Support per-operand image tags

internal/deployer/acs_images.go

@@ -1,22 +1,15 @@
 package deployer
 
-import (
-	"fmt"
-)
-
+// TODO(#303): Also include explicit RELATED_IMAGE_* env var overrides in the preload list.
 func imagesForConfig(config Config) []string {
 	var images []string
 
-	for _, instance := range config.OperatorInstances() {
-		prefix := ""
-		if instance.KonfluxImagesEnabled() {
-			prefix = "release-"
+	instances, _, _ := config.OperatorInstances()
+	for _, instance := range instances {
+		for _, imageName := range relatedImages {
+			images = append(images, constructOperandImageFromInstance(instance, imageName))
 		}
 		images = append(images,
-			fmt.Sprintf("%s/%s%s:%s", instance.ImageRegistry, prefix, "main", instance.Version),
-			fmt.Sprintf("%s/%s%s:%s", instance.ImageRegistry, prefix, "central-db", instance.Version),
-			fmt.Sprintf("%s/%s%s:%s", instance.ImageRegistry, prefix, "scanner-v4-db", instance.Version),
-			fmt.Sprintf("%s/%s%s:%s", instance.ImageRegistry, prefix, "scanner-v4", instance.Version),
 			instance.OperatorImage(),
 			instance.BundleImage(),
 		)

internal/deployer/config.go

@@ -88,9 +88,11 @@ func NewRoxieConfig() RoxieConfig {
 // is used directly. In mixed-operator mode, CentralConfig.Operator and
 // SecuredClusterConfig.Operator override the top-level defaults.
 type OperatorInstanceConfig struct {
-	Version       imagetag.MainTag  `yaml:"version,omitempty"`
-	EnvVars       map[string]string `yaml:"envVars,omitempty"`
-	KonfluxImages *bool             `yaml:"konfluxImages,omitempty"`
+	Version             imagetag.MainTag            `yaml:"version,omitempty"`
+	OperandTag          imagetag.MainTag            `yaml:"operandTag,omitempty"`
+	OperandTagOverrides map[string]imagetag.MainTag `yaml:"operandTagOverrides,omitempty"`
+	EnvVars             map[string]string           `yaml:"envVars,omitempty"`
+	KonfluxImages       *bool                       `yaml:"konfluxImages,omitempty"`
 
 	// The following fields are computed internally and are not user-configurable.
 	Namespace      string `yaml:"-"`

internal/deployer/deploy_via_operator.go

@@ -59,8 +59,21 @@ func (d *Deployer) ensureOperatorDeployed(ctx context.Context) error {
 		return fmt.Errorf("failed to ensure CRDs installed: %w", err)
 	}
 
-	if d.config.Operator.DeployViaOlmEnabled() {
-		return d.ensureOperatorDeployedOLM(ctx)
+	instances, olmMode, err := d.config.OperatorInstances()
+	if err != nil {
+		return err
+	}
+
+	if err := d.teardownStaleOperatorNamespaces(ctx, instances); err != nil {
+		return err
+	}
+
+	for i := range instances {
+		populateOperatorEnvVars(&instances[i])
+	}
+
+	if olmMode {
+		return d.ensureOperatorDeployedOLM(ctx, instances[0])
 	}
 
 	// Non-OLM case.
@@ -76,15 +89,7 @@ func (d *Deployer) ensureOperatorDeployed(ctx context.Context) error {
 		}
 	}
 
-	instances := d.config.OperatorInstances()
-	if err := d.teardownStaleOperatorNamespaces(ctx, instances); err != nil {
-		return err
-	}
-
 	for _, instance := range instances {
-		if instance.KonfluxImagesEnabled() {
-			populateKonfluxEnvVars(&instance)
-		}
 		if err := d.ensureOperatorInstanceNonOLM(ctx, instance); err != nil {
 			return fmt.Errorf("failed to deploy operator in namespace %s: %w", instance.Namespace, err)
 		}
@@ -155,13 +160,7 @@ func (d *Deployer) ensureOperatorInstanceNonOLM(ctx context.Context, instance Op
 }
 
 // ensureOperatorDeployedOLM is the single-operator OLM path (mixed versions are rejected in validation).
-func (d *Deployer) ensureOperatorDeployedOLM(ctx context.Context) error {
-	// Remove any leftover dual-operator namespaces before installing via OLM.
-	desired := []OperatorInstanceConfig{{Namespace: operatorNamespaceSystem}}
-	if err := d.teardownStaleOperatorNamespaces(ctx, desired); err != nil {
-		return err
-	}
-
+func (d *Deployer) ensureOperatorDeployedOLM(ctx context.Context, instance OperatorInstanceConfig) error {
 	operatorExists, currentMode, err := d.detectOperatorDeploymentMode(ctx)
 	if err != nil {
 		return fmt.Errorf("detecting operator deployment mode: %w", err)
@@ -176,13 +175,10 @@ func (d *Deployer) ensureOperatorDeployedOLM(ctx context.Context) error {
 		needsTeardown = true
 		needsDeployment = true
 	} else {
-		instance := OperatorInstanceConfig{
-			Version:   d.config.Operator.Version,
-			Namespace: operatorNamespaceSystem,
-			EnvVars:   d.config.Operator.EnvVars,
-		}
 		if d.isOperatorImageCorrect(ctx, instance) {
 			log.Info("✓ Operator already deployed with correct image")
+			// TODO(#304): Changes in the operator environment configuration do not
+			// trigger a redeployment of the operator.
 		} else {
 			log.Info("🔄 Operator image mismatch, redeploying...")
 			needsTeardown = true
@@ -203,7 +199,7 @@ func (d *Deployer) ensureOperatorDeployedOLM(ctx context.Context) error {
 	}
 
