fix: pin hypershift operator to avoid registry override regression (AROSLSRE-1318) - #5776
Merged
openshift-merge-bot[bot] merged 1 commit intoJun 25, 2026
Conversation
…ROSLSRE-1318) The latest HyperShift operator image includes a regression in registryoverride.Replace (openshift/hypershift#8509) that breaks repository-level --registry-overrides for digest-based images. This causes all CAPI and component image rewrites to fail in environments using ACR mirrors, blocking cluster creation. Pin to the known-good build (a101e669, 2026-06-05) until the upstream fix (openshift/hypershift#8824, OCPBUGS-92034) merges and a new image is published.
openshift-ci
Bot
requested review from
Tony Schneider (tony-schndr) and
Venkatesh S (venkateshsredhat)
June 24, 2026 17:57
Copilot started reviewing on behalf of
Anthony Vollmer (avollmer-redhat)
June 24, 2026 17:57
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR pins the HyperShift operator source tag in the image-updater configuration to prevent automated digest bumps from tracking a regressed latest image that breaks registry overrides in ARO-HCP environments.
Changes:
- Pin
tooling/image-updater/config.yamlhypershiftsource.tagfrom"latest"to a specific commit SHA. - Add an inline comment documenting the upstream regression and the unpin tracker.
| source: | ||
| image: quay.io/redhat-services-prod/crt-redhat-acm-tenant/hypershift/hypershift-operator | ||
| tag: "latest" | ||
| tag: "a101e6697af02eba43e6cfd04fc4c00277b72a64" # pinned: latest includes openshift/hypershift#8509 which breaks registry overrides for digest images (OCPBUGS-92034, unpin: AROSLSRE-1318) |
Collaborator
Author
Local bumper testVerified the pin works correctly by running the image-updater locally: AZURE_TOKEN_CREDENTIALS=dev ./image-updater update --config config.yaml --tags --components maestro,hypershiftResult:
|
Collaborator
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: avollmer-redhat, hbhushan3 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Collaborator
|
/test e2e-parallel |
1 similar comment
Collaborator
|
/test e2e-parallel |
Merged
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://redhat.atlassian.net/browse/AROSLSRE-1318
What
Pins the HyperShift operator image tag in
tooling/image-updater/config.yamlfromlatesttoa101e6697af02eba43e6cfd04fc4c00277b72a64(the current known-good build from 2026-06-05) to prevent the automated bumper from picking up the broken image.No
config/config.yamlchange needed — the current digest on main (sha256:e30b97d...from Jun 19) is pre-regression and safe.Why
The latest HyperShift operator image includes a regression in
registryoverride.Replace(openshift/hypershift#8509, merged 2026-06-22). The bug causes repository-level--registry-overridesto fail for digest-based images (@sha256:...), because the code only accepts/as a valid separator after the source prefix.This breaks all CAPI and component image rewrites in ARO-HCP environments where
quay.io/openshift-release-dev/ocp-v4.0-art-devis overridden to the mirrored ACR. The CPO tries to pull fromquay.iodirectly and getsunauthorized, blocking cluster creation. The automated bumper PR #5740 has been failing e2e consistently with:Upstream bug: OCPBUGS-92034
Upstream fix: openshift/hypershift#8824 — approved, CI green, waiting on
/lgtmUnpin
Revert
tagback to"latest"intooling/image-updater/config.yamlonce openshift/hypershift#8824 merges and a new image is published. Tracked in AROSLSRE-1318.Testing
make yamlfmt— passes (no formatting changes)tooling/image-updater/config.yaml(tag pin, no config.yaml or rendered config changes)Previous precedent
Same pattern as #5371 (AROSLSRE-919) → unpinned in #5401 (AROSLSRE-921).