fix: include system CA certificates in controller container images

[mangelajo]

Problem

The ubi9/ubi-micro runtime images used for controller containers do not include a CA certificates bundle. This causes TLS verification failures when connecting to external services using publicly trusted CAs (e.g. OIDC providers behind Let's Encrypt certificates):

tls: failed to verify certificate: x509: certificate signed by unknown authority

Fix

Copy the system CA bundle (/etc/pki/tls/certs/ca-bundle.crt) into all runtime images:

• Multi-stage builds (Containerfile, Containerfile.operator, Containerfile.exporter-set-controller): copy from the existing builder stage
• Prebuilt images (Containerfile.prebuilt, Containerfile.telemetry.prebuilt): add ubi9/ubi-minimal as a cert source stage

Fixes #1117

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3fc7ac87-01bc-4854-914b-eea5c8ec041b

📥 Commits

Reviewing files that changed from the base of the PR and between 8f239b7 and 2656f29.

📒 Files selected for processing (5)

• controller/Containerfile
• controller/Containerfile.exporter-set-controller
• controller/Containerfile.operator
• controller/Containerfile.prebuilt
• controller/Containerfile.telemetry.prebuilt

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The controller Containerfiles now include the CA certificate bundle in their runtime images. Three copy the bundle from the builder stage; two add a certs stage based on ubi-minimal:9.8 and copy the bundle from that stage.

Changes

Controller image CA bundle

Layer / File(s)	Summary
Add CA bundle to runtime images controller/Containerfile, controller/Containerfile.exporter-set-controller, controller/Containerfile.operator, controller/Containerfile.prebuilt, controller/Containerfile.telemetry.prebuilt	The three builder-based Containerfiles copy the CA bundle from the builder stage. The two prebuilt Containerfiles add a certs stage based on ubi-minimal:9.8 and copy the bundle into the runtime image.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2656f

The images should include the system CA bundle for supported builds; no merge-blocking issue was found.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding system CA certificates to controller container images.
Description check	✅ Passed	The description directly explains the CA certificate problem, the container image changes, and the expected TLS verification fix.
Linked Issues check	✅ Passed	The PR implements issue #1117. The multi-stage controller, exporter-set-controller, and operator images copy /etc/pki/tls/certs/ca-bundle.crt into the runtime image. The prebuilt controller and tele…
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to adding the system CA bundle to controller runtime image definitions. The changes support the TLS certificate requirement in issue #1117. No unrelated implementation…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit packed a bundle bright,
For runtime images built tonight.
From builder stage or certs stage,
The trust store joins the image’s page.
Now carrot carts roll through the snow.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Container Images

The following container images have been built for this PR:

Image	URI
jumpstarter-controller	quay.io/jumpstarter-dev/jumpstarter-controller:pr-1118
jumpstarter-exporterset-controller	quay.io/jumpstarter-dev/jumpstarter-exporterset-controller:pr-1118
virtual	quay.io/jumpstarter-dev/virtual/qemu-runtime:pr-1118
jumpstarter-operator	quay.io/jumpstarter-dev/jumpstarter-operator:pr-1118
jumpstarter-operator-bundle	quay.io/jumpstarter-dev/jumpstarter-operator-bundle:pr-1118
jumpstarter	quay.io/jumpstarter-dev/jumpstarter:pr-1118
jumpstarter-utils	quay.io/jumpstarter-dev/jumpstarter-utils:pr-1118
jