Skip to content

Commit 690dbcc

Browse files
minmzzhangminmzzhang
authored
fix: update ose-cli image version (#4)
* fix: update ose-cli image version Signed-off-by: Min Zhang <minzhang@redhat.com> * refactor: use OpenShift built-in cli ImageStream instead of ose-cli Replace hardcoded registry.redhat.io/openshift4/ose-cli-rhel9:v4.20 with the cluster-internal cli ImageStream at image-registry.openshift-image-registry.svc:5000/openshift/cli. This image auto-updates with the cluster, eliminating the need to manually track ose-cli version bumps on a monthly/quarterly/yearly basis. Signed-off-by: Min Zhang <minzhang@redhat.com> --------- Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent b7a45a1 commit 690dbcc

6 files changed

Lines changed: 32 additions & 28 deletions

File tree

‎.github/linters/.checkov.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ skip-check:
1919
- CKV_K8S_38
2020
# CKV_K8S_40: Job uses OpenShift namespace default UID (high UID assigned at runtime, no anyuid needed)
2121
- CKV_K8S_40
22+
# CKV_K8S_14: ImageStream tag tracks the cluster version; no fixed tag by design
23+
- CKV_K8S_14
2224
# CKV_K8S_43: Image digest; chart uses tag, digest is deployment-specific
2325
- CKV_K8S_43
2426
# CKV_SECRET_6: False positives - templates use placeholders, script refs to cluster secrets only

‎.trivyignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# AVD-KSV-0125: registry.redhat.io trusted; S3 job uses ose-cli from Red Hat
1+
# AVD-KSV-0125: S3 job uses OpenShift built-in cli ImageStream (cluster-internal registry)
22
AVD-KSV-0125
33
# AVD-KSV-0113: S3 setup Role intentionally needs secret get/create/patch for quay config bundle
44
AVD-KSV-0113

‎Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: quay
33
description: Red Hat Quay Registry Resources
44
type: application
5-
version: 0.1.1
5+
version: 0.1.2
66
appVersion: "3.9"
77
home: https://github.com/validatedpatterns/quay-chart
88
maintainers:

‎README.md‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<!-- markdownlint-disable MD013 -->
44

5-
![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9](https://img.shields.io/badge/AppVersion-3.9-informational?style=flat-square)
5+
![Version: 0.1.2](https://img.shields.io/badge/Version-0.1.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9](https://img.shields.io/badge/AppVersion-3.9-informational?style=flat-square)
66

77
<!-- markdownlint-enable MD013 -->
88

@@ -28,28 +28,28 @@ This chart is used to serve as the template for Validated Patterns Charts
2828

2929
## Values
3030

31-
| Key | Type | Default | Description |
32-
| -------------------------------------------- | ------ | ---------------------------------------------- | ----------- |
33-
| job.image | string | `"registry.redhat.io/openshift4/ose-cli:4.15"` | |
34-
| job.resources.limits.cpu | string | `"500m"` | |
35-
| job.resources.limits.memory | string | `"256Mi"` | |
36-
| job.resources.requests.cpu | string | `"50m"` | |
37-
| job.resources.requests.memory | string | `"128Mi"` | |
38-
| objectStorage.objectBucketClaim.bucketName | string | `"quay-datastore"` | |
39-
| objectStorage.objectBucketClaim.name | string | `"quay-bucket"` | |
40-
| objectStorage.objectBucketClaim.storageClass | string | `"openshift-storage.noobaa.io"` | |
41-
| quay.configBundleSecret.deploy | bool | `true` | |
42-
| quay.configBundleSecret.name | string | `"quay-init-config-bundle-secret"` | |
43-
| quay.namespace | string | `"quay-enterprise"` | |
44-
| quay.setup.admin.email | string | `"quayadmin@example.com"` | |
45-
| quay.setup.admin.name | string | `"quayadmin"` | |
46-
| quay.setup.user.email | string | `"developer1@myorg.com"` | |
47-
| quay.setup.user.name | string | `"developer1"` | |
48-
| quay.storage.clairpostgres.size | string | `"50Gi"` | |
49-
| quay.storage.postgres.size | string | `"50Gi"` | |
50-
| quay_config.org.email | string | `"devel@myorg.com"` | |
51-
| quay_config.org.name | string | `"devel"` | |
52-
| quay_config.repo | string | `"example"` | |
31+
| Key | Type | Default | Description |
32+
| -------------------------------------------- | ------ | ------------------------------------------------------------------ | ----------- |
33+
| job.image | string | `"image-registry.openshift-image-registry.svc:5000/openshift/cli"` | |
34+
| job.resources.limits.cpu | string | `"500m"` | |
35+
| job.resources.limits.memory | string | `"256Mi"` | |
36+
| job.resources.requests.cpu | string | `"50m"` | |
37+
| job.resources.requests.memory | string | `"128Mi"` | |
38+
| objectStorage.objectBucketClaim.bucketName | string | `"quay-datastore"` | |
39+
| objectStorage.objectBucketClaim.name | string | `"quay-bucket"` | |
40+
| objectStorage.objectBucketClaim.storageClass | string | `"openshift-storage.noobaa.io"` | |
41+
| quay.configBundleSecret.deploy | bool | `true` | |
42+
| quay.configBundleSecret.name | string | `"quay-init-config-bundle-secret"` | |
43+
| quay.namespace | string | `"quay-enterprise"` | |
44+
| quay.setup.admin.email | string | `"quayadmin@example.com"` | |
45+
| quay.setup.admin.name | string | `"quayadmin"` | |
46+
| quay.setup.user.email | string | `"developer1@myorg.com"` | |
47+
| quay.setup.user.name | string | `"developer1"` | |
48+
| quay.storage.clairpostgres.size | string | `"50Gi"` | |
49+
| quay.storage.postgres.size | string | `"50Gi"` | |
50+
| quay_config.org.email | string | `"devel@myorg.com"` | |
51+
| quay_config.org.name | string | `"devel"` | |
52+
| quay_config.repo | string | `"example"` | |
5353

5454
<!-- markdownlint-enable MD013 MD034 MD060 -->
5555

‎templates/quay-s3-credentials-job.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ spec:
1818
automountServiceAccountToken: true
1919
containers:
2020
- name: setup-s3-credentials
21-
image: {{ .Values.job.image | default "registry.redhat.io/openshift4/ose-cli:4.15" }}
21+
image: {{ .Values.job.image | default "image-registry.openshift-image-registry.svc:5000/openshift/cli" }}
2222
imagePullPolicy: Always
2323
securityContext:
2424
allowPrivilegeEscalation: false

‎values.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@ quay:
1717
size: 50Gi # Default and minimum size is 50 Gi
1818

1919
job:
20-
# Use a version tag; avoid :latest for production (CKV_K8S_14)
21-
image: registry.redhat.io/openshift4/ose-cli:4.15
20+
# Uses OpenShift built-in cli ImageStream; auto-updates with the cluster
21+
# Override with e.g. registry.redhat.io/openshift4/ose-cli-rhel9:v4.20
22+
# if the internal image registry is not available
23+
image: image-registry.openshift-image-registry.svc:5000/openshift/cli
2224
resources:
2325
requests:
2426
cpu: 50m

0 commit comments

Comments
 (0)