Skip to content

Instantly share code, notes, and snippets.

@dmc5179
Last active September 11, 2025 18:59
Show Gist options
  • Select an option

  • Save dmc5179/db745edd5f75ef7b0241be6d2f95e4c9 to your computer and use it in GitHub Desktop.

Select an option

Save dmc5179/db745edd5f75ef7b0241be6d2f95e4c9 to your computer and use it in GitHub Desktop.
Repair an OpenShift operator catalog container image in place when permissions are incorrect due to a bad umask setting

Steps to fix a catalog image from a bad umask

Pull down the catalog image

podman pull myregistry.com:8443/redhat/certified-operator-index:v4.18

Start up the image and get a bash shell

podman run -ti --entrypoint bash --name newcatalog myregistry.com:8443/redhat/certified-operator-index:v4.18

inside the container, fix permissions like

chmod -R 0755 /configs

Exit the container

exit

commit the new image with updated entrypoint and opm command to ignore integrity because we changed the file permissions

podman commit --change ENTRYPOINT=/bin/opm --change 'CMD ["serve", "--cache-enforce-integrity=false", "/configs", "--cache-dir=/tmp/cache"]' newcatalog myregistry.com:8443/redhat/certified-operator-index:v4.18

Push the new image into your registry.

  • Note, you could push this to another tag to preserve the old one
podman push myregistry.com:8443/redhat/certified-operator-index:v4.18

Update the catalog source to poll for new image faster. Default is 15 minutes if not specified

oc edit CatalogSource <cs-certified-operator-index>
  • add in the update interval like
  SourceType: grpc
  updateStrategy:
    registryPoll:
      interval: 1m0s

Below here is likely not needed!!!!!!

Delete the old catalog image from the cluster by deleting the yaml for it

Update the catalog yaml file to point to your new container image

  • If you push using the same tag, OCP may not pull your new image because it thinks t hat it has it already.
  • Change the catalog yaml to use the digest of the image instead of tag unless you us e a different tag
  • To get the digest, go into the quay web console and find the image and then tag
  • Quay has a button "pull this image by digest with podman"
  • Take that image and digest, put it into your catalog yaml file, then oc create that into the cluster.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment