CLOUDP-366183: Bump Ops Manager Container Image version to 7.0.21 and fix image usage

.evergreen-snippets.yml

@@ -54,6 +54,11 @@ variables:
         variant: init_test_run
       - name: build_agent_images_ubi
         variant: init_test_run
+      # Wait for OM images to be published to quay.io on commit builds (staging).
+      # On patch builds, this dependency is skipped (task doesn't exist).
+      - name: release_om_and_agents
+        variant: release_om_and_agents
+        patch_optional: true
 
 functions:
   upload_code_snippets_logs:

.evergreen.yml

@@ -13,7 +13,7 @@ include:
 variables:
   - &ops_manager_60_latest 6.0.27 # The order/index is important, since these are anchors. Please do not change
 
-  - &ops_manager_70_latest 7.0.20 # The order/index is important, since these are anchors. Please do not change
+  - &ops_manager_70_latest 7.0.21 # The order/index is important, since these are anchors. Please do not change
 
   - &ops_manager_80_latest 8.0.18 # The order/index is important, since these are anchors. Please do not change
 
@@ -146,6 +146,11 @@ variables:
         variant: init_test_run
       - name: publish_helm_chart
         variant: init_test_run
+      # Wait for OM images to be published to quay.io on commit builds (staging).
+      # On patch builds, this dependency is skipped (task doesn't exist).
+      - name: release_om_and_agents
+        variant: release_om_and_agents
+        patch_optional: true
 
   - &base_om7_dependency_with_race
     depends_on:
@@ -185,6 +190,11 @@ variables:
         variant: init_test_run
       - name: publish_helm_chart
         variant: init_test_run
+      # Wait for OM images to be published to quay.io on commit builds (staging).
+      # On patch builds, this dependency is skipped (task doesn't exist).
+      - name: release_om_and_agents
+        variant: release_om_and_agents
+        patch_optional: true
 
 parameters:
   - key: evergreen_retry

config/manager/manager.yaml

@@ -142,6 +142,8 @@ spec:
               value: "quay.io/mongodb/mongodb-agent:107.0.19.8805-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_107_0_20_8807_1
               value: "quay.io/mongodb/mongodb-agent:107.0.20.8807-1"
+            - name: RELATED_IMAGE_AGENT_IMAGE_107_0_21_8817_1
+              value: "quay.io/mongodb/mongodb-agent:107.0.21.8817-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_108_0_1_8718_1
               value: "quay.io/mongodb/mongodb-agent:108.0.1.8718-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_108_0_11_8830_1
@@ -192,6 +194,8 @@ spec:
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.19"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_7_0_20
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.20"
+            - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_7_0_21
+              value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.21"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_8_0_0
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:8.0.0"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_8_0_1

docker/mongodb-kubernetes-tests/tests/conftest.py

@@ -961,6 +961,25 @@ def install_official_operator(
         "operator.mdbDefaultArchitecture": operator_installation_config["operator.mdbDefaultArchitecture"],
     }
 
