ROX-35435: Support differing versions of Central and SecuredCluster

cmd/deploy.go

@@ -139,6 +139,20 @@ this flag can be used to tell roxie how to pre-load images for the current clust
 		}),
 	)
 
+	registerFlag(cmd, settings, "central-tag", "Image tag for Central (overrides --tag for Central)",
+		withApplyFn("version", func(config *deployer.Config, tag string) error {
+			config.Central.Operator.Version = tag
+			return nil
+		}),
+	)
+
+	registerFlag(cmd, settings, "secured-cluster-tag", "Image tag for SecuredCluster (overrides --tag for SecuredCluster)",
+		withApplyFn("version", func(config *deployer.Config, tag string) error {
+			config.SecuredCluster.Operator.Version = tag
+			return nil
+		}),
+	)
+
 	registerFlag(cmd, settings, "operator-env", "Operator environment variables (e.g., RELATED_IMAGE_MAIN=quay.io/...)",
 		withApplyFn("env-var", func(config *deployer.Config, envExpr string) error {
 			key, value, err := deployer.ParseOperatorEnvVar(envExpr)
@@ -253,25 +267,6 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	if !deploySettings.Central.EarlyReadinessEnabled() || !deploySettings.SecuredCluster.EarlyReadinessEnabled() {
-		// Explanation on the versions involved here:
-		// Deploying StackRox begins with picking a "main image tag" -- this is a version identifier, which cannot be reliably parsed as a semver.
-		// But there is a derived version from that -- the operator version -- which can be parsed as a semver.
-		//
-		// The invocation of deploySettings.Operator.Configure() above in this function prepares the operator deployment config in the sense
-		// that top-level roxie configuration options are propagated to the concrete operator deployment configuration. This includes also
-		// storing of the derived operator version within the operator configuration.
-		//
-		// This is why we use the operator version here when checking version constraints.
-		hasSupport, err := stackroxversions.SupportsAdditionalPrinterColumns(deploySettings.Operator.Version)
-		if err != nil {
-			return fmt.Errorf("checking version constraint on main image tag %s: %w", deploySettings.Roxie.Version, err)
-		}
-		if !hasSupport {
-			return fmt.Errorf("--early-readiness=false can only be used for StackRox versions satisfying %s", stackroxversions.SupportsAdditionalPrinterColumnsConstraint.String())
-		}
-	}
-
 	d, err := deployer.New(log)
 	if err != nil {
 		return fmt.Errorf("failed to create deployer: %w", err)
@@ -427,10 +422,6 @@ func configureConfig(log *logger.Logger, components component.Component, deployS
 		return fmt.Errorf("configuring operator configuration: %w", err)
 	}
 
-	if deploySettings.Roxie.KonfluxImagesEnabled() {
-		deployer.PopulateKonfluxEnvVars(deploySettings)
-	}
-
 	if components.IncludesCentral() {
 		if err := deploySettings.Central.ConfigureSpec(&deploySettings.Roxie); err != nil {
 			return fmt.Errorf("configuring Central spec: %w", err)
@@ -495,6 +486,42 @@ func deployValidate(components component.Component, deploySettings *deployer.Con
 		}
 	}
 
+	if deploySettings.HasMixedVersions() {
+		globalLogger.Dimf("Mixed versions detected (configured via --central-tag / --secured-cluster-tag or central.operator / securedCluster.operator)")
+		if components.IncludesOperatorExplicitly() {
+			return errors.New("mixed versions are not supported with operator-only deploy")
+		}
+		if deploySettings.Operator.DeployViaOlmEnabled() {
+			return errors.New("mixed versions are not supported with OLM deployment mode")
+		}
+	}
+
+	if !deploySettings.Central.EarlyReadinessEnabled() {
+		if err := checkEarlyReadinessSupport("Central", deploySettings.CentralVersion()); err != nil {
+			return err
+		}
+	}
+	if !deploySettings.SecuredCluster.EarlyReadinessEnabled() {
+		if err := checkEarlyReadinessSupport("SecuredCluster", deploySettings.SecuredClusterVersion()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func checkEarlyReadinessSupport(componentName, mainTag string) error {
+	// The main image tag is not reliably parsible as semver, so we derive the operator
+	// tag (via ConvertToOperatorTag) for the constraint check.
+	version := helpers.ConvertToOperatorTag(mainTag)
+	hasSupport, err := stackroxversions.SupportsAdditionalPrinterColumns(version)
+	if err != nil {
+		return fmt.Errorf("checking version constraint on %s operator version %s: %w", componentName, version, err)
+	}
+	if !hasSupport {
+		return fmt.Errorf("--early-readiness=false can only be used for StackRox versions satisfying %s (%s version %s does not)",
+			stackroxversions.SupportsAdditionalPrinterColumnsConstraint.String(), componentName, version)
+	}
 	return nil
 }
 

