Only create marketplace publish after container image have been publi…

…shed (minio#2084)

* Only create marketplace publish after container image have been published

---------

Signed-off-by: pjuarezd <pjuarezd@users.noreply.github.com>
Co-authored-by: Ramon de Klein <mail@ramondeklein.nl>

Makefile

@@ -90,7 +90,6 @@ helm-reindex:
 
 release: assets
 	@./release.sh
-	@./olm.sh
 
 apply-gofmt:
 	@echo "Applying gofmt to all generated an existing files"

community-operators/update-community-operator.sh

@@ -42,13 +42,11 @@ git rebase upstream/main
 git push
 
 echo " "
-echo "Execute olm.sh and then olm-post-script.sh"
+echo "Execute olm.sh"
 echo "As a work around get working scripts from your repository"
 cp ~/minio/olm-scripts/community-operators/olm.sh ~/operator/olm.sh
-cp ~/minio/olm-scripts/community-operators/olm-post-script.sh ~/operator/olm-post-script.sh
 cd ~/operator || return
 source olm.sh
-source olm-post-script.sh
 
 echo " "
 echo "Create the branch:"

olm.sh

@@ -3,7 +3,7 @@
 set -e
 
 #binary versions
-OPERATOR_SDK_VERSION=v1.22.2
+OPERATOR_SDK_VERSION=v1.34.1
 TMP_BIN_DIR="$(mktemp -d)"
 
 function install_binaries() {
@@ -24,8 +24,10 @@ function install_binaries() {
 
 install_binaries
 
+RELEASE="$(sed -n 's/^.*DefaultOperatorImage = "minio\/operator:v\(.*\)"/\1/p' pkg/controller/operator.go)"
+
 # get the minio version
-minioVersionInExample=$(kustomize build examples/kustomization/tenant-openshift | yq eval-all '.spec.image' | tail -1)
+minioVersionInExample=$(kustomize build examples/kustomization/tenant-lite | yq eval-all '.spec.image' | tail -1)
 echo "minioVersionInExample: ${minioVersionInExample}"
 
 # Get sha form of minio version
@@ -66,13 +68,15 @@ for catalog in "${redhatCatalogs[@]}"; do
     --use-image-digests \
     --kustomize-dir config/manifests
 
-  # Set the version, later in olm-post-script.sh we change for Digest form.
-  containerImage="quay.io/minio/operator:v${RELEASE}"
-  echo "containerImage: ${containerImage}"
-  operatorImageDigest="quay.io/minio/operator:v${RELEASE}"
-  yq -i ".metadata.annotations.containerImage |= (\"${operatorImageDigest}\")" bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
-  yq -i ".spec.install.spec.deployments[0].spec.template.spec.containers[0].image |= (\"${operatorImageDigest}\")" bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
-  yq -i ".spec.install.spec.deployments[1].spec.template.spec.containers[0].image |= (\"${operatorImageDigest}\")" bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
+  # https://connect.redhat.com/support/technology-partner/#/case/03206318
+  # If no securityContext is specified, the OLM will choose one that fits within
+  # the security context constraint either explicitly specified for the project under which the pod is run,
+  # or the default. If the SCC specifies a value that doesn't match the specified value in our files,
+  # the pods will not start properly and we can't be installed.
+  # Let the user select their own securityContext and don't hardcode values that can affect the ability
+  # to debug and deploy our Operator in OperatorHub.
+  echo "Removing securityContext from CSV"
+  yq -i eval 'del(.spec.install.spec.deployments[].spec.template.spec.containers[0].securityContext)' bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
 
   # Will query if a previous version of the CSV was published to the catalog of the latest supported Openshift version.
   # It will help to prevent add the `spec.replaces` annotation when there is no preexisting CSV in the catalog to replace.
@@ -88,9 +92,23 @@ for catalog in "${redhatCatalogs[@]}"; do
     PREV_VERSION=$(curl -s "https://catalog.redhat.com/api/containers/v1/operators/bundles?channel_name=stable&package=${package}&organization=${catalog}&ocp_version=${maxOpenshiftVersion}&include=data.version,data.csv_name,data.ocp_version" | jq '.data | max_by(.version).csv_name' -r)
     echo "replaces: $PREV_VERSION"
     yq -i e ".spec.replaces |= \"${PREV_VERSION}\"" bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
+    # We need to remove "skips" and only use "replaces"
+    yq -i "del(.spec.skips) " bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
   else
-    echo "no previous published in catalog ${maxOpenshiftVersion}, removing spec.replaces"
+    # This procedure is needed when a new Index is released
+    # Having a new Index (ie Openshift 4.15) means that Operator haven't been published in it yet, so the "replaces" annotation fails.
+    # To prevent it we reached out to RedHat support and told us to use "skips" instead, that way we can keep the update
+    # graph and publish Operator in the new Index for the first time.
+    # https://connect.redhat.com/support/technology-partner/#/case/03793912
+    echo "no previous published in index ${maxOpenshiftVersion}, removing spec.replaces"
     yq -i "del(.spec.replaces) " bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
+    echo "adding spec.skips for new index"
+    # Get the previous Openshift Index
+    previousOpenshiftVersion=$(curl -s "https://catalog.redhat.com/api/containers/v1/operators/indices?ocp_versions_range=${minOpenshiftVersion}-${maxOpenshiftVersion}&organization=${catalog}" | yq  '.data.[].ocp_version' | sort -V | tail -n2 | head -n1)
+    # Get the latest published operator in the previous Openshift Index
+    PREV_VERSION=$(curl -s "https://catalog.redhat.com/api/containers/v1/operators/bundles?channel_name=stable&package=${package}&organization=${catalog}&ocp_version=${previousOpenshiftVersion}&include=data.version,data.csv_name,data.ocp_version" | jq '.data | max_by(.version).csv_name' -r)
+    echo "skips: $PREV_VERSION"
+    yq -i e ".spec.skips += [\"${PREV_VERSION}\"]" bundles/$catalog/$RELEASE/manifests/$package.clusterserviceversion.yaml
   fi
 
   # Now promote the latest release to the root of the repository

redhat-marketplace/update-redhat-marketplace-operator.sh

@@ -30,13 +30,11 @@ git rebase upstream/master
 git push
 
 echo " "
-echo "Execute olm.sh and then olm-post-script.sh"
+echo "Execute olm.sh"
 echo "As a work around get working scripts from your repository"
 cp ~/minio/olm-scripts/olm.sh ~/operator/olm.sh
-cp ~/minio/olm-scripts/olm-post-script.sh ~/operator/olm-post-script.sh
 cd ~/operator || return
 source olm.sh
-source olm-post-script.sh
 
 echo " "
 echo "Create the branch:"