HYPERFLEET-1411 - fix: Address comments

Author: ma-hill

.tekton/hyperfleet-operator-bundle-push.yaml

@@ -12,7 +12,8 @@ metadata:
       == "main" && 
       (".tekton/hyperfleet-operator-bundle-push.yaml".pathChanged() || 
       "bundle.Dockerfile".pathChanged() || 
-      "config/***".pathChanged())
+      "config/***".pathChanged() ||
+      "validators/related-images/**".pathChanged())
   labels:
     appstudio.openshift.io/application: hyperfleet
     appstudio.openshift.io/component: hyperfleet-operator-bundle
@@ -228,6 +229,7 @@ spec:
         - $(params.build-args[*])
         - KUSTOMIZE_VARIANT=config/manifests/prod
         - BUNDLE_VERSION=0.0.1
+        - VALIDATE_RELATED_IMAGES=true
       - name: BUILD_ARGS_FILE
         value: $(params.build-args-file)
       - name: PRIVILEGED_NESTED

.tekton/hyperfleet-operator-push.yaml

@@ -15,6 +15,7 @@ metadata:
            x.matches('^bundle\\.Dockerfile$')
            || x.matches('^config/manifests/prod/')
            || x.matches('^hack/test-disconnected-mirror\\.sh$')
+           || x.matches('^validators/')
            || x.matches('^\\.tekton/hyperfleet-operator-bundle-push\\.yaml$')
            || x.matches('^catalog/')
            || x.matches('^catalog\\.Dockerfile$')

bundle.Dockerfile

@@ -11,25 +11,24 @@ FROM quay.io/konflux-ci/operator-sdk-builder:latest@sha256:bd34ca58b2d08e8ee3b9c
 
 WORKDIR /workdir
 COPY config/ ./config/
-
 COPY --from=validator /workdir/bin/related-images-validator ./related-images-validator
-# Specify the kustomize variant, either bases/kustomization.yaml or prod/kustomization.yaml
-# prod/kustomization.yaml gets image update references from konflux.
+
+# Specify the kustomize variant, either config/manifests/dev or config/manifests/prod
 ARG KUSTOMIZE_VARIANT=config/manifests/dev
-# ARG KUSTOMIZE_VARIANT=config/manifests/prod for konflux builds
 RUN kustomize build /workdir/${KUSTOMIZE_VARIANT} > /workdir/manifests.yaml
 
 ARG CHANNELS=stable
 ARG DEFAULT_CHANNEL=stable
 ARG BUNDLE_VERSION=0.0.1
-
 RUN mkdir -p /workdir/bundle
 RUN cat manifests.yaml | operator-sdk generate bundle -q --version ${BUNDLE_VERSION} \
       --channels=${CHANNELS} --default-channel=${DEFAULT_CHANNEL} \
       --package=hyperfleet-operator && \
-    operator-sdk bundle validate ./bundle --select-optional name=operatorhubv2 && \
-    if [ "${VALIDATE_RELATED_IMAGES}" = "true" ]; then \
-      operator-sdk bundle validate ./bundle --alpha-select-external ./related-images-validator; \
+    operator-sdk bundle validate ./bundle --select-optional name=operatorhubv2
+
+ARG VALIDATE_RELATED_IMAGES=true
+RUN if [ "$VALIDATE_RELATED_IMAGES" = "true" ]; then \
+      ./related-images-validator -csv bundle/manifests/*.clusterserviceversion.yaml; \
     fi
 
 FROM scratch

validators/related-images/main.go

@@ -1,3 +1,16 @@
+// Copyright 2026.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 package main
 
 import (
@@ -52,7 +65,8 @@ type deployment struct {
 	Spec struct {
 		Template struct {
 			Spec struct {
-				Containers []container `json:"containers"`
+				Containers     []container `json:"containers"`
+				InitContainers []container `json:"initContainers"`
 			} `json:"spec"`
 		} `json:"template"`
 	} `json:"spec"`
@@ -94,14 +108,20 @@ func main() {
 		os.Exit(1)
 	}
 	fmt.Println(string(out))
+
+	// operator-sdk reads errors from JSON output, so exit 0 is fine there.
+	// Standalone -csv mode needs a non-zero exit code for CI.
+	if *csvPath != "" && len(result.Errors) > 0 {
+		os.Exit(1)
+	}
 }
 
 func validate(bundleRoot string) manifestResult {
-	csvPath := findCSV(bundleRoot)
-	if csvPath == "" {
+	csvPath, err := findCSV(bundleRoot)
+	if err != nil {
 		return manifestResult{
 			Name:   validatorName,
-			Errors: []validationMsg{errMsg("", "no ClusterServiceVersion found in bundle manifests")},
+			Errors: []validationMsg{errMsg("", fmt.Sprintf("failed to find CSV: %v", err))},
 		}
 	}
 
@@ -125,81 +145,85 @@ func validateCSVData(data []byte) manifestResult {
 		return result
 	}
 
+	containerImages := validateContainerImages(&result, csv.Spec.Install.Spec.Deployments)
+	relatedImages := validateRelatedImages(&result, csv.Spec.RelatedImages, containerImages)
+	validateEnvVars(&result, csv.Spec.Install.Spec.Deployments, relatedImages)
+
+	for image, matched := range containerImages {
+		if !matched {
+			result.Errors = append(result.Errors, errMsg("spec.relatedImages",
+				fmt.Sprintf("container image not in relatedImages: %q", image)))
+		}
+	}
+	return result
+}
+
+// validateContainerImages checks that each container image is a sha256 digest pullspec.
+func validateContainerImages(result *manifestResult, deployments []deployment) map[string]bool {
 	containerImages := make(map[string]bool)
-	for _, dep := range csv.Spec.Install.Spec.Deployments {
-		for _, c := range dep.Spec.Template.Spec.Containers {
-			// Add these to a managerImages map
+	for _, dep := range deployments {
+		allContainers := append(dep.Spec.Template.Spec.Containers, dep.Spec.Template.Spec.InitContainers...)
+		for _, c := range allContainers {
 			containerImages[c.Image] = false
 			if !isSHA256DigestPullspec(c.Image) {
 				result.Errors = append(result.Errors, errMsg("relatedImages",
-					fmt.Sprintf("not using sha256 in image tag: %v", c.Image)))
+					fmt.Sprintf("image reference is not a sha256 digest: %v", c.Image)))
 			}
 		}
 	}
+	return containerImages
+}
 