internal/deployer/acs_images.go

@@ -4,33 +4,30 @@ import (
 	"fmt"
 
 	"github.com/stackrox/roxie/internal/constants"
+	"github.com/stackrox/roxie/internal/helpers"
 )
 
 func imagesForConfig(config Config) []string {
-	images := make([]string, 0)
-	prefix := ""
-	if config.Roxie.KonfluxImagesEnabled() {
-		prefix = "release-"
-	}
-
+	var images []string
 	imageRegistry := constants.DefaultRegistry
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "main", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "central-db", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4-db", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4", config.Roxie.Version))
-	if !config.Roxie.KonfluxImagesEnabled() {
-		prefix = "stackrox-"
+
+	for _, instance := range config.OperatorInstances() {
+		prefix := ""
+		operatorPrefix := "stackrox-"
+		if instance.KonfluxImagesEnabled() {
+			prefix = "release-"
+			operatorPrefix = "release-"
+		}
+		operatorTag := helpers.ConvertToOperatorTag(instance.Version)
+		images = append(images,
+			fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "main", instance.Version),
+			fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "central-db", instance.Version),
+			fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4-db", instance.Version),
+			fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4", instance.Version),
+			fmt.Sprintf("%s/%s%s:%s", imageRegistry, operatorPrefix, "operator", operatorTag),
+			instance.BundleImage(),
+		)
 	}
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "operator", config.Operator.Version))
-	images = append(images, OperatorBundleImage(config))
 
 	return images
 }
-
-func OperatorBundleImage(config Config) string {
-	imageRegistry := constants.DefaultRegistry
-	if config.Roxie.KonfluxImagesEnabled() {
-		return fmt.Sprintf("%s/release-operator-bundle:v%s", imageRegistry, config.Operator.Version)
-	}
-	return fmt.Sprintf("%s/stackrox-operator-bundle:v%s", imageRegistry, config.Operator.Version)
-}

internal/deployer/config.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/stackrox/roxie/internal/constants"
 	"github.com/stackrox/roxie/internal/helpers"
 	"github.com/stackrox/roxie/internal/types"
 	"gopkg.in/yaml.v3"
@@ -75,12 +76,59 @@ func NewRoxieConfig() RoxieConfig {
 	}
 }
 
