator3.yaml @@ -33,11 +33,11 @@ spec: images.v1_24_5.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:87b967785d7cc222f9df9cb49f0373a9819bf67910ce523dc3b8345849e881dd images.v1_24_5.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7fa655f5efb1175ff1e1c138371fc1233e5d4313c5feb07194428d0d1fdd33a3 images.v1_24_5.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:7ea9b82e192402566e69063a4787351be9f1ef50719bfd1a8f5d5940362b3f70 - images.v1_24_6.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:54508ddeb570a45b5576d4e128fc6f4114e3bb0ed8cf600f2bcbf80d8b4f6b8a - images.v1_24_6.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:c018e5c2fe81d6b6577cbf32a9aa3f909c69c24ed411e4fa3fa7b4a891ce017e - images.v1_24_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:892c857d7ea35e60e13a277f5ab1268a4068c316353403a2846f116235d52a7b - images.v1_24_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:836c53299b170a1ef0bc8ce958da2abe14a48b8d84f9298e7c6b3d940fa8a1cc - images.v1_24_6.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:18897281e5ab5198506c4dd5cc0f5a96245794e6b33f63a2a4a3195bf23fbf60 + images.v1_24_6.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:a650350c1c673c393def5cc8ad16a29a0514fbf72dcfe23858e103ee05ad3277 + images.v1_24_6.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:f7c3b758ce6318f33c1fe7307182428b0bbd678ce6b69d4b4692cf44c581b4cb + images.v1_24_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:446d404e0e373750ab47406a55461e151f93e3771adf02b18f6ee427ac1fcdcd + images.v1_24_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1bbae810c90431b87e31b6c67eb2f62d0754ac63b678e03fb1e5324926632f8b + images.v1_24_6.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:6e8b674e308f70c12c88f9d75ee407c2f59df8f929bec0dace1b5d6664636a59 images.v1_26_2.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:14c5a52faf20267baa43d9a72ee6416f56fbc41dd640adc2aba3c4043802a0e9 images.v1_26_2.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:028e10651db0d1ddb769a27c9483c6d41be6ac597f253afd9d599f395d9c82d8 images.v1_26_2.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:366266f10e658c4cea86bddf6ee847e1908ea4dd780cb5f7fb0e466bac8995f1 @@ -58,11 +58,26 @@ spec: images.v1_26_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8a21e30593e51f2fd2e51d9ab1d0ed2fc43eaa9b98173d7fb74f799d6b2f163d images.v1_26_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:47100186c27934adeda3002bb04cac28980ca8854eee7d6e4f4b3f85562e9a8e images.v1_26_6.ztunnel: registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:f39e2c28ef36fce9f808f3946cc4e4126047e142ad84cb18c222cecceae29730 + images.v1_26_8.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:edb5aab128bc90ba62a9b1d268be82ea8771ff70b0305ad9d85d8f669a995044 + images.v1_26_8.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6f9ed59521fab78d5cf576d0519b5aa40ea46963a13772b0a6ecabafbb32778b + images.v1_26_8.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:3e3e4a5f1e644796c13728c6c7f7ca8daab3b9a08d8ffd2a7a8c8f424d47b0b8 + images.v1_26_8.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6558eba168f2cb50aa40394b9ff9e71882c9e4a4c93ca189ba8f71f324c12ab4 + images.v1_26_8.ztunnel: registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:af4076fd0bef20612081bd8b0dbf9434a33a879545bba823cdaeeeb01ad39056 images.v1_27_3.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ddadd677161ad8c1077dd156821d6b4e32742ccbb210e9c14696fa66a58c0867 images.v1_27_3.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:0850242436e88f7d82f0f2126de064c7e0f09844f31d8ff0f53dc8d3908075d9 images.v1_27_3.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:742bc084c26769ff57cb3aa47b7a35c2b94684c3f67a9388da07a0490a942e5c images.v1_27_3.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7d15cebf9b62f3f235c0eab5158ac8ff2fda86a1d193490dc94c301402c99da8 images.v1_27_3.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:b2b3216a05f6136ed9ddb71d72d493030c6d6b431682dddffa692c760b6c9ba1 + images.v1_27_5.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2929b7df3da8228a728945542647ec5450c0585a2ed5cbdb84f8e3d81ab41806 + images.v1_27_5.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2e515a40de141bd4e516bfcf4fd0cbb8d236ac02799a7a35d77ae44f53916bc9 + images.v1_27_5.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d1baba8cb454b62d804dc427d4ccfea928348631c384d1ab3d170e1e2a9d1178 + images.v1_27_5.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:650da1e2ad1cb93e6a0231dba7ca1f27f4cccac84e5925135281adc629a0caea + images.v1_27_5.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:0ae2919cd446e0e1f0a21d0850e7809ba8f44c06d484c023b3bee2787ca4bdd0 + images.v1_27_8.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f072a10513086f330af8bbd4e70d6922167417cfb15674d4e9834565071f2c20 + images.v1_27_8.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2a25d47b4bb3bf346563a0ccea986c0ab0466709ca4cb9d2666ba6a02a8a5f31 + images.v1_27_8.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:6eaedfbf16cfc73196e693b97d33e399acf438bce5fd7ec3c91f3f084c87edf0 + images.v1_27_8.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2b5f5aa5ee9974269d8e3666b1bfc58da10c172bf3f1d6defd555fbd1ac9a6ec + images.v1_27_8.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4e085c9b6ca08f950798bf5153579e00e8e65226befe9c9043c19ae53f8a3a2d kubectl.kubernetes.io/default-container: sail-operator labels: app.kubernetes.io/created-by: servicemeshoperator3 @@ -93,7 +108,7 @@ spec: - --zap-log-level=info command: - /usr/local/bin/sail-operator - image: registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:656511cdb0683ff7e3336d4f41a672b4063b665e9e6e34d5370640103fd49365 + image: registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b2a576f6eaddba51d5f9a7847642e95b6dfaafc4498e779f17e5f216c677f873 livenessProbe: httpGet: path: /healthz diff --git a/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml b/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml index 67efb05d..1ea25880 100644 --- a/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml @@ -426,11 +426,11 @@ spec: images.v1_24_5.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:87b967785d7cc222f9df9cb49f0373a9819bf67910ce523dc3b8345849e881dd images.v1_24_5.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7fa655f5efb1175ff1e1c138371fc1233e5d4313c5feb07194428d0d1fdd33a3 images.v1_24_5.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:7ea9b82e192402566e69063a4787351be9f1ef50719bfd1a8f5d5940362b3f70 - images.v1_24_6.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:54508ddeb570a45b5576d4e128fc6f4114e3bb0ed8cf600f2bcbf80d8b4f6b8a - images.v1_24_6.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:c018e5c2fe81d6b6577cbf32a9aa3f909c69c24ed411e4fa3fa7b4a891ce017e - images.v1_24_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:892c857d7ea35e60e13a277f5ab1268a4068c316353403a2846f116235d52a7b - images.v1_24_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:836c53299b170a1ef0bc8ce958da2abe14a48b8d84f9298e7c6b3d940fa8a1cc - images.v1_24_6.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:18897281e5ab5198506c4dd5cc0f5a96245794e6b33f63a2a4a3195bf23fbf60 + images.v1_24_6.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:a650350c1c673c393def5cc8ad16a29a0514fbf72dcfe23858e103ee05ad3277 + images.v1_24_6.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:f7c3b758ce6318f33c1fe7307182428b0bbd678ce6b69d4b4692cf44c581b4cb + images.v1_24_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:446d404e0e373750ab47406a55461e151f93e3771adf02b18f6ee427ac1fcdcd + images.v1_24_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1bbae810c90431b87e31b6c67eb2f62d0754ac63b678e03fb1e5324926632f8b + images.v1_24_6.ztunnel: registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:6e8b674e308f70c12c88f9d75ee407c2f59df8f929bec0dace1b5d6664636a59 images.v1_26_2.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:14c5a52faf20267baa43d9a72ee6416f56fbc41dd640adc2aba3c4043802a0e9 images.v1_26_2.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:028e10651db0d1ddb769a27c9483c6d41be6ac597f253afd9d599f395d9c82d8 images.v1_26_2.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:366266f10e658c4cea86bddf6ee847e1908ea4dd780cb5f7fb0e466bac8995f1 @@ -451,11 +451,26 @@ spec: images.v1_26_6.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8a21e30593e51f2fd2e51d9ab1d0ed2fc43eaa9b98173d7fb74f799d6b2f163d images.v1_26_6.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:47100186c27934adeda3002bb04cac28980ca8854eee7d6e4f4b3f85562e9a8e images.v1_26_6.ztunnel: registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:f39e2c28ef36fce9f808f3946cc4e4126047e142ad84cb18c222cecceae29730 + images.v1_26_8.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:edb5aab128bc90ba62a9b1d268be82ea8771ff70b0305ad9d85d8f669a995044 + images.v1_26_8.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6f9ed59521fab78d5cf576d0519b5aa40ea46963a13772b0a6ecabafbb32778b + images.v1_26_8.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:3e3e4a5f1e644796c13728c6c7f7ca8daab3b9a08d8ffd2a7a8c8f424d47b0b8 + images.v1_26_8.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6558eba168f2cb50aa40394b9ff9e71882c9e4a4c93ca189ba8f71f324c12ab4 + images.v1_26_8.ztunnel: registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:af4076fd0bef20612081bd8b0dbf9434a33a879545bba823cdaeeeb01ad39056 images.v1_27_3.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ddadd677161ad8c1077dd156821d6b4e32742ccbb210e9c14696fa66a58c0867 images.v1_27_3.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:0850242436e88f7d82f0f2126de064c7e0f09844f31d8ff0f53dc8d3908075d9 images.v1_27_3.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:742bc084c26769ff57cb3aa47b7a35c2b94684c3f67a9388da07a0490a942e5c images.v1_27_3.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7d15cebf9b62f3f235c0eab5158ac8ff2fda86a1d193490dc94c301402c99da8 images.v1_27_3.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:b2b3216a05f6136ed9ddb71d72d493030c6d6b431682dddffa692c760b6c9ba1 + images.v1_27_5.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2929b7df3da8228a728945542647ec5450c0585a2ed5cbdb84f8e3d81ab41806 + images.v1_27_5.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2e515a40de141bd4e516bfcf4fd0cbb8d236ac02799a7a35d77ae44f53916bc9 + images.v1_27_5.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d1baba8cb454b62d804dc427d4ccfea928348631c384d1ab3d170e1e2a9d1178 + images.v1_27_5.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:650da1e2ad1cb93e6a0231dba7ca1f27f4cccac84e5925135281adc629a0caea + images.v1_27_5.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:0ae2919cd446e0e1f0a21d0850e7809ba8f44c06d484c023b3bee2787ca4bdd0 + images.v1_27_8.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f072a10513086f330af8bbd4e70d6922167417cfb15674d4e9834565071f2c20 + images.v1_27_8.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:2a25d47b4bb3bf346563a0ccea986c0ab0466709ca4cb9d2666ba6a02a8a5f31 + images.v1_27_8.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:6eaedfbf16cfc73196e693b97d33e399acf438bce5fd7ec3c91f3f084c87edf0 + images.v1_27_8.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2b5f5aa5ee9974269d8e3666b1bfc58da10c172bf3f1d6defd555fbd1ac9a6ec + images.v1_27_8.ztunnel: registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4e085c9b6ca08f950798bf5153579e00e8e65226befe9c9043c19ae53f8a3a2d kubectl.kubernetes.io/default-container: sail-operator labels: app.kubernetes.io/created-by: servicemeshoperator3 @@ -486,7 +501,7 @@ spec: - --zap-log-level=info command: - /usr/local/bin/sail-operator - image: registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:656511cdb0683ff7e3336d4f41a672b4063b665e9e6e34d5370640103fd49365 + image: registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b2a576f6eaddba51d5f9a7847642e95b6dfaafc4498e779f17e5f216c677f873 livenessProbe: httpGet: path: /healthz diff --git a/charts/dependencies/sail-operator/values.yaml b/charts/dependencies/sail-operator/values.yaml index c19f725b..716af693 100644 --- a/charts/dependencies/sail-operator/values.yaml +++ b/charts/dependencies/sail-operator/values.yaml @@ -5,4 +5,4 @@ imagePullSecrets: - name: rhaii-pull-secret bundle: - version: "3.2.1" + version: "3.2.3" From 362ff11429dbdb02639b3db15fb855b523d913fa Mon Sep 17 00:00:00 2001 From: Davide Bianchi <10374360+davidebianchi@users.noreply.github.com> Date: Thu, 16 Apr 2026 12:38:18 +0200 Subject: [PATCH 3/7] fix: set image pull policy in operator init containers (#82) --- charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml | 3 +++ .../templates/manager/deployment-rhods-operator.yaml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml b/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml index 6820221a..07c07433 100644 --- a/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml +++ b/charts/rhai-on-xks-chart/scripts/helmtemplate-config.yaml @@ -121,8 +121,11 @@ rules: # Rename webhook cert secret in volume (rhods-operator to rhai-operator) - path: .spec.template.spec.volumes[name=cert].secret.secretName value: rhai-operator-controller-webhook-cert + # Replace init container image with Helm template value - path: .spec.template.spec.initContainers[name=copy-manifests].image value: '{{ .Values.rhaiOperator.image }}' + - path: .spec.template.spec.initContainers[name=copy-manifests].imagePullPolicy + value: '{{ .Values.rhaiOperator.imagePullPolicy }}' # Rename ServiceAccount - match: diff --git a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml index 1163ca3b..cb738214 100644 --- a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml @@ -168,7 +168,7 @@ spec: - /opt/manifests-template/. - /opt/manifests/ image: {{ .Values.rhaiOperator.image }} - imagePullPolicy: Always + imagePullPolicy: {{ .Values.rhaiOperator.imagePullPolicy }} name: copy-manifests resources: limits: From 32c1d8c44699fbba3bcf650124552e90f83cae6c Mon Sep 17 00:00:00 2001 From: Wen Zhou Date: Thu, 16 Apr 2026 12:59:50 +0200 Subject: [PATCH 4/7] update: rename rhaii-* to rhai-* (#80) - keep profile as rhaii - keep exmpale namespace rhaii-gitops , release name rhaii Signed-off-by: Wen Zhou --- .../cert-manager-operator/api-docs.md | 2 +- .../test/snapshots/default.snap.yaml | 8 +-- .../cert-manager-operator/values.yaml | 2 +- charts/dependencies/lws-operator/api-docs.md | 2 +- .../test/snapshots/default.snap.yaml | 4 +- charts/dependencies/lws-operator/values.yaml | 2 +- charts/dependencies/sail-operator/api-docs.md | 2 +- .../test/snapshots/default.snap.yaml | 4 +- charts/dependencies/sail-operator/values.yaml | 2 +- charts/rhai-on-xks-chart/README.md | 8 +-- charts/rhai-on-xks-chart/api-docs.md | 2 +- .../rhai-on-xks-chart/templates/_helpers.tpl | 2 +- ...ployment-azure-cloud-manager-operator.yaml | 4 +- ...ment-coreweave-cloud-manager-operator.yaml | 4 +- .../templates/hooks/post-install-crs-job.yaml | 4 +- .../hooks/post-install-crs-rbac.yaml | 10 +-- .../hooks/post-install-gateway-job.yaml | 18 ++--- .../manager/deployment-rhods-operator.yaml | 6 +- .../azure-with-pull-secret.snap.yaml | 68 +++++++++---------- .../azure-with-related-images.snap.yaml | 50 +++++++------- .../coreweave-with-pull-secret.snap.yaml | 68 +++++++++---------- .../test/snapshots/coreweave.snap.yaml | 50 +++++++------- .../snapshots/with-custom-namespace.snap.yaml | 50 +++++++------- charts/rhai-on-xks-chart/values.schema.json | 4 +- charts/rhai-on-xks-chart/values.yaml | 2 +- 25 files changed, 189 insertions(+), 189 deletions(-) diff --git a/charts/dependencies/cert-manager-operator/api-docs.md b/charts/dependencies/cert-manager-operator/api-docs.md index 4f950481..be20ad7b 100644 --- a/charts/dependencies/cert-manager-operator/api-docs.md +++ b/charts/dependencies/cert-manager-operator/api-docs.md @@ -15,7 +15,7 @@ Red Hat cert-manager Operator for vanilla Kubernetes (without OLM) | Key | Type | Default | Description | |-----|------|---------|-------------| | bundle.version | string | `"v1.18.1"` | | -| imagePullSecrets[0].name | string | `"rhaii-pull-secret"` | | +| imagePullSecrets[0].name | string | `"rhai-pull-secret"` | | | operandNamespace | string | `"cert-manager"` | | | operatorNamespace | string | `"cert-manager-operator"` | | diff --git a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml index 86bf9586..7562fe66 100644 --- a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml @@ -18,7 +18,7 @@ metadata: name: cert-manager-operator-controller-manager namespace: cert-manager-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: cert-manager-operator/templates/serviceaccount-cert-manager.yaml apiVersion: v1 @@ -27,7 +27,7 @@ metadata: name: cert-manager namespace: cert-manager imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: cert-manager-operator/templates/serviceaccount-cert-manager.yaml apiVersion: v1 @@ -36,7 +36,7 @@ metadata: name: cert-manager-cainjector namespace: cert-manager imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: cert-manager-operator/templates/serviceaccount-cert-manager.yaml apiVersion: v1 @@ -45,7 +45,7 @@ metadata: name: cert-manager-webhook namespace: cert-manager imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: cert-manager-operator/templates/clusterrole-cert-manager-operator-controller-manager-clusterro.yaml apiVersion: rbac.authorization.k8s.io/v1 diff --git a/charts/dependencies/cert-manager-operator/values.yaml b/charts/dependencies/cert-manager-operator/values.yaml index 0d6a0697..41eb5633 100644 --- a/charts/dependencies/cert-manager-operator/values.yaml +++ b/charts/dependencies/cert-manager-operator/values.yaml @@ -3,7 +3,7 @@ operatorNamespace: cert-manager-operator operandNamespace: cert-manager imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret bundle: version: "v1.18.1" diff --git a/charts/dependencies/lws-operator/api-docs.md b/charts/dependencies/lws-operator/api-docs.md index e02ac86a..673afaec 100644 --- a/charts/dependencies/lws-operator/api-docs.md +++ b/charts/dependencies/lws-operator/api-docs.md @@ -19,6 +19,6 @@ Red Hat Leader Worker Set Operator for Kubernetes | Key | Type | Default | Description | |-----|------|---------|-------------| | bundle.version | string | `"1.0"` | | -| imagePullSecrets[0].name | string | `"rhaii-pull-secret"` | | +| imagePullSecrets[0].name | string | `"rhai-pull-secret"` | | | namespace | string | `"openshift-lws-operator"` | | diff --git a/charts/dependencies/lws-operator/test/snapshots/default.snap.yaml b/charts/dependencies/lws-operator/test/snapshots/default.snap.yaml index 3ff7d810..05bc73fc 100644 --- a/charts/dependencies/lws-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/lws-operator/test/snapshots/default.snap.yaml @@ -12,7 +12,7 @@ metadata: name: lws-controller-manager namespace: openshift-lws-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: lws-operator/templates/serviceaccount-openshift-lws-operator.yaml apiVersion: v1 @@ -21,7 +21,7 @@ metadata: name: openshift-lws-operator namespace: openshift-lws-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: lws-operator/templates/clusterrole-openshift-lws-operator-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 diff --git a/charts/dependencies/lws-operator/values.yaml b/charts/dependencies/lws-operator/values.yaml index 6c9584ad..7f41439c 100644 --- a/charts/dependencies/lws-operator/values.yaml +++ b/charts/dependencies/lws-operator/values.yaml @@ -2,7 +2,7 @@ namespace: openshift-lws-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret bundle: version: "1.0" diff --git a/charts/dependencies/sail-operator/api-docs.md b/charts/dependencies/sail-operator/api-docs.md index c8e7a851..48039b3e 100644 --- a/charts/dependencies/sail-operator/api-docs.md +++ b/charts/dependencies/sail-operator/api-docs.md @@ -19,6 +19,6 @@ Red Hat Sail Operator (OSSM 3.x) for Kubernetes | Key | Type | Default | Description | |-----|------|---------|-------------| | bundle.version | string | `"3.2.3"` | | -| imagePullSecrets[0].name | string | `"rhaii-pull-secret"` | | +| imagePullSecrets[0].name | string | `"rhai-pull-secret"` | | | namespace | string | `"istio-system"` | | diff --git a/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml b/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml index 1ea25880..d86fbe64 100644 --- a/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/sail-operator/test/snapshots/default.snap.yaml @@ -12,7 +12,7 @@ metadata: name: servicemesh-operator3 namespace: istio-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: sail-operator/templates/clusterrole-metrics-reader.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -568,4 +568,4 @@ spec: ENABLE_GATEWAY_API_INFERENCE_EXTENSION: "true" global: imagePullSecrets: - - rhaii-pull-secret + - rhai-pull-secret diff --git a/charts/dependencies/sail-operator/values.yaml b/charts/dependencies/sail-operator/values.yaml index 716af693..dad0748b 100644 --- a/charts/dependencies/sail-operator/values.yaml +++ b/charts/dependencies/sail-operator/values.yaml @@ -2,7 +2,7 @@ namespace: istio-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret bundle: version: "3.2.3" diff --git a/charts/rhai-on-xks-chart/README.md b/charts/rhai-on-xks-chart/README.md index 30797a00..c966a539 100644 --- a/charts/rhai-on-xks-chart/README.md +++ b/charts/rhai-on-xks-chart/README.md @@ -41,10 +41,10 @@ podman login registry.redhat.io --authfile /path/to/auth.json The `imagePullSecret.dockerConfigJson` parameter: -1. Creates a `kubernetes.io/dockerconfigjson` Secret named `rhaii-pull-secret` in all chart-managed namespaces (operator, applications, release, cloud manager and all dependency namespaces) +1. Creates a `kubernetes.io/dockerconfigjson` Secret named `rhai-pull-secret` in all chart-managed namespaces (operator, applications, release, cloud manager and all dependency namespaces) 2. Adds `imagePullSecrets` to all chart-managed ServiceAccounts (RHAI operator, cloud manager, llmisvc-controller-manager, and the post-install hook) -The secret name defaults to `rhaii-pull-secret` and **should not** be changed. +The secret name defaults to `rhai-pull-secret` and **should not** be changed. > [!NOTE] > Pull secrets for dependency namespaces (`cert-manager-operator`, `cert-manager`, `istio-system`, `openshift-lws-operator`) are managed by this chart by default. To customize which dependency namespaces receive pull secrets, set `imagePullSecret.dependencyNamespaces`. @@ -92,8 +92,8 @@ Phase 2 and 3 are necessary because the CRs depend on CRDs and resources that ar By default (`components.kserve.gateway.create: true`), the chart creates a Gateway CR named `inference-gateway` in the applications namespace. This gateway is required for KServe model inference traffic. The hook: 1. Waits for Gateway API CRDs to be installed (by the cloud manager) -2. Waits for the cert-manager CA secret (`rhaii-ca`) -3. Creates a CA bundle ConfigMap (`rhaii-ca-bundle`) +2. Waits for the cert-manager CA secret (`rhai-ca`) +3. Creates a CA bundle ConfigMap (`rhai-ca-bundle`) 4. Creates a gateway config ConfigMap (`inference-gateway-config`) with CA bundle mount for istio-proxy and Azure-specific health probe annotation (Azure only) 5. Waits for the `istio` GatewayClass (created by Sail Operator) 6. Creates the `inference-gateway` Gateway CR diff --git a/charts/rhai-on-xks-chart/api-docs.md b/charts/rhai-on-xks-chart/api-docs.md index eb494ff2..b1f86d9b 100644 --- a/charts/rhai-on-xks-chart/api-docs.md +++ b/charts/rhai-on-xks-chart/api-docs.md @@ -45,7 +45,7 @@ Red Hat OpenShift AI Operator Helm chart (non-OLM installation) | imagePullSecret.dependencyNamespaces[2] | string | `"openshift-lws-operator"` | | | imagePullSecret.dependencyNamespaces[3] | string | `"istio-system"` | | | imagePullSecret.dockerConfigJson | string | `""` | | -| imagePullSecret.name | string | `"rhaii-pull-secret"` | | +| imagePullSecret.name | string | `"rhai-pull-secret"` | | | installCRDs | bool | `true` | | | labels | object | `{}` | | | rhaiOperator.applicationsNamespace | string | `"redhat-ods-applications"` | | diff --git a/charts/rhai-on-xks-chart/templates/_helpers.tpl b/charts/rhai-on-xks-chart/templates/_helpers.tpl index b471bd44..78524742 100644 --- a/charts/rhai-on-xks-chart/templates/_helpers.tpl +++ b/charts/rhai-on-xks-chart/templates/_helpers.tpl @@ -36,7 +36,7 @@ true Return the imagePullSecret name. */}} {{- define "rhai-on-xks-chart.imagePullSecretName" -}} -{{- .Values.imagePullSecret.name | default "rhaii-pull-secret" -}} +{{- .Values.imagePullSecret.name | default "rhai-pull-secret" -}} {{- end -}} {{/* diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml index e9599c30..1edbe977 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/azure/manager/deployment-azure-cloud-manager-operator.yaml @@ -59,11 +59,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: diff --git a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml index f85d6cf5..f7f760cb 100644 --- a/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/cloudmanager/coreweave/manager/deployment-coreweave-cloud-manager-operator.yaml @@ -59,11 +59,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml index c263ba2b..7dc69440 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml @@ -7,7 +7,7 @@ apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: {{ .Release.Namespace }} labels: {{- include "rhai-on-xks-chart.labels" . | nindent 4 }} @@ -23,7 +23,7 @@ spec: {{- include "rhai-on-xks-chart.labels" . | nindent 8 }} spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook {{- include "rhai-on-xks-chart.imagePullSecrets" . | nindent 6 }} securityContext: runAsNonRoot: true diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-rbac.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-rbac.yaml index f4e49e41..e1dfd893 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-rbac.