+    # For upgrade tests in patch builds, we need to use ECR registries for workload images
+    # (OpsManager, Agent, etc.) since new versions may not be released to quay.io yet.
+    # The operator itself still comes from the official helm chart, but resources it creates
+    # should use the dev registries where unreleased images are available.
+    # For staging/release builds, images are already published to quay.io, so we use quay.io
+    # to verify the actual public release path.
+    build_scenario = operator_installation_config.get("buildScenario", "")
+    if build_scenario == "patch":
+        logger.debug("Patch build detected: using ECR registries for workload images in upgrade tests")
+        # Override OM registry for ALL operators (including legacy) - OM version tags are standard (e.g., 7.0.21)
+        if "registry.opsManager" in operator_installation_config:
+            helm_args["registry.opsManager"] = operator_installation_config["registry.opsManager"]
+
+        # Only override Agent registry for current operator (not legacy) because legacy operators
+        # use different agent tag formats (e.g., 13.21.0.9059-1_1.27.0) that don't exist in ECR.
+        # Init images are already released to quay.io and don't need ECR override.
+        if custom_operator_version is None and "registry.agent" in operator_installation_config:
+            helm_args["registry.agent"] = operator_installation_config["registry.agent"]
+
     # Note, that we don't intend to install the official Operator to standalone clusters (kops/openshift) as we want to
     # avoid damaged CRDs. But we may need to install the "openshift like" environment to Kind instead of the "ubi"
     # images are used for installing the dev Operator
@@ -1008,9 +1027,9 @@ def install_official_operator(
                 "multiCluster.clusters": operator_installation_config["multiCluster.clusters"],
             }
         )
-        # The "official" Operator will be installed, from the Helm Repo ("mongodb/enterprise-operator")
-        # We pass helm_args as operator installation config below instead of the full configmap data, otherwise
-        # it overwrites registries and image versions, and we wouldn't use the official images but the dev ones
+        # The "official" Operator will be installed from the Helm Repo ("mongodb/enterprise-operator")
+        # but workload images (OpsManager, Agent, etc.) will use dev registries from operator_installation_config
+        # to support testing unreleased versions in patch builds.
         return _install_multi_cluster_operator(
             namespace,
             helm_args,

docker/mongodb-kubernetes-tests/tests/olm/olm_meko_operator_upgrade_with_resources.py

@@ -20,6 +20,7 @@
     get_current_operator_version,
     get_latest_released_operator_version,
     get_operator_group_resource,
+    get_registry_env_vars_for_subscription,
     get_subscription_custom_object,
     increment_patch_version,
     wait_for_operator_ready,
@@ -60,11 +61,21 @@ def catalog_source(namespace: str, version_id: str):
 
 
 @fixture
-def meko_subscription(namespace: str, catalog_source: CustomObject):
+def meko_subscription(namespace: str, catalog_source: CustomObject, operator_installation_config: dict[str, str]):
     """
     Create subscription for the MEKO operator.
     """
     static_value = get_default_architecture()
+    base_env_vars = [
+        {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
+        {"name": "OPERATOR_ENV", "value": "dev"},
+        {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
+        {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
+    ]
+    # Add registry env vars for patch builds (ECR registries for unreleased images)
+    registry_env_vars = get_registry_env_vars_for_subscription(operator_installation_config)
+    all_env_vars = base_env_vars + registry_env_vars
+
     return get_subscription_custom_object(
         LEGACY_OPERATOR_NAME,
         namespace,
@@ -77,23 +88,30 @@ def meko_subscription(namespace: str, catalog_source: CustomObject):
             # In certified OpenShift bundles we have this enabled, so the operator is not defining security context (it's managed globally by OpenShift).
             # In Kind this will result in empty security contexts and problems deployments with filesystem permissions.
             "config": {
-                "env": [
-                    {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
-                    {"name": "OPERATOR_ENV", "value": "dev"},
-                    {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
-                    {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
-                ]
+                "env": all_env_vars
             },
         },
     )
 
 
-def get_mck_subscription_object(namespace: str, catalog_source: CustomObject):
+def get_mck_subscription_object(
+    namespace: str, catalog_source: CustomObject, operator_installation_config: dict[str, str]
+):
     """
     Create a subscription object for the MCK operator.
     This is a separate function (not a fixture) so it can be called after uninstalling MEKO.
     """
     static_value = get_default_architecture()
+    base_env_vars = [
+        {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
+        {"name": "OPERATOR_ENV", "value": "dev"},
+        {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
+        {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
+    ]
+    # Add registry env vars for patch builds (ECR registries for unreleased images)
+    registry_env_vars = get_registry_env_vars_for_subscription(operator_installation_config)
+    all_env_vars = base_env_vars + registry_env_vars
+
     return get_subscription_custom_object(
         OPERATOR_NAME,
         namespace,
@@ -104,12 +122,7 @@ def get_mck_subscription_object(namespace: str, catalog_source: CustomObject):
             "sourceNamespace": namespace,
             "installPlanApproval": "Automatic",
             "config": {
-                "env": [
-                    {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
-                    {"name": "OPERATOR_ENV", "value": "dev"},
-                    {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
-                    {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
-                ]
+                "env": all_env_vars
             },
         },
     )
@@ -464,12 +477,13 @@ def test_connectivity_after_meko_uninstall(
 def test_install_mck_operator(
     namespace: str,
     catalog_source: CustomObject,
+    operator_installation_config: dict[str, str],
 ):
     current_operator_version = get_current_operator_version()
     incremented_operator_version = increment_patch_version(current_operator_version)
 
     # Create MCK subscription
-    mck_subscription = get_mck_subscription_object(namespace, catalog_source)
+    mck_subscription = get_mck_subscription_object(namespace, catalog_source, operator_installation_config)
     mck_subscription.update()
 
     wait_for_operator_ready(namespace, OPERATOR_NAME, f"mongodb-kubernetes.v{incremented_operator_version}")

docker/mongodb-kubernetes-tests/tests/olm/olm_operator_upgrade_with_resources.py

@@ -19,6 +19,7 @@
     get_current_operator_version,
     get_latest_released_operator_version,
     get_operator_group_resource,
+    get_registry_env_vars_for_subscription,
     get_subscription_custom_object,
     increment_patch_version,
     wait_for_operator_ready,
@@ -54,8 +55,18 @@ def catalog_source(namespace: str, version_id: str):
 
 
 @fixture
-def subscription(namespace: str, catalog_source: CustomObject):
+def subscription(namespace: str, catalog_source: CustomObject, operator_installation_config: dict[str, str]):
     static_value = get_default_architecture()
+    base_env_vars = [
+        {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
+        {"name": "OPERATOR_ENV", "value": "dev"},
+        {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
+        {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
+    ]
+    # Add registry env vars for patch builds (ECR registries for unreleased images)
+    registry_env_vars = get_registry_env_vars_for_subscription(operator_installation_config)
+    all_env_vars = base_env_vars + registry_env_vars
+
     return get_subscription_custom_object(
         OPERATOR_NAME,
         namespace,
@@ -68,12 +79,7 @@ def subscription(namespace: str, catalog_source: CustomObject):
             # In certified OpenShift bundles we have this enabled, so the operator is not defining security context (it's managed globally by OpenShift).
             # In Kind this will result in empty security contexts and problems deployments with filesystem permissions.
             "config": {
-                "env": [
-                    {"name": "MANAGED_SECURITY_CONTEXT", "value": "false"},
-                    {"name": "OPERATOR_ENV", "value": "dev"},
-                    {"name": "MDB_DEFAULT_ARCHITECTURE", "value": static_value},
-                    {"name": "MDB_OPERATOR_TELEMETRY_SEND_ENABLED", "value": "false"},
-                ]
+                "env": all_env_vars
             },
         },
     )

docker/mongodb-kubernetes-tests/tests/olm/olm_test_commons.py

@@ -3,7 +3,7 @@
 import re
 import tempfile
 import time
-from typing import Callable
+from typing import Callable, List, Dict
 
 import kubetester
 import pytest
@@ -182,3 +182,38 @@ def wait_for_operator_ready_fn():
         timeout=120,
         msg=f"operator ready and with {expected_operator_version} version",
     )
+
+
+def get_registry_env_vars_for_subscription(operator_installation_config: Dict[str, str]) -> List[Dict[str, str]]:
+    """
+    Returns registry env vars to add to OLM subscription config for patch builds.
+
+    For upgrade tests in patch builds, we need to use ECR registries for workload images
+    (OpsManager) since new versions may not be released to quay.io yet.
+    For staging/release builds, images are already published to quay.io, so we use quay.io
+    to verify the actual public release path.
+
+    Note: We only pass OM registry (not agent) for OLM subscriptions because:
+    1. The stable/released operators may use different agent tag formats that don't exist in ECR
+    2. OLM subscription env vars persist across channel upgrades, so we can't differentiate
+       between released and dev operators
+
+    This function returns the env vars in the format expected by OLM subscription config:
+    [{"name": "ENV_VAR_NAME", "value": "value"}, ...]
+    """
+    build_scenario = operator_installation_config.get("buildScenario", "")
+
+    if build_scenario != "patch":
+        return []
+
+    env_vars = []
+
+    # Only override OM registry - OM version tags are standard (e.g., 7.0.21)
+    # Agent registry is not overridden because released operators may use different tag formats
+    if "registry.opsManager" in operator_installation_config:
+        # Get the opsManager.name value for building the full repository path
+        ops_manager_name = operator_installation_config.get("opsManager.name", "mongodb-enterprise-ops-manager-ubi")
+        registry = operator_installation_config["registry.opsManager"]
+        env_vars.append({"name": "OPS_MANAGER_IMAGE_REPOSITORY", "value": f"{registry}/{ops_manager_name}"})
+
+    return env_vars

helm_chart/values-openshift.yaml

@@ -41,6 +41,7 @@ relatedImages:
   - 7.0.18
   - 7.0.19
   - 7.0.20
+  - 7.0.21
   - 8.0.0
   - 8.0.1
   - 8.0.2
@@ -115,6 +116,7 @@ relatedImages:
   - 107.0.18.8784-1
   - 107.0.19.8805-1
   - 107.0.20.8807-1
+  - 107.0.21.8817-1
   - 108.0.1.8718-1
   - 108.0.11.8830-1
   - 108.0.12.8846-1

public/mongodb-kubernetes-openshift.yaml

@@ -446,6 +446,8 @@ spec:
               value: "quay.io/mongodb/mongodb-agent:107.0.19.8805-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_107_0_20_8807_1
               value: "quay.io/mongodb/mongodb-agent:107.0.20.8807-1"
+            - name: RELATED_IMAGE_AGENT_IMAGE_107_0_21_8817_1
+              value: "quay.io/mongodb/mongodb-agent:107.0.21.8817-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_108_0_1_8718_1
               value: "quay.io/mongodb/mongodb-agent:108.0.1.8718-1"
             - name: RELATED_IMAGE_AGENT_IMAGE_108_0_11_8830_1
@@ -496,6 +498,8 @@ spec:
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.19"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_7_0_20
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.20"
+            - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_7_0_21
+              value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:7.0.21"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_8_0_0
               value: "quay.io/mongodb/mongodb-enterprise-ops-manager-ubi:8.0.0"
             - name: RELATED_IMAGE_OPS_MANAGER_IMAGE_REPOSITORY_8_0_1

release.json

@@ -51,6 +51,7 @@
         "7.0.18",
         "7.0.19",
         "7.0.20",
+        "7.0.21",
         "8.0.0",
         "8.0.1",
         "8.0.2",
@@ -217,6 +218,10 @@
             "agent_version": "108.0.16.8895-1",
             "tools_version": "100.13.0"
           },
+          "7.0.21": {
+            "agent_version": "107.0.21.8817-1",
+            "tools_version": "100.13.0"
+          },
           "8.0.18": {
             "agent_version": "108.0.18.8921-1",
             "tools_version": "100.13.0"

scripts/funcs/operator_deployment

@@ -9,6 +9,7 @@ get_operator_helm_values() {
 
   declare -a config=(
     "managedSecurityContext=${MANAGED_SECURITY_CONTEXT:-false}"
+    "buildScenario=${BUILD_SCENARIO:-}"
     "registry.operator=${OPERATOR_REGISTRY}"
     "registry.imagePullSecrets=image-registries-secret"
     "registry.initOpsManager=${INIT_OPS_MANAGER_REGISTRY}"