-// OperatorConfig controls how the ACS operator is deployed.
-type OperatorConfig struct {
-	SkipDeployment *bool             `yaml:"skipDeployment,omitempty"`
-	DeployViaOlm   *bool             `yaml:"deployViaOlm,omitempty"`
+// OperatorInstanceConfig describes how to deploy a single operator instance.
+// In the common single-operator mode, the top-level OperatorConfig (which embeds this)
+// is used directly. In mixed-operator mode, CentralConfig.Operator and
+// SecuredClusterConfig.Operator override the top-level defaults.
+type OperatorInstanceConfig struct {
+	// Version holds a main image tag (e.g. "4.8.0", "4.8.0-dirty").
+	// Methods that need the operator tag (semver-only) convert via helpers.ConvertToOperatorTag.
 	Version        string            `yaml:"version,omitempty"`
 	EnvVars        map[string]string `yaml:"envVars,omitempty"`
+	Namespace      string            `yaml:"namespace,omitempty"`
+	RoleNameSuffix string            `yaml:"roleNameSuffix,omitempty"`
+	KonfluxImages  *bool             `yaml:"konfluxImages,omitempty"`
+}
+
+func (c *OperatorInstanceConfig) KonfluxImagesSet() bool {
+	return c.KonfluxImages != nil
+}
+
+func (c *OperatorInstanceConfig) KonfluxImagesEnabled() bool {
+	return c.KonfluxImages != nil && *c.KonfluxImages
+}
+
+// ClusterRoleName returns the ClusterRole name for this operator instance.
+func (c *OperatorInstanceConfig) ClusterRoleName() string {
+	if c.RoleNameSuffix == "" {
+		return "rhacs-operator-manager-role"
+	}
+	return "rhacs-operator-manager-role-" + c.RoleNameSuffix
+}
+
+// ClusterRoleBindingName returns the ClusterRoleBinding name for this operator instance.
+func (c *OperatorInstanceConfig) ClusterRoleBindingName() string {
+	if c.RoleNameSuffix == "" {
+		return "rhacs-operator-manager-rolebinding"
+	}
+	return "rhacs-operator-manager-rolebinding-" + c.RoleNameSuffix
+}
+
+// BundleImage returns the operator bundle image for this operator instance.
+func (c *OperatorInstanceConfig) BundleImage() string {
+	imageRegistry := constants.DefaultRegistry
+	operatorTag := helpers.ConvertToOperatorTag(c.Version)
+	if c.KonfluxImagesEnabled() {
+		return fmt.Sprintf("%s/release-operator-bundle:v%s", imageRegistry, operatorTag)
+	}
+	return fmt.Sprintf("%s/stackrox-operator-bundle:v%s", imageRegistry, operatorTag)
+}
+
+// OperatorConfig is the top-level operator configuration used in single-operator mode.
+type OperatorConfig struct {
+	SkipDeployment         *bool `yaml:"skipDeployment,omitempty"`
+	DeployViaOlm           *bool `yaml:"deployViaOlm,omitempty"`
+	OperatorInstanceConfig `yaml:",inline"`
 }
 
 func (c *OperatorConfig) SkipDeploymentSet() bool {
@@ -101,7 +149,10 @@ func (c *OperatorConfig) DeployViaOlmEnabled() bool {
 
 // Configure derives the operator version from the roxie configuration.
 func (c *OperatorConfig) Configure(roxieConfig *RoxieConfig) error {
-	c.Version = helpers.ConvertMainTagToOperatorTag(roxieConfig.Version)
+	c.Version = helpers.ConvertToOperatorTag(roxieConfig.Version)
+	if c.KonfluxImages == nil {
+		c.KonfluxImages = roxieConfig.KonfluxImages
+	}
 	return nil
 }
 
@@ -115,6 +166,8 @@ type WaitConfig struct {
 
 // CentralConfig holds deployment settings for the Central component.
 type CentralConfig struct {
+	// Operator allows per-component operator overrides; only used in dual-operator mode.
+	Operator            OperatorInstanceConfig `yaml:"operator,omitempty"`
 	Namespace           string                 `yaml:"namespace,omitempty"`
 	ResourceProfile     types.ResourceProfile  `yaml:"resourceProfile,omitempty"`
 	PauseReconciliation *bool                  `yaml:"pauseReconciliation,omitempty"`
@@ -265,6 +318,8 @@ func (c *CentralConfig) CustomResource() (map[string]interface{}, error) {
 
 // SecuredClusterConfig holds deployment settings for the SecuredCluster component.
 type SecuredClusterConfig struct {
+	// Operator allows per-component operator overrides; only used in dual-operator mode.
+	Operator            OperatorInstanceConfig `yaml:"operator,omitempty"`
 	Namespace           string                 `yaml:"namespace,omitempty"`
 	ResourceProfile     types.ResourceProfile  `yaml:"resourceProfile,omitempty"`
 	PauseReconciliation *bool                  `yaml:"pauseReconciliation,omitempty"`