Skip to content

Instantly share code, notes, and snippets.

@dmc5179
Last active August 28, 2025 16:14
Show Gist options
  • Save dmc5179/db745edd5f75ef7b0241be6d2f95e4c9 to your computer and use it in GitHub Desktop.
Save dmc5179/db745edd5f75ef7b0241be6d2f95e4c9 to your computer and use it in GitHub Desktop.
Repair an OpenShift operator catalog container image in place when permissions are incorrect due to a bad umask setting

Steps to fix a catalog image from a bad umask

Pull down the catalog image

podman pull myregistry.com:8443/redhat/certified-operator-index:v4.18

Start up the image and get a bash shell

podman run -ti --entrypoint bash --name newcatalog registry.redhat.io/redhat/certified-operator-index:v4.18

inside the container, fix permissions like

chmod -R 0755 /configs

Exit the container

exit

commit the new image with updated entrypoint and opm command to ignore integrity because we changed the file permissions

podman commit --change ENTRYPOINT=/bin/opm --change 'CMD ["serve", "--cache-enforce-integrity=false", "/configs", "--cache-dir=/tmp/cache"]' newcatalog myregistry.com:8443/redhat/certified-operator-index:v4.18

Push the new image into your registry.

  • Note, you could push this to another tag to preserve the old one
podman push myregistry.com:8443/redhat/certified-operator-index:v4.18

Delete the old catalog image from the cluster by deleting the yaml for it

Update the catalog yaml file to point to your new container image

  • If you push using the same tag, OCP may not pull your new image because it thinks t hat it has it already.
  • Change the catalog yaml to use the digest of the image instead of tag unless you us e a different tag
  • To get the digest, go into the quay web console and find the image and then tag
  • Quay has a button "pull this image by digest with podman"
  • Take that image and digest, put it into your catalog yaml file, then oc create that into the cluster.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment