Upstream sync

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/openshift/api v0.0.0-20200331152225-585af27e34fd
 	github.com/operator-framework/api v0.10.1
 	github.com/operator-framework/operator-lifecycle-manager v0.0.0-00010101000000-000000000000
-	github.com/operator-framework/operator-registry v1.13.6
+	github.com/operator-framework/operator-registry v1.17.5
 	github.com/spf13/cobra v1.1.3
 	github.com/stretchr/testify v1.7.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0

manifests/0000_50_olm_02-services.yaml

@@ -14,9 +14,9 @@ spec:
   type: ClusterIP
   ports:
     - name: https-metrics
-      port: 8081
+      port: 8443
       protocol: TCP
-      targetPort: metrics
+      targetPort: 8443
   selector:
     app: olm-operator
 ---
@@ -36,8 +36,8 @@ spec:
   type: ClusterIP
   ports:
     - name: https-metrics
-      port: 8081
+      port: 8443
       protocol: TCP
-      targetPort: metrics
+      targetPort: 8443
   selector:
     app: catalog-operator

manifests/0000_50_olm_07-olm-operator.deployment.ibm-cloud-managed.yaml

@@ -22,8 +22,27 @@ spec:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
     spec:
       serviceAccountName: olm-operator-serviceaccount
+      volumes:
+        - name: srv-cert
+          secret:
+            secretName: olm-operator-serving-cert
+        - name: profile-collector-cert
+          secret:
+            secretName: olm-operator-serving-cert
+        - name: serving-cert
+          secret:
+            secretName: olm-operator-serving-cert
       containers:
         - name: olm-operator
+          volumeMounts:
+            - name: srv-cert
+              mountPath: "/srv-cert"
+              readOnly: true
+            - name: profile-collector-cert
+              mountPath: "/profile-collector-cert"
+              readOnly: true
+            - mountPath: /var/run/secrets/serving-cert
+              name: serving-cert
           command:
             - /bin/olm
           args:
@@ -34,24 +53,26 @@ spec:
             - --writePackageServerStatusName
             - operator-lifecycle-manager-packageserver
             - --tls-cert
-            - /var/run/secrets/serving-cert/tls.crt
+            - /srv-cert/tls.crt
             - --tls-key
-            - /var/run/secrets/serving-cert/tls.key
+            - /srv-cert/tls.key
+            - --client-ca
+            - /profile-collector-cert/tls.crt
           image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
           imagePullPolicy: IfNotPresent
           ports:
-            - containerPort: 8080
-            - containerPort: 8081
+            - containerPort: 8443
               name: metrics
-              protocol: TCP
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           readinessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           terminationMessagePolicy: FallbackToLogsOnError
           env:
             - name: OPERATOR_NAMESPACE
@@ -66,9 +87,6 @@ spec:
             requests:
               cpu: 10m
               memory: 160Mi
-          volumeMounts:
-            - mountPath: /var/run/secrets/serving-cert
-              name: serving-cert
       nodeSelector:
         kubernetes.io/os: linux
       tolerations:
@@ -84,7 +102,3 @@ spec:
           operator: Exists
           tolerationSeconds: 120
       priorityClassName: system-cluster-critical
-      volumes:
-        - name: serving-cert
-          secret:
-            secretName: olm-operator-serving-cert

