ROX-35435: Support differing versions of Central and SecuredCluster

cmd/deploy.go

@@ -135,6 +135,20 @@ this flag can be used to tell roxie how to pre-load images for the current clust
 		}),
 	)
 
+	registerFlag(cmd, settings, "central-tag", "Image tag for Central (overrides --tag for Central)",
+		withApplyFn("version", func(config *deployer.Config, tag string) error {
+			config.Central.Version = tag
+			return nil
+		}),
+	)
+
+	registerFlag(cmd, settings, "secured-cluster-tag", "Image tag for SecuredCluster (overrides --tag for SecuredCluster)",
+		withApplyFn("version", func(config *deployer.Config, tag string) error {
+			config.SecuredCluster.Version = tag
+			return nil
+		}),
+	)
+
 	registerFlag(cmd, settings, "operator-env", "Operator environment variables (e.g., RELATED_IMAGE_MAIN=quay.io/...)",
 		withApplyFn("env-var", func(config *deployer.Config, envExpr string) error {
 			key, value, err := deployer.ParseOperatorEnvVar(envExpr)
@@ -251,12 +265,22 @@ func runDeploy(cmd *cobra.Command, args []string) error {
 		// storing of the derived operator version within the operator configuration.
 		//
 		// This is why we use the operator version here when checking version constraints.
-		hasSupport, err := stackroxversions.SupportsAdditionalPrinterColumns(deploySettings.Operator.Version)
-		if err != nil {
-			return fmt.Errorf("checking version constraint on main image tag %s: %w", deploySettings.Roxie.Version, err)
+		// With mixed versions, check every operator instance that will be deployed.
+		versionsToCheck := []string{deploySettings.Operator.Version}
+		if deploySettings.HasMixedVersions() {
+			versionsToCheck = nil
+			for _, instance := range deploySettings.OperatorInstances() {
+				versionsToCheck = append(versionsToCheck, instance.Version)
+			}
 		}
-		if !hasSupport {
-			return fmt.Errorf("--early-readiness=false can only be used for StackRox versions satisfying %s", stackroxversions.SupportsAdditionalPrinterColumnsConstraint.String())
+		for _, opVersion := range versionsToCheck {
+			hasSupport, err := stackroxversions.SupportsAdditionalPrinterColumns(opVersion)
+			if err != nil {
+				return fmt.Errorf("checking version constraint on operator version %s: %w", opVersion, err)
+			}
+			if !hasSupport {
+				return fmt.Errorf("--early-readiness=false can only be used for StackRox versions satisfying %s", stackroxversions.SupportsAdditionalPrinterColumnsConstraint.String())
+			}
 		}
 	}
 
@@ -390,7 +414,10 @@ func configureConfig(log *logger.Logger, components component.Component, deployS
 		return fmt.Errorf("configuring operator configuration: %w", err)
 	}
 
-	if deploySettings.Roxie.KonfluxImagesEnabled() {
+	// For the single-operator path (including OLM), populate RELATED_IMAGE_* on the
+	// top-level OperatorConfig. Mixed-version deployments apply Konflux env vars
+	// per OperatorInstance during deployment instead.
+	if deploySettings.Roxie.KonfluxImagesEnabled() && !deploySettings.HasMixedVersions() {
 		deployer.PopulateKonfluxEnvVars(deploySettings)
 	}
 
@@ -458,5 +485,21 @@ func deployValidate(components component.Component, deploySettings *deployer.Con
 		}
 	}
 
+	if deploySettings.HasMixedVersions() {
+		if components.IncludesOperatorExplicitly() {
+			return errors.New("mixed versions (--central-tag / --secured-cluster-tag / central.version / securedCluster.version) are not supported with operator-only deploy")
+		}
+		if deploySettings.Operator.DeployViaOlmEnabled() {
+			return errors.New("mixed versions (--central-tag / --secured-cluster-tag / central.version / securedCluster.version) are not supported with OLM deployment mode")
+		}
+	}
+
+	if deploySettings.Central.Version != "" && deploySettings.SecuredCluster.Version != "" &&
+		deploySettings.Central.Version == deploySettings.SecuredCluster.Version &&
+		deploySettings.Central.Version != deploySettings.Roxie.Version {
+		return fmt.Errorf("both --central-tag and --secured-cluster-tag are set to %s which differs from --tag %s; use --tag %s instead",
+			deploySettings.Central.Version, deploySettings.Roxie.Version, deploySettings.Central.Version)
+	}
+
 	return nil
 }

internal/deployer/acs_images.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 
 	"github.com/stackrox/roxie/internal/constants"
+	"github.com/stackrox/roxie/internal/helpers"
 )
 
 func imagesForConfig(config Config) []string {
@@ -14,23 +15,65 @@ func imagesForConfig(config Config) []string {
 	}
 
 	imageRegistry := constants.DefaultRegistry
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "main", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "central-db", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4-db", config.Roxie.Version))
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4", config.Roxie.Version))
+	seen := make(map[string]bool)
+	add := func(image string) {
+		if seen[image] {
+			return
+		}
+		seen[image] = true
+		images = append(images, image)
+	}
+
+	for _, mainTag := range uniqueMainVersions(config) {
+		add(fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "main", mainTag))
+		add(fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "central-db", mainTag))
+		add(fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4-db", mainTag))
+		add(fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "scanner-v4", mainTag))
+	}
+
+	operatorPrefix := prefix
 	if !config.Roxie.KonfluxImagesEnabled() {
-		prefix = "stackrox-"
+		operatorPrefix = "stackrox-"
+	}
+	for _, instance := range config.OperatorInstances() {
+		add(fmt.Sprintf("%s/%s%s:%s", imageRegistry, operatorPrefix, "operator", instance.Version))
+		add(OperatorBundleImageForVersion(instance.Version, config.Roxie.KonfluxImagesEnabled()))
 	}
-	images = append(images, fmt.Sprintf("%s/%s%s:%s", imageRegistry, prefix, "operator", config.Operator.Version))
-	images = append(images, OperatorBundleImage(config))
 
 	return images
 }
 
+func uniqueMainVersions(config Config) []string {
+	versions := []string{config.EffectiveCentralVersion(), config.EffectiveSecuredClusterVersion()}
+	seen := make(map[string]bool)
+	var unique []string
+	for _, v := range versions {
+		if v == "" || seen[v] {
+			continue
+		}
+		seen[v] = true
+		unique = append(unique, v)
+	}
+	if len(unique) == 0 && config.Roxie.Version != "" {
+		unique = append(unique, config.Roxie.Version)
+	}
+	return unique
+}
+
+// OperatorBundleImage returns the operator bundle image for the top-level operator version.
 func OperatorBundleImage(config Config) string {
+	version := config.Operator.Version
+	if version == "" {
+		version = helpers.ConvertMainTagToOperatorTag(config.Roxie.Version)
+	}
+	return OperatorBundleImageForVersion(version, config.Roxie.KonfluxImagesEnabled())
+}
+
+// OperatorBundleImageForVersion returns the operator bundle image for a specific operator version.
+func OperatorBundleImageForVersion(operatorVersion string, konflux bool) string {
 	imageRegistry := constants.DefaultRegistry
-	if config.Roxie.KonfluxImagesEnabled() {
-		return fmt.Sprintf("%s/release-operator-bundle:v%s", imageRegistry, config.Operator.Version)
+	if konflux {
+		return fmt.Sprintf("%s/release-operator-bundle:v%s", imageRegistry, operatorVersion)
 	}
-	return fmt.Sprintf("%s/stackrox-operator-bundle:v%s", imageRegistry, config.Operator.Version)
+	return fmt.Sprintf("%s/stackrox-operator-bundle:v%s", imageRegistry, operatorVersion)
 }

internal/deployer/config.go

@@ -115,6 +115,8 @@ type WaitConfig struct {
 
 // CentralConfig holds deployment settings for the Central component.
 type CentralConfig struct {
+	// Version overrides Roxie.Version for Central (and its operator when versions differ).
+	Version             string                 `yaml:"version,omitempty"`
 	Namespace           string                 `yaml:"namespace,omitempty"`
 	ResourceProfile     types.ResourceProfile  `yaml:"resourceProfile,omitempty"`
 	PauseReconciliation *bool                  `yaml:"pauseReconciliation,omitempty"`
@@ -262,6 +264,8 @@ func (c *CentralConfig) CustomResource() (map[string]interface{}, error) {
 
 // SecuredClusterConfig holds deployment settings for the SecuredCluster component.
 type SecuredClusterConfig struct {
+	// Version overrides Roxie.Version for SecuredCluster (and its operator when versions differ).
+	Version             string                 `yaml:"version,omitempty"`
 	Namespace           string                 `yaml:"namespace,omitempty"`
 	ResourceProfile     types.ResourceProfile  `yaml:"resourceProfile,omitempty"`
 	PauseReconciliation *bool                  `yaml:"pauseReconciliation,omitempty"`