CMP- 3973: install index image (supersedes PR 1001)

Makefile

@@ -127,7 +127,17 @@ E2E_TEST_TYPE?=all
 # variable to true if you prefer the tests to cleanup regardless of test status, e.g.:
 # E2E_CLEANUP_ON_ERROR=true make e2e
 E2E_CLEANUP_ON_ERROR?=false
-E2E_ARGS=-root=$(PROJECT_DIR) -globalMan=$(TEST_CRD) -namespacedMan=$(TEST_DEPLOY) -cleanupOnError=$(E2E_CLEANUP_ON_ERROR) -testType=$(E2E_TEST_TYPE)
+
+# Installation method for e2e tests. Options: manifest (default), subscription
+E2E_INSTALL_METHOD?=manifest
+# OLM subscription channel (only used when E2E_INSTALL_METHOD=subscription)
+E2E_OLM_CHANNEL?=stable
+# OLM catalog source (only used when E2E_INSTALL_METHOD=subscription)
+E2E_OLM_SOURCE?=redhat-operators
+# OLM catalog source namespace (only used when E2E_INSTALL_METHOD=subscription)
+E2E_OLM_SOURCE_NAMESPACE?=openshift-marketplace
+
+E2E_ARGS=-root=$(PROJECT_DIR) -globalMan=$(TEST_CRD) -namespacedMan=$(TEST_DEPLOY) -cleanupOnError=$(E2E_CLEANUP_ON_ERROR) -testType=$(E2E_TEST_TYPE) -installMethod=$(E2E_INSTALL_METHOD) -olmChannel=$(E2E_OLM_CHANNEL) -olmSource=$(E2E_OLM_SOURCE) -olmSourceNamespace=$(E2E_OLM_SOURCE_NAMESPACE)
 TEST_OPTIONS?=-timeout=20m
 # Skip pushing the container to your cluster
 E2E_SKIP_CONTAINER_PUSH?=false

cmd/manager/cel_scanner_test.go

@@ -228,7 +228,7 @@ var _ = Describe("getVariablesForProfile", func() {
 	It("returns empty when profile has no values", func() {
 		scheme := newTestScheme()
 		profile := &cmpv1alpha1.Profile{
-			ObjectMeta: metav1.ObjectMeta{Name: "no-vals", Namespace: "ns"},
+			ObjectMeta:     metav1.ObjectMeta{Name: "no-vals", Namespace: "ns"},
 			ProfilePayload: cmpv1alpha1.ProfilePayload{},
 		}
 		client := fake.NewClientBuilder().WithScheme(scheme).
@@ -331,14 +331,14 @@ var _ = Describe("celRuleWrapper", func() {
 			},
 		}
 
-	w := celRuleWrapper{
-		scannerRule: rule,
-		payload:     &rule.RulePayload,
-	}
+		w := celRuleWrapper{
+			scannerRule: rule,
+			payload:     &rule.RulePayload,
+		}
 
-	Expect(w.scannerRule.Identifier()).To(Equal("my-rule"))
-	Expect(w.payload.Expression).To(Equal("pods.items.size() > 0"))
-	Expect(w.payload.FailureReason).To(Equal("no pods"))
+		Expect(w.scannerRule.Identifier()).To(Equal("my-rule"))
+		Expect(w.payload.Expression).To(Equal("pods.items.size() > 0"))
+		Expect(w.payload.FailureReason).To(Equal("no pods"))
 	})
 })
 

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.39.1
+	github.com/operator-framework/api v0.29.0
 	k8s.io/apimachinery v0.35.3
 	k8s.io/client-go v1.5.2
 	open-cluster-management.io/api v0.15.0

go.sum

@@ -282,6 +282,8 @@ github.com/openshift/library-go v0.0.0-20260326200317-12d8376369b7 h1:GRQO8uAHck
 github.com/openshift/library-go v0.0.0-20260326200317-12d8376369b7/go.mod h1:3bi4pLpYRdVd1aEhsHfRTJkwxwPLfRZ+ZePn3RmJd2k=
 github.com/openshift/machine-config-operator v0.0.1-0.20260410020757-449e78f7ec94 h1:yOOrCtGX3QZ8EOjhwjFrR7fOKoFO9CQhT+iOEvzrbrA=
 github.com/openshift/machine-config-operator v0.0.1-0.20260410020757-449e78f7ec94/go.mod h1:Yw5V0UkMteEhSKJXzCEiyUwOGJ5944HpEX7W9EECV3g=
+github.com/operator-framework/api v0.29.0 h1:TxAR8RCO+I4FjRrY4PSMgnlmbxNWeD8pzHXp7xwHNmw=
+github.com/operator-framework/api v0.29.0/go.mod h1:0whQE4mpMDd2zyHkQe+bFa3DLoRs6oGWCbu8dY/3pyc=
 github.com/pborman/uuid v1.2.1 h1:+ZZIw58t/ozdjRaXh/3awHfmWRbzYxJoAdNJxe/3pvw=
 github.com/pborman/uuid v1.2.1/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pin/tftp v2.1.0+incompatible/go.mod h1:xVpZOMCXTy+A5QMjEVN0Glwa1sUvaJhFXbr/aAxuxGY=

pkg/apis/compliance/v1alpha1/rule_scanner_test.go

@@ -12,16 +12,16 @@ var _ = Describe("RulePayload shared helpers", func() {
 
 	BeforeEach(func() {
 		payload = RulePayload{
-			ID:          "test-rule-id",
-			Title:       "Test Rule",
-			Description: "A test rule description",
-			Rationale:   "Test rationale",
-			Warning:     "Test warning",
-			Severity:    "high",
+			ID:           "test-rule-id",
+			Title:        "Test Rule",
+			Description:  "A test rule description",
+			Rationale:    "Test rationale",
+			Warning:      "Test warning",
+			Severity:     "high",
 			Instructions: "Test instructions",
-			CheckType:   CheckTypePlatform,
-			ScannerType: ScannerTypeCEL,
-			Expression:  "pods.items.all(p, p.spec.securityContext != null)",
+			CheckType:    CheckTypePlatform,
+			ScannerType:  ScannerTypeCEL,
+			Expression:   "pods.items.all(p, p.spec.securityContext != null)",
 			Inputs: []InputPayload{
 				{
 					Name: "pods",

pkg/apis/compliance/v1alpha1/rule_types.go

@@ -28,7 +28,6 @@ const (
 	CheckTypeNone     = ""
 )
 
-
 type RulePayload struct {
 	// The ID of the Rule
 	ID string `json:"id"`

pkg/controller/compliancescan/compliancescan_controller_test.go

@@ -879,4 +879,3 @@ fi`, runtimeDir, configPath, sshdBin, terminationLog)
 		})
 	})
 })
-

pkg/controller/customrule/customrule_controller_test.go

@@ -37,13 +37,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
 				},
 				Spec: v1alpha1.CustomRuleSpec{
 					RulePayload: v1alpha1.RulePayload{
-						ID:           "test-rule-1",
-						Title:        "Test Rule",
-						Description:  "A test rule for validation",
-						Severity:     "medium",
-						ScannerType:  v1alpha1.ScannerTypeCEL,
-						Expression:   "pods.items.all(pod, pod.spec.containers.all(container, container.securityContext.runAsNonRoot == true))",
-						Inputs:       []v1alpha1.InputPayload{
+						ID:          "test-rule-1",
+						Title:       "Test Rule",
+						Description: "A test rule for validation",
+						Severity:    "medium",
+						ScannerType: v1alpha1.ScannerTypeCEL,
+						Expression:  "pods.items.all(pod, pod.spec.containers.all(container, container.securityContext.runAsNonRoot == true))",
+						Inputs: []v1alpha1.InputPayload{
 							{
 								Name: "pods",
 								KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
@@ -70,13 +70,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
 				},
 				Spec: v1alpha1.CustomRuleSpec{
 					RulePayload: v1alpha1.RulePayload{
-						ID:           "test-rule-2",
-						Title:        "Invalid Rule",
-						Description:  "A rule with invalid CEL syntax",
-						Severity:     "high",
-						ScannerType:  v1alpha1.ScannerTypeCEL,
-						Expression:   "this is not &&& valid CEL syntax", // Invalid CEL syntax
-						Inputs:       []v1alpha1.InputPayload{
+						ID:          "test-rule-2",
+						Title:       "Invalid Rule",
+						Description: "A rule with invalid CEL syntax",
+						Severity:    "high",
+						ScannerType: v1alpha1.ScannerTypeCEL,
+						Expression:  "this is not &&& valid CEL syntax", // Invalid CEL syntax
+						Inputs: []v1alpha1.InputPayload{
 							{
 								Name: "test",
 								KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
@@ -103,13 +103,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
 				},
 				Spec: v1alpha1.CustomRuleSpec{
 					RulePayload: v1alpha1.RulePayload{
-						ID:           "test-rule-5",
-						Title:        "Multi-input Rule",
-						Description:  "A rule with multiple inputs",
-						Severity:     "medium",
-						ScannerType:  v1alpha1.ScannerTypeCEL,
-						Expression:   "namespaces.items.all(ns, networkpolicies.items.exists(np, np.metadata.namespace == ns.metadata.name))",
-						Inputs:       []v1alpha1.InputPayload{
+						ID:          "test-rule-5",
+						Title:       "Multi-input Rule",
+						Description: "A rule with multiple inputs",
+						Severity:    "medium",
+						ScannerType: v1alpha1.ScannerTypeCEL,
+						Expression:  "namespaces.items.all(ns, networkpolicies.items.exists(np, np.metadata.namespace == ns.metadata.name))",
+						Inputs: []v1alpha1.InputPayload{
 							{
 								Name: "namespaces",
 								KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
@@ -144,13 +144,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
 				},
 				Spec: v1alpha1.CustomRuleSpec{
 					RulePayload: v1alpha1.RulePayload{
-						ID:           "test-rule-5",
-						Title:        "Multi-input Rule",
-						Description:  "A rule with multiple inputs",
-						Severity:     "medium",
-						ScannerType:  v1alpha1.ScannerTypeCEL,
-						Expression:   "namespaces.items.all(ns, networkpolicies-non-existent.items.exists(np, np.metadata.namespace == ns.metadata.name))",
-						Inputs:       []v1alpha1.InputPayload{
+						ID:          "test-rule-5",
+						Title:       "Multi-input Rule",
+						Description: "A rule with multiple inputs",
+						Severity:    "medium",
+						ScannerType: v1alpha1.ScannerTypeCEL,
+						Expression:  "namespaces.items.all(ns, networkpolicies-non-existent.items.exists(np, np.metadata.namespace == ns.metadata.name))",
+						Inputs: []v1alpha1.InputPayload{
 							{
 								Name: "namespaces",
 								KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
@@ -185,13 +185,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
 				},
 				Spec: v1alpha1.CustomRuleSpec{
 					RulePayload: v1alpha1.RulePayload{
-						ID:           "test-rule-6",
-						Title:        "Undefined Reference Rule",
-						Description:  "A rule referencing undefined inputs",
-						Severity:     "medium",
-						ScannerType:  v1alpha1.ScannerTypeCEL,
-						Expression:   "undefinedInput.items.size() > 0", // References 'undefinedInput' not in inputs
-						Inputs:       []v1alpha1.InputPayload{
+						ID:          "test-rule-6",
+						Title:       "Undefined Reference Rule",
+						Description: "A rule referencing undefined inputs",
+						Severity:    "medium",
+						ScannerType: v1alpha1.ScannerTypeCEL,
+						Expression:  "undefinedInput.items.size() > 0", // References 'undefinedInput' not in inputs
+						Inputs: []v1alpha1.InputPayload{
 							{
 								Name: "test",
 								KubernetesInputSpec: v1alpha1.KubernetesInputSpec{

