feat: switch from UBI images to Debian based ones

.github/workflows/ci.yml

@@ -227,11 +227,13 @@ jobs:
         run: |
           task operator:ci
 
-      - name: Run Red Hat preflight certification
-        run: |
-          # Certify the operator image just built and pushed by operator:ci
-          IMAGE=$(jq -r '.default."image.name" | split(",")[0]' operator/metadata.json)
-          task olm:preflight-container IMAGE="${IMAGE}"
+      # TODO(fcanovai): this has been disabled in #85 because the image build there is now Debian based and
+      # the Red Hat preflight certification fails. It should be re-enabled once we have an image built on Red Hat UBI.
+      #- name: Run Red Hat preflight certification
+      #  run: |
+      #    # Certify the operator image just built and pushed by operator:ci
+      #    IMAGE=$(jq -r '.default."image.name" | split(",")[0]' operator/metadata.json)
+      #    task olm:preflight-container IMAGE="${IMAGE}"
 
   integration-tests:
     name: Integration Tests

core/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
 
-ARG BASE_IMAGE=registry.access.redhat.com/ubi10/ubi-micro:10.2-1786324819@sha256:cabedb588644e9da2c95ebb173a67b78d58aaedcb0eaa42a86f880bcef8a0b2f
+ARG BASE_IMAGE=debian:13.6-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258
 
 # Build Kopia on the host platform for the target platform
 FROM --platform=${BUILDPLATFORM} golang:1.26.5@sha256:5822931cf78fe98a97edcf73a0c54c29fa2386b99c8136468e274ae9fab8cfba AS builder

core/docker-bake.hcl

@@ -30,8 +30,8 @@ variable "registry" {
 }
 
 variable "base_image" {
-  // renovate image: datasource=docker depName=registry.access.redhat.com/ubi10/ubi-micro versioning=docker
-  default = "registry.access.redhat.com/ubi10/ubi-micro:10.2-1786324819@sha256:cabedb588644e9da2c95ebb173a67b78d58aaedcb0eaa42a86f880bcef8a0b2f"
+  // renovate image: datasource=docker depName=debian versioning=docker
+  default = "debian:13.6-slim@sha256:3a39a0592364683e6bab97937b72cad5a8fa6dcbbee90edb3bb48c7f8e94f258"
 }
 
 function "getRegistry" {
@@ -89,7 +89,7 @@ target "default" {
     "index,manifest:org.opencontainers.image.documentation=${documentation}",
     "index,manifest:org.opencontainers.image.authors=${authors}",
     "index,manifest:org.opencontainers.image.licenses=${license}",
-    "index,manifest:org.opencontainers.image.base.name=ubi10/ubi-micro",
+    "index,manifest:org.opencontainers.image.base.name=${baseName(base_image)}",
     "index,manifest:org.opencontainers.image.base.digest=${digest(base_image)}",
   ]
   labels = {
@@ -104,7 +104,7 @@ target "default" {
     "org.opencontainers.image.documentation" = "${documentation}",
     "org.opencontainers.image.authors"       = "${authors}",
     "org.opencontainers.image.licenses"      = "${license}",
-    "org.opencontainers.image.base.name"     = "ubi10/ubi-micro",
+    "org.opencontainers.image.base.name"     = "${baseName(base_image)}",
     "org.opencontainers.image.base.digest"   = "${digest(base_image)}",
     "name"                                   = "${title}",
     "maintainer"                             = "${authors}",
@@ -122,6 +122,13 @@ function digest {
   result = index(split("@", imageNameWithSha), 1)
 }
 
+// We get the image reference without the sha256, so that the base.name label
+// is always derived from base_image and cannot drift away from it.
+function baseName {
+  params = [ imageNameWithSha ]
+  result = index(split("@", imageNameWithSha), 0)
+}
+
 function latest {
   params = [ image, latest ]
   result = (latest == "true") ? "${image}:latest" : ""

documentation/.wordlist.txt

@@ -29,6 +29,7 @@ ClusterMetadata
 ClusterName
 CodeReady
 DNS
+Debian
 DeleteBackup
 DeleteBackupRequest
 DeleteBackupResponse
@@ -176,6 +177,7 @@ Taskfile
 Tolerations
 TopoLVM
 TrueClass
+UBI
 UID
 UIDs
 UTF

documentation/web/docs/developer/openshift_testing.md

@@ -235,16 +235,28 @@ certification policies. Two checks cover the two artifacts:
 
 - **`check container`** — static policy checks on the operator image
   (labels, layers, license, base image). It needs no cluster and runs
-  in the Dagger engine on every PR via `task olm:preflight-container`.
+  in the Dagger engine via `task olm:preflight-container`.
 - **`check operator`** — installs the bundle through OLM into a live
   OpenShift cluster and verifies it is deployable. Because it needs a
   real OpenShift cluster (OLM and Security Context Constraints), it runs
-  via `task olm:preflight-operator`: in the OpenShift E2E CI job (against
-  the CRC cluster it starts, before the e2e suite runs) and locally
-  against CRC. A failing check fails the job. The bundle and catalog
-  images are multi-arch (`linux/amd64` and `linux/arm64`), so the check
-  runs natively on either architecture — including CRC on an Apple
-  Silicon Mac.
+  via `task olm:preflight-operator`, against the CRC cluster the
+  OpenShift E2E job starts or against a local CRC. The bundle and
+  catalog images are multi-arch (`linux/amd64` and `linux/arm64`), so
+  the check runs natively on either architecture — including CRC on an
+  Apple Silicon Mac.
+
+:::note
+
+Both checks are currently **disabled in CI**. The operator and operand
+images are built on Debian instead of Red Hat UBI, which the
+`check container` base-image policy rejects, and `check operator` is
+parked alongside it. The steps are commented out in
+`.github/workflows/ci.yml` and `.github/workflows/openshift-e2e.yml`,
+ready to be restored once a UBI-based image variant is built again — see
+[issue #85](https://github.com/cloudnative-pg/klio/issues/85). Both
+tasks still work when run manually, as described below.
+
+:::
 
 ### Run `check operator` against CRC
 

operator/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
 
-ARG BASE_IMAGE=registry.access.redhat.com/ubi10/ubi-micro:10.2-1786324819@sha256:cabedb588644e9da2c95ebb173a67b78d58aaedcb0eaa42a86f880bcef8a0b2f
+ARG BASE_IMAGE=gcr.io/distroless/static-debian13:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6
 
 # Build stage: build on the host platform for the target platform
 FROM --platform=${BUILDPLATFORM} golang:1.26.5@sha256:5822931cf78fe98a97edcf73a0c54c29fa2386b99c8136468e274ae9fab8cfba AS builder

operator/docker-bake.hcl

@@ -30,8 +30,8 @@ variable "registry" {
 }
 
 variable "base_image" {
-  // renovate image: datasource=docker depName=registry.access.redhat.com/ubi10/ubi-micro versioning=docker
-  default = "registry.access.redhat.com/ubi10/ubi-micro:10.2-1786324819@sha256:cabedb588644e9da2c95ebb173a67b78d58aaedcb0eaa42a86f880bcef8a0b2f"
+  // renovate image: datasource=docker depName=static-debian13 lookupName=gcr.io/distroless/static-debian13 versioning=docker
+  default = "gcr.io/distroless/static-debian13:nonroot@sha256:f7f8f729987ad0fdf6b05eeeae94b26e6a0f613bdf46feea7fc40f7bd72953e6"
 }
 
 function "getRegistry" {
@@ -89,7 +89,7 @@ target "default" {
     "index,manifest:org.opencontainers.image.documentation=${documentation}",
     "index,manifest:org.opencontainers.image.authors=${authors}",
     "index,manifest:org.opencontainers.image.licenses=${license}",
-    "index,manifest:org.opencontainers.image.base.name=ubi10/ubi-micro",
+    "index,manifest:org.opencontainers.image.base.name=${baseName(base_image)}",
     "index,manifest:org.opencontainers.image.base.digest=${digest(base_image)}",
   ]
   labels = {
@@ -104,7 +104,7 @@ target "default" {
     "org.opencontainers.image.documentation" = "${documentation}",
     "org.opencontainers.image.authors"       = "${authors}",
     "org.opencontainers.image.licenses"      = "${license}",
-    "org.opencontainers.image.base.name"     = "ubi10/ubi-micro",
+    "org.opencontainers.image.base.name"     = "${baseName(base_image)}",
     "org.opencontainers.image.base.digest"   = "${digest(base_image)}",
     "name"                                   = "${title}",
     "maintainer"                             = "${authors}",
@@ -122,6 +122,13 @@ function digest {
   result = index(split("@", imageNameWithSha), 1)
 }
 
+// We get the image reference without the sha256, so that the base.name label
+// is always derived from base_image and cannot drift away from it.
+function baseName {
+  params = [ imageNameWithSha ]
+  result = index(split("@", imageNameWithSha), 0)
+}
+
 function latest {
   params = [ image, latest ]
   result = (latest == "true") ? "${image}:latest" : ""