OLS-1829: Detect change in specified BYOK images

.tekton/integration-tests/pipelines/lightspeed-operator-e2e-test-pipeline-416.yaml

@@ -247,6 +247,9 @@ spec:
                 value: credentials
           - name: run-e2e-tests
             onError: continue
+            resources:
+              limits:
+                memory: 8Gi
             volumeMounts:
               - name: azure-openai-token
                 mountPath: /var/run/azure_openai
@@ -280,7 +283,7 @@ spec:
               echo "---------------------------------------------"
               cat $KUBECONFIG
               echo "---------------------------------------------"
-              dnf -y install git make golang
+              dnf -y install git make golang gpgme-devel
               git clone https://github.com/openshift/lightspeed-operator.git
               cd lightspeed-operator
               git config --global user.email [email protected]

.tekton/integration-tests/pipelines/lightspeed-operator-e2e-test-pipeline-417.yaml

@@ -247,6 +247,9 @@ spec:
                 value: credentials
           - name: run-e2e-tests
             onError: continue
+            resources:
+              limits:
+                memory: 8Gi
             volumeMounts:
               - name: azure-openai-token
                 mountPath: /var/run/azure_openai
@@ -280,7 +283,7 @@ spec:
               echo "---------------------------------------------"
               cat $KUBECONFIG
               echo "---------------------------------------------"
-              dnf -y install git make golang
+              dnf -y install git make golang gpgme-devel
               git clone https://github.com/openshift/lightspeed-operator.git
               cd lightspeed-operator
               git config --global user.email [email protected]

.tekton/integration-tests/pipelines/lightspeed-operator-e2e-test-pipeline-418.yaml

@@ -247,6 +247,9 @@ spec:
                 value: credentials
           - name: run-e2e-tests
             onError: continue
+            resources:
+              limits:
+                memory: 8Gi
             volumeMounts:
               - name: azure-openai-token
                 mountPath: /var/run/azure_openai
@@ -280,7 +283,7 @@ spec:
               echo "---------------------------------------------"
               cat $KUBECONFIG
               echo "---------------------------------------------"
-              dnf -y install git make golang
+              dnf -y install git make golang gpgme-devel
               git clone https://github.com/openshift/lightspeed-operator.git
               cd lightspeed-operator
               git config --global user.email [email protected]

.tekton/integration-tests/pipelines/lightspeed-operator-e2e-test-pipeline-419.yaml

@@ -247,6 +247,9 @@ spec:
                 value: credentials
           - name: run-e2e-tests
             onError: continue
+            resources:
+              limits:
+                memory: 8Gi
             volumeMounts:
               - name: azure-openai-token
                 mountPath: /var/run/azure_openai
@@ -280,7 +283,7 @@ spec:
               echo "---------------------------------------------"
               cat $KUBECONFIG
               echo "---------------------------------------------"
-              dnf -y install git make golang
+              dnf -y install git make golang gpgme-devel
               git clone https://github.com/openshift/lightspeed-operator.git
               cd lightspeed-operator
               git config --global user.email [email protected]

Makefile

@@ -119,7 +119,7 @@ fmt: ## Run go fmt against code.
 
 .PHONY: vet
 vet: ## Run go vet against code.
-	go vet ./...
+	go vet -tags=exclude_graphdriver_btrfs ./...
 
 .PHONY: test
 test: manifests generate fmt vet envtest test-crds ## Run local tests.
@@ -131,15 +131,18 @@ OS_CONSOLE_PLUGIN_CRD_URL = https://raw.githubusercontent.com/openshift/api/refs
 OCP_CLUSTER_VERSION_CRD_URL = https://raw.githubusercontent.com/openshift/api/refs/heads/release-4.18/config/v1/zz_generated.crd-manifests/0000_00_cluster-version-operator_01_clusterversions-Default.crd.yaml
 MONITORING_CRD_URL = https://raw.githubusercontent.com/openshift/prometheus-operator/master/bundle.yaml
 OCP_APISERVER_CRD_URL = https://raw.githubusercontent.com/openshift/api/refs/heads/release-4.18/payload-manifests/crds/0000_10_config-operator_01_apiservers.crd.yaml
+# generated with `controller-gen crd paths=./image/... output:crd:dir=./crd` from https://github.com/openshift/api
+OCP_IMAGESTREAM_CRD_URL = ./config/crd/ocp/image.openshift.io_imagestreams.yaml
 TEST_CRD_DIR = .testcrds
 OS_CONSOLE_CRD_FILE = $(TEST_CRD_DIR)/openshift-console-crd.yaml
 OS_CONSOLE_PLUGIN_CRD_FILE = $(TEST_CRD_DIR)/openshift-console-plugin-crd.yaml
 OCP_CLUSTER_VERSION_CRD_FILE = $(TEST_CRD_DIR)/openshift-config-clusterversion-crd.yaml
 MONITORING_CRD_FILE = $(TEST_CRD_DIR)/monitoring-crd.yaml
 OCP_APISERVER_CRD_FILE = $(TEST_CRD_DIR)/openshift-apiserver-crd.yaml
+OCP_IMAGESTREAM_CRD_FILE = $(TEST_CRD_DIR)/image.openshift.io_imagestreams.yaml
 
 .PHONY: test-crds
-test-crds: $(TEST_CRD_DIR) $(OS_CONSOLE_CRD_FILE) $(OS_CONSOLE_PLUGIN_CRD_FILE) $(MONITORING_CRD_FILE) $(OCP_CLUSTER_VERSION_CRD_FILE) $(OCP_APISERVER_CRD_FILE) ## Test Dependencies CRDs
+test-crds: $(TEST_CRD_DIR) $(OS_CONSOLE_CRD_FILE) $(OS_CONSOLE_PLUGIN_CRD_FILE) $(MONITORING_CRD_FILE) $(OCP_CLUSTER_VERSION_CRD_FILE) $(OCP_APISERVER_CRD_FILE) $(OCP_IMAGESTREAM_CRD_FILE) ## Test Dependencies CRDs
 
 $(TEST_CRD_DIR):
 	mkdir -p $(TEST_CRD_DIR)
@@ -159,6 +162,9 @@ $(OCP_CLUSTER_VERSION_CRD_FILE): $(TEST_CRD_DIR)
 $(OCP_APISERVER_CRD_FILE): $(TEST_CRD_DIR)
 	wget -O $(OCP_APISERVER_CRD_FILE) $(OCP_APISERVER_CRD_URL)
 
+$(OCP_IMAGESTREAM_CRD_FILE): $(TEST_CRD_DIR)
+	cp $(OCP_IMAGESTREAM_CRD_URL) $(OCP_APISERVER_CRD_FILE)
+
 
 .PHONY: test-e2e
 test-e2e: ## Run e2e tests with an Openshift cluster. Requires KUBECONFIG and LLM_TOKEN environment variables.
@@ -168,7 +174,7 @@ endif
 ifndef LLM_TOKEN
 	$(error LLM_TOKEN  environment variable is not set)
 endif
-	go test ./test/e2e -timeout=120m -ginkgo.v -test.v -ginkgo.show-node-events --ginkgo.label-filter="!Rapidast && !Upgrade" --ginkgo.timeout=2h
+	go test -tags=exclude_graphdriver_btrfs ./test/e2e -timeout=120m -ginkgo.v -test.v -ginkgo.show-node-events --ginkgo.label-filter="!Rapidast && !Upgrade" --ginkgo.timeout=2h
 
 .PHONY: test-upgrade
 test-upgrade: ## Run upgrade tests with an Openshift cluster. Requires KUBECONFIG, LLM_TOKEN and BUNDLE_IMAGE environment variables.
@@ -195,7 +201,7 @@ endif
 
 .PHONY: lint
 lint: ## Run golangci-lint against code.
-	golangci-lint run --config=.golangci.yaml
+	golangci-lint run --config=.golangci.yaml --build-tags "exclude_graphdriver_btrfs"
 
 .PHONY: lint-fix
 lint-fix: ## Fix found issues (if it's supported by the linter).
@@ -297,17 +303,18 @@ LOCALBIN ?= $(shell pwd)/bin
 $(LOCALBIN):
 	mkdir -p $(LOCALBIN)
 
+## Tool Versions
+KUSTOMIZE_VERSION ?= v5.3.0
+CONTROLLER_TOOLS_VERSION ?= v0.19.0
+ENVTEST_VERSION ?= release-0.19
+
+
 ## Tool Binaries
 KUBECTL ?= kubectl
 KUSTOMIZE ?= $(LOCALBIN)/kustomize
-CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen --load-build-tags=exclude_graphdriver_btrfs
 ENVTEST ?= $(LOCALBIN)/setup-envtest
 
-## Tool Versions
-KUSTOMIZE_VERSION ?= v5.3.0
-CONTROLLER_TOOLS_VERSION ?= v0.16.5
-ENVTEST_VERSION ?= release-0.19
-
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. If wrong version is installed, it will be removed before downloading.
 $(KUSTOMIZE): $(LOCALBIN)

bundle/manifests/lightspeed-operator.clusterserviceversion.yaml

@@ -36,9 +36,9 @@ metadata:
           }
         }
       ]
-    capabilities: Basic Install
+    capabilities: Seamless Upgrades
     console.openshift.io/operator-monitoring-default: "true"
-    createdAt: "2025-10-10T17:31:05Z"
+    createdAt: "2025-12-06T17:28:28Z"
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
@@ -81,9 +81,7 @@ spec:
           - description: The name of the secret object that stores API provider credentials
             displayName: Credential Secret
             path: llm.providers[0].credentialsSecretRef
-          - description: |-
-              Feature Gates holds list of features to be enabled explicitly, otherwise they are disabled by default.
-              possible values: MCPServer
+          - description: 'Feature Gates holds list of features to be enabled explicitly, otherwise they are disabled by default. possible values: MCPServer'
             displayName: Feature Gates
             path: featureGates
           - displayName: LLM Settings
@@ -137,12 +135,7 @@ spec:
           - description: Enable Server Sent Events
             displayName: Enable Server Sent Events
             path: mcpServers[0].streamableHTTP.enableSSE
-          - description: |-
-              Headers to send to the MCP server
-              the map contains the header name and the name of the secret with the content of the header. This secret
-              should contain a header path in the data containing a header value.
-              A special case is usage of the kubernetes token in the header. to specify this use
-              a string "kubernetes" instead of the secret name
+          - description: Headers to send to the MCP server the map contains the header name and the name of the secret with the content of the header. This secret should contain a header path in the data containing a header value. A special case is usage of the kubernetes token in the header. to specify this use a string "kubernetes" instead of the secret name
             displayName: Headers
             path: mcpServers[0].streamableHTTP.headers
           - description: SSE Read Timeout, default is 10 seconds
@@ -277,9 +270,7 @@ spec:
           - description: The configmap holding proxy CA certificate
             displayName: Proxy CA Certificate
             path: ols.proxyConfig.proxyCACertificate
-          - description: |-
-              Proxy URL, e.g. https://proxy.example.com:8080
-              If not specified, the cluster wide proxy will be used, though env var "https_proxy".
+          - description: Proxy URL, e.g. https://proxy.example.com:8080 If not specified, the cluster wide proxy will be used, though env var "https_proxy".
             displayName: Proxy URL
             path: ols.proxyConfig.proxyURL
           - description: Query filters
@@ -513,6 +504,18 @@ spec:
                 - delete
                 - get
                 - update
+            - apiGroups:
+                - image.openshift.io
+              resources:
+                - imagestreams
+              verbs:
+                - create
+                - delete
+                - get
+                - list
+                - patch
+                - update
+                - watch
             - apiGroups:
                 - monitoring.coreos.com
               resources:

bundle/manifests/ols.openshift.io_olsconfigs.yaml

@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.19.0
   creationTimestamp: null
   name: olsconfigs.ols.openshift.io
 spec:

cmd/main.go

@@ -62,6 +62,7 @@ import (
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
 	consolev1 "github.com/openshift/api/console/v1"
+	imagev1 "github.com/openshift/api/image/v1"
 	openshiftv1 "github.com/openshift/api/operator/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -107,6 +108,7 @@ var (
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(consolev1.AddToScheme(scheme))
+	utilruntime.Must(imagev1.AddToScheme(scheme))
 	utilruntime.Must(openshiftv1.AddToScheme(scheme))
 	utilruntime.Must(monv1.AddToScheme(scheme))
 	utilruntime.Must(configv1.AddToScheme(scheme))

config/crd/bases/ols.openshift.io_olsconfigs.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.5
+    controller-gen.kubebuilder.io/version: v0.19.0
   name: olsconfigs.ols.openshift.io
 spec:
   group: ols.openshift.io