Description of problem:
We got a case were cdi-deployment wasn't able to start due to PSA.
The deployment controller was clearly stating that on the conditions on the deployment status:

$ oc get deployments -n openshift-cnv cdi-deployment -o json | jq .status.conditions
[

{ "lastTransitionTime": "2022-09-21T21:21:28Z", "lastUpdateTime": "2022-09-21T21:21:28Z", "message": "Deployment does not have minimum availability.", "reason": "MinimumReplicasUnavailable", "status": "False", "type": "Available" }

,

{ "lastTransitionTime": "2022-09-21T21:21:28Z", "lastUpdateTime": "2022-09-21T21:21:28Z", "message": "pods \"cdi-deployment-6f4888b5cb-r9f5h\" is forbidden: violates PodSecurity \"restricted:latest\": allowPrivilegeEscalation != false (container \"cdi-controller\" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container \"cdi-controller\" must set securityContext.capabilities.drop=[\"ALL\"]), seccompProfile (pod or container \"cdi-controller\" must set securityContext.seccompProfile.type to \"RuntimeDefault\" or \"Localhost\")", "reason": "FailedCreate", "status": "True", "type": "ReplicaFailure" }

,

{ "lastTransitionTime": "2022-09-21T21:31:29Z", "lastUpdateTime": "2022-09-21T21:31:29Z", "message": "ReplicaSet \"cdi-deployment-6f4888b5cb\" has timed out progressing.", "reason": "ProgressDeadlineExceeded", "status": "False", "type": "Progressing" }

]

although cdi-operator was still reporting Progressing=True, Degraded=False on its CR:

$ oc get cdi cdi-kubevirt-hyperconverged -o yaml
apiVersion: cdi.kubevirt.io/v1beta1
kind: CDI
metadata:
annotations:
cdi.kubevirt.io/configAuthority: ""
creationTimestamp: "2022-09-21T21:21:24Z"
finalizers:

• operator.cdi.kubevirt.io
  generation: 2
  labels:
  app: kubevirt-hyperconverged
  app.kubernetes.io/component: storage
  app.kubernetes.io/managed-by: hco-operator
  app.kubernetes.io/part-of: hyperconverged-cluster
  app.kubernetes.io/version: 4.11.0
  name: cdi-kubevirt-hyperconverged
  resourceVersion: "39138"
  uid: 8cf09f52-9ad4-48d0-8831-d97923fdfe29
  spec:
  certConfig:
  ca:
  duration: 48h0m0s
  renewBefore: 24h0m0s
  server:
  duration: 24h0m0s
  renewBefore: 12h0m0s
  config:
  featureGates:
• HonorWaitForFirstConsumer
  infra: {}
  uninstallStrategy: BlockUninstallIfWorkloadsExist
  workload: {}
  status:
  conditions:
• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  status: "False"
  type: Available
• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  message: Started Deployment
  reason: DeployStarted
  status: "True"
  type: Progressing
• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  status: "False"
  type: Degraded
  operatorVersion: 4.11.0
  phase: Deploying
  targetVersion: 4.11.0

so HCO is going to report progressing forever as well (HCO is reading only the conditions on CDI CR and not the ones on its operands)

Version-Release number of selected component (if applicable):
4.11.0

How reproducible:
100%

Steps to Reproduce:
1. try to deploy with cdi-deployment getting stuck (for instance CNV 4.11.0 on OCP 4.12.0 with enforcing restricted PSA on openshift-cnv)
2. check `oc get deployments -n openshift-cnv cdi-deployment -o json | jq .status.conditions`
3. compare with `oc get cdi cdi-kubevirt-hyperconverged -o json | jq .status.conditions`

Actual results:
a mismatch between cdi-deployment and CDI CR:

on CDI deployment:
status:
conditions:

• lastTransitionTime: "2022-09-21T21:21:28Z"
  lastUpdateTime: "2022-09-21T21:21:28Z"
  message: 'pods "cdi-deployment-6f4888b5cb-r9f5h" is forbidden: violates PodSecurity
  "restricted:latest": allowPrivilegeEscalation != false (container "cdi-controller"
  must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities
  (container "cdi-controller" must set securityContext.capabilities.drop=["ALL"]),
  seccompProfile (pod or container "cdi-controller" must set securityContext.seccompProfile.type
  to "RuntimeDefault" or "Localhost")'
  reason: FailedCreate
  status: "True"
  type: ReplicaFailure
• lastTransitionTime: "2022-09-21T21:31:29Z"
  lastUpdateTime: "2022-09-21T21:31:29Z"
  message: ReplicaSet "cdi-deployment-6f4888b5cb" has timed out progressing.
  reason: ProgressDeadlineExceeded
  status: "False"
  type: Progressing

on CDI CR:
status:
conditions:

• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  status: "False"
  type: Available
• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  message: Started Deployment
  reason: DeployStarted
  status: "True"
  type: Progressing
• lastHeartbeatTime: "2022-09-21T21:21:25Z"
  lastTransitionTime: "2022-09-21T21:21:25Z"
  status: "False"
  type: Degraded

Expected results:
CDI CR conditions correctly aggregates the ones from its operands.

Additional info:
Please notice that correctly reporting a failed install/upgrade is actually a prerequisite for the unsafe fail forward upgrades feature:
https://olm.operatorframework.io/docs/advanced-tasks/unsafe-fail-forward-upgrades/

Currently we are still not opting-in, but that feature will eventually let customers try to recover from stuck upgrades.