Installation Manual - 93 Disconnected catalog hygiene

Disable default external operator catalogs and pin greenfield v7 operator resolution to mirrored sources.

This chapter records the OP-GF-OPERATORS-02 catalog hygiene gate for the greenfield v7 clusters.

The gate changed catalog desired state through GitOps. It did not install a new operator.

Governance

Intent

The previous readiness gate found that future operators could still resolve through default external catalog names. This gate made catalog resolution mirror-only and deterministic before starting Gatekeeper planning.

Access Path

Live checks and GitOps refreshes used:

local workspace -> dl385-2 -> gf-ocp-bootstrap-01 -> v7 kubeconfigs

Kubeconfigs on gf-ocp-bootstrap-01:

/home/ze/ocp-greenfield-deployment/artifacts/openshift/hub-dc-v7/auth/kubeconfig
/home/ze/ocp-greenfield-deployment/artifacts/openshift/spoke-dc-v7/auth/kubeconfig

GitOps Commits

Platform GitOps commits:

495d41a Harden v7 operator catalog sources
b384be3 Allow spoke Argo to manage ClusterCatalogs
11e76f4 Order catalog sync after spoke RBAC

Final live Argo revision:

11e76f466ddcccee78e6ea59f06c55ad775b3c25

Desired-state Changes

Both clusters now declare:

apiVersion: config.openshift.io/v1
kind: OperatorHub
metadata:
  name: cluster
spec:
  disableAllDefaultSources: true

Both clusters set the built-in external OLM v1 catalogs to unavailable:

openshift-redhat-operators
openshift-certified-operators
openshift-redhat-marketplace
openshift-community-operators

Spoke was aligned with hub by adding:

cs-redhat-operator-index-v4-20
cs-certified-operator-index-v4-20
cc-redhat-operator-index-v4-20
cc-certified-operator-index-v4-20

The spoke GitOps controller also received a narrow permission extension for olm.operatorframework.io/clustercatalogs, and catalog resources were moved to Argo sync wave 1 so RBAC lands before catalog reconciliation.

Validation

Render and dry-run validation passed:

oc kustomize clusters/hub-dc-v7
oc kustomize clusters/spoke-dc-v7
oc apply --dry-run=server

The server-side dry-runs reported existing last-applied-configuration warnings for already-live resources. The new catalog and RBAC resources validated.

Argo State

Final Argo state:

All three were at:

11e76f466ddcccee78e6ea59f06c55ad775b3c25

Final Catalog State

Both clusters report default sources disabled:

certified-operators disabled=true
community-operators disabled=true
redhat-marketplace disabled=true
redhat-operators disabled=true

Only mirrored classic CatalogSources remained in the checked set:

OLM v1 catalog state:

Health

Cluster health stayed steady after reconciliation:

OADP, External Secrets stores, RHACS, logging/Loki, and spoke ODF/Ceph/NooBaa remained healthy.

Package-source Check

The checked candidate packages now resolve to the mirrored Red Hat classic source on both clusters:

cs-redhat-operator-index-v4-20/openshift-marketplace

Checked packages:

gatekeeper-operator-product
netobserv-operator
tempo-product
opentelemetry-product
openshift-pipelines-operator-rh
cluster-kube-descheduler-operator
quay-operator
rhods-operator

Result

Catalog hygiene is complete for the current phase.

The next gate is:

OP-GF-OPERATORS-03: Gatekeeper preflight and dry-run-only install design

Do not install Gatekeeper directly without that preflight. Gatekeeper affects admission, so the next step should validate channels, dependencies, dry-run manifests, and rollback posture first.