pkg/controller/tailoredprofile/tailoredprofile_controller_test.go

@@ -1355,12 +1355,12 @@ var _ = Describe("TailoredprofileController", func() {
 					},
 					Spec: compv1alpha1.CustomRuleSpec{
 						RulePayload: compv1alpha1.RulePayload{
-							ID:           "custom_rule_1",
-							Title:        "Test Custom Rule",
-							Description:  "A test custom rule",
-							Severity:     "medium",
-							ScannerType:  compv1alpha1.ScannerTypeCEL,
-							Expression:   "true",
+							ID:          "custom_rule_1",
+							Title:       "Test Custom Rule",
+							Description: "A test custom rule",
+							Severity:    "medium",
+							ScannerType: compv1alpha1.ScannerTypeCEL,
+							Expression:  "true",
 							Inputs: []compv1alpha1.InputPayload{
 								{
 									Name: "pods",
@@ -1446,12 +1446,12 @@ var _ = Describe("TailoredprofileController", func() {
 					},
 					Spec: compv1alpha1.CustomRuleSpec{
 						RulePayload: compv1alpha1.RulePayload{
-							ID:           "custom_rule_2",
-							Title:        "Test Custom Rule with Error",
-							Description:  "A test custom rule with validation error",
-							Severity:     "high",
-							ScannerType:  compv1alpha1.ScannerTypeCEL,
-							Expression:   "invalid expression",
+							ID:          "custom_rule_2",
+							Title:       "Test Custom Rule with Error",
+							Description: "A test custom rule with validation error",
+							Severity:    "high",
+							ScannerType: compv1alpha1.ScannerTypeCEL,
+							Expression:  "invalid expression",
 							Inputs: []compv1alpha1.InputPayload{
 								{
 									Name: "pods",
@@ -1535,12 +1535,12 @@ var _ = Describe("TailoredprofileController", func() {
 					},
 					Spec: compv1alpha1.CustomRuleSpec{
 						RulePayload: compv1alpha1.RulePayload{
-							ID:           "custom_rule_3",
-							Title:        "Test Custom Rule Pending",
-							Description:  "A test custom rule pending validation",
-							Severity:     "low",
-							ScannerType:  compv1alpha1.ScannerTypeCEL,
-							Expression:   "true",
+							ID:          "custom_rule_3",
+							Title:       "Test Custom Rule Pending",
+							Description: "A test custom rule pending validation",
+							Severity:    "low",
+							ScannerType: compv1alpha1.ScannerTypeCEL,
+							Expression:  "true",
 							Inputs: []compv1alpha1.InputPayload{
 								{
 									Name: "pods",

pkg/profileparser/cel_content.go

@@ -27,26 +27,26 @@ type CELBundleContent struct {
 
 // CELRuleContent represents a single CEL rule definition in the content file.
 type CELRuleContent struct {
-	Name          string                       `json:"name"`
-	ID            string                       `json:"id"`
-	Title         string                       `json:"title"`
-	Description   string                       `json:"description,omitempty"`
-	Rationale     string                       `json:"rationale,omitempty"`
-	Severity      string                       `json:"severity"`
-	CheckType     string                       `json:"checkType"`
-	Expression    string                       `json:"expression"`
-	Inputs        []cmpv1alpha1.InputPayload    `json:"inputs"`
-	FailureReason string                       `json:"failureReason,omitempty"`
-	Instructions  string                       `json:"instructions,omitempty"`
+	Name          string                     `json:"name"`
+	ID            string                     `json:"id"`
+	Title         string                     `json:"title"`
+	Description   string                     `json:"description,omitempty"`
+	Rationale     string                     `json:"rationale,omitempty"`
+	Severity      string                     `json:"severity"`
+	CheckType     string                     `json:"checkType"`
+	Expression    string                     `json:"expression"`
+	Inputs        []cmpv1alpha1.InputPayload `json:"inputs"`
+	FailureReason string                     `json:"failureReason,omitempty"`
+	Instructions  string                     `json:"instructions,omitempty"`
 	// Variables lists the Variable CR names that this rule depends on.
 	// Sets the compliance.openshift.io/rule-variable annotation.
 	// +optional
-	Variables     []string                     `json:"variables,omitempty"`
+	Variables []string `json:"variables,omitempty"`
 	// Controls maps compliance standard names to their control IDs.
 	// Sets control.compliance.openshift.io/<standard> and RHACM annotations.
 	// Example: {"NIST-800-53": ["IA-5(f)", "CM-6(a)"], "CIS-OCP": ["1.2.3"]}
 	// +optional
-	Controls      map[string][]string          `json:"controls,omitempty"`
+	Controls map[string][]string `json:"controls,omitempty"`
 }
 
 // CELProfileContent represents a single CEL profile definition in the content file.
@@ -61,9 +61,9 @@ type CELProfileContent struct {
 	// Values lists the Variable CR names this profile references.
 	// Stored in Profile.Values so the CEL scanner can load them.
 	// +optional
-	Values      []string `json:"values,omitempty"`
+	Values []string `json:"values,omitempty"`
 	// +optional
-	Version     string   `json:"version,omitempty"`
+	Version string `json:"version,omitempty"`
 }
 
 // ParseCELBundle reads a CEL content YAML file and creates Rule and Profile CRs.