manifests/0000_50_olm_07-olm-operator.deployment.yaml

@@ -23,8 +23,27 @@ spec:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
     spec:
       serviceAccountName: olm-operator-serviceaccount
+      volumes:
+        - name: srv-cert
+          secret:
+            secretName: olm-operator-serving-cert
+        - name: profile-collector-cert
+          secret:
+            secretName: olm-operator-serving-cert
+        - name: serving-cert
+          secret:
+            secretName: olm-operator-serving-cert
       containers:
         - name: olm-operator
+          volumeMounts:
+            - name: srv-cert
+              mountPath: "/srv-cert"
+              readOnly: true
+            - name: profile-collector-cert
+              mountPath: "/profile-collector-cert"
+              readOnly: true
+            - mountPath: /var/run/secrets/serving-cert
+              name: serving-cert
           command:
             - /bin/olm
           args:
@@ -35,24 +54,26 @@ spec:
             - --writePackageServerStatusName
             - operator-lifecycle-manager-packageserver
             - --tls-cert
-            - /var/run/secrets/serving-cert/tls.crt
+            - /srv-cert/tls.crt
             - --tls-key
-            - /var/run/secrets/serving-cert/tls.key
+            - /srv-cert/tls.key
+            - --client-ca
+            - /profile-collector-cert/tls.crt
           image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
           imagePullPolicy: IfNotPresent
           ports:
-            - containerPort: 8080
-            - containerPort: 8081
+            - containerPort: 8443
               name: metrics
-              protocol: TCP
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           readinessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           terminationMessagePolicy: FallbackToLogsOnError
           env:
             - name: OPERATOR_NAMESPACE
@@ -67,9 +88,6 @@ spec:
             requests:
               cpu: 10m
               memory: 160Mi
-          volumeMounts:
-            - mountPath: /var/run/secrets/serving-cert
-              name: serving-cert
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/master: ""
@@ -86,7 +104,3 @@ spec:
           operator: Exists
           tolerationSeconds: 120
       priorityClassName: system-cluster-critical
-      volumes:
-        - name: serving-cert
-          secret:
-            secretName: olm-operator-serving-cert

manifests/0000_50_olm_08-catalog-operator.deployment.ibm-cloud-managed.yaml

@@ -22,37 +22,59 @@ spec:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
     spec:
       serviceAccountName: olm-operator-serviceaccount
+      volumes:
+        - name: srv-cert
+          secret:
+            secretName: catalog-operator-serving-cert
+        - name: profile-collector-cert
+          secret:
+            secretName: catalog-operator-serving-cert
+        - name: serving-cert
+          secret:
+            secretName: catalog-operator-serving-cert
       containers:
         - name: catalog-operator
+          volumeMounts:
+            - name: srv-cert
+              mountPath: "/srv-cert"
+              readOnly: true
+            - name: profile-collector-cert
+              mountPath: "/profile-collector-cert"
+              readOnly: true
+            - mountPath: /var/run/secrets/serving-cert
+              name: serving-cert
           command:
             - /bin/catalog
           args:
             - '-namespace'
             - openshift-marketplace
             - -configmapServerImage=quay.io/operator-framework/configmap-operator-registry:latest
+            - -opmImage=quay.io/operator-framework/configmap-operator-registry:latest
             - -util-image
             - quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
             - -writeStatusName
             - operator-lifecycle-manager-catalog
-            - -tls-cert
-            - /var/run/secrets/serving-cert/tls.crt
-            - -tls-key
-            - /var/run/secrets/serving-cert/tls.key
+            - --tls-cert
+            - /srv-cert/tls.crt
+            - --tls-key
+            - /srv-cert/tls.key
+            - --client-ca
+            - /profile-collector-cert/tls.crt
           image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
           imagePullPolicy: IfNotPresent
           ports:
-            - containerPort: 8080
-            - containerPort: 8081
+            - containerPort: 8443
               name: metrics
-              protocol: TCP
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           readinessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           terminationMessagePolicy: FallbackToLogsOnError
           resources:
             requests:
@@ -61,9 +83,6 @@ spec:
           env:
             - name: RELEASE_VERSION
               value: "0.0.1-snapshot"
-          volumeMounts:
-            - mountPath: /var/run/secrets/serving-cert
-              name: serving-cert
       nodeSelector:
         kubernetes.io/os: linux
       tolerations:
@@ -79,7 +98,3 @@ spec:
           operator: Exists
           tolerationSeconds: 120
       priorityClassName: system-cluster-critical
-      volumes:
-        - name: serving-cert
-          secret:
-            secretName: catalog-operator-serving-cert

manifests/0000_50_olm_08-catalog-operator.deployment.yaml

@@ -23,37 +23,59 @@ spec:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
     spec:
       serviceAccountName: olm-operator-serviceaccount
+      volumes:
+        - name: srv-cert
+          secret:
+            secretName: catalog-operator-serving-cert
+        - name: profile-collector-cert
+          secret:
+            secretName: catalog-operator-serving-cert
+        - name: serving-cert
+          secret:
+            secretName: catalog-operator-serving-cert
       containers:
         - name: catalog-operator
+          volumeMounts:
+            - name: srv-cert
+              mountPath: "/srv-cert"
+              readOnly: true
+            - name: profile-collector-cert
+              mountPath: "/profile-collector-cert"
+              readOnly: true
+            - mountPath: /var/run/secrets/serving-cert
+              name: serving-cert
           command:
             - /bin/catalog
           args:
             - '-namespace'
             - openshift-marketplace
             - -configmapServerImage=quay.io/operator-framework/configmap-operator-registry:latest
+            - -opmImage=quay.io/operator-framework/configmap-operator-registry:latest
             - -util-image
             - quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
             - -writeStatusName
             - operator-lifecycle-manager-catalog
-            - -tls-cert
-            - /var/run/secrets/serving-cert/tls.crt
-            - -tls-key
-            - /var/run/secrets/serving-cert/tls.key
+            - --tls-cert
+            - /srv-cert/tls.crt
+            - --tls-key
+            - /srv-cert/tls.key
+            - --client-ca
+            - /profile-collector-cert/tls.crt
           image: quay.io/operator-framework/olm@sha256:de396b540b82219812061d0d753440d5655250c621c753ed1dc67d6154741607
           imagePullPolicy: IfNotPresent
           ports:
-            - containerPort: 8080
-            - containerPort: 8081
+            - containerPort: 8443
               name: metrics
-              protocol: TCP
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           readinessProbe:
             httpGet:
               path: /healthz
-              port: 8080
+              port: 8443
+              scheme: HTTPS
           terminationMessagePolicy: FallbackToLogsOnError
           resources:
             requests:
@@ -62,9 +84,6 @@ spec:
           env:
             - name: RELEASE_VERSION
               value: "0.0.1-snapshot"
-          volumeMounts:
-            - mountPath: /var/run/secrets/serving-cert
-              name: serving-cert
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/master: ""
@@ -81,7 +100,3 @@ spec:
           operator: Exists
           tolerationSeconds: 120
       priorityClassName: system-cluster-critical
-      volumes:
-        - name: serving-cert
-          secret:
-            secretName: catalog-operator-serving-cert

staging/api/pkg/operators/v1alpha1/subscription_types.go

@@ -102,6 +102,9 @@ const (
 
 	// SubscriptionInstallPlanFailed indicates that the installation of a Subscription's InstallPlan has failed.
 	SubscriptionInstallPlanFailed SubscriptionConditionType = "InstallPlanFailed"
+
+	// SubscriptionResolutionFailed indicates that the dependency resolution in the namespace in which the subscription is created has failed
+	SubscriptionResolutionFailed SubscriptionConditionType = "ResolutionFailed"
 )
 
 const (

staging/operator-lifecycle-manager/.github/workflows/test-scripts.yml

@@ -23,6 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
+    - uses: actions/setup-go@v2
+      with:
+        go-version: '~1.16'
     - run: |
         sudo apt-get install conntrack
         curl -sLo minikube "$(curl -sL https://api.github.com/repos/kubernetes/minikube/releases/latest | jq -r '[.assets[] | select(.name == "minikube-linux-amd64")] | first | .browser_download_url')"
@@ -34,6 +37,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
+    - uses: actions/setup-go@v2
+      with:
+        go-version: '~1.16'
     - run: |
         curl -sLo kind "$(curl -sL https://api.github.com/repos/kubernetes-sigs/kind/releases/latest | jq -r '[.assets[] | select(.name == "kind-linux-amd64")] | first | .browser_download_url')"
         chmod +x kind