stackrox · mclasmeier · Mar 27, 2026 · Mar 27, 2026 · Mar 26, 2026 · Mar 26, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -30,6 +30,8 @@ Changes should still be described appropriately in JIRA/doc input pages, for inc
 
 ### Technical Changes
 
+- OpenShift 3 support removed from Helm charts and roxctl manifest bundle generation.
+
 ## [4.10.0]
 
 

diff --git a/central/cluster/datastore/datastore_impl_postgres_test.go b/central/cluster/datastore/datastore_impl_postgres_test.go
@@ -977,7 +977,6 @@ func (s *ClusterPostgresDataStoreTestSuite) TestAddDefaults() {
 			expectedDisabledLogs bool
 		}{
 			"Kubernetes cluster":  {&storage.Cluster{Type: storage.ClusterType_KUBERNETES_CLUSTER, MainImage: mainImage, CentralApiEndpoint: centralEndpoint}, true},
-			"Openshift 3 cluster": {&storage.Cluster{Type: storage.ClusterType_OPENSHIFT_CLUSTER, MainImage: mainImage, CentralApiEndpoint: centralEndpoint}, true},
 			"Openshift 4 cluster": {&storage.Cluster{Type: storage.ClusterType_OPENSHIFT4_CLUSTER, MainImage: mainImage, CentralApiEndpoint: centralEndpoint}, false},
 			"Openshift 4 cluster with disabled logs": {&storage.Cluster{Type: storage.ClusterType_OPENSHIFT4_CLUSTER, MainImage: mainImage, CentralApiEndpoint: centralEndpoint,
 				DynamicConfig: &storage.DynamicClusterConfig{DisableAuditLogs: true}}, true},

diff --git a/central/clusters/zip/render_test.go b/central/clusters/zip/render_test.go
@@ -135,7 +135,7 @@ func TestRenderWithNoCollection(t *testing.T) {
 	cluster := &storage.Cluster{
 		Name:             "cluster",
 		MainImage:        "stackrox/main:abc",
-		Type:             storage.ClusterType_OPENSHIFT_CLUSTER,
+		Type:             storage.ClusterType_OPENSHIFT4_CLUSTER,
 		CollectionMethod: storage.CollectionMethod_NO_COLLECTION,
 	}
 

diff --git a/central/complianceoperator/v2/integration/datastore/datastore_impl_test.go b/central/complianceoperator/v2/integration/datastore/datastore_impl_test.go
@@ -257,7 +257,7 @@ func (s *complianceIntegrationDataStoreTestSuite) TestGetComplianceIntegrationsV
 	// Add some clusters
 	_, err := s.db.DB.Exec(context.Background(), "insert into clusters (id, name, status_providermetadata_cluster_type, type) values ($1, $2, $3, $4)", testconsts.Cluster1, "cluster1", 1, 1)
 	s.Require().NoError(err)
-	_, err = s.db.DB.Exec(context.Background(), "insert into clusters (id, name, status_providermetadata_cluster_type, type) values ($1, $2, $3, $4)", testconsts.Cluster2, "cluster2", 2, 2)
+	_, err = s.db.DB.Exec(context.Background(), "insert into clusters (id, name, status_providermetadata_cluster_type, type) values ($1, $2, $3, $4)", testconsts.Cluster2, "cluster2", 2, 5)
 	s.Require().NoError(err)
 	_, err = s.db.DB.Exec(context.Background(), "insert into clusters (id, name, status_providermetadata_cluster_type, type) values ($1, $2, $3, $4)", testconsts.Cluster3, "cluster3", 5, 5)
 	s.Require().NoError(err)
@@ -463,7 +463,7 @@ func getDefaultTestIntegrationViews() []*IntegrationDetails {
 			Version:                           "2",
 			OperatorStatus:                    pointers.Pointer(storage.COStatus_HEALTHY),
 			ClusterName:                       "cluster2",
-			Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT_CLUSTER),
+			Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT4_CLUSTER),
 			StatusProviderMetadataClusterType: pointers.Pointer(storage.ClusterMetadata_ARO),
 			OperatorInstalled:                 pointers.Bool(true),
 		},

diff --git a/central/complianceoperator/v2/integration/service/convert_test.go b/central/complianceoperator/v2/integration/service/convert_test.go
@@ -48,7 +48,7 @@ func TestConvertStorageIntegrationToV2(t *testing.T) {
 				OperatorStatus:                    pointers.Pointer(storage.COStatus_HEALTHY),
 				ClusterID:                         fixtureconsts.Cluster1,
 				ClusterName:                       mockClusterName,
-				Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT_CLUSTER),
+				Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT4_CLUSTER),
 				StatusProviderMetadataClusterType: pointers.Pointer(storage.ClusterMetadata_OCP),
 			},
 			expected: &apiV2.ComplianceIntegration{
@@ -60,7 +60,7 @@ func TestConvertStorageIntegrationToV2(t *testing.T) {
 				StatusErrors:        []string{"Error 1", "Error 2", "Error 3"},
 				OperatorInstalled:   true,
 				Status:              apiV2.COStatus_HEALTHY,
-				ClusterPlatformType: apiV2.ClusterPlatformType_OPENSHIFT_CLUSTER,
+				ClusterPlatformType: apiV2.ClusterPlatformType_OPENSHIFT4_CLUSTER,
 				ClusterProviderType: apiV2.ClusterProviderType_OCP,
 			},
 			clusterError: false,
@@ -81,7 +81,7 @@ func TestConvertStorageIntegrationToV2(t *testing.T) {
 				OperatorStatus:                    pointers.Pointer(storage.COStatus_HEALTHY),
 				ClusterID:                         testconsts.Cluster1,
 				ClusterName:                       mockClusterName,
-				Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT_CLUSTER),
+				Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT4_CLUSTER),
 				StatusProviderMetadataClusterType: pointers.Pointer(storage.ClusterMetadata_OCP),
 			},
 			expected:     nil,

diff --git a/central/complianceoperator/v2/integration/service/service_impl_test.go b/central/complianceoperator/v2/integration/service/service_impl_test.go
@@ -157,7 +157,7 @@ func (s *ComplianceIntegrationServiceTestSuite) TestListComplianceIntegrations()
 						StatusErrors:        []string{"Error 1", "Error 2", "Error 3"},
 						OperatorInstalled:   true,
 						Status:              apiV2.COStatus_HEALTHY,
-						ClusterPlatformType: apiV2.ClusterPlatformType_OPENSHIFT_CLUSTER,
+						ClusterPlatformType: apiV2.ClusterPlatformType_OPENSHIFT4_CLUSTER,
 						ClusterProviderType: apiV2.ClusterProviderType_OCP,
 					},
 				},
@@ -209,7 +209,7 @@ func (s *ComplianceIntegrationServiceTestSuite) TestListComplianceIntegrations()
 					OperatorStatus:                    pointers.Pointer(storage.COStatus_HEALTHY),
 					ClusterID:                         fixtureconsts.Cluster1,
 					ClusterName:                       mockClusterName,
-					Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT_CLUSTER),
+					Type:                              pointers.Pointer(storage.ClusterType_OPENSHIFT4_CLUSTER),
 					StatusProviderMetadataClusterType: pointers.Pointer(storage.ClusterMetadata_OCP),
 				},
 				}, nil).Times(1)

diff --git a/central/graphql/resolvers/cluster_count_by_type.go b/central/graphql/resolvers/cluster_count_by_type.go
@@ -45,9 +45,9 @@ func (resolver *clusterCountByTypeResolver) Kubernetes(_ context.Context) int32
 	return int32(resolver.data.GetKubernetesClusterCount())
 }
 
-// Openshift returns the number of clusters of type OPENSHIFT
+// Openshift returns the number of clusters of type OPENSHIFT (deprecated -- returns 0).
 func (resolver *clusterCountByTypeResolver) Openshift(_ context.Context) int32 {
-	return int32(resolver.data.GetOpenshiftClusterCount())
+	return 0
 }
 
