Add resolve_image_pullspecs customization for pinning

Refers to CLOUDDST-10231

Author: yashvardhannanavati

README.md

@@ -303,12 +303,18 @@ The custom configuration options for the Celery workers are listed below:
     organization, the `related_bundles` endpoint won't work for regenerate-bundle requests of that
     organization. If no organization is specified, IIB will try to find `related_bundles` for all
     regenerate-bundle requests.
+  * The `resolve_image_pullspecs` customization type is a dictionary with no additional arguments
+    and it basically pins all the pull specs in the CSV files of the operator bundle image in
+    question to their digests. If this customization is not specified in the config for an
+    organization, the pinning will not be done. If no organization is specified, IIB will try and
+    pin the pull specs in the CSV files to their digests.
 
   Here is an example that ties this all together:
 
   ```python
   iib_organization_customizations = {
         'company-marketplace': [
+            {'type': 'resolve_image_pullspecs'},
             {
                 'type': 'csv_annotations',
                 'annotations': {

iib/workers/config.py

@@ -73,6 +73,7 @@ class DevelopmentConfig(Config):
     iib_log_level = 'DEBUG'
     iib_organization_customizations = {
         'company-marketplace': [
+            {'type': 'resolve_image_pullspecs'},
             {'type': 'related_bundles'},
             {
                 'type': 'csv_annotations',

iib/workers/tasks/build_regenerate_bundle.py

@@ -221,6 +221,7 @@ def _adjust_operator_bundle(
     organization_customizations = conf['iib_organization_customizations'].get(organization, [])
     if not organization_customizations:
         organization_customizations = [
+            {'type': 'resolve_image_pullspecs'},
             {'type': 'related_bundles'},
             {'type': 'package_name_suffix'},
             {'type': 'registry_replacements'},
@@ -235,10 +236,6 @@ def _adjust_operator_bundle(
     ]
     labels = {}
 
-    log.info('Resolving image pull specs')
-    bundle_metadata = _get_bundle_metadata(operator_manifest, pinned_by_iib)
-    _resolve_image_pull_specs(bundle_metadata, labels, pinned_by_iib)
-
     # Perform the customizations in order
     for customization in organization_customizations:
         customization_type = customization['type']
@@ -285,6 +282,10 @@ def _adjust_operator_bundle(
             log.info('Applying related_bundles customization')
             bundle_metadata = _get_bundle_metadata(operator_manifest, pinned_by_iib)
             _write_related_bundles_file(bundle_metadata, request_id)
+        elif customization_type == 'resolve_image_pullspecs':
+            log.info('Resolving image pull specs')
+            bundle_metadata = _get_bundle_metadata(operator_manifest, pinned_by_iib)
+            _resolve_image_pull_specs(bundle_metadata, labels, pinned_by_iib)
 
     return labels
 

tests/test_workers/test_tasks/test_build_regenerate_bundle.py

@@ -978,13 +978,13 @@ def test_apply_repo_enclosure(original_image, eclosure_namespace, expected_image
 @mock.patch('iib.workers.tasks.build_regenerate_bundle._adjust_csv_annotations')
 @mock.patch('iib.workers.tasks.build_regenerate_bundle.get_image_labels')
 @mock.patch('iib.workers.tasks.build_regenerate_bundle._write_related_bundles_file')
+@mock.patch('iib.workers.tasks.build_regenerate_bundle._resolve_image_pull_specs')
 def test_adjust_operator_bundle_duplicate_customizations_ordered(
-    mock_grbi, mock_gil, mock_aca, mock_gri, mock_apns, mock_gpa, tmpdir
+    mock_rips, mock_grbi, mock_gil, mock_aca, mock_gri, mock_apns, mock_gpa, tmpdir
 ):
     manager = MagicMock()
     manager.attach_mock(mock_gpa, 'mock_gpa')
     manager.attach_mock(mock_apns, 'mock_apns')
-    manager.attach_mock(mock_gri, 'mock_gri')
     manager.attach_mock(mock_aca, 'mock_aca')
     manager.attach_mock(mock_gil, 'mock_gil')
     manager.attach_mock(mock_grbi, 'mock_grbi')
@@ -1042,7 +1042,7 @@ def test_adjust_operator_bundle_duplicate_customizations_ordered(
             registry='quay.io',
             operator='operator',
             image='/image',
-            ref=':v1',
+            ref='@sha256:654322',
             related_name=f'image-{image_digest}-annotation',
             related_ref='@sha256:749327',
         )
@@ -1054,29 +1054,18 @@ def test_adjust_operator_bundle_duplicate_customizations_ordered(
     )
     csv3.write(
         csv_template.format(
-            registry='registry.access.company.com', operator='operator', image='/image', ref=':v2'
+            registry='registry.access.company.com',
+            operator='operator',
+            image='/image',
+            ref='@sha256:654321',
         )
     )
 
-    def get_resolved_image(image):
-        return {
-            'quay.io/operator/image:v1': 'quay.io/operator/image@sha256:654322',
-            'quay.io/operator/image:v2': 'quay.io/operator/image@sha256:654321',
-            'quay.io/operator/image@sha256:654321': 'quay.io/operator/image@sha256:654321',
-            'quay.io/operator/image@sha256:749327': 'quay.io/operator/image@sha256:749327',
-            'registry.access.company.com/operator/image:v2': (
-                'registry.access.company.com/operator/image@sha256:654321'
-            ),
-        }[image]
-
-    mock_gri.side_effect = get_resolved_image
-
     labels = build_regenerate_bundle._adjust_operator_bundle(
         str(manifests_dir), str(metadata_dir), 1, 'company-managed'
     )
 
     assert labels == {
-        'com.redhat.iib.pinned': 'true',
         'operators.operatorframework.io.bundle.package.v1': 'amqstreams-cmp',
     }
     # Verify that the relatedImages are not modified if they were already set and that images were
@@ -1110,10 +1099,6 @@ def get_resolved_image(image):
 
     expected_calls = [
         call.mock_gpa(mock.ANY),
-        call.mock_gri(mock.ANY),
-        call.mock_gri(mock.ANY),
-        call.mock_gri(mock.ANY),
-        call.mock_gri(mock.ANY),
         call.mock_apns(mock.ANY, '-cmp'),
         call.mock_aca(mock.ANY, 'amqstreams', annotations),
         call.mock_grbi(mock.ANY, 1),
@@ -1122,6 +1107,8 @@ def get_resolved_image(image):
         call.mock_gil(mock.ANY),
     ]
     assert manager.mock_calls == expected_calls
+    mock_rips.assert_not_called()
+    mock_gri.assert_not_called()
 
 
 @mock.patch('iib.workers.tasks.build_regenerate_bundle.get_image_label')