Openshift values not included in Latest release/image in helm chart?

[matzew]

Hello,

running:

helm upgrade -i toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-operator -n toolhive-system --create-namespace
Pulled: ghcr.io/stacklok/toolhive/toolhive-operator:0.2.4
Digest: sha256:9a3005c7cd34bff395101978d05232da50fcf1227d485a7816026391a96d24ff
Release "toolhive-operator" has been upgraded. Happy Helming!

I see the 0.2.4 image is used for the operator - will the chart be updated to contain the latest (0.2.8) image?

I saw that this contains an OPERATOR_OPENSHIFT flag, to pick OCP values (e.g. for securityContext etc)

Thanks!

[JAORMX]

This usually requires a manual bump, we'll do it today!

[JAORMX]

@matzew so version 0.2.4 of the chart should have appVersion 0.2.8 which matches the ToolHive release. The operator chart version is different than the toolhive version. I know it's a bit confusing 😕

[matzew]

Oh, ok.

So I was doing

OPERATOR_OPENSHIFT=true

helm upgrade -i toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-operator-crds

helm upgrade -i toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-operator -n toolhive-system --create-namespace

But looks like the OPERATOR_OPENSHIFT had no effect, as the pod for the operator did not come up.

Lacking these values: https://github.com/stacklok/toolhive/blob/main/deploy/charts/operator/values-openshift.yaml

[JAORMX]

Ah! I didn't know you were running on OpenShift. Yeah, the values did need a bump there.

[matzew]

@JAORMX I've update the title of the issue to be a bit more meaningful - in this context.

Thanks for looking into this

[matzew]

@JAORMX

@JAORMX I am still seeing issue:

OPERATOR_OPENSHIFT=true
helm upgrade -i toolhive-operator-crds oci://ghcr.io/stacklok/toolhive/toolhive-operator-crds                                                                                    

Release "toolhive-operator-crds" does not exist. Installing it now.
Pulled: ghcr.io/stacklok/toolhive/toolhive-operator-crds:0.0.15
Digest: sha256:43c984acaa5b043a37b95e106e63f1c04de325ad0349ce3219c18ea38b7c7a78
NAME: toolhive-operator-crds
LAST DEPLOYED: Tue Aug 19 13:00:45 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None

followed by:

helm upgrade -i toolhive-operator oci://ghcr.io/stacklok/toolhive/toolhive-operator -n toolhive-system --create-namespace
Release "toolhive-operator" does not exist. Installing it now.
Pulled: ghcr.io/stacklok/toolhive/toolhive-operator:0.2.5
Digest: sha256:76518c41e40a152a8ffa9a3a234fce9e2b8249e1683dbf54c4b65f346eacb07f
I0819 13:01:03.718983   17556 warnings.go:110] "Warning: would violate PodSecurity \"restricted:v1.24\": seccompProfile (pod or container \"manager\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")"
NAME: toolhive-operator
LAST DEPLOYED: Tue Aug 19 13:01:03 2025
NAMESPACE: toolhive-system
STATUS: deployed
REVISION: 1
TEST SUITE: None

Is there more than setting the env-var OPERATOR_OPENSHIFT ?

[RoddieKieley]

I last tested the helm chart using the values-openshift.yaml earlier today while making the update for the README.md file via PR#1487. At that point a clean deploy from the main branch worked for the operator, however when I deployed the fetch MCP server the the resulting yaml had the runAsUser, runAsGroup, and fsGroup settings set to 1000 and thus it failed. Removing these resulted in a successful fetch MCP server deployment.

That's one issue to be resolved, however I utilized the OpenShift detection of OpenShift via the route v1 API being available and not the env var override method. Will double check with that method and update further.

[jhrozek]

@matzew it's unclear to me from the issue what exact issue you are hitting, could you please clarify? The fix that @JAORMX did earlier ensures that both the operator and the proxyrunner images would be version 0.2.8, e.g.:

k describe -ntoolhive-system deploy/toolhive-operator | grep ghcr.io
    Image:       ghcr.io/stacklok/toolhive/operator:v0.2.8
      TOOLHIVE_RUNNER_IMAGE:  ghcr.io/stacklok/toolhive/proxyrunner:v0.2.8

About installing on openshift, this is really new code that @RoddieKieley merged very recently, in PR #1487 there's code block that shows how to point to the OCP-specific values file which should prevent issues Roddie was seeing wrt resource limits.

But specifying the OPERATOR_OPENSHIFT=true variable explicitly shouldn't be needed, you should see something along the lines of:

OpenShift detected by route resource check

on INFO-level in the proxy runner logs.