fix: resolve oauth-proxy image from cluster release payload for multi-arch support

[swapnilsingh-ibm]

What does this PR do?

Fixes che-gateway deployment on OpenShift on IBM Z (s390x) where the oauth-proxy sidecar enters ImagePullBackOff because quay.io/openshift/origin-oauth-proxy:4.22(hardcoded as RELATED_IMAGE_gateway_authentication_sidecar) carries only a linux/amd64 manifest, making Che undeployable on s390x OpenShift.

The operator now resolves the oauth-proxy image dynamically at CheCluster reconciliation time from the cluster's own openshift/oauth-proxy ImageStream (namespace openshift). This ImageStream is managed by the Cluster Version Operator and always carries an architecture-native, digest-pinned image from the cluster's release payload — accessible from any pod via the node-level global pull secret without additional configuration.

Falls back to RELATED_IMAGE_gateway_authentication_sidecar when the ImageStream is unavailable, preserving existing behaviour for non-OCP environments. No RBAC changes required — the operator's ClusterRole already has image.openshift.io/imagestreams: get, list. Also extends build/scripts/olm/release-catalog.sh to produce linux/s390x and linux/ppc64le manifests for the OLM catalog image.

Screenshot/screencast of this PR

See attached screenshots:

1. che-gateway reaching 4/4 Running on s390x

2. All pods healthy in eclipse-che namespace

3. oauth-proxy container image resolved from cluster release payload

4. Operator log confirming dynamic image resolution

5. All gateway unit tests passing

What issues does this PR fix or reference?

Fixes eclipse-che/che#23895

How to test this PR?

Deploy the operator on an OpenShift cluster running on a non-amd64 architecture (s390x, ppc64le, or arm64):

OpenShift

oc create namespace devworkspace-controller
oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml

OPERATOR_IMAGE=<...>
sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' \
  deploy/deployment/openshift/combined.yaml | oc apply --server-side -f -

oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
oc wait checluster eclipse-che -n eclipse-che \
  --for=jsonpath='.status.chePhase'=Active --timeout=120s

Verify:

• Must show quay.io/openshift-release-dev/... not quay.io/openshift/origin-oauth-proxy:4.22

oc get deployment che-gateway -n eclipse-che \
  -o jsonpath='{.spec.template.spec.containers[?(@.name=="oauth-proxy")].image}'

• Must show 4/4 Running

oc get pods -n eclipse-che -l app=che-gateway

Common Test Scenarios

• Deploy Eclipse Che — verified on OpenShift 4.22 on IBM Z (s390x)
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Hi @swapnilsingh-ibm. Thanks for your PR.

I'm waiting for a eclipse-che member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: swapnilsingh-ibm

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment