OSD-32240: Update Konflux references

[red-hat-konflux-kflux-prd-rh03]

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan (source, changelog)	6bcb4d4 -> 2f3015a
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	0.2 -> 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	1dbb98f -> ac4f8b5
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	0.7 -> 0.9	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	0.7 -> 0.9	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	ee558db -> 9397d3e
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	f3d2d17 -> 9f18b21
quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check (source, changelog)	3640087 -> de35caf
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	462baed -> 3457a4c
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	04f7559 -> 945f8ba
quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta (source, changelog)	8f62bc6 -> 0dd84e6
quay.io/konflux-ci/tekton-catalog/task-fbc-target-index-pruning-check (source, changelog)	216200a -> c2203ad
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	0a89e1a -> 2c388d2
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	0.2 -> 0.4	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	3fa0204 -> 22612d6
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	0.1 -> 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	6bcb4d4 -> 0dbb461
quay.io/konflux-ci/tekton-catalog/task-run-opm-command-oci-ta (source, changelog)	4ab5dba -> c79858b
quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta (source, changelog)	78f5244 -> ab60e90
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	d44336d -> c314b4d
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	8ad28b7 -> 6045ed6
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	0.3 -> 0.4	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	beb0616 -> e119aa8
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	4abb2db -> eb620d1
quay.io/konflux-ci/tekton-catalog/task-validate-fbc (source, changelog)	2a99dbd -> 291cbcc

---

Release Notes

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3

• Switched from bash implementation to Konflux Build CLI.
• Deprecated older 0.1 and 0.2 versions.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.9

Changed

• The buildah image now uses version 1.4.1 of konflux-ci/task-runner
  • This version pulls in version 1.42.1 of syft that ensures 'redhat' is used as the namespace for hummingbird rpms

v0.8

Fixed

• Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
  for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
  or linux/arm64).

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.9

Changed

• The buildah image now uses version 1.4.1 of konflux-ci/task-runner
  • This version pulls in version 1.42.1 of syft that ensures 'redhat' is used as the namespace for hummingbird rpms

v0.8

Fixed

• Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
  for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
  or linux/arm64).

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-init)

v0.4

• Task started using konflux build cli instead of bash script.

v0.3

• Remove params image-url, rebuild and skip-checks
• Remove task result build

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta)

v0.3

Fixed

• Use Dockerfile as the file name in the uploaded artifact, regardless of the name of the actual file.

v0.2

Removed

• BREAKING: Support for Dockerfile downloading in Konflux Build Pipeline.

---

Configuration

📅 Schedule: Branch creation - "after 5am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh03[bot]. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[alebedev87]

/ok-to-test

[alebedev87]

/retest

[melvinjoseph86]

/retest

[openshift-ci-robot]

@red-hat-konflux-kflux-prd-rh03[bot]: This pull request references OSD-32240 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This PR contains the following updates:

Package	Change	Notes
quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan (source, changelog)	6bcb4d4 -> 2f3015a
quay.io/konflux-ci/tekton-catalog/task-apply-tags (source, changelog)	0.2 -> 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-build-image-index (source, changelog)	1dbb98f -> ac4f8b5
quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta (source, changelog)	0.7 -> 0.9	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta (source, changelog)	0.7 -> 0.9	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-clair-scan (source, changelog)	ee558db -> 9397d3e
quay.io/konflux-ci/tekton-catalog/task-clamav-scan (source, changelog)	f3d2d17 -> 9f18b21
quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check (source, changelog)	3640087 -> de35caf
quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check (source, changelog)	462baed -> 3457a4c
quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks (source, changelog)	04f7559 -> 945f8ba
quay.io/konflux-ci/tekton-catalog/task-fbc-fips-check-oci-ta (source, changelog)	8f62bc6 -> 0dd84e6
quay.io/konflux-ci/tekton-catalog/task-fbc-target-index-pruning-check (source, changelog)	216200a -> c2203ad
quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta (source, changelog)	0a89e1a -> 2c388d2
quay.io/konflux-ci/tekton-catalog/task-init (source, changelog)	0.2 -> 0.4	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta (source, changelog)	3fa0204 -> 22612d6
quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta (source, changelog)	0.1 -> 0.3	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan (source, changelog)	6bcb4d4 -> 0dbb461
quay.io/konflux-ci/tekton-catalog/task-run-opm-command-oci-ta (source, changelog)	4ab5dba -> c79858b
quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta (source, changelog)	78f5244 -> ab60e90
quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta (source, changelog)	d44336d -> c314b4d
quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta (source, changelog)	8ad28b7 -> 6045ed6
quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta (source, changelog)	0.3 -> 0.4	⚠️migration⚠️
quay.io/konflux-ci/tekton-catalog/task-show-sbom (source, changelog)	beb0616 -> e119aa8
quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta (source, changelog)	4abb2db -> eb620d1
quay.io/konflux-ci/tekton-catalog/task-validate-fbc (source, changelog)	2a99dbd -> 291cbcc

---

Release Notes

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-apply-tags)

v0.3

• Switched from bash implementation to Konflux Build CLI.
• Deprecated older 0.1 and 0.2 versions.

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)

v0.9

Changed

• The buildah image now uses version 1.4.1 of konflux-ci/task-runner
• This version pulls in version 1.42.1 of syft that ensures 'redhat' is used as the namespace for hummingbird rpms

v0.8

Fixed

• Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
  for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
  or linux/arm64).

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)

v0.9

Changed

• The buildah image now uses version 1.4.1 of konflux-ci/task-runner
• This version pulls in version 1.42.1 of syft that ensures 'redhat' is used as the namespace for hummingbird rpms

v0.8

Fixed

• Platform build arguments (BUILDPLATFORM, TARGETPLATFORM) now correctly include CPU variant
  for ARM architectures (e.g., linux/arm/v7 or linux/arm64/v8 instead of just linux/arm
  or linux/arm64).

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-init)

v0.4

• Task started using konflux build cli instead of bash script.

v0.3

• Remove params image-url, rebuild and skip-checks
• Remove task result build

konflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta)

v0.3

Fixed

• Use Dockerfile as the file name in the uploaded artifact, regardless of the name of the actual file.

v0.2

Removed

• BREAKING: Support for Dockerfile downloading in Konflux Build Pipeline.

---

Configuration

📅 Schedule: Branch creation - "after 5am on tuesday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[alebedev87]

/override ci/prow/e2e-gcp-operator
/override ci/prow/e2e-aws-operator
/override ci/prow/e2e-aws-shared-vpc-phz-operator
/override ci/prow/e2e-azure-operator
/override ci/prow/e2e-azure-infoblox-operator

This PR changes Konflux pipeline config, no need to wait for CI presubmits.

[openshift-ci]

@alebedev87: Overrode contexts on behalf of alebedev87: ci/prow/e2e-aws-operator, ci/prow/e2e-aws-shared-vpc-phz-operator, ci/prow/e2e-azure-infoblox-operator, ci/prow/e2e-azure-operator, ci/prow/e2e-gcp-operator

Details

In response to this:

/override ci/prow/e2e-gcp-operator
/override ci/prow/e2e-aws-operator
/override ci/prow/e2e-aws-shared-vpc-phz-operator
/override ci/prow/e2e-azure-operator
/override ci/prow/e2e-azure-infoblox-operator

This PR changes Konflux pipeline config, no need to wait for CI presubmits.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[alebedev87]

/lgtm
/approve

All building pipelines are green.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[alebedev87]

4.15 and 4.16 pipeline deployments failures seem to indicate a real problem. After extracting the deploy pipeline artifacts (oras pull), Claude Code pointed me to the following:

  Root Cause: OPM Cache Digest Mismatch                                                                                              
                                                                                                                                     
  The installation failed because the FBC (File-Based Catalog) CatalogSource pod crashed in a restart loop (TRANSIENT_FAILURE),      
  preventing OLM from discovering the operator. No Subscription or ClusterServiceVersion was ever created.                           
                                                                                                                                   
  Error from the registry-server container

  level=fatal msg="cache requires rebuild: cache reports digest as \"5aea720ffa49a68f\", but computed digest is \"19e78b24cbe4e9fd\""

  What happened

  1. The catalog image (Containerfile.external-dns-operator-catalog-v4-15:26) pre-populates a serve cache during the image build
  using the opm binary from the base image ose-operator-registry-rhel9:v4.15 (a floating tag):
  RUN ["/bin/opm", "serve", "/configs/external-dns-operator", "--cache-dir=/tmp/cache", "--cache-only"]
  2. The CatalogSource uses extractContent (.tekton/pipelines/deploy-fbc-operator.yaml:684-686), which means:
    - An init container extracts /configs and /tmp/cache from the FBC image into shared volumes
    - The registry-server container (from the cluster's OLM, OCP 4.15.61) uses its own opm to serve the extracted content with the
  extracted cache
  3. The opm version that built the cache (from ose-operator-registry-rhel9:v4.15 floating tag) is different from the opm in the
  cluster's OLM (OCP 4.15.61). These two versions compute catalog content digests differently, causing the cache validation to fail.
  4. The opm serve exits with fatal instead of rebuilding the stale cache, so the pod enters CrashLoopBackOff, the CatalogSource
  never becomes READY, and the operator is never installed.

  Evidence chain

  - catalogsource-oo-6zhjf.yaml:23 — lastObservedState: TRANSIENT_FAILURE
  - subscriptions.json — empty (no subscription was ever created)
  - clusterserviceversions.json — empty (no CSV was ever created)
  - Events show BackOff: Back-off restarting failed container registry-server

  Possible fixes

  1. Remove the pre-populated cache from the Containerfile — remove line 26 (RUN opm serve --cache-only) and --cache-dir=/tmp/cache
  from the CMD on line 33. This lets the runtime opm build its own compatible cache. Also remove cacheDir: /tmp/cache from the
  extractContent spec in the pipeline.
  2. Pin the base image to a specific z-stream version (e.g., ose-operator-registry-rhel9:v4.15.0-202603...) that matches the
  cluster's OLM opm version, instead of using the floating v4.15 tag.
  3. Add --cache-enforce-integrity=false to the CMD to skip cache digest validation (if supported by the opm version).

[alebedev87]

/override "Red Hat Konflux / ext-dns-optr-fbc-v4-15-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-15"
/override "Red Hat Konflux / ext-dns-optr-fbc-v4-16-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-16"

Deployment issue will have to be investigated independently...

[openshift-ci]

@alebedev87: Overrode contexts on behalf of alebedev87: Red Hat Konflux / ext-dns-optr-fbc-v4-15-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-15, Red Hat Konflux / ext-dns-optr-fbc-v4-16-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-16

Details

In response to this:

/override "Red Hat Konflux / ext-dns-optr-fbc-v4-15-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-15"
/override "Red Hat Konflux / ext-dns-optr-fbc-v4-16-deploy-operator / external-dns-fbc-container-ext-dns-optr-fbc-v4-16"

Deployment issue will have to be investigated independently...

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

@red-hat-konflux-kflux-prd-rh03[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.