 // Openshift4 retruns the number of clusters of type OPENSHIFT4

diff --git a/central/graphql/resolvers/cluster_vulnerabilities_postgres_test.go b/central/graphql/resolvers/cluster_vulnerabilities_postgres_test.go
@@ -403,16 +403,16 @@ func (s *GraphQLClusterVulnerabilityTestSuite) TestEnvImpact() {
 	ctx := SetAuthorizerOverride(s.ctx, allow.Anonymous())
 
 	vuln := s.getClusterVulnerabilityResolver(ctx, "clusterCve1")
-
+	clusterCount := len(s.clusterIDs)
 	impact, err := vuln.EnvImpact(ctx)
 	s.NoError(err)
-	s.Equal(float64(1)/8, impact)
+	s.Equal(float64(1)/float64(clusterCount), impact)
 
 	vuln = s.getClusterVulnerabilityResolver(ctx, "clusterCve2")
 
 	impact, err = vuln.EnvImpact(ctx)
 	s.NoError(err)
-	s.Equal(float64(2)/8, impact)
+	s.Equal(float64(2)/float64(clusterCount), impact)
 }
 
 func (s *GraphQLClusterVulnerabilityTestSuite) getClusterResolver(ctx context.Context, id string) *clusterResolver {

diff --git a/central/graphql/resolvers/test_utils.go b/central/graphql/resolvers/test_utils.go
@@ -268,18 +268,6 @@ func testCluster() []*storage.Cluster {
 			MainImage:          mainImage,
 			CentralApiEndpoint: centralEndpoint,
 		},
-		{
-			Name:               "os_cluster1",
-			Type:               storage.ClusterType_OPENSHIFT_CLUSTER,
-			MainImage:          mainImage,
-			CentralApiEndpoint: centralEndpoint,
-		},
-		{
-			Name:               "os_cluster2",
-			Type:               storage.ClusterType_OPENSHIFT_CLUSTER,
-			MainImage:          mainImage,
-			CentralApiEndpoint: centralEndpoint,
-		},
 		{
 			Name:               "os4_cluster1",
 			Type:               storage.ClusterType_OPENSHIFT4_CLUSTER,

diff --git a/central/telemetry/centralclient/client.go b/central/telemetry/centralclient/client.go
@@ -114,6 +114,8 @@ func newCentralClient(instanceId string) *CentralClient {
 func getCentralDeploymentProperties() map[string]any {
 	orchestrator := storage.ClusterType_KUBERNETES_CLUSTER.String()
 	if env.Openshift.BooleanSetting() {
+		// Should probably be changed to OPENSHIFT4_CLUSTER, but since this is production code, keeping it for now
+		// due to compatibility concerns.
 		orchestrator = storage.ClusterType_OPENSHIFT_CLUSTER.String()
 	}
 	// k8s apiserver is not accessible in cloud service environment.

diff --git a/central/views/platformcve/db_response.go b/central/views/platformcve/db_response.go
@@ -50,7 +50,6 @@ func (c *platformCVECoreResponse) GetClusterCountByPlatformType() ClusterCountBy
 	return &clusterCountByPlatformType{
 		GenericClusterCount:    c.GenericClusters,
 		KubernetesClusterCount: c.KubernetesClusters,
-		OpenshiftClusterCount:  c.OpenshiftClusters,
 		Openshift4ClusterCount: c.Openshift4Clusters,
 	}
 }
@@ -72,7 +71,6 @@ type platformCVECoreCount struct {
 type clusterCountByPlatformType struct {
 	GenericClusterCount    int
 	KubernetesClusterCount int
-	OpenshiftClusterCount  int
 	Openshift4ClusterCount int
 }
 
@@ -84,10 +82,6 @@ func (c *clusterCountByPlatformType) GetKubernetesClusterCount() int {
 	return c.KubernetesClusterCount
 }
 
-func (c *clusterCountByPlatformType) GetOpenshiftClusterCount() int {
-	return c.OpenshiftClusterCount
-}
-
 func (c *clusterCountByPlatformType) GetOpenshift4ClusterCount() int {
 	return c.Openshift4ClusterCount
 }

diff --git a/central/views/platformcve/empty.go b/central/views/platformcve/empty.go
@@ -17,10 +17,6 @@ func (e *emptyClusterCountByPlatformType) GetKubernetesClusterCount() int {
 	return 0
 }
 
-func (e *emptyClusterCountByPlatformType) GetOpenshiftClusterCount() int {
-	return 0
-}
-
 func (e *emptyClusterCountByPlatformType) GetOpenshift4ClusterCount() int {
 	return 0
 }

diff --git a/central/views/platformcve/mocks/types.go b/central/views/platformcve/mocks/types.go
diff --git a/central/views/platformcve/types.go b/central/views/platformcve/types.go
@@ -38,7 +38,6 @@ type CveView interface {
 type ClusterCountByPlatformType interface {
 	GetGenericClusterCount() int
 	GetKubernetesClusterCount() int
-	GetOpenshiftClusterCount() int
 	GetOpenshift4ClusterCount() int
 }
 

diff --git a/central/views/platformcve/view_impl.go b/central/views/platformcve/view_impl.go
@@ -147,16 +147,6 @@ func withCountByPlatformTypeSelectQuery(q *v1.Query) *v1.Query {
 						storage.ClusterType_KUBERNETES_CLUSTER.String(),
 					).ProtoQuery(),
 			).Proto(),
-		search.NewQuerySelect(search.ClusterID).
-			Distinct().
-			AggrFunc(aggregatefunc.Count).
-			Filter("openshift_cluster_count",
-				search.NewQueryBuilder().
-					AddExactMatches(
-						search.ClusterPlatformType,
-						storage.ClusterType_OPENSHIFT_CLUSTER.String(),
-					).ProtoQuery(),
-			).Proto(),
 		search.NewQuerySelect(search.ClusterID).
 			Distinct().
 			AggrFunc(aggregatefunc.Count).

diff --git a/central/views/platformcve/view_test.go b/central/views/platformcve/view_test.go
@@ -166,7 +166,6 @@ func (s *PlatformCVEViewTestSuite) TestGetPlatformCVECore() {
 				assert.Equal(t,
 					record.GetClusterCountByPlatformType().GetGenericClusterCount()+
 						record.GetClusterCountByPlatformType().GetKubernetesClusterCount()+
-						record.GetClusterCountByPlatformType().GetOpenshiftClusterCount()+
 						record.GetClusterCountByPlatformType().GetOpenshift4ClusterCount(),
 					record.GetClusterCount(),
 				)
@@ -226,7 +225,6 @@ func (s *PlatformCVEViewTestSuite) TestGetPlatformCVECoreWithPagination() {
 					assert.Equal(t,
 						record.GetClusterCountByPlatformType().GetGenericClusterCount()+
 							record.GetClusterCountByPlatformType().GetKubernetesClusterCount()+
-							record.GetClusterCountByPlatformType().GetOpenshiftClusterCount()+
 							record.GetClusterCountByPlatformType().GetOpenshift4ClusterCount(),
 						record.GetClusterCount(),
 					)
@@ -428,21 +426,21 @@ func (s *PlatformCVEViewTestSuite) testCases() []testCase {
 			desc: "search one cluster",
 			ctx:  context.Background(),
 			q: search.NewQueryBuilder().
-				AddExactMatches(search.Cluster, "openshift-1").ProtoQuery(),
+				AddExactMatches(search.Cluster, "openshift4-1").ProtoQuery(),
 			matchFilter: matchAllFilter().withClusterFilter(func(cluster *storage.Cluster) bool {
-				return cluster.GetName() == "openshift-1"
+				return cluster.GetName() == "openshift4-1"
 			}),
 		},
 		{
 			desc: "search one cve + one cluster",
 			ctx:  context.Background(),
 			q: search.NewQueryBuilder().
 				AddExactMatches(search.CVE, "cve-2").
-				AddExactMatches(search.Cluster, "openshift-2").
+				AddExactMatches(search.Cluster, "openshift4-2").
 				ProtoQuery(),
 			matchFilter: matchAllFilter().
 				withClusterFilter(func(cluster *storage.Cluster) bool {
-					return cluster.GetName() == "openshift-2"
+					return cluster.GetName() == "openshift4-2"
 				}).
 				withCVEPartsFilter(func(cveParts converterV2.ClusterCVEParts) bool {
 					return cveParts.CVE.GetCveBaseInfo().GetCve() == "cve-2"
@@ -506,12 +504,12 @@ func (s *PlatformCVEViewTestSuite) testCases() []testCase {
 			q: search.NewQueryBuilder().
 				AddExactMatches(search.ClusterPlatformType,
 					storage.ClusterType_KUBERNETES_CLUSTER.String(),
-					storage.ClusterType_OPENSHIFT_CLUSTER.String(),
+					storage.ClusterType_OPENSHIFT4_CLUSTER.String(),
 				).
 				ProtoQuery(),
 			matchFilter: matchAllFilter().withClusterFilter(func(cluster *storage.Cluster) bool {
 				return cluster.GetType() == storage.ClusterType_KUBERNETES_CLUSTER ||
-					cluster.GetType() == storage.ClusterType_OPENSHIFT_CLUSTER
+					cluster.GetType() == storage.ClusterType_OPENSHIFT4_CLUSTER
 			}),
 		},
 		{
@@ -614,39 +612,36 @@ func (s *PlatformCVEViewTestSuite) sacTestCases(ctx context.Context) []sacTestCa
 			visibleClusters: set.NewStringSet(
 				s.clusterNameToIDMap["generic-1"], s.clusterNameToIDMap["generic-2"],
 				s.clusterNameToIDMap["kubernetes-1"], s.clusterNameToIDMap["kubernetes-2"],
-				s.clusterNameToIDMap["openshift-1"], s.clusterNameToIDMap["openshift-2"],
 				s.clusterNameToIDMap["openshift4-1"], s.clusterNameToIDMap["openshift4-2"],
 			),
 		},
 		{
-			desc: "generic-1, kubernetes-1, openshift-1 and openshift4-1 clusters visible",
+			desc: "generic-1, kubernetes-1 and openshift4-1 clusters visible",
 			ctx: sac.WithGlobalAccessScopeChecker(ctx,
 				sac.AllowFixedScopes(
 					sac.AccessModeScopeKeys(storage.Access_READ_ACCESS, storage.Access_READ_WRITE_ACCESS),
 					sac.ResourceScopeKeys(resources.Cluster),
 					sac.ClusterScopeKeys(
 						s.clusterNameToIDMap["generic-1"], s.clusterNameToIDMap["kubernetes-1"],
-						s.clusterNameToIDMap["openshift-1"], s.clusterNameToIDMap["openshift4-1"]))),
+						s.clusterNameToIDMap["openshift4-1"]))),
 			visibleClusters: set.NewStringSet(
 				s.clusterNameToIDMap["generic-1"],
 				s.clusterNameToIDMap["kubernetes-1"],
-				s.clusterNameToIDMap["openshift-1"],
 				s.clusterNameToIDMap["openshift4-1"],
 			),
 		},
 		{
-			desc: "generic-2, kubernetes-2, openshift-2, openshift4-2 clusters visible",
+			desc: "generic-2, kubernetes-2, openshift4-2 clusters visible",
 			ctx: sac.WithGlobalAccessScopeChecker(ctx,
 				sac.AllowFixedScopes(
 					sac.AccessModeScopeKeys(storage.Access_READ_ACCESS),
 					sac.ResourceScopeKeys(resources.Cluster),
 					sac.ClusterScopeKeys(
 						s.clusterNameToIDMap["generic-2"], s.clusterNameToIDMap["kubernetes-2"],
-						s.clusterNameToIDMap["openshift-2"], s.clusterNameToIDMap["openshift4-2"]))),
+						s.clusterNameToIDMap["openshift4-2"]))),
 			visibleClusters: set.NewStringSet(
 				s.clusterNameToIDMap["generic-2"],
 				s.clusterNameToIDMap["kubernetes-2"],
-				s.clusterNameToIDMap["openshift-2"],
 				s.clusterNameToIDMap["openshift4-2"],
 			),
 		},
@@ -943,26 +938,6 @@ func getTestData() (map[string]*storage.Cluster, map[storage.CVE_CVEType][]conve
 	})
 	clusterMap[kubernetes2.GetId()] = kubernetes2
 
-	openshift1 := generateTestCluster(&testClusterFields{
-		Name:         "openshift-1",
-		PlatformType: storage.ClusterType_OPENSHIFT_CLUSTER,
-		ProviderType: storage.ClusterMetadata_OCP,
-		Labels:       map[string]string{"platform-type": "openshift"},
-		K8sVersion:   "8.0",
-		IsOpenshift:  true,
-	})
-	clusterMap[openshift1.GetId()] = openshift1
-
-	openshift2 := generateTestCluster(&testClusterFields{
-		Name:         "openshift-2",
-		PlatformType: storage.ClusterType_OPENSHIFT_CLUSTER,
-		ProviderType: storage.ClusterMetadata_OSD,
-		Labels:       map[string]string{"platform-type": "openshift"},
-		K8sVersion:   "8.0",
-		IsOpenshift:  true,
-	})
-	clusterMap[openshift2.GetId()] = openshift2
-
 	openshift41 := generateTestCluster(&testClusterFields{
 		Name:         "openshift4-1",
 		PlatformType: storage.ClusterType_OPENSHIFT4_CLUSTER,
@@ -1004,9 +979,9 @@ func getTestData() (map[string]*storage.Cluster, map[storage.CVE_CVEType][]conve
 		converterV2.NewClusterCVEParts(cve3Openshift, []*storage.Cluster{generic2}, ""),
 		converterV2.NewClusterCVEParts(cve4K8, []*storage.Cluster{kubernetes1, kubernetes2}, "9.3"),
 		converterV2.NewClusterCVEParts(cve5K8, []*storage.Cluster{kubernetes1, kubernetes2}, "9.2"),
-		converterV2.NewClusterCVEParts(cve1Openshift, []*storage.Cluster{openshift1, openshift41, openshift42}, ""),
-		converterV2.NewClusterCVEParts(cve2Openshift, []*storage.Cluster{openshift1, openshift2, openshift42}, "4.15"),
-		converterV2.NewClusterCVEParts(cve4Openshift, []*storage.Cluster{openshift2, openshift42}, "4.13"),
+		converterV2.NewClusterCVEParts(cve1Openshift, []*storage.Cluster{openshift41, openshift42}, ""),
+		converterV2.NewClusterCVEParts(cve2Openshift, []*storage.Cluster{openshift42}, "4.15"),
+		converterV2.NewClusterCVEParts(cve4Openshift, []*storage.Cluster{openshift42}, "4.13"),
 		converterV2.NewClusterCVEParts(cve5Openshift, []*storage.Cluster{openshift41, openshift42}, "4.15"),
 		converterV2.NewClusterCVEParts(cve1Istio, []*storage.Cluster{generic1}, ""),
 		converterV2.NewClusterCVEParts(cve5Istio, []*storage.Cluster{openshift41}, "4.15"),

diff --git a/generated/storage/cluster.pb.go b/generated/storage/cluster.pb.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -30,6 +30,8 @@ Changes should still be described appropriately in JIRA/doc input pages, for inc

		### Technical Changes

		- OpenShift 3 support removed from Helm charts and roxctl manifest bundle generation.

		## [4.10.0]


Expand Down