HYPERFLEET-1411 - refactor: Update konflux + dev bundles by ma-hill · Pull Request #29 · openshift-hyperfleet/hyperfleet-operator

ma-hill · 2026-09-10T19:54:29Z

Summary

Consolidates bundle build workflows by eliminating bundle.konflux.Dockerfile and using a single bundle.Dockerfile with build-time variant selection. This follows the same pattern as the catalog build, using a KUSTOMIZE_VARIANT build argument to select between dev (:latest tags) and production (digest-pinned) image references, reducing maintenance burden and ensuring consistency between development and CI builds.

HYPERFLEET-1411

Changes

Removed bundle.konflux.Dockerfile and consolidated into single bundle.Dockerfile with KUSTOMIZE_VARIANT build arg (defaults to config/manager/dev/kustomization.yaml)
Created config/manager/dev/kustomization.yaml for development builds using :latest image tags
Created config/manager/prod/kustomization.yaml for Konflux/production builds using digest-pinned image references (updated by Konflux build-nudges)
Removed bundle-hack/update_bundle.sh script (no longer needed with new variant-based approach)
Removed committed bundle/ directory contents (bundle manifests should be generated at build time, not committed)
Removed config/manager/kustomization.yaml (replaced by environment-specific variants)
Updated .tekton/hyperfleet-operator-bundle-push.yaml to use bundle.Dockerfile with KUSTOMIZE_VARIANT=config/manager/prod/kustomization.yaml build arg
Simplified Tekton pipeline trigger to only watch bundle.Dockerfile instead of multiple files (bundle.konflux.Dockerfile, bundle-hack/***, bundle/***)
Updated Makefile bundle targets to work with new variant-based structure

Notes

The variant system works by having the Dockerfile copy the specified kustomization file to override the base config/manager/kustomization.yaml before running kustomize build. This allows:

Dev builds: Use config/manager/dev/kustomization.yaml (default) with :latest tags for rapid iteration
Konflux/prod builds: Use config/manager/prod/kustomization.yaml with digest-pinned images that Konflux build-nudges automatically update

This eliminates the need to maintain two separate Dockerfiles and the update_bundle.sh script, reducing the surface area for drift between environments.

Test Plan

Built bundle locally with default dev variant: make bundle-build
Built bundle with prod variant: make bundle-build KUSTOMIZE_VARIANT=config/manager/prod/kustomization.yaml
Verified bundle manifests contain correct image references for each variant
Verified Konflux pipeline triggers on bundle.Dockerfile changes
Deployed bundle to development cluster and verified operator installs correctly

Gitlab Change: https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/22503

openshift-ci · 2026-09-10T19:54:33Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2026-09-10T19:54:34Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ruclo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-09-10T19:54:36Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (2)

do-not-merge/work-in-progress
do-not-merge/hold

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 936f5c27-6125-4f15-8a68-ae9d2f6c5832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

ma-hill · 2026-09-10T20:34:43Z

+    - op: add
+      path: /spec/template/spec/containers/0/env/-
+      value:
+        name: RELATED_IMAGE_HYPERFLEET_OPERATOR


Need to properly update this in makefile?

ma-hill · 2026-09-10T20:35:04Z

+    - op: add
+      path: /spec/template/spec/containers/0/env/-
+      value:
+        name: RELATED_IMAGE_HYPERFLEET_OPERATOR


Not 100% sure bundle-nudges ref will update this but hopefully

Yeah you are right it won't get nudged. The build-service nudge regex is <repo>(:.*)?@(?<currentDigest>sha256:...) on a single token, so it only matches repo@sha256:digest on one line. Splitting into newName and digest means the two RELATED_IMAGE env values below get bumped but the controller image itself goes stale. Drop the images: block and patch the container image directly in the same patch list:

- op: replace path: /spec/template/spec/containers/0/image value: quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet/hyperfleet-operator@sha256:7504189fc375ee65457baa568487b9f083b35b882d58601cd4f4ad8ee50e639e

Nudging the redhat-services-prod path is fine btw, PR #27 already did that against the old Dockerfile.

ma-hill · 2026-09-10T20:36:23Z

 # Uninstall resources 
 # kubectl delete -f dist/install.yaml
 # For image overrides edit config/manager/kustomization.yaml
 .PHONY: build-deployer
 build-deployer: manifests generate ## Generate a consolidated YAML with CRDs and deployment.
 	@mkdir -p dist
 	@$(KUSTOMIZE) build config/default > dist/install.yaml

 .PHONY: build-deployer-override-img
 build-deployer-override-img: manifests generate ## Generate deployer with IMG override, then restore kustomization.yaml
 	@mkdir -p dist
 	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)


Need to update this to work properly

Yeah true true, With config/manager/kustomization.yaml gone, kustomize build config/default fails so make deploy and build-deployer are broken. One way to avoid both this and the cp hack in the Dockerfile: keep config/manager/kustomization.yaml as the dev default, and make prod an overlay under config/manifests/prod with resources: [../] plus the image patch. Then the Dockerfile arg just picks which manifests dir to kustomize build.

ciaranRoche · 2026-09-11T10:54:07Z

+
+# Override the base kustomization.yaml
+ARG KUSTOMIZE_VARIANT=dev/kustomization.yaml
+RUN cp /workdir/config/manager/${KUSTOMIZE_VARIANT} \


this won't build on Konflux. The tekton push passes KUSTOMIZE_VARIANT=config/manager/prod/kustomization.yaml but this line prefixes /workdir/config/manager/ itself, so the cp target becomes config/manager/config/manager/prod/... and fails. Pick one convention, I'd go with the full repo path in the ARG

