Operator Version Lock (current)

Locked OpenShift release + operator versions for the dc-lab disconnected rebuild — channel, version, source catalog.

Locked baseline for the dc-lab disconnected rebuild. The intent is to mirror OpenShift 4.20.18 plus the operator set used (or planned) in the previous lab so implementation work does not repeatedly depend on slow public pulls. Architecture is amd64 only; the update graph is disabled in this first install mirror; operator catalog content is pinned to exact package/channel/version ranges where prior CSV evidence exists rather than entire channels.

  • OpenShift release payload: 4.20.18
  • Architecture: amd64
  • Update graph: disabled for this first install mirror
  • Active image set: plans/disconnected-rebuild/environments/dc-lab/imageset-config.yaml

Operators included in first mirror

OperatorChannelVersionSource catalogNotes
openshift-gitops-operatorlatest1.20.3redhat-operator-index:v4.20Hub GitOps bootstrap and desired-state delivery.
advanced-cluster-managementrelease-2.162.16.1redhat-operator-index:v4.20hub-dc-v6 management plane.
multicluster-enginestable-2.112.11.1redhat-operator-index:v4.20Required dep for ACM 2.16.1.
lvms-operatorstable-4.204.20.0redhat-operator-index:v4.20Compact hub VM storage.
local-storage-operatorstable4.20.0-202604140241redhat-operator-index:v4.20Local disk discovery for spoke ODF.
odf-operatorstable-4.204.20.10-rhodfredhat-operator-index:v4.20Spoke cluster storage.
redhat-oadp-operatorstable1.5.5redhat-operator-index:v4.20Backup/restore baseline.
openshift-cert-manager-operatorstable-v11.19.0redhat-operator-index:v4.20Certificate automation.
openshift-external-secrets-operatorstable-v11.1.0redhat-operator-index:v4.20Vault/secret integration baseline.
openshift-pipelines-operator-rhpipelines-1.221.22.0redhat-operator-index:v4.20Jenkins/Nexus CI smoke path + future in-cluster pipelines option.
rhacs-operatorstable4.10.2redhat-operator-index:v4.20Previous ACS central/secured-cluster baseline.
compliance-operatorstable1.9.0redhat-operator-index:v4.20Compliance baseline.
gatekeeper-operator-productstable3.21.0redhat-operator-index:v4.20Policy/OPA baseline.
container-security-operatorstable-3.163.16.3redhat-operator-index:v4.20Quay image scanning operator.
cluster-observability-operatorstable1.4.0redhat-operator-index:v4.20Observability operator.
loki-operatorstable-6.56.5.0redhat-operator-index:v4.20Logging backend.
cluster-loggingstable-6.56.5.0redhat-operator-index:v4.20Cluster logging.
tempo-productstable0.20.0-3redhat-operator-index:v4.20Tracing baseline.
opentelemetry-productstable0.144.0-3redhat-operator-index:v4.20OpenTelemetry baseline.
netobserv-operatorstable1.11.1redhat-operator-index:v4.20Network observability.
servicemeshoperator3stable-3.33.3.2redhat-operator-index:v4.20OSSM 3 ambient mesh.
kiali-ossmstable2.22.2redhat-operator-index:v4.20Service mesh UI.
quay-operatorstable-3.173.17.1redhat-operator-index:v4.20Quay registry.
cluster-kube-descheduler-operatorstable5.3.2redhat-operator-index:v4.20Kube descheduler.
file-integrity-operatorstable1.3.8redhat-operator-index:v4.20File integrity.
security-profiles-operatorrelease-alpha-rhel-80.10.0redhat-operator-index:v4.20Security profiles.
nfdstable4.20.0-202604140241redhat-operator-index:v4.20Node Feature Discovery for GPU workers.
kubevirt-hyperconvergedstable4.20.11redhat-operator-index:v4.20OpenShift Virtualization (under issue #139).
cloudnative-pgstable-v11.29.0certified-operator-index:v4.20PostgreSQL operator.
open-liberty-certifiedv1.61.6.1certified-operator-index:v4.20Open Liberty Operator.

Additional non-operator images

ImageSource
registry.redhat.io/ubi9/ubi:latestRed Hat
registry.redhat.io/ubi9/ubi-minimal:latestRed Hat
registry.access.redhat.com/ubi9/nodejs-22-minimal:latestRed Hat
icr.io/appcafe/open-liberty:25.0.0.6-kernel-slim-java17-openj9-ubi-minimalIBM (Open Liberty)

2026-05-21 live v7 installation status

This table records the live OP-GF-OPERATORS-18 read-only parity audit. It distinguishes packages that are installed in the active v7 clusters from packages that are mirrored or catalog-visible but not installed.

Packagehub-dc-v7spoke-dc-v7Status
openshift-gitops-operator1.20.3service/application present, no direct OLM SubscriptionPresent with spoke ownership caveat
advanced-cluster-management2.16.1n/aPresent on hub
multicluster-engine2.11.1n/aPresent on hub
lvms-operator4.20.0n/aPresent on hub
local-storage-operatorn/a4.20.0-202604140241Present on spoke
odf-operator and dependenciesn/a4.20.10-rhodfPresent on spoke
redhat-oadp-operator1.5.51.5.5Present
openshift-cert-manager-operator1.19.01.19.0Present
openshift-external-secrets-operator1.1.01.1.0Present
rhacs-operator4.10.24.10.2Present
compliance-operator1.9.01.9.0Present
gatekeeper-operator-product3.21.03.21.0Present, non-enforcing policy posture
loki-operator6.5.06.5.0Present
cluster-logging6.5.06.5.0Present
file-integrity-operatorabsent1.3.8Present on spoke
openshift-pipelines-operator-rhabsent1.22.0Present on spoke; Batch 1 / OP-GF-OPERATORS-21 completed
cluster-observability-operatorabsent1.4.0Present on spoke; Batch 2 / OP-GF-OPERATORS-22 completed operator-only
netobserv-operatorabsent1.11.1Present on spoke; Batch 2 / OP-GF-OPERATORS-22 completed operator-only
tempo-productabsent0.20.0-3Present on spoke; Batch 3 / OP-GF-OPERATORS-23 completed operator-only
opentelemetry-productabsent0.144.0-3Present on spoke; Batch 3 / OP-GF-OPERATORS-23 completed operator-only
servicemeshoperator3 / Service Meshabsent3.3.2Present on spoke; Batch 3 / OP-GF-OPERATORS-23 completed operator-only
kiali-ossmabsent2.22.2Present on spoke; Batch 3 / OP-GF-OPERATORS-23 completed operator-only
jaeger-productabsentabsentMissing/deferred
quay-operatorabsentabsentExternal registry path currently used
container-security-operatorabsentabsentMissing/deferred
cluster-kube-descheduler-operatorabsentabsentMissing/deferred
security-profiles-operatorabsentabsentMissing/deferred
cloudnative-pgabsentabsentMissing/deferred for app database use; ODF includes internal CNPG components
open-liberty-certifiedabsentabsentMissing/deferred app-platform operator
nfdabsentabsentDeferred
gpu-operator-certifiedabsentabsentDeferred
kubevirt-hyperconvergedabsentabsentDeferred
serverless-operatorabsentabsentDeferred
rhods-operatorabsentabsentDeferred

Historical next decision gate from the parity audit:

OP-GF-OPERATORS-19: v7 missing-operator decision and install/defer plan

2026-05-21 install/defer decision

OP-GF-OPERATORS-19 selected the next operator install batch and separated the rest of the missing list into deferred tracks.

