Skip to content

CM-1236: Use prod 1.19.2 operator and operand images for CI testing - #493

Draft
mytreya-rh wants to merge 1 commit into
openshift:cert-manager-1.19from
mytreya-rh:cm-1236-prod-images-ci
Draft

CM-1236: Use prod 1.19.2 operator and operand images for CI testing#493
mytreya-rh wants to merge 1 commit into
openshift:cert-manager-1.19from
mytreya-rh:cm-1236-prod-images-ci

Conversation

@mytreya-rh

@mytreya-rh mytreya-rh commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Test-only PR — do not merge.

Points the operator image and RELATED_IMAGE_* env vars at the production 1.19.2 digests from cert-manager-operator-release images_digest.conf on release-1.19 so operator CI e2e (e2e-operator) runs the prod stack instead of pipeline-substituted quay.io/jetstack / openshift.io/cert-manager-operator images.

ci-operator substitutions only rewrite quay.io/jetstack/... and openshift.io/cert-manager-operator:.*. Using registry.redhat.io/...@sha256:... means those substitutions no longer match.

Jira: https://redhat.atlassian.net/browse/CM-1236

Image mapping

Component Pullspec Version Label
Operator registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:a1f49ceaf14cbf12fcad5c7ce19cb8bec9222ee52533642092bfb60ce6f59f63 v1.19.2
webhook / cainjector / controller registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:3afda61dcc3c22373e234bccd55ac2d09dd7db86e0c90b761ed967969b47541e v1.19.6-1
acmesolver registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:309dcc51ac5c0c8651f5a14d389b16d9ea217c33fe2b15cb5bf7966f2928ff53 v1.19.6-1
istio-csr registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:eb340b679c1b792b57cbd28b6ca049fc7df21fa8780bf96e746ca43fe3d4589a v0.16.0-1-1
trust-manager registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:d0834b140e53cb2b96d30f227b0c7dcab3463eeab80049df608582c45c792a82 v0.20.3

The operator is pinned on config/manager/manager.yaml image: (replacing controller:latest), not via kustomization.yaml. make bundle always runs kustomize edit set image controller=openshift.io/cert-manager-operator:latest; pinning only in kustomize would be reset and ci-operator would inject the PR-built operator again.

The CSV is regenerated with make bundle so hack/verify-bundle.sh stays green. spec.relatedImages collapses webhook/cainjector/controller to one entry because they share a digest (operator-sdk warning); the RELATED_IMAGE_* env vars still list each component separately, which is what the operator uses at runtime.

Image inspection commands and output

Command used to fetch digests and version labels:

$ for img in \
    "registry.redhat.io/cert-manager/cert-manager-operator-rhel9:v1.19.2" \
    "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9:v1.19.6-1" \
    "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.19.6-1" \
    "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9:v0.16.0-1-1" \
    "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9:v0.20.3"; do
    echo "--- $img ---"
    skopeo inspect "docker://$img" --format '  Digest:  {{.Digest}}
  Version: {{index .Labels "version"}}'
    echo
done

Output:

--- registry.redhat.io/cert-manager/cert-manager-operator-rhel9:v1.19.2 ---
  Digest:  sha256:a1f49ceaf14cbf12fcad5c7ce19cb8bec9222ee52533642092bfb60ce6f59f63
  Version: v1.19.2

--- registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9:v1.19.6-1 ---
  Digest:  sha256:3afda61dcc3c22373e234bccd55ac2d09dd7db86e0c90b761ed967969b47541e
  Version: v1.19.6-1

--- registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.19.6-1 ---
  Digest:  sha256:309dcc51ac5c0c8651f5a14d389b16d9ea217c33fe2b15cb5bf7966f2928ff53
  Version: v1.19.6-1

--- registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9:v0.16.0-1-1 ---
  Digest:  sha256:eb340b679c1b792b57cbd28b6ca049fc7df21fa8780bf96e746ca43fe3d4589a
  Version: v0.16.0-1-1

--- registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9:v0.20.3 ---
  Digest:  sha256:d0834b140e53cb2b96d30f227b0c7dcab3463eeab80049df608582c45c792a82
  Version: v0.20.3

Test plan

  • Confirm e2e-operator runs (not skipped)
  • Operator pod uses registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:a1f49ceaf1...
  • Operand deployments use the prod jetstack / acmesolver / istio-csr / trust-manager digests
  • No ImagePullBackOff (prod images are publicly accessible from registry.redhat.io)
  • Close this PR without merging after CI results are collected

Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin

Made with Cursor

@mytreya-rh @cursoragent
CM-1236: Use prod 1.19.2 operator and operand images for CI testing
6488be0 
Point the operator image and RELATED_IMAGE_* at registry.redhat.io
digests from cert-manager-operator-release images_digest.conf so operator
CI e2e runs the prod 1.19.2 stack instead of pipeline-substituted images.

Do not merge; test-only PR.

Commit-Message-Assisted-by: Claude (via Claude Code)
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Mytreya Kasturi <mykastur@redhat.com>
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 4, 2026
@openshift-ci-robot

openshift-ci-robot commented Sep 4, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@mytreya-rh: This pull request references CM-1236 which is a valid jira issue.

Details

In response to this:

Summary

Test-only PR — do not merge.

Points the operator image and RELATED_IMAGE_* env vars at the production 1.19.2 digests from cert-manager-operator-release images_digest.conf on release-1.19 so operator CI e2e (e2e-operator) runs the prod stack instead of pipeline-substituted quay.io/jetstack / openshift.io/cert-manager-operator images.

ci-operator substitutions only rewrite quay.io/jetstack/... and openshift.io/cert-manager-operator:.*. Using registry.redhat.io/...@sha256:... means those substitutions no longer match.

Jira: https://redhat.atlassian.net/browse/CM-1236

Image mapping

Component Pullspec Version Label
Operator registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:a1f49ceaf14cbf12fcad5c7ce19cb8bec9222ee52533642092bfb60ce6f59f63 v1.19.2
webhook / cainjector / controller registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:3afda61dcc3c22373e234bccd55ac2d09dd7db86e0c90b761ed967969b47541e v1.19.6-1
acmesolver registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:309dcc51ac5c0c8651f5a14d389b16d9ea217c33fe2b15cb5bf7966f2928ff53 v1.19.6-1
istio-csr registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:eb340b679c1b792b57cbd28b6ca049fc7df21fa8780bf96e746ca43fe3d4589a v0.16.0-1-1
trust-manager registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9@sha256:d0834b140e53cb2b96d30f227b0c7dcab3463eeab80049df608582c45c792a82 v0.20.3

The operator is pinned on config/manager/manager.yaml image: (replacing controller:latest), not via kustomization.yaml. make bundle always runs kustomize edit set image controller=openshift.io/cert-manager-operator:latest; pinning only in kustomize would be reset and ci-operator would inject the PR-built operator again.

The CSV is regenerated with make bundle so hack/verify-bundle.sh stays green. spec.relatedImages collapses webhook/cainjector/controller to one entry because they share a digest (operator-sdk warning); the RELATED_IMAGE_* env vars still list each component separately, which is what the operator uses at runtime.

Image inspection commands and output

Command used to fetch digests and version labels:

$ for img in \
   "registry.redhat.io/cert-manager/cert-manager-operator-rhel9:v1.19.2" \
   "registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9:v1.19.6-1" \
   "registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.19.6-1" \
   "registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9:v0.16.0-1-1" \
   "registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9:v0.20.3"; do
   echo "--- $img ---"
   skopeo inspect "docker://$img" --format '  Digest:  {{.Digest}}
 Version: {{index .Labels "version"}}'
   echo
done

Output:

--- registry.redhat.io/cert-manager/cert-manager-operator-rhel9:v1.19.2 ---
 Digest:  sha256:a1f49ceaf14cbf12fcad5c7ce19cb8bec9222ee52533642092bfb60ce6f59f63
 Version: v1.19.2

--- registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9:v1.19.6-1 ---
 Digest:  sha256:3afda61dcc3c22373e234bccd55ac2d09dd7db86e0c90b761ed967969b47541e
 Version: v1.19.6-1

--- registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9:v1.19.6-1 ---
 Digest:  sha256:309dcc51ac5c0c8651f5a14d389b16d9ea217c33fe2b15cb5bf7966f2928ff53
 Version: v1.19.6-1

--- registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9:v0.16.0-1-1 ---
 Digest:  sha256:eb340b679c1b792b57cbd28b6ca049fc7df21fa8780bf96e746ca43fe3d4589a
 Version: v0.16.0-1-1

--- registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9:v0.20.3 ---
 Digest:  sha256:d0834b140e53cb2b96d30f227b0c7dcab3463eeab80049df608582c45c792a82
 Version: v0.20.3

Test plan

  • Confirm e2e-operator runs (not skipped)
  • Operator pod uses registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:a1f49ceaf1...
  • Operand deployments use the prod jetstack / acmesolver / istio-csr / trust-manager digests
  • No ImagePullBackOff (prod images are publicly accessible from registry.redhat.io)
  • Close this PR without merging after CI results are collected

Always review AI generated responses prior to use.
Generated with Claude Code via openshift-developer plugin

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 90530f24-0180-49ab-9acc-f74613002dd5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 4, 2026
@openshift-ci

openshift-ci Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci

openshift-ci Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mytreya-rh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 4, 2026
@mytreya-rh

mytreya-rh commented Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

/test e2e-operator-aws-proxy
/test e2e-operator-aws-upi-proxy
/test e2e-operator-aws-sts
/test e2e-operator-gcp-ovn
/test e2e-operator-gcp-workload-identity
/test e2e-operator-azure-ovn
/test e2e-operator-azure-workload-identity
/test e2e-operator-consoleless
/test e2e-operator
/test e2e-operator-tech-preview

@openshift-ci

openshift-ci Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

@mytreya-rh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-operator-gcp-workload-identity 6488be0 link false /test e2e-operator-gcp-workload-identity
ci/prow/e2e-operator 6488be0 link true /test e2e-operator
ci/prow/e2e-operator-gcp-ovn 6488be0 link false /test e2e-operator-gcp-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mytreya-rh @openshift-ci-robot