Fix missing OperatorGroup for OPP 4.22 upgrade operators

[amp-rh]

Summary

• Adds missing operator_group field to rhacs-operator and odf-operator entries in the OPP 4.22 upgrade job config
• The install-operators step only creates an OperatorGroup when this field is present; without it, OLM cannot process the Subscription and the operator install times out
• Root cause of LPINTEROP-6962 failures on Aug 2 builds

Details

The install-operators-commands.sh script (lines 115-138) conditionally creates an OperatorGroup only when the operator_group key exists in the operator's JSON config. Both rhacs-operator and odf-operator were missing this field, so no OperatorGroup was created in their respective namespaces. OLM requires an OperatorGroup to process Subscriptions.

The 5.0 upgrade config was fixed differently in #82372 (operators removed entirely), but 4.22 still needs them installed.

Summary by CodeRabbit

• Updated the OPP 4.22 upgrade configuration for rhacs-operator and odf-operator.
• Added the required operator_group settings so install-operators creates the OperatorGroup required for OLM installation.
• Configured rhacs-operator for AllNamespaces mode by removing target_namespaces, as required by ACS v4.11 and later.
• Prevented operator installation timeouts in affected upgrade jobs.

[openshift-ci]

@amp-rh: GitHub didn't allow me to request PR reviews from the following users: mpruitt.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

• Adds missing operator_group field to rhacs-operator and odf-operator entries in the OPP 4.22 upgrade job config
• The install-operators step only creates an OperatorGroup when this field is present; without it, OLM cannot process the Subscription and the operator install times out
• Root cause of LPINTEROP-6962 failures on Aug 2 builds

Details

The install-operators-commands.sh script (lines 115-138) conditionally creates an OperatorGroup only when the operator_group key exists in the operator's JSON config. Both rhacs-operator and odf-operator were missing this field, so no OperatorGroup was created in their respective namespaces. OLM requires an OperatorGroup to process Subscriptions.

The 5.0 upgrade config was fixed differently in #82372 (operators removed entirely), but 4.22 still needs them installed.

/cc @MPruitt

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: amp-rh
Once this PR has been reviewed and has the lgtm label, please assign dhaiducek for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/stolostron/policy-collection/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c935112-c70f-44cd-b3d8-5cfc7cc5eafd

📥 Commits

Reviewing files that changed from the base of the PR and between 3770a7c and cc49dbf.

📒 Files selected for processing (1)

• ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-upgrade.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-upgrade.yaml

---

Walkthrough

The OCP 4.22 upgrade test configuration adds operator_group settings for the rhacs-operator and odf-operator entries.

Changes

Operator group configuration

Layer / File(s)	Summary
Configure operator groups ci-operator/config/stolostron/policy-collection/stolostron-policy-collection-main__ocp4.22-upgrade.yaml	The RHACS and ODF operator entries now define operator group assignments. Existing sources, channels, namespaces, and targets remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• openshift/release#82918: Updates another OCP upgrade configuration with related RHACS operator_group settings.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the missing OperatorGroup configuration for the OPP 4.22 upgrade operators.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The commit changes only one YAML CI configuration field; it adds no Ginkgo tests or test titles, so the stable-name check is not applicable.
Test Structure And Quality	✅ Passed	The PR changes only one YAML configuration line; it modifies no Ginkgo tests, It blocks, resource setup, cleanup, waits, or assertions.
Microshift Test Compatibility	✅ Passed	The only change is a YAML operator configuration edit that removes rhacs-operator target_namespaces; it adds no Ginkgo e2e tests or MicroShift-incompatible test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR modifies only CI configuration (YAML file for operator installation settings) and adds no Ginkgo e2e tests. The SNO compatibility check applies only to new test code, making it inapplicable...
Topology-Aware Scheduling Compatibility	✅ Passed	The PR modifies only a CI test configuration file to add an operator_group field for operator installation. It introduces no deployment manifests, operator code, or scheduling constraints that as...
Ote Binary Stdout Contract	✅ Passed	The complete PR range changes only one YAML configuration file; it adds OperatorGroup fields and removes a namespace target, with no process-level binary or stdout code changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	This PR modifies only a YAML CI operator configuration file, not any Ginkgo e2e tests; the check applies only when new Ginkgo tests are added.
No-Weak-Crypto	✅ Passed	PR modifies only YAML CI/CD configuration; no cryptographic code present to evaluate against weak-crypto check.
Container-Privileges	✅ Passed	PR adds operator_group metadata fields only; no container privilege definitions (privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation) are introduced or modified.
No-Sensitive-Data-In-Logs	✅ Passed	The PR changes only remove target_namespaces from the rhacs-operator configuration and do not add passwords, tokens, API keys, PII, or other sensitive data to logs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

@amp-rh: pj-rehearse could not automatically process this event because the request waited in queue for longer than 5 minutes. Use /pj-rehearse to trigger rehearsals manually.

[amp-rh]

/pj-rehearse auto-ack

[openshift-merge-bot]

@amp-rh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[amp-rh]

Correct Fix — Plus a Process Improvement Suggestion

The fix is straightforward and correct: adding operator_group to the RHACS and ODF operator configs so the install-operators step creates the required OperatorGroup in each namespace. Without this, OLM can't process the Subscription. Good root cause identification.

One process observation: the interop team is debugging OLM install prerequisites for products that should document their own requirements. The knowledge that RHACS needs rhacs-operator-group in the rhacs-operator namespace, and ODF needs openshift-storage-operator-group in openshift-storage, is product-team install knowledge.

Suggestion for reducing this maintenance burden going forward:

1. Ask each product team (ACS, ODF, ACM, Quay) to provide and maintain a "golden config" JSON block for their operator in the OPP pipeline
2. Product teams should include all OLM prerequisites: operator_group name, target_namespaces, channel, and any other install-time requirements
3. When product teams change their channel or namespace conventions, they should file the config update PR (not the interop team)

The Quay operator config already has this right — "install_namespace": "openshift-operators" with no explicit operator_group because openshift-operators has a pre-existing global OperatorGroup. That's product-team knowledge baked into the config correctly.

This isn't a merge blocker — please proceed with the fix. The process improvement is for future sprints.

See also: DPTP-1522 ("installation steps should be owned and maintained by SMEs"), OSSM-14040 (precedent for interop-to-product transition).

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@amp-rh: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-stolostron-policy-collection-main-ocp4.22-upgrade-interop-opp-upgrade-aws	N/A	periodic	Ci-operator config changed

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[openshift-ci]

@amp-rh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/periodic-ci-stolostron-policy-collection-main-ocp4.22-upgrade-interop-opp-upgrade-aws	3770a7c	link	unknown	/pj-rehearse periodic-ci-stolostron-policy-collection-main-ocp4.22-upgrade-interop-opp-upgrade-aws

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[amp-rh]

Superseded by #82920 which consolidates this fix (correct approach: install rhacs-operator into openshift-operators instead of a custom namespace with OwnNamespace OperatorGroup).