chore(base-image): Migrate Konflux builds to UBI9/RHEL9 #2562
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This migrates scanner (non-v4) Konflux and non-Konflux builds from UBI8/RHEL8 to UBI9/RHEL9 base images. Changes: - Generated rpms.lock.yaml for RHEL 9 (48 lines, xz package for all 4 architectures) - Updated rpms.rhel.repo: RHEL 8→9 repository URLs, SSL vars not hardcoded - Updated .tekton CPE labels: el8→el9 for all 4 build configs - Updated konflux Dockerfiles: - image/scanner/rhel/konflux.Dockerfile: rhel_8_1.24→rhel_9_1.24 builder, ubi8→ubi9 base - image/db/rhel/konflux.Dockerfile: rhel8/postgresql-15→rhel9/postgresql-15 base - Updated non-konflux Dockerfiles: - image/scanner/rhel/Dockerfile: ubi8-minimal→ubi9-minimal - image/db/rhel/Dockerfile: ubi8→ubi9, ubi8-minimal→ubi9-minimal - image/vulnerabilities/Dockerfile: ubi8-minimal→ubi9-minimal The RPM lockfile was generated using rpm-lockfile-prototype with Red Hat subscription credentials via update.repos.sh script (kept locally only). Note: Image name labels remain as "rhel8" since new rhel9 registry repos are not yet available. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
Skipping CI for Draft Pull Request. |
The microdnf install xz command was missing the -y flag, causing the Konflux build to hang waiting for user confirmation. This fix adds the -y flag to auto-confirm the package installation. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Apply the same entrypoint script fixes from stackrox PR rox-14475-ubi9-acs411 to handle UBI9's stricter filesystem permissions when running as non-root. Changes: - restore-all-dir-contents: Use --no-clobber flag to prevent overwriting read-only files and avoid permission denied errors - import-additional-cas: Use --update flag and make directory-hash writable before update-ca-trust, add explicit --output flag - trust-root-ca: Add chmod to make directory-hash writable, use --update flag, and add explicit --output flag These changes prevent crashes when the scanner container (running as UID 65534) tries to update CA trust files in /etc/pki/ca-trust which are owned by root in the base UBI9 image. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Resolved conflicts in favor of UBI9 base images: - image/db/rhel/konflux.Dockerfile: Keep rhel9/postgresql-15:latest - image/scanner/rhel/konflux.Dockerfile: Keep ubi9-minimal:latest Updated image name labels from rhel8 to rhel9 to match new base images. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…ics) This commit contains ONLY the absolutely necessary changes to migrate from UBI8/RHEL8 to UBI9/RHEL9 base images, plus diagnostic commands to investigate the THIRD_PARTY_NOTICES tar extraction issue observed in earlier testing. Minimal Required Changes: - image/scanner/rhel/Dockerfile.slim: ubi8-minimal → ubi9-minimal - image/db/rhel/Dockerfile.slim: ubi8-minimal → ubi9-minimal, ubi8 → ubi9 - image/db/rhel/scripts/download.sh: pg_rhel_major=8 → pg_rhel_major=9 Diagnostic/Research Commands Added: - image/scanner/rhel/Dockerfile: Added verbose tar extraction with diagnostics - image/scanner/rhel/Dockerfile.slim: Added verbose tar extraction with diagnostics The diagnostic commands will help us understand: 1. What tar version is in UBI9 vs UBI8 2. What filesystem type is being used 3. Whether tar successfully extracts THIRD_PARTY_NOTICES 4. Where THIRD_PARTY_NOTICES ends up in the filesystem 5. Whether UBI9 can create directories with names like 'cloud.google.com-go-errorreporting' 6. What the actual tar exit code is (success/failure) These diagnostics are TEMPORARY and will be removed once we understand the root cause of any tar extraction issues. They do not change behavior - they only add verbose logging to the build output. No functional changes. Build failures will reveal what UBI9 compatibility changes are needed based on diagnostic output. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This change addresses arm64 build failures where tar extraction of THIRD_PARTY_NOTICES fails with "Cannot open: Invalid argument" errors. Root cause: - GitHub Actions migrated ubuntu-latest to ubuntu-24.04 (Dec 2024 - Jan 2025) - ubuntu-24.04 has a QEMU regression (issue #11662) affecting fchmodat2 syscall - UBI9 glibc (2.34+) uses fchmodat2 for file operations - When building UBI9 images under QEMU emulation on ubuntu-24.04, tar extraction fails with EINVAL, leaving THIRD_PARTY_NOTICES empty - Only affects arm64 builds (amd64/ppc64le/s390x use different QEMU paths) UBI8 vs UBI9: - UBI8 glibc (2.28) uses old fchmodat syscall → works fine on ubuntu-24.04 - UBI9 glibc (2.34+) uses new fchmodat2 syscall → hits QEMU regression Solution: - Pin pre-build-scanner, generate-scanner-bundle, and build-images jobs to ubuntu-22.04 which does not have the QEMU regression - All architectures (amd64, arm64, ppc64le, s390x) use same runner for consistency - This is a temporary workaround until upstream fixes the regression Updated jobs: - pre-build-scanner: ubuntu-22.04 - generate-scanner-bundle: ubuntu-22.04 - build-images: ubuntu-22.04 References: - actions/runner-images#11662 (QEMU regression) - https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2059734 (fchmodat2 issue) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Resolved conflicts by keeping UBI9/RHEL9 base images: - image/db/rhel/konflux.Dockerfile: Keep rhel9/postgresql-15 - image/scanner/rhel/konflux.Dockerfile: Keep ubi9-minimal Master had updated UBI8 image digests which conflict with our UBI9 migration.
1. Regenerated rpms.rhel.repo and rpms.lock.yaml using improved script:
- Uses $basearch variable correctly (no hardcoded "ARM 64", etc.)
- Only includes used repos (baseos and baseos-source)
- Follows documentation steps exactly
- rpms.rhel.repo reduced from 5113 lines to 29 lines
2. Restore ubuntu-latest for CI jobs:
- Remove ubuntu-22.04 pins from pre-build-scanner, generate-scanner-bundle,
and build-and-push-scanner jobs
- Testing if QEMU fchmodat2 issue is now resolved in ubuntu-24.04
- Track: actions/runner-images#11662
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Author
|
@tommartensen fyi this is the parallel scanner update for UBI9. In this, we also have to add the update-ca-trust workaround for UBI9 changed perms on second execution. The arm build fails because tar hits a bug in a syscall in qemu; I still have some debug logging around that, and I expect the arm arch build to fail because of it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.