 	if needsDeployment {
-		if err := d.deployOperatorViaOLM(ctx); err != nil {
+		if err := d.deployOperatorViaOLM(ctx, instance); err != nil {
 			return fmt.Errorf("failed to deploy operator via OLM: %w", err)
 		}
 	}

internal/deployer/operand_images.go

@@ -0,0 +1,98 @@
+package deployer
+
+import (
+	"fmt"
+
+	"github.com/stackrox/roxie/internal/constants"
+	"github.com/stackrox/roxie/internal/imagetag"
+)
+
+var relatedImages = map[string]string{
+	"RELATED_IMAGE_MAIN":          "main",
+	"RELATED_IMAGE_CENTRAL_DB":    "central-db",
+	"RELATED_IMAGE_COLLECTOR":     "collector",
+	"RELATED_IMAGE_SCANNER_V4_DB": "scanner-v4-db",
+	"RELATED_IMAGE_SCANNER_V4":    "scanner-v4",
+	"RELATED_IMAGE_FACT":          "fact",
+
+	// Old scanner images need to stay for now to be able to deploy older ACS versions.
+	"RELATED_IMAGE_SCANNER":         "scanner",
+	"RELATED_IMAGE_SCANNER_SLIM":    "scanner-slim",
+	"RELATED_IMAGE_SCANNER_DB":      "scanner-db",
+	"RELATED_IMAGE_SCANNER_DB_SLIM": "scanner-db-slim",
+}
+
+// populateOperatorEnvVars adds RELATED_IMAGE_* env vars to the instance
+// when the effective operand image differs from what the operator would
+// use by default (i.e. when OperandTag or OperandTagOverrides are set).
+// In Konflux mode, all entries are added unconditionally.
+// Explicitly-provided env vars (e.g. from --operator-env) take precedence.
+func populateOperatorEnvVars(instance *OperatorInstanceConfig) {
+	if instance == nil {
+		// Nothing to do.
+		return
+	}
+
+	envVars := make(map[string]string)
+
+	for envName, imageName := range relatedImages {
+		envVars[envName] = constructOperandImageFromInstance(*instance, imageName)
+	}
+
+	instanceWithoutOverrides := *instance
+	instanceWithoutOverrides.OperandTag = imagetag.MainTag("")
+	instanceWithoutOverrides.OperandTagOverrides = nil
+
+	if instance.EnvVars == nil {
+		instance.EnvVars = make(map[string]string)
+	}
+	for envName, imageRef := range envVars {
+		if _, exists := instance.EnvVars[envName]; exists {
+			// Explicitly set env vars for related images take precedence.
+			continue
+		}
+		if !instance.KonfluxImagesEnabled() {
+			// Only add env var if it differs from what the operator would use anyway.
+			// For Konflux mode we need to add the overwrites unconditionally, because the operator
+			// happily references non-existing downstream operand images.
+			defaultImageRef := constructOperandImageFromInstance(instanceWithoutOverrides, relatedImages[envName])
+			if imageRef == defaultImageRef {
+				continue
+			}
+		}
+		instance.EnvVars[envName] = imageRef
+	}
+}
+
+func constructOperandImageFromInstance(instance OperatorInstanceConfig, imageName string) string {
+	imagePrefix := ""
+	useKonflux := instance.KonfluxImagesEnabled()
+	if useKonflux {
+		imagePrefix = "release-"
+	}
+	imageRegistry := constants.DefaultRegistry
+	if !useKonflux && instance.ImageRegistry != "" { // Konflux images are only supported for default registry.
+		imageRegistry = instance.ImageRegistry
+	}
+
+	// The top-level version in an OperatorInstanceConfig can be
+	// selectively overwritten for specific images.
+	effectiveOperandImageVersion := instance.Version
+	if instance.OperandTag.IsSet() {
+		effectiveOperandImageVersion = instance.OperandTag
+	}
+	if perImageVersion := instance.OperandTagOverrides[imageName]; perImageVersion.IsSet() {
+		// A custom version for this particular image is requested.
+		effectiveOperandImageVersion = perImageVersion
+	}
+
+	var effectiveVersionString string
+	if useKonflux {
+		// Konflux built images use the "operator tag".
+		effectiveVersionString = effectiveOperandImageVersion.ToOperatorTag().String()
+	} else {
+		effectiveVersionString = effectiveOperandImageVersion.String()
+	}
+
+	return fmt.Sprintf("%s/%s%s:%s", imageRegistry, imagePrefix, imageName, effectiveVersionString)
+}