Technote: FTM Operator - Manually Upgrading kube-rbac-proxy Image

10.2 Update the SHA for both instances by using the OpenShift CLI.

The ClusterServiceVersion (CSV) must be retrieved from the namespace where the IBM Financial Transaction Manager Controller operator is installed. This might be the FTM deployment namespace or another namespace selected when the controller operator was installed.

First, identify the namespace and CSV name:

oc get csv --all-namespaces | grep ibm-ftm-operator

Confirm that the result corresponds to the IBM Financial Transaction Manager Controller operator for the FTM release you want to update. Record the namespace and CSV name returned by the command.

Choose one of the following CLI methods. Do not run both.

Method A: Use placeholder values

Replace each placeholder before running the command:

oc get csv <ftm_operator_csv_name> \
  -n <operator_namespace> \
  -o json |
jq \
  --arg name "kube-rbac-proxy" \
  --arg image \
  "icr.io/cpopen/ibm-ftm/openshift4/ose-kube-rbac-proxy@sha256:<sha_value>" \
  'del(.metadata.annotations["kubectl.kubernetes.io/last-applied-configuration"])   | (.spec.relatedImages[] | select(.name == $name)).image = $image   | (.spec.install.spec.deployments[].spec.template.spec.containers[]      | select(.name == $name)).image = $image' |
oc replace -n <operator_namespace> -f -

Replace:

• <ftm_operator_csv_name> with the CSV name.
• <operator_namespace> with the namespace containing the CSV.
• <sha_value> with the SHA-256 digest provided in the support notification.

Method B: Use shell variables

Set the variables before running the update command:

CSV_NAME="ibm-ftm-operator.vX.X.X" OPERATOR_NAMESPACE="your-operator-namespace" SHA_VALUE="your-sha256-value"

KUBE_PROXY_IMAGE="icr.io/cpopen/ibm-ftm/openshift4/ose-kube-rbac-proxy@sha256:${SHA_VALUE}"

oc get csv "${CSV_NAME}" \
  -n "${OPERATOR_NAMESPACE}" \
  -o json |
jq \
  --arg name "kube-rbac-proxy" \
  --arg image "${KUBE_PROXY_IMAGE}" \
  'del(.metadata.annotations["kubectl.kubernetes.io/last-applied-configuration"])   | (.spec.relatedImages[] | select(.name == $name)).image = $image   | (.spec.install.spec.deployments[].spec.template.spec.containers[]      | select(.name == $name)).image = $image' |
oc replace -n "${OPERATOR_NAMESPACE}" -f -

For Method B:

• CSV_NAME is the CSV name returned by the discovery command.
• OPERATOR_NAMESPACE is the namespace containing the CSV.
• SHA_VALUE contains only the characters following sha256:.

11.    Verify the updated operator pod

In the Red Hat OpenShift web console, go to Workloads → Pods. Select the namespace where the FTM controller operator is installed, search for ibm-ftm-operator-controller-manager, and open the restarted pod.

On the pod details page, review the container image information and verify that the ose-kube-rbac-proxy image uses the new SHA value.

12.    Save the changes
13.    The ibm-ftm-operator-controller-manager pod will automatically restart
14.    Browse to Workloads -> Pods, search for ibm-ftm-operator-controller-manager, click on the POD, browse to the YAML tab, and verify the ose-kube-rbac-proxy image SHA