chore(CI): Konflux build to UBI9 #2815

davdhacs · 2026-01-23T04:11:31Z

Description

Migrates Konflux collector builds from UBI8/RHEL8 to UBI9/RHEL9 base images.

Key Changes

Base Images:

Builder: registry.access.redhat.com/ubi9/ubi:latest
Runtime: registry.access.redhat.com/ubi9/ubi-minimal:latest
Image name: rhacs-collector-rhel9

RPM Packages (RHEL 9):

Clang: 20.1.8 (was 18.1.8 in RHEL 8)
elfutils-libelf (was included in UBI8-minimal base image but not in ubi9-minimal)
All build dependencies updated to RHEL 9 versions

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

CI is sufficient.

elfutils:

$ docker run --rm registry.access.redhat.com/ubi8/ubi-minimal:latest rpm -qa | grep -i elfutils
elfutils-libelf-0.190-2.el8.aarch64
$ docker run --rm registry.access.redhat.com/ubi9/ubi-minimal:latest rpm -qa | grep -i elfutils

Update Konflux build configuration to use UBI9 and RHEL 9: - Update builder base image: ubi8/ubi -> ubi9/ubi Pinned to sha256:22e95731596d661ff08daabaa5ef751b20ac42d0a58492dac5efa7373f471389 - Update runtime base image: ubi8/ubi-minimal -> ubi9/ubi-minimal Pinned to sha256:90bd85dcd061d1ad6dbda70a867c41958c04a86462d05c631f8205e8870f28f8 - Add Cachi2 environment sourcing for hermetic RPM builds - Update image label: rhacs-collector-rhel8 -> rhacs-collector-rhel9 - Update Tekton CPE label: el8 -> el9 This aligns collector Konflux builds with the UBI9 migration already completed for GitHub CI builds.

Configure hermetic builds with RHEL 9 package dependencies: - Update rpms.in.yaml: * Change context from bare:true to UBI9 image * Update clang version: clang-19.1.7 -> clang-20.1.8 - Add rpms.rhel.repo with RHEL 9 repository configurations * Updated from RHEL 8 to RHEL 9 base URLs * Includes all required repos for 4 architectures - Add rpms.lock.yaml with locked package versions * Generated for aarch64, ppc64le, s390x, x86_64 * Enables hermetic builds with reproducible dependencies * Required for RHEL-only packages (elfutils-libelf-devel, tbb-devel, c-ares-devel) not in public UBI repos Hermetic builds ensure reproducible container images by prefetching all RPM dependencies before the build starts.

davdhacs · 2026-01-23T04:51:55Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

davdhacs · 2026-01-23T04:55:37Z

@tommartensen does this include all of the Konflux-built collector images? I think this does what is needed: base image update, pinned to latest image shas, and updated rpm lockfiles. Is there anything missing?

collector/container/konflux.Dockerfile

rpms.in.yaml

tommartensen · 2026-01-23T08:57:33Z

rpms.in.yaml

 - wget
 - unzip
- clang-19.1.7
+- clang-20.1.8


Please check with @stackrox/collector-team if this clang version is compatible.

The kind of issues we get with incompatible versions of clang are usually detected pretty well by integration tests. Making sure that all the tests pass should be enough.

I think that clang-20 is already what is used for upstream.

ty. This is the latest stable clang I found for ubi9. @ovalenti would it be better to un-pin clang for ubi9?

rpms.rhel.repo

rpms.lock.yaml

ovalenti · 2026-01-23T09:29:35Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

Unfortunately, github will refuse to run its pipelines unless those conflicts are resolved, it seems.

davdhacs · 2026-01-23T15:38:36Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

Unfortunately, github will refuse to run its pipelines unless those conflicts are resolved, it seems.

Thank you. I'll update and fix the conflicts then.

konflux sources the env file for every RUN already Co-authored-by: Tom Martensen <tmartens@redhat.com>

Analysis showed that bare: true and image: with SHA produce identical lockfiles (4,668 lines, 167 packages). Both correctly exclude base image packages, with only 2 packages overlapping (openssl/openssl-libs as dependencies of openssl-devel). Using bare: true is clearer for our use case since collector has two different base images (ubi9/ubi for builder, ubi9/ubi-minimal for runtime). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Source RPMs are required for build-source-image task in Konflux and GPL compliance. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

codecov-commenter · 2026-01-25T20:01:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.38%. Comparing base (24f41bd) to head (8cb31c2).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2815   +/-   ##
=======================================
  Coverage   27.38%   27.38%           
=======================================
  Files          95       95           
  Lines        5427     5427           
  Branches     2548     2548           
=======================================
  Hits         1486     1486           
  Misses       3214     3214           
  Partials      727      727

Flag	Coverage Δ
collector-unit-tests	`27.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

rpms.rhel.repo

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

The collector binary requires libelf.so.1 at runtime to load eBPF programs into the kernel via libbpf. When migrating from UBI8 to UBI9, this runtime dependency was not explicitly added because it was included in the UBI8 ubi-minimal base image. UBI9 ubi-minimal is more stripped down and does not include elfutils-libelf by default. Without this library, the collector fails at runtime with: collector: error while loading shared libraries: libelf.so.1: cannot open shared object file: No such file or directory Why libelf is required: - Collector uses libbpf to load eBPF programs for kernel-level monitoring - eBPF programs are compiled by LLVM into ELF object files - libbpf uses libelf to parse these ELF files and extract: - eBPF program bytecode - BPF map descriptions - BTF (BPF Type Format) metadata - Relocation information - libelf is an internal dependency of libbpf and must be present at runtime This issue was discovered by run-konflux-tests, which test the actual Konflux-built UBI9 images at runtime, while integration-tests (which test GitHub Actions-built images) continued to pass. References: - https://docs.kernel.org/bpf/libbpf/libbpf_build.html - https://docs.ebpf.io/ebpf-library/libbpf/ Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

davdhacs · 2026-01-27T04:54:17Z

rpms.in.yaml

 # final stage in collector/container/konflux.Dockerfile
 - tbb
 - c-ares
+- elfutils-libelf


@ovalenti It looks like this is needed now. Is this valid?

tommartensen · 2026-01-27T08:41:52Z

rpms.rhel.repo

-[rhel-8-for-$basearch-appstream-rpms]
-name = Red Hat Enterprise Linux 8 for $basearch - AppStream (RPMs)
-baseurl = https://cdn.redhat.com/content/dist/rhel8/8/$basearch/appstream/os
+[rhel-9-for-$basearch-appstream-rpms]


This file looks better now!

tommartensen

As a next step, can you try to deploy ACS with this image?

Manifest or Helm based installs should be easiest to setup: https://spaces.redhat.com/spaces/StackRox/pages/483005167/How+to+deploy+ACS+with+Konflux+images

Then run the manual smoke tests: https://spaces.redhat.com/spaces/StackRox/pages/388132725/Manual+smoke+test+for+ACS

davdhacs added 2 commits January 22, 2026 21:24

davdhacs force-pushed the konflux-ubi9-migration branch from 2334d7b to 23cacca Compare January 23, 2026 04:26

davdhacs requested a review from tommartensen January 23, 2026 04:52

tommartensen reviewed Jan 23, 2026

View reviewed changes

collector/container/konflux.Dockerfile Show resolved Hide resolved

tommartensen requested changes Jan 23, 2026

View reviewed changes

davdhacs and others added 4 commits January 23, 2026 09:01

remove duplicated cachi2 env sourcing

3f88be9

konflux sources the env file for every RUN already Co-authored-by: Tom Martensen <tmartens@redhat.com>

Regenerate rpms.rhel.repo and rpms.lock.yaml with source RPMs enabled

7f0efb4

Source RPMs are required for build-source-image task in Konflux and GPL compliance. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

remove 9 from repo suffix

a9a6866

davdhacs requested a review from tommartensen January 24, 2026 18:44

Merge master (keep UBI9 rpms)

094e8aa

tommartensen reviewed Jan 26, 2026

View reviewed changes

rpms.rhel.repo Outdated Show resolved Hide resolved

davdhacs and others added 4 commits January 26, 2026 07:40

Fix rpms.rhel.repo to use $basearch variable in name fields

bc767da

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Merge branch 'master' into konflux-ubi9-migration

e01bd2b

empty commit

6dcdf3d

restore "-rhel9" image suffix

ae9872f

davdhacs added the do-not-merge/work-in-progress label Jan 26, 2026

davdhacs requested a review from tommartensen January 27, 2026 04:48

davdhacs commented Jan 27, 2026

View reviewed changes

davdhacs added 2 commits January 26, 2026 22:10

Remove unnecessary enabled_metadata=1 from source repos

2ca1e46

remove trailing newline

8cb31c2

tommartensen reviewed Jan 27, 2026

View reviewed changes

chore(CI): Konflux build to UBI9 #2815

Are you sure you want to change the base?

chore(CI): Konflux build to UBI9 #2815

Conversation

davdhacs commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

Checklist

Testing Performed

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tommartensen Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

ovalenti Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

davdhacs Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ovalenti commented Jan 23, 2026

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

codecov-commenter commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

davdhacs Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

tommartensen Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

tommartensen left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

davdhacs commented Jan 23, 2026 •

edited

Loading

codecov-commenter commented Jan 25, 2026 •

edited

Loading