ARG KUSTOMIZE_VARIANT=config/manager/dev/kustomization.yaml
RUN cp /workdir/${KUSTOMIZE_VARIANT} /workdir/config/manager/kustomization.yaml &&
kustomize build /workdir/config/manifests > /workdir/manifests.yaml

ciaranRoche · 2026-09-11T10:55:27Z

+    - op: add
+      path: /spec/template/spec/containers/0/env/-
+      value:
+        name: RELATED_IMAGE_HYPERFLEET_OPERATOR


Yeah you are right it won't get nudged. The build-service nudge regex is <repo>(:.*)?@(?<currentDigest>sha256:...) on a single token, so it only matches repo@sha256:digest on one line. Splitting into newName and digest means the two RELATED_IMAGE env values below get bumped but the controller image itself goes stale. Drop the images: block and patch the container image directly in the same patch list:

- op: replace path: /spec/template/spec/containers/0/image value: quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet/hyperfleet-operator@sha256:7504189fc375ee65457baa568487b9f083b35b882d58601cd4f4ad8ee50e639e

Nudging the redhat-services-prod path is fine btw, PR #27 already did that against the old Dockerfile.

ciaranRoche · 2026-09-11T10:56:00Z

    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main" && ( ".tekton/hyperfleet-operator-bundle-push.yaml".pathChanged() || "bundle.konflux.Dockerfile".pathChanged()
-      || "bundle-hack/***".pathChanged() || "bundle/***".pathChanged() )
+      == "main" && ( ".tekton/hyperfleet-operator-bundle-push.yaml".pathChanged() || "bundle.Dockerfile".pathChanged())


The bundle content now comes from config/, but this only fires on bundle.Dockerfile. So a nudge PR touching config/manager/prod/kustomization.yaml never rebuilds the bundle. Worse, it does match the operator push (it only excludes the bundle Dockerfile and this file), so the operator rebuilds, gets a new digest, opens another nudge, and we loop. Add "config/***".pathChanged() here, and exclude the prod kustomization in the operator push CEL

ciaranRoche · 2026-09-11T10:56:45Z

@@ -1,3 +1,23 @@
+FROM registry.k8s.io/kustomize/kustomize:v5.0.0 AS kustomize


registry.k8s.io and quay.io/operator-framework (line 11) aren't in the app-interface-standard base image allowlist, so Conforma fails base_image_permitted on the release, same thing we hit on the catalog PR. registry.redhat.io/openshift4/ose-operator-sdk-rhel9:v4.18 has operator-sdk, and registry.redhat.io/openshift4/ose-cli-rhel9:v4.18 gives you oc kustomize for the first stage.

ciaranRoche · 2026-09-11T10:57:22Z

  provider:
    name: Red Hat
    url: https://github.com/openshift-hyperfleet
+  relatedImages:


I think these placeholders are dead. operator-sdk replaces spec.relatedImages wholesale from the RELATED_IMAGE_* env vars (base.Spec.RelatedImages = g.RelatedImages), so they never make it into the bundle. Can drop them to save the next person wondering why they're empty.

ciaranRoche · 2026-09-11T10:57:56Z

+	$(CONTAINER_TOOL) build -f bundle.Dockerfile \
+		--platform $(PLATFORM) \
+		--build-arg VERSION=$(VERSION) \
+		--build-arg CHANNEL=$(CHANNELS) \


the Dockerfile ARG is CHANNELS but this passes CHANNEL, so make bundle-build CHANNELS=candidate silently builds stable. Also worth passing KUSTOMIZE_VARIANT through here so you can build the prod variant locally

ciaranRoche · 2026-09-11T10:58:41Z

 # Uninstall resources 
 # kubectl delete -f dist/install.yaml
 # For image overrides edit config/manager/kustomization.yaml
 .PHONY: build-deployer
 build-deployer: manifests generate ## Generate a consolidated YAML with CRDs and deployment.
 	@mkdir -p dist
 	@$(KUSTOMIZE) build config/default > dist/install.yaml

 .PHONY: build-deployer-override-img
 build-deployer-override-img: manifests generate ## Generate deployer with IMG override, then restore kustomization.yaml
 	@mkdir -p dist
 	cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)


Yeah true true, With config/manager/kustomization.yaml gone, kustomize build config/default fails so make deploy and build-deployer are broken. One way to avoid both this and the cp hack in the Dockerfile: keep config/manager/kustomization.yaml as the dev default, and make prod an overlay under config/manifests/prod with resources: [../] plus the image patch. Then the Dockerfile arg just picks which manifests dir to kustomize build.

HYPERFLEET-1411 - refactor: Update konflux + dev bundles

3e68a86

openshift-ci Bot added the do-not-merge/work-in-progress label Sep 10, 2026

ma-hill added 3 commits September 10, 2026 15:58

HYPERFLEET-1411 - feat: Updates

f44c1e2

HYPERFLEET-1411 - feat: Updates

e1f686c

HYPERFLEET-1411 - feat: Updates

158d158

ma-hill commented Sep 10, 2026

View reviewed changes

ciaranRoche reviewed Sep 11, 2026

View reviewed changes

		@@ -1,3 +1,23 @@
		FROM registry.k8s.io/kustomize/kustomize:v5.0.0 AS kustomize

Uh oh!

Conversation

ma-hill commented Sep 10, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Notes

Test Plan

Uh oh!

openshift-ci Bot commented Sep 10, 2026

Uh oh!

openshift-ci Bot commented Sep 10, 2026

Uh oh!

coderabbitai Bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ma-hill commented Sep 10, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Sep 10, 2026 •

edited

Loading