+// validateRelatedImages checks for duplicate entries and non-sha256 digests in spec.relatedImages.
+func validateRelatedImages(result *manifestResult, images []imageEntry, containerImages map[string]bool) map[string]string {
 	relatedImages := make(map[string]string)
-	for _, image := range csv.Spec.RelatedImages {
+	for _, image := range images {
 		if !isSHA256DigestPullspec(image.Image) {
 			result.Errors = append(result.Errors, errMsg("relatedImages",
-				fmt.Sprintf("not using sha256 in image tag: %v", image.Image)))
+				fmt.Sprintf("image reference is not a sha256 digest: %v", image.Image)))
 		}
-		_, ok := relatedImages[image.Image]
-		if !ok {
-			// no match in the map, add them and continue
+		if _, ok := relatedImages[image.Image]; !ok {
 			relatedImages[image.Image] = image.Name
-
-			// check if relatedImage is a container image, if so, mark it as added.
 			if _, ok := containerImages[image.Image]; ok {
 				containerImages[image.Image] = true
 			}
 		} else {
-			// duplicate in map, add to result.Errors
 			result.Errors = append(result.Errors, errMsg("relatedImages",
 				fmt.Sprintf("duplicate value of image: %v", image.Image)))
 		}
 	}
+	return relatedImages
+}
 
-	// duplicate env var
-	envRelatedImages := []string{}
-	for _, dep := range csv.Spec.Install.Spec.Deployments {
-		for _, c := range dep.Spec.Template.Spec.Containers {
+// validateEnvVars checks that RELATED_IMAGE_ env vars use sha256 digests, are not duplicated
+// within a container, and have a corresponding entry in spec.relatedImages.
+func validateEnvVars(result *manifestResult, deployments []deployment, relatedImages map[string]string) {
+	for _, dep := range deployments {
+		allContainers := append(dep.Spec.Template.Spec.Containers, dep.Spec.Template.Spec.InitContainers...)
+		for _, c := range allContainers {
+			envRelatedImages := []string{}
 			for _, e := range c.Env {
-				if strings.HasPrefix(e.Name, "RELATED_IMAGE_") {
+				if strings.HasPrefix(e.Name, relatedImagePrefix) {
 					if !isSHA256DigestPullspec(e.Value) {
 						result.Errors = append(result.Errors, errMsg("relatedImages",
-							fmt.Sprintf("not using sha256 in image tag: %v", e.Value)))
+							fmt.Sprintf("image reference is not a sha256 digest: %v", e.Value)))
 					}
-					// verify that every value is in relatedImages section
-					if _, ok := relatedImages[e.Value]; !ok {
+					if slices.Contains(envRelatedImages, e.Name) {
 						result.Errors = append(result.Errors,
 							errMsg("relatedImages",
-								fmt.Sprintf("env var not add to relatedImages: %v", e)))
+								fmt.Sprintf("duplicate env var %s in container %s", e.Name, c.Name)))
 						continue
-					} else {
-						if slices.Contains(envRelatedImages, e.Name) {
-							// duplicate found
-							result.Errors = append(result.Errors,
-								errMsg("relatedImages",
-									fmt.Sprintf("env var duplicated: %v", e)))
-							continue
-						} else {
-							envRelatedImages = append(envRelatedImages, e.Name)
-						}
+					}
+					envRelatedImages = append(envRelatedImages, e.Name)
+					if _, ok := relatedImages[e.Value]; !ok {
+						result.Errors = append(result.Errors,
+							errMsg("relatedImages",
+								fmt.Sprintf("env var %s not found in spec.relatedImages (value: %s)", e.Name, e.Value)))
 					}
 				}
 			}
 		}
 	}
-
-	// Verify that containerImages all include true
-	for image, matched := range containerImages {
-		if !matched {
-			result.Errors = append(result.Errors, errMsg("spec.relatedImages",
-				fmt.Sprintf("container image not in relatedImages:%q", image)))
-		}
-	}
-	// check that images are all sha digests
-	return result
 }
 
 func isSHA256DigestPullspec(image string) bool {
@@ -215,18 +239,18 @@ func isSHA256DigestPullspec(image string) bool {
 	return digest.Algorithm().String() == "sha256" && digest.Validate() == nil
 }
 
-func findCSV(bundleRoot string) string {
+func findCSV(bundleRoot string) (string, error) {
 	manifestsDir := bundleRoot + "/manifests"
 	entries, err := os.ReadDir(manifestsDir)
 	if err != nil {
-		return ""
+		return "", fmt.Errorf("reading manifests directory: %w", err)
 	}
 	for _, e := range entries {
 		if strings.HasSuffix(e.Name(), ".clusterserviceversion.yaml") {
-			return manifestsDir + "/" + e.Name()
+			return manifestsDir + "/" + e.Name(), nil
 		}
 	}
-	return ""
+	return "", fmt.Errorf("no CSV found in manifests directory")
 }
 
 func errMsg(field, detail string) validationMsg {