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-rbac.yaml @@ -8,7 +8,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: {{ .Release.Namespace }} labels: {{- include "rhai-on-xks-chart.labels" . | nindent 4 }} @@ -20,7 +20,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: {{- include "rhai-on-xks-chart.labels" . | nindent 4 }} annotations: @@ -89,7 +89,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: {{- include "rhai-on-xks-chart.labels" . | nindent 4 }} annotations: @@ -99,10 +99,10 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: {{ .Release.Namespace }} {{- end }} {{- end }} diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml index 1d6c1c3f..7e5d9d71 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml @@ -4,7 +4,7 @@ apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: {{ .Release.Namespace }} labels: {{- include "rhai-on-xks-chart.labels" . | nindent 4 }} @@ -20,7 +20,7 @@ spec: {{- include "rhai-on-xks-chart.labels" . | nindent 8 }} spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook {{- include "rhai-on-xks-chart.imagePullSecrets" . | nindent 6 }} securityContext: runAsNonRoot: true @@ -72,7 +72,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -84,9 +84,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n {{ $appNs }} \ --dry-run=client -o yaml | kubectl apply -f - @@ -105,14 +105,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true {{- if .Values.azure.enabled }} service: | diff --git a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml index cb738214..b8a9482f 100644 --- a/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml +++ b/charts/rhai-on-xks-chart/templates/manager/deployment-rhods-operator.yaml @@ -99,13 +99,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml index 31fa3c19..3b995a1a 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml @@ -48,7 +48,7 @@ metadata: name: azure-cloud-manager-operator namespace: rhai-cloudmanager-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/pull-secret.yaml # TODO: This is a temporary solution to inject the pull secret into the llmisvc-controller-manager service account. @@ -58,7 +58,7 @@ metadata: name: llmisvc-controller-manager namespace: redhat-ods-applications imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/rbac/serviceaccount-redhat-ods-operator-controller-manager.yaml apiVersion: v1 @@ -67,13 +67,13 @@ metadata: name: rhai-operator-controller-manager namespace: redhat-ods-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/pull-secret.yaml apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: redhat-ods-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -86,7 +86,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: redhat-ods-applications labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -99,7 +99,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -112,7 +112,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: rhai-cloudmanager-system labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -125,7 +125,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: cert-manager-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -138,7 +138,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: cert-manager labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -151,7 +151,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: openshift-lws-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -164,7 +164,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: istio-system labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2380,11 +2380,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2531,13 +2531,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2688,7 +2688,7 @@ webhooks: apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2702,7 +2702,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2771,7 +2771,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2782,17 +2782,17 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default --- # Source: rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2810,9 +2810,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2880,7 +2880,7 @@ spec: apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2898,9 +2898,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2951,7 +2951,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2963,9 +2963,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n redhat-ods-applications \ --dry-run=client -o yaml | kubectl apply -f - @@ -2984,14 +2984,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true service: | metadata: diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml index 8f7907cf..28552196 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml @@ -24,7 +24,7 @@ metadata: name: azure-cloud-manager-operator namespace: rhai-cloudmanager-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/rbac/serviceaccount-redhat-ods-operator-controller-manager.yaml apiVersion: v1 @@ -33,7 +33,7 @@ metadata: name: rhai-operator-controller-manager namespace: redhat-ods-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/cloudmanager/azure/crds/customresourcedefinition-azurekubernetesengines.infrastructure.opendatahub.io.yaml apiVersion: apiextensions.k8s.io/v1 @@ -2242,11 +2242,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2393,13 +2393,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2552,7 +2552,7 @@ webhooks: apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2566,7 +2566,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2635,7 +2635,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2646,17 +2646,17 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default --- # Source: rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2674,9 +2674,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2744,7 +2744,7 @@ spec: apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2762,9 +2762,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2815,7 +2815,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2827,9 +2827,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n redhat-ods-applications \ --dry-run=client -o yaml | kubectl apply -f - @@ -2848,14 +2848,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true service: | metadata: diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml index ccc55730..5b4e0ae1 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml @@ -48,7 +48,7 @@ metadata: name: coreweave-cloud-manager-operator namespace: rhai-cloudmanager-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/pull-secret.yaml # TODO: This is a temporary solution to inject the pull secret into the llmisvc-controller-manager service account. @@ -58,7 +58,7 @@ metadata: name: llmisvc-controller-manager namespace: redhat-ods-applications imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/rbac/serviceaccount-redhat-ods-operator-controller-manager.yaml apiVersion: v1 @@ -67,13 +67,13 @@ metadata: name: rhai-operator-controller-manager namespace: redhat-ods-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/pull-secret.yaml apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: redhat-ods-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -86,7 +86,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: redhat-ods-applications labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -99,7 +99,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -112,7 +112,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: rhai-cloudmanager-system labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -125,7 +125,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: cert-manager-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -138,7 +138,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: cert-manager labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -151,7 +151,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: openshift-lws-operator labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -164,7 +164,7 @@ data: apiVersion: v1 kind: Secret metadata: - name: rhaii-pull-secret + name: rhai-pull-secret namespace: istio-system labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2380,11 +2380,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2531,13 +2531,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2688,7 +2688,7 @@ webhooks: apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2702,7 +2702,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2771,7 +2771,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2782,17 +2782,17 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default --- # Source: rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2810,9 +2810,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2880,7 +2880,7 @@ spec: apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2898,9 +2898,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2951,7 +2951,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2963,9 +2963,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n redhat-ods-applications \ --dry-run=client -o yaml | kubectl apply -f - @@ -2984,14 +2984,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true EOF echo "ConfigMap used by Gateway CR 'inference-gateway' created." diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml index 73d48aee..c462c65e 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml @@ -24,7 +24,7 @@ metadata: name: coreweave-cloud-manager-operator namespace: rhai-cloudmanager-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/rbac/serviceaccount-redhat-ods-operator-controller-manager.yaml apiVersion: v1 @@ -33,7 +33,7 @@ metadata: name: rhai-operator-controller-manager namespace: redhat-ods-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/cloudmanager/coreweave/crds/customresourcedefinition-coreweavekubernetesengines.infrastructure.opendatahub.io.yaml apiVersion: apiextensions.k8s.io/v1 @@ -2242,11 +2242,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2393,13 +2393,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2550,7 +2550,7 @@ webhooks: apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2564,7 +2564,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2633,7 +2633,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2644,17 +2644,17 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default --- # Source: rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2672,9 +2672,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2742,7 +2742,7 @@ spec: apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2760,9 +2760,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2813,7 +2813,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2825,9 +2825,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n redhat-ods-applications \ --dry-run=client -o yaml | kubectl apply -f - @@ -2846,14 +2846,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true EOF echo "ConfigMap used by Gateway CR 'inference-gateway' created." diff --git a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml index f7dd8505..dc385a0a 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml @@ -24,7 +24,7 @@ metadata: name: azure-cloud-manager-operator namespace: rhai-cloudmanager-system imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/rbac/serviceaccount-redhat-ods-operator-controller-manager.yaml apiVersion: v1 @@ -33,7 +33,7 @@ metadata: name: rhai-operator-controller-manager namespace: rhai-operator imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret --- # Source: rhai-on-xks-chart/templates/cloudmanager/azure/crds/customresourcedefinition-azurekubernetesengines.infrastructure.opendatahub.io.yaml apiVersion: apiextensions.k8s.io/v1 @@ -2242,11 +2242,11 @@ spec: - name: RHAI_WEBHOOK_CERT_NAME value: rhai-operator-webhook-cert - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: OPERATOR_NAMESPACE valueFrom: fieldRef: @@ -2393,13 +2393,13 @@ spec: - name: ODH_PLATFORM_TYPE value: XKS - name: RHAI_CA_SECRET_NAME - value: rhaii-ca + value: rhai-ca - name: RHAI_CA_SECRET_NAMESPACE value: cert-manager - name: RHAI_ISSUER_REF_NAME - value: rhaii-ca-issuer + value: rhai-ca-issuer - name: RHAI_ISTIO_CA_CERTIFICATE_PATH - value: /var/run/secrets/rhaii/ca.crt + value: /var/run/secrets/rhai/ca.crt - name: OPERATOR_NAME value: rhai-operator - name: OPERATOR_NAMESPACE @@ -2550,7 +2550,7 @@ webhooks: apiVersion: v1 kind: ServiceAccount metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2564,7 +2564,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2633,7 +2633,7 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: rhaii-post-install-hook + name: rhai-post-install-hook labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED app.kubernetes.io/managed-by: Helm @@ -2644,17 +2644,17 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: rhaii-post-install-hook + name: rhai-post-install-hook subjects: - kind: ServiceAccount - name: rhaii-post-install-hook + name: rhai-post-install-hook namespace: default --- # Source: rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-install-crs + name: rhai-post-install-crs namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2672,9 +2672,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2742,7 +2742,7 @@ spec: apiVersion: batch/v1 kind: Job metadata: - name: rhaii-post-create-gateway + name: rhai-post-create-gateway namespace: default labels: helm.sh/chart: HELM_CHART_VERSION_REDACTED @@ -2760,9 +2760,9 @@ spec: app.kubernetes.io/managed-by: Helm spec: restartPolicy: Never - serviceAccountName: rhaii-post-install-hook + serviceAccountName: rhai-post-install-hook imagePullSecrets: - - name: rhaii-pull-secret + - name: rhai-pull-secret securityContext: runAsNonRoot: true seccompProfile: @@ -2813,7 +2813,7 @@ spec: echo "Step 2: Waiting for cert-manager CA secret required by Gateway CR 'inference-gateway'..." ELAPSED=0 - until kubectl get secret rhaii-ca -n cert-manager >/dev/null 2>&1; do + until kubectl get secret rhai-ca -n cert-manager >/dev/null 2>&1; do if [ "$ELAPSED" -ge "$TIMEOUT" ]; then echo "ERROR: Timed out waiting for CA secret after ${TIMEOUT}s" exit 1 @@ -2825,9 +2825,9 @@ spec: echo "CA secret is available." echo "Step 3: Creating CA bundle ConfigMap for Gateway CR 'inference-gateway'..." - kubectl get secret rhaii-ca -n cert-manager \ + kubectl get secret rhai-ca -n cert-manager \ -o jsonpath='{.data.ca\.crt}' | base64 -d > /tmp/ca.crt - kubectl create configmap rhaii-ca-bundle \ + kubectl create configmap rhai-ca-bundle \ --from-file=ca.crt=/tmp/ca.crt \ -n rhai-applications \ --dry-run=client -o yaml | kubectl apply -f - @@ -2846,14 +2846,14 @@ spec: template: spec: volumes: - - name: rhaii-ca-bundle + - name: rhai-ca-bundle configMap: - name: rhaii-ca-bundle + name: rhai-ca-bundle containers: - name: istio-proxy volumeMounts: - - name: rhaii-ca-bundle - mountPath: /var/run/secrets/rhaii + - name: rhai-ca-bundle + mountPath: /var/run/secrets/rhai readOnly: true service: | metadata: diff --git a/charts/rhai-on-xks-chart/values.schema.json b/charts/rhai-on-xks-chart/values.schema.json index a8154ac2..1608de1a 100644 --- a/charts/rhai-on-xks-chart/values.schema.json +++ b/charts/rhai-on-xks-chart/values.schema.json @@ -247,8 +247,8 @@ "name": { "type": "string", "description": "Name of the pull secret to create in target namespaces", - "default": "rhaii-pull-secret", - "const": "rhaii-pull-secret" + "default": "rhai-pull-secret", + "const": "rhai-pull-secret" }, "dockerConfigJson": { "type": "string", diff --git a/charts/rhai-on-xks-chart/values.yaml b/charts/rhai-on-xks-chart/values.yaml index ccabd918..1dccb356 100644 --- a/charts/rhai-on-xks-chart/values.yaml +++ b/charts/rhai-on-xks-chart/values.yaml @@ -100,7 +100,7 @@ coreweave: imagePullSecret: # Name of the pull secret to create in target namespaces. This name MUST not be changed # as it is referred also in other installed dependencies and not yet configurable. - name: rhaii-pull-secret + name: rhai-pull-secret # Docker config JSON content (populated via --set-file) dockerConfigJson: "" # Namespaces created by dependency operators where pull secrets should be injected From e74d47c32faac3b92a76bb72fcfe629e222859b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rinaldo=20Pitzer=20J=C3=BAnior?= <16694899+rinaldodev@users.noreply.github.com> Date: Thu, 16 Apr 2026 14:24:16 -0300 Subject: [PATCH 5/7] RHOAIENG-57828: add CertManager/cluster CR to cert-manager-operator chart (#78) Add CertManager/cluster to the cert-manager-operator Helm chart templates so it receives an OwnerReference to the AKE/CWE CR via dynamic ownership. Without this, the opendatahub-operator finalizer action that sequences CertManager/cluster deletion (added in the companion opendatahub-operator PR) cannot identify "our" CR by UID and is a no-op. With this file present, the cleanup action correctly deletes CertManager/cluster before cascade, allowing cert-manager-operator to process its own finalizers and remove its operand Deployments before the operator pod is killed. Assisted-By: Claude Sonnet 4.6 --- .../cert-manager-operator/templates/certmanager.yaml | 6 ++++++ .../test/snapshots/default.snap.yaml | 8 ++++++++ 2 files changed, 14 insertions(+) create mode 100644 charts/dependencies/cert-manager-operator/templates/certmanager.yaml diff --git a/charts/dependencies/cert-manager-operator/templates/certmanager.yaml b/charts/dependencies/cert-manager-operator/templates/certmanager.yaml new file mode 100644 index 00000000..14eb0a02 --- /dev/null +++ b/charts/dependencies/cert-manager-operator/templates/certmanager.yaml @@ -0,0 +1,6 @@ +apiVersion: operator.openshift.io/v1alpha1 +kind: CertManager +metadata: + name: cluster +spec: + managementState: Managed diff --git a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml index 7562fe66..9d5144e3 100644 --- a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml @@ -559,3 +559,11 @@ spec: volumes: - emptyDir: {} name: tmp +--- +# Source: cert-manager-operator/templates/certmanager.yaml +apiVersion: operator.openshift.io/v1alpha1 +kind: CertManager +metadata: + name: cluster +spec: + managementState: Managed From 027b76f009e79e1c544a2dd228de1db06a9ef76d Mon Sep 17 00:00:00 2001 From: Davide Bianchi <10374360+davidebianchi@users.noreply.github.com> Date: Fri, 17 Apr 2026 12:39:00 +0200 Subject: [PATCH 6/7] fix(RHOAIENG-58507): use cli image from values for both hooks (#84) --- charts/rhai-on-xks-chart/api-docs.md | 2 +- .../templates/hooks/post-install-crs-job.yaml | 2 +- .../templates/hooks/post-install-gateway-job.yaml | 2 +- .../snapshots/azure-with-pull-secret.snap.yaml | 4 ++-- .../snapshots/azure-with-related-images.snap.yaml | 4 ++-- .../snapshots/coreweave-with-pull-secret.snap.yaml | 4 ++-- .../test/snapshots/coreweave.snap.yaml | 4 ++-- .../test/snapshots/with-custom-namespace.snap.yaml | 4 ++-- charts/rhai-on-xks-chart/values.schema.json | 14 +++++++------- charts/rhai-on-xks-chart/values.yaml | 2 +- 10 files changed, 21 insertions(+), 21 deletions(-) diff --git a/charts/rhai-on-xks-chart/api-docs.md b/charts/rhai-on-xks-chart/api-docs.md index b1f86d9b..1b310dbd 100644 --- a/charts/rhai-on-xks-chart/api-docs.md +++ b/charts/rhai-on-xks-chart/api-docs.md @@ -38,8 +38,8 @@ Red Hat OpenShift AI Operator Helm chart (non-OLM installation) | coreweave.kubernetesEngine.spec.dependencies.sailOperator.configuration | object | `{}` | | | coreweave.kubernetesEngine.spec.dependencies.sailOperator.managementPolicy | string | `"Managed"` | | | enabled | bool | `true` | | +| hooks.cliImage | string | `"registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1"` | | | hooks.postInstallCrs.enabled | bool | `true` | | -| hooks.postInstallCrs.image | string | `"registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce"` | | | imagePullSecret.dependencyNamespaces[0] | string | `"cert-manager-operator"` | | | imagePullSecret.dependencyNamespaces[1] | string | `"cert-manager"` | | | imagePullSecret.dependencyNamespaces[2] | string | `"openshift-lws-operator"` | | diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml index 7dc69440..ce096598 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-crs-job.yaml @@ -31,7 +31,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: {{ required "hooks.postInstallCrs.image is required" .Values.hooks.postInstallCrs.image | quote }} + image: {{ required "hooks.cliImage is required" .Values.hooks.cliImage | quote }} resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml index 7e5d9d71..8e838ee5 100644 --- a/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml +++ b/charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml @@ -31,7 +31,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: {{ required "hooks.cliImage is required" .Values.hooks.cliImage | quote }} resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml index 3b995a1a..caae5112 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml @@ -2819,7 +2819,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: "registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce" + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m @@ -2910,7 +2910,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml index 28552196..21516f19 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml @@ -2683,7 +2683,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: "registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce" + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m @@ -2774,7 +2774,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml index 5b4e0ae1..81bb32c4 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave-with-pull-secret.snap.yaml @@ -2819,7 +2819,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: "registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce" + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m @@ -2910,7 +2910,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml index c462c65e..052f4a6e 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/coreweave.snap.yaml @@ -2681,7 +2681,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: "registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce" + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m @@ -2772,7 +2772,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml index dc385a0a..cf8229f4 100644 --- a/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml +++ b/charts/rhai-on-xks-chart/test/snapshots/with-custom-namespace.snap.yaml @@ -2681,7 +2681,7 @@ spec: type: RuntimeDefault containers: - name: create-crs - image: "registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce" + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m @@ -2772,7 +2772,7 @@ spec: emptyDir: {} containers: - name: create-gateway - image: registry.redhat.io/openshift4/ose-cli-rhel9:v4.21.0 + image: "registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1" resources: limits: cpu: 200m diff --git a/charts/rhai-on-xks-chart/values.schema.json b/charts/rhai-on-xks-chart/values.schema.json index 1608de1a..ca3c4869 100644 --- a/charts/rhai-on-xks-chart/values.schema.json +++ b/charts/rhai-on-xks-chart/values.schema.json @@ -41,6 +41,10 @@ "type": "object", "description": "Helm hooks configuration", "properties": { + "cliImage": { + "type": "string", + "description": "CLI container image used by all post-install hook jobs" + }, "postInstallCrs": { "type": "object", "description": "Post-install hook for creating CRs", @@ -49,16 +53,12 @@ "type": "boolean", "description": "Enable post-install CR creation hook", "default": true - }, - "image": { - "type": "string", - "description": "Container image used by the post-install hook job" } }, - "additionalProperties": false, - "required": ["image"] + "additionalProperties": false } - } + }, + "required": ["cliImage"] }, "components": { "type": "object", diff --git a/charts/rhai-on-xks-chart/values.yaml b/charts/rhai-on-xks-chart/values.yaml index 1dccb356..c7344fa8 100644 --- a/charts/rhai-on-xks-chart/values.yaml +++ b/charts/rhai-on-xks-chart/values.yaml @@ -24,9 +24,9 @@ rhaiOperator: # value: quay.io/opendatahub/kserve-controller:latest hooks: + cliImage: registry.redhat.io/openshift4/ose-cli-rhel9:v4.20@sha256:d876c1d98b39d65c00c4261431bb84b90284699f3aef84d8701a25c786fb79a1 postInstallCrs: enabled: true - image: registry.redhat.io/openshift4/ose-cli-rhel9@sha256:dcb3f93d34aa0fdab33eb37949adfaa8fdd11ff3479363bb7735c5ba3eb345ce # Components configuration components: From d15165be2ce18ff2f7c4092282b46ee9edfcf493 Mon Sep 17 00:00:00 2001 From: Wen Zhou Date: Fri, 17 Apr 2026 14:24:06 +0200 Subject: [PATCH 7/7] Revert "RHOAIENG-57828: add CertManager/cluster CR to cert-manager-operator chart (#78)" This reverts commit e74d47c32faac3b92a76bb72fcfe629e222859b1. --- .../cert-manager-operator/templates/certmanager.yaml | 6 ------ .../test/snapshots/default.snap.yaml | 8 -------- 2 files changed, 14 deletions(-) delete mode 100644 charts/dependencies/cert-manager-operator/templates/certmanager.yaml diff --git a/charts/dependencies/cert-manager-operator/templates/certmanager.yaml b/charts/dependencies/cert-manager-operator/templates/certmanager.yaml deleted file mode 100644 index 14eb0a02..00000000 --- a/charts/dependencies/cert-manager-operator/templates/certmanager.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: operator.openshift.io/v1alpha1 -kind: CertManager -metadata: - name: cluster -spec: - managementState: Managed diff --git a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml index 9d5144e3..7562fe66 100644 --- a/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml +++ b/charts/dependencies/cert-manager-operator/test/snapshots/default.snap.yaml @@ -559,11 +559,3 @@ spec: volumes: - emptyDir: {} name: tmp ---- -# Source: cert-manager-operator/templates/certmanager.yaml -apiVersion: operator.openshift.io/v1alpha1 -kind: CertManager -metadata: - name: cluster -spec: - managementState: Managed