ExploitIQ Operator FBC

File-Based Catalog (FBC) for the ExploitIQ Operator.

Structure

v4.19/                          # OCP version directory
├── catalog.Dockerfile          # FBC image build
├── graph.yaml                  # OLM template (channels, bundles)
├── licenses/license.txt        # Apache 2.0
└── catalog/exploit-iq-operator/
    └── catalog.json            # Rendered FBC (generated — do not edit)

Updating the Bundle

Two workflows exist depending on whether you are releasing a new operator version or re-releasing an existing version with a new build.

Identifying the Correct Release Object

Both workflows require a Konflux Release object name. Use the release whose Component column in the Konflux UI shows operator-bundle-*, not operator-*. If you specify a release that contains only the operator image, the script exits with an error.

To list bundle releases sorted by creation time, run the following command:

oc get release -n exploit-intelligence-tenant \
  -l appstudio.openshift.io/component=operator-bundle-0-0-3 \
  --sort-by=.metadata.creationTimestamp \
  -o custom-columns='TIME:.metadata.creationTimestamp,NAME:.metadata.name'

Updating the SHA of an Existing Version

Use this workflow when the operator version already exists in graph.yaml but a new build was released (for example, a re-release to stage). The script auto-detects the version from the release artifacts.

python3 update-fbc.py \
  --release <release-name> \
  --stage          # or --prod for production
  --update-existing
./generate-fbc.sh --render-all

Adding a New Operator Version

Use this workflow when the operator version does not yet exist in graph.yaml.

python3 update-fbc.py \
  --release <release-name> \
  --new-version 0.0.4 \
  --stage          # or --prod for production
./generate-fbc.sh --render-all

For a quick manual SHA replacement across all files, use replace.sh instead:

./replace.sh sha256:<old-digest> sha256:<new-digest>
./generate-fbc.sh --render-all

Common Options

• --dry-run — preview changes without writing files.
• --ocp v4.<version> — update a single OCP version only instead of all versions.

Rendering and Validating the Catalog

After updating graph.yaml, render and validate the catalog:

./generate-fbc.sh --render v4.19      # render + validate one OCP version
./generate-fbc.sh --render-all        # render + validate all OCP versions
./generate-fbc.sh --validate v4.19    # validate only
./generate-fbc.sh --validate-all

Adding a New OCP Version

To add support for a new OCP minor version, copy an existing version directory and update the Dockerfile reference:

NEW=22  # new OCP minor version
cp -r v4.19 v4.${NEW}
sed -i "s|:v4\.[0-9]*|:v4.${NEW}|" v4.${NEW}/catalog.Dockerfile
./generate-fbc.sh --render v4.${NEW}

This creates v4.${NEW}/ with the same structure as v4.19/ and renders the catalog for the new version.