The immediate next install candidate from OP-GF-OPERATORS-19 was reconciled by OP-GF-OPERATORS-20 into the operator batch model. The package choice is unchanged, but the execution label is now Batch 1:

PackageTargetScope
openshift-pipelines-operator-rhspoke-dc-v7 onlyBatch 1 / OP-GF-OPERATORS-21, operator-only, stop at readiness

Deferred tracks:

TrackPackagesDecision
OP-GF-OBS-01cluster-observability-operator, netobserv-operatorBatch 2 installed operator-only on spoke-dc-v7; FlowCollector, MonitoringStack, UIPlugin, Perses, ACM observability, storage, retention, and tenant telemetry operands remain deferred.
OP-GF-TRACE-MESH-01tempo-product, opentelemetry-product, servicemeshoperator3, kiali-ossmBatch 3 installed operator-only on spoke-dc-v7; TempoStack, OpenTelemetryCollector, ServiceMeshControlPlane, Istio/Sail, Kiali, Jaeger, mesh membership, telemetry pipelines, storage/retention, sample workloads, and tenant namespaces remain deferred.
OP-GF-APPPLAT-01open-liberty-certified, cloudnative-pgDefer to app-platform/golden-path work.
OP-GF-HARDENING-01cluster-kube-descheduler-operator, security-profiles-operatorDefer until workload evidence and disruption/profile ownership exist.

Replaced or removed expectations:

PackageDecision
quay-operatorReplaced by the external Quay registry architecture.
container-security-operatorRemoved from active expectation because RHACS is the current security control plane.

Out of active scope until explicitly reintroduced:

Package familyReason
nfd, gpu-operator-certifiedGPU enablement is not active scope.
rhods-operatorOpenShift AI is not active scope.
kubevirt-hyperconvergedVirtualization is not active scope.
serverless-operatorServerless workloads are not active scope.

2026-05-21 operator batch assignment

Future operator execution uses one batch per install wave. Each batch includes preflight, GitOps install, validation, rollback or promotion decision, and documentation closeout.

BatchPhasePackagesStatus
1OP-GF-OPERATORS-21openshift-pipelines-operator-rhCompleted on spoke-dc-v7 at 1.22.0; operator-only, no user workload runs or CI/CD credentials.
2OP-GF-OPERATORS-22cluster-observability-operator, netobserv-operatorCompleted on spoke-dc-v7; operator-only, no FlowCollector, MonitoringStack, UIPlugin, Perses, ACM observability, object storage, retention, or tenant telemetry operands.
3OP-GF-OPERATORS-23tempo-product, opentelemetry-product, servicemeshoperator3, kiali-ossmCompleted on spoke-dc-v7; operator-only, no TempoStack, OpenTelemetryCollector, ServiceMeshControlPlane, Istio/Sail, Kiali, Jaeger, mesh membership, telemetry pipeline, storage, retention, tenant namespace, or sample app operands.
4OP-GF-OPERATORS-24open-liberty-certified, cloudnative-pgDeferred by user decision in issue #440; not the active next operator batch.
5OP-GF-OPERATORS-25cluster-kube-descheduler-operator, security-profiles-operatorDeferred until workload evidence, disruption budgets, and profile ownership are ready.

2026-05-21 app-platform batch deferral

Issue #440 records that Batch 4 is not needed now. Open Liberty and app-facing CloudNativePG remain mirrored/catalog-visible planning items, but they are not an active install queue entry. Reintroduce them only when there is an explicit app-platform onboarding requirement with tenant ownership, backup/restore, image supply, and RHACS policy decisions.

2026-05-21 Batch 1 live outcome

OP-GF-OPERATORS-21 installed openshift-pipelines-operator-rh on spoke-dc-v7.

FieldValue
Packageopenshift-pipelines-operator-rh
Channelpipelines-1.22
CSVopenshift-pipelines-operator-rh.v1.22.0
Version1.22.0
Targetspoke-dc-v7
Sourcecs-redhat-operator-index-v4-20
GitOps commit8c41a86
OLM statusSubscription AtLatestKnown, CSV Succeeded
Operand statusTektonConfig/config Ready=True

Scope note: no user PipelineRuns, TaskRuns, TriggerBindings, TriggerTemplates, EventListeners, app namespaces, build workloads, or CI/CD credentials were created. The operator did create default operator-owned Tekton Tasks/Pipelines as add-ons.

2026-05-21 Batch 2 live outcome

OP-GF-OPERATORS-22 installed the observability foundation operators on spoke-dc-v7.

FieldCluster Observability OperatorNetObserv Operator
Packagecluster-observability-operatornetobserv-operator
Channelstablestable
CSVcluster-observability-operator.v1.4.0network-observability-operator.v1.11.1
Version1.4.01.11.1
Namespaceopenshift-cluster-observability-operatoropenshift-netobserv-operator
Targetspoke-dc-v7spoke-dc-v7
Sourcecs-redhat-operator-index-v4-20cs-redhat-operator-index-v4-20
GitOps commitdd6d1dadd6d1da
OLM statusSubscription AtLatestKnown, CSV SucceededSubscription AtLatestKnown, CSV Succeeded

Scope note: no FlowCollector, FlowMetric, MonitoringStack, UIPlugin, ObservabilityInstaller, Perses, PersesDashboard, or MultiClusterObservability resources were created. Storage, retention, flow collection, ACM observability, tenant telemetry, tracing, service mesh, and sample workload onboarding remain future decisions.

2026-05-21 Batch 3 live outcome

OP-GF-OPERATORS-23 installed the tracing and mesh foundation operators on spoke-dc-v7.

FieldTempoOpenTelemetryService Mesh 3Kiali
Packagetempo-productopentelemetry-productservicemeshoperator3kiali-ossm
Channelstablestablestable-3.3stable
CSVtempo-operator.v0.20.0-3opentelemetry-operator.v0.144.0-3servicemeshoperator3.v3.3.2kiali-operator.v2.22.2
Version0.20.0-30.144.0-33.3.22.22.2
Namespaceopenshift-tempo-operatoropenshift-opentelemetry-operatoropenshift-operatorsopenshift-operators
Targetspoke-dc-v7spoke-dc-v7spoke-dc-v7spoke-dc-v7
Sourcecs-redhat-operator-index-v4-20cs-redhat-operator-index-v4-20cs-redhat-operator-index-v4-20cs-redhat-operator-index-v4-20
GitOps commit0f08a740f08a740f08a740f08a74
OLM statusSubscription AtLatestKnown, CSV SucceededSubscription AtLatestKnown, CSV SucceededSubscription AtLatestKnown, CSV SucceededSubscription AtLatestKnown, CSV Succeeded

Scope note: no TempoStack, TempoMonolithic, OpenTelemetryCollector, OpAMPBridge, TargetAllocator, ServiceMeshControlPlane, ServiceMeshMemberRoll, ServiceMeshMember, Sail Istio, IstioRevision, ztunnel, Kiali, OSSMConsole, or Jaeger resources were created. Mesh membership, telemetry pipelines, trace storage, retention, tenant namespaces, and sample workloads remain future decisions.

Deferred operator packages

CatalogPackageChannelVersionReason
redhat-operator-index:v4.20rhods-operatorstable2.25.6Deferred to avoid large RHOAI images during ACM/GitOps build. Reintroduce only when OpenShift AI is in scope.
certified-operator-index:v4.20gpu-operator-certifiedv26.326.3.1Deferred to avoid NVIDIA GPU images during ACM/GitOps build. Reintroduce only when GPU worker enablement is in scope.

Evidence summary

  • Wiki records OpenShift 4.20.18 as the fleet baseline.
  • lab-gitops-full records package names, catalog sources, channels, and several startingCSV values.
  • Report 20260506-215619-live-focused.md records previous installed CSV versions (ACM 2.16.1, MCE 2.11.1, Open Liberty 1.6.1, ODF 4.20.9-rhodf, Pipelines 1.22.0, ESO 1.1.0, RHACS 4.10.2, Quay 3.17.1, OpenShift AI 2.25.6).
  • Expanded dry-run on 2026-05-08 produced 702 mappings.
  • 2026-05-10 ODF dependency refresh completed at 193/193 release images, 425/425 operator images, 4/4 additional images. ImageSet now pins ODF and generated dependency packages to 4.20.10-rhodf.

Last regenerated from plans/disconnected-rebuild/environments/dc-lab/operator-version-lock.md (dated 2026-05-08, refreshed 2026-05-10).

Last reviewed: 2026-05-21