medik8s: centralize workload image and mirror for disconnected

ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-disconnected.yaml

@@ -45,6 +45,7 @@ tests:
       cli: latest
       commands: |
         [[ -f "${SHARED_DIR}/proxy-conf.sh" ]] && source "${SHARED_DIR}/proxy-conf.sh"
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
         make run-tests
       env:
       - name: ECO_TEST_FEATURES
@@ -83,6 +84,7 @@ tests:
       cli: latest
       commands: |
         [[ -f "${SHARED_DIR}/proxy-conf.sh" ]] && source "${SHARED_DIR}/proxy-conf.sh"
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
         make run-tests
       env:
       - name: ECO_TEST_FEATURES

ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml

@@ -38,7 +38,9 @@ tests:
     - ref: medik8s-aws-credentials
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -64,7 +66,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -90,7 +94,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -116,7 +122,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -147,7 +155,9 @@ tests:
     - ref: odf-apply-storage-cluster
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -183,7 +193,9 @@ tests:
     - ref: storage-conf-wait-for-csi-driver
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -209,7 +221,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -242,7 +256,9 @@ tests:
     - ref: medik8s-aws-credentials
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_ENABLE_REPORT
       - name: ECO_TC_PREFIX
@@ -281,7 +297,9 @@ tests:
     - ref: odf-apply-storage-cluster
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TC_PREFIX
       - name: ECO_TEST_FEATURES
@@ -308,7 +326,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -333,7 +353,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -365,15 +387,16 @@ tests:
     - ref: storage-destroy-csi-aws-efs-sts-operator-role
     - chain: ipi-aws-post
     test:
-    - ref: medik8s-catalogsource
-    - ref: medik8s-operator-subscribe
+    - chain: medik8s-setup
     - ref: storage-create-csi-aws-efs-sts-operator-role
     - ref: storage-subscribe-aws-efs-csi-driver
     - ref: storage-create-csi-aws-efs
     - ref: storage-conf-wait-for-csi-driver
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TC_PREFIX
       - name: ECO_TEST_FEATURES
@@ -400,7 +423,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src
@@ -425,7 +450,9 @@ tests:
     - chain: medik8s-setup
     - as: e2e-test
       cli: latest
-      commands: make run-tests
+      commands: |
+        [[ -f "${SHARED_DIR}/workload_image" ]] && export WORKLOAD_IMAGE=$(cat "${SHARED_DIR}/workload_image")
+        make run-tests
       env:
       - name: ECO_TEST_FEATURES
       from: src

ci-operator/step-registry/medik8s/disconnected-catalogsource/medik8s-disconnected-catalogsource-commands.sh

@@ -14,6 +14,12 @@ declare GIT_REF="${GIT_REF:-main}"
 declare FBC_COMMIT_SHA="${FBC_COMMIT_SHA:-}"
 # shellcheck disable=SC2034 # used by medik8s-lib.sh verify_fbc_image()
 declare FBC_SHA_PINNED="${FBC_COMMIT_SHA:+true}"
+if [[ ! -s "${SHARED_DIR}/workload_image" ]]; then
+    echo "ERROR: workload_image not found in SHARED_DIR." >&2
+    echo "Include the medik8s-lib ref before this step." >&2
+    exit 1
+fi
+WORKLOAD_IMAGE=$(sed 's/:[^/]*$//' "${SHARED_DIR}/workload_image")
 declare MEDIK8S_PACKAGES="${MEDIK8S_PACKAGES:-fence-agents-remediation,storage-based-remediation,self-node-remediation,node-healthcheck-operator,node-maintenance-operator,machine-deletion-remediation}"
 
 collect_artifacts() {
@@ -133,6 +139,8 @@ mirror_catalog_and_operators() {
 apiVersion: mirror.openshift.io/v2alpha1
 kind: ImageSetConfiguration
 mirror:
+  additionalImages:
+  - name: ${WORKLOAD_IMAGE}:latest
   operators:
   - catalog: ${fbc_image}
     packages:
@@ -181,8 +189,8 @@ EOF
     log "Mirroring complete"
 }
 
-create_idms_disconnected() {
-    log "Creating IDMS for disconnected environment..."
+create_mirror_sets_disconnected() {
+    log "Creating image mirror sets for disconnected environment..."
 
     local idms_file="${TMP_DIR}/idms-source.yaml"
     if [[ ! -f "$idms_file" ]]; then
@@ -219,6 +227,25 @@ create_idms_disconnected() {
         exit 1
     fi
 
+    # Apply ITMS for test workload image (ubi-minimal). The test suite uses
+    # registry.access.redhat.com/ubi9/ubi-minimal as a lightweight workload pod
+    # for eviction verification. On disconnected clusters this registry is
+    # unreachable, so we mirror it (via additionalImages above) and create an
+    # ITMS to redirect pulls to the bastion mirror.
+    # Pattern from kueue-operator/disconnected/install (lines 140-155).
+    log "Applying ITMS for test workload image..."
+    oc apply -f - <<ITMS_EOF
+apiVersion: config.openshift.io/v1
+kind: ImageTagMirrorSet
+metadata:
+  name: medik8s-workload-image
+spec:
+  imageTagMirrors:
+  - mirrors:
+    - ${MIRROR_REGISTRY_HOST}/${WORKLOAD_IMAGE#*/}
+    source: ${WORKLOAD_IMAGE}
+ITMS_EOF
+
     # Resume MCPs — single consolidated rollout with only the correct IDMS.
     log "Resuming MCPs to trigger MCO rollout..."
     for mcp in master worker; do
@@ -303,7 +330,7 @@ main() {
     configure_host_pull_secret
     install_oc_mirror
     mirror_catalog_and_operators
-    create_idms_disconnected
+    create_mirror_sets_disconnected
     ensure_marketplace
     create_catalogsource
     # shellcheck disable=SC2034 # used by medik8s-lib.sh wait_for_catalogsource()

ci-operator/step-registry/medik8s/lib/medik8s-lib-commands.sh

@@ -214,4 +214,9 @@ wait_for_catalogsource() {
 }
 MEDIK8S_LIB_EOF
 
+# Single source of truth for the workload image used by all medik8s E2E
+# destructive tests (connected, disconnected, upgrade). Change HERE to
+# update the image for all environments in one place.
+echo "registry.access.redhat.com/ubi9/ubi-minimal:latest" > "${SHARED_DIR}/workload_image"
+
 echo "medik8s-lib.sh written to ${SHARED_DIR}"