fix: resolve postgresql image from operator csv in setup-database

replace the hardcoded postgresql image with a dynamic lookup from the
rhoai operator csv's spec.relatedImages. this ensures the setup script
uses the digest-pinned image shipped with the operator, which is
critical for disconnected environments where idms redirects
registry.redhat.io references to the local mirror.

the csv lookup extracts the image for "postgresql_16_image", strips the
mirror registry prefix, and reconstructs it with the canonical
registry.redhat.io path. if the csv is not available (e.g., dev/odh
environments without olm), falls back to a :latest tag. an explicit
POSTGRES_IMAGE env var override is also supported.

Signed-off-by: Chaitanya Kulkarni <chkulkar@redhat.com>
Made-with: Cursor

Author: chaitanya1731

scripts/setup-database.sh

@@ -11,9 +11,11 @@
 #   - Default: opendatahub (ODH) or redhat-ods-applications (RHOAI)
 #
 # Environment variables:
-#   NAMESPACE       Target namespace (default: opendatahub)
-#   POSTGRES_USER   Database user (default: maas)
-#   POSTGRES_DB     Database name (default: maas)
+#   NAMESPACE          Target namespace (default: opendatahub)
+#   POSTGRES_IMAGE     Override PostgreSQL image (default: resolved from operator CSV,
+#                      falls back to registry.redhat.io/rhel9/postgresql-16:latest)
+#   POSTGRES_USER      Database user (default: maas)
+#   POSTGRES_DB        Database name (default: maas)
 #   POSTGRES_PASSWORD  Database password (default: auto-generated)
 #
 # Usage:
@@ -33,6 +35,30 @@ source "${SCRIPT_DIR}/deployment-helpers.sh"
 # Default namespace for ODH; use redhat-ods-applications for RHOAI
 : "${NAMESPACE:=opendatahub}"
 
+# Fallback image when the RHOAI operator CSV is not available (e.g., vanilla
+# Kubernetes, ODH-only clusters, or dev environments without OLM).
+DEFAULT_POSTGRES_IMAGE="registry.redhat.io/rhel9/postgresql-16:latest"
+
+# Resolve the PostgreSQL image from the RHOAI operator CSV's relatedImages.
+# Expects the RHOAI operator (or its CSV) to be installed on the cluster.
+# Replaces the registry prefix with registry.redhat.io so that IDMS can
+# redirect to the correct mirror in disconnected environments.
+# Falls back to DEFAULT_POSTGRES_IMAGE if the CSV is not found or the entry
+# is missing.
+resolve_postgres_image() {
+  local csv_image
+  csv_image=$(kubectl get csv -l 'olm.copiedFrom=redhat-ods-operator' \
+    -o jsonpath='{.items[0].spec.relatedImages[?(@.name=="postgresql_16_image")].image}' 2>/dev/null) || true
+
+  if [[ -n "${csv_image}" ]]; then
+    # Strip the registry host and prepend the canonical registry.redhat.io
+    # e.g., bastion.example.com:8443/rhel9/postgresql-16@sha256:abc → registry.redhat.io/rhel9/postgresql-16@sha256:abc
+    echo "registry.redhat.io/${csv_image#*/}"
+  else
+    echo "${DEFAULT_POSTGRES_IMAGE}"
+  fi
+}
+
 # Ensure namespace exists
 if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
   echo "📦 Creating namespace '$NAMESPACE'..."
@@ -70,6 +96,16 @@ fi
 
 echo "  Creating PostgreSQL deployment..."
 echo "  ⚠️  Using POC configuration (ephemeral storage)"
+
+# Allow explicit override via POSTGRES_IMAGE env var; otherwise resolve from
+# the operator CSV, falling back to the default :latest tag.
+POSTGRES_IMAGE="${POSTGRES_IMAGE:-$(resolve_postgres_image)}"
+if [[ "${POSTGRES_IMAGE}" == "${DEFAULT_POSTGRES_IMAGE}" ]]; then
+  echo "  Using default PostgreSQL image (operator CSV not available)"
+else
+  echo "  Resolved PostgreSQL image from operator CSV"
+fi
+echo "  Image: ${POSTGRES_IMAGE}"
 echo ""
 
 # Deploy PostgreSQL resources
@@ -105,7 +141,7 @@ spec:
     spec:
       containers:
       - name: postgres
-        image: registry.redhat.io/rhel9/postgresql-16:latest@sha256:680b42d2c51b76d23cd5b68dd774af456b1e4c98c4aaeb49d0de0948dc933716
+        image: ${POSTGRES_IMAGE}
         env:
         - name: POSTGRESQL_USER
           valueFrom: