Skip to content

chore(base-image): Migrate Konflux builds to UBI9/RHEL9#2562

Open
davdhacs wants to merge 3 commits intomasterfrom
konflux-ubi9-rhel9-migration
Open

chore(base-image): Migrate Konflux builds to UBI9/RHEL9#2562
davdhacs wants to merge 3 commits intomasterfrom
konflux-ubi9-rhel9-migration

Conversation

@davdhacs
Copy link

@davdhacs davdhacs commented Jan 15, 2026 •
edited
Loading

Description

Migrates scanner builds from UBI8/RHEL8 to UBI9/RHEL9 base images.

Key Changes

Konflux Base Images:

  • Builder: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24
  • Scanner runtime: registry.access.redhat.com/ubi9-minimal:latest
  • Scanner DB: registry.redhat.io/rhel9/postgresql-15:latest
  • Image names: rhacs-scanner-rhel9, rhacs-scanner-slim-rhel9, rhacs-scanner-db-rhel9, rhacs-scanner-db-slim-rhel9

Non-Konflux Base Images:

  • Scanner: ubi9-minimal
  • Scanner DB: ubi9 / ubi9-minimal
  • Vulnerabilities: ubi9-minimal

RPM/Repo Updates:

  • rpms.lock.yaml: xz updated from RHEL 8 (5.2.4) to RHEL 9 (5.2.5)
  • rpms.rhel.repo: repos updated from rhel8 to rhel9
  • PostgreSQL download script: pg_rhel_major=9

Tekton Labels:

  • CPE labels: el8 → el9

UBI9 Compatibility Fixes:

  • update-ca-trust extract -o /etc/pki/ca-trust/extracted for unprivileged containers (RHBZ#2241240)
  • cp --recursive --no-dereference --no-clobber in restore-all-dir-contents
  • microdnf install -y xz (explicit -y flag)

Checklist

  • Investigated and inspected CI test results

Testing Performed

TBD

@davdhacs davdhacs added the konflux-build Run Konflux in PR. Push commit to trigger it. label Jan 15, 2026
@openshift-ci
Copy link

openshift-ci bot commented Jan 15, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@davdhacs
Copy link
Author

davdhacs commented Jan 27, 2026

@tommartensen fyi this is the parallel scanner update for UBI9. In this, we also have to add the update-ca-trust workaround for UBI9 changed perms on second execution.

The arm build fails because tar hits a bug in a syscall in qemu; I still have some debug logging around that, and I expect the arm arch build to fail because of it.

@davdhacs davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from d9cdc31 to d2f149d Compare February 5, 2026 16:58
@davdhacs davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from 34c5d67 to 5a2e599 Compare February 18, 2026 05:37
@davdhacs davdhacs marked this pull request as ready for review February 18, 2026 05:39
@davdhacs davdhacs requested review from a team and rhacs-bot as code owners February 18, 2026 05:39
@davdhacs
Copy link
Author

davdhacs commented Feb 18, 2026

/test all

@rhacs-bot rhacs-bot requested a review from a team February 18, 2026 05:48
davdhacs and others added 2 commits February 18, 2026 14:01
@davdhacs @claude
chore(build): Migrate scanner images to UBI9/RHEL9
1a70218 
Migrate all scanner base images from UBI8/RHEL8 to UBI9/RHEL9:

Konflux base images:
- Builder: openshift-golang-builder:rhel_9_golang_1.25
- Scanner runtime: ubi9-minimal
- Scanner DB: rhel9/postgresql-15

Non-Konflux base images:
- Scanner: ubi9-minimal
- Scanner DB: ubi9 / ubi9-minimal
- Vulnerabilities: ubi9-minimal

Other updates:
- Tekton CPE labels: el8 -> el9
- rpms.lock.yaml: xz updated to RHEL 9 version (5.2.5-8.el9_0)
- rpms.rhel.repo: RHEL 8 repos -> RHEL 9 repos
- PostgreSQL download script: pg_rhel_major=9
- Image name labels: rhel8 -> rhel9
- microdnf install -y xz (explicit -y for UBI9 compatibility)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davdhacs @claude
fix: Add update-ca-trust workaround for unprivileged containers
b3addf3 
In UBI9, update-ca-trust fails when running as an unprivileged user
(nobody:nobody) because it attempts to write to system-wide paths.
Use the -o flag to specify a user-writable output directory.

Also switch restore-all-dir-contents to use --no-clobber to avoid
overwriting CA trust files that were already updated at runtime.

See: https://bugzilla.redhat.com/show_bug.cgi?id=2241240

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@davdhacs davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from 5a2e599 to b3addf3 Compare February 18, 2026 21:07
@davdhacs
Copy link
Author

davdhacs commented Feb 18, 2026

/retest

@davdhacs
Copy link
Author

davdhacs commented Feb 19, 2026

@tommartensen could you review this? (the ubi9 upgrade for scanner(v2); includes the update-ca-trust permissions workaround)

tommartensen
tommartensen reviewed Feb 19, 2026
View reviewed changes
Copy link
Contributor

@tommartensen tommartensen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM to me from a Konflux perspective. Have you deployed and smoke tested the resulting images (like we did for collector)?

@davdhacs
Copy link
Author

davdhacs commented Feb 19, 2026

LGTM to me from a Konflux perspective. Have you deployed and smoke tested the resulting images (like we did for collector)?

Yes, I tested with these changes (minus the master-merge [empty] commits). I'll re-do the smoke test with this and the latest master collector builds.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tommartensen tommartensen tommartensen left review comments

@rhacs-bot rhacs-bot Awaiting requested review from rhacs-bot rhacs-bot is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

konflux-build Run Konflux in PR. Push commit to trigger it.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@davdhacs @tommartensen

Comments