Skip to content

task: update bundle to v26.4.1-rc.2#2848

Closed
nvidia-ci-cd wants to merge 1 commit into
v26.4.xfrom
update-ocp-bundle-to-v26.4.1-rc.2
Closed

task: update bundle to v26.4.1-rc.2#2848
nvidia-ci-cd wants to merge 1 commit into
v26.4.xfrom
update-ocp-bundle-to-v26.4.1-rc.2

Conversation

@nvidia-ci-cd

Copy link
Copy Markdown
Collaborator

Created by the ocp-bundle job in Mellanox/network-operator OCP bundle CI.

Signed-off-by: nvidia-ci-cd <svc-cloud-orch-gh@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Jul 14, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@greptile-apps

greptile-apps Bot commented Jul 14, 2026

Copy link
Copy Markdown

Greptile Summary

This PR updates the v26.4.x OCP bundle to 26.4.1-rc.2. The main changes are:

  • Bundle channel metadata is reordered to stable,v26.4.
  • The CSV name, version, timestamp, and default example versions are updated.
  • Operator, init container, plugin, and driver image references are updated to new digests.
  • Most image repositories move from production nvcr.io/nvidia/... paths to nvcr.io/nvstaging/mellanox/... paths.
  • Additional doca-driver-* related images are added for the new DOCA driver version.

Confidence Score: 4/5

The bundle can expose an RC staging image set through the stable/default channel.

  • Stable subscriptions can resolve this CSV if it is published into a shared catalog.
  • The operator and most related images now pull from nvcr.io/nvstaging/mellanox.
  • Production and disconnected clusters may not have credentials or mirror rules for those staging repositories.

bundle/metadata/annotations.yaml; bundle/manifests/nvidia-network-operator.clusterserviceversion.yaml

Security Review

The bundle crosses a release boundary by combining stable/default channel metadata with staging registry image references. A production or disconnected catalog can select the RC CSV and then fail to pull images or mirror staging artifacts.

Important Files Changed

Filename Overview
bundle.Dockerfile Reorders the bundle channels label to stable,v26.4; the order itself is unlikely to affect OLM selection.
bundle/metadata/annotations.yaml Keeps stable as the default channel for an RC bundle, which can expose the RC to stable subscriptions.
bundle/manifests/nvidia-network-operator.clusterserviceversion.yaml Updates the CSV to 26.4.1-rc.2 and changes most runtime and related images to nvstaging repositories.

Reviews (1): Last reviewed commit: "task: update bundle to v26.4.1-rc.2" | Re-trigger Greptile

Comment on lines +7 to 8
operators.operatorframework.io.bundle.channels.v1: stable,v26.4
operators.operatorframework.io.bundle.channel.default.v1: stable

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Stable Channel Carries RC

This bundle advertises 26.4.1-rc.2 on the stable channel and keeps stable as the default. If the bundle is added to a catalog used by stable subscriptions, OLM can select this release-candidate CSV and deploy the staging image set instead of a production build.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

value: nvcr.io/nvidia/mellanox/network-operator-init-container@sha256:d1fcdf836604591d018628f9ac8ecec30d14cee85e2aa1ea6fe762cfe463df75
image: nvcr.io/nvidia/cloud-native/network-operator@sha256:07867535ee9853e9da28824e1334fe3577e5c843c6c54e372b6e86cae09bd0fd
value: nvcr.io/nvstaging/mellanox/network-operator-init-container@sha256:aed545a13789e2deece22d4fcff904903d2658664c4cfdf3d27d2a48bd8ee612
image: nvcr.io/nvstaging/mellanox/network-operator@sha256:0b4add57d995c737f9fd79e04cddde918ee86d0a18ba587c13fc95e925839faf

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 security Staging Registry Pulls Production

The deployed operator image now points at nvcr.io/nvstaging/mellanox, and the CSV also uses nvstaging for the init image and most related images. When this bundle is installed or mirrored from a production catalog, clusters that only have production NVIDIA registry access can hit image pull or disconnected mirroring failures before the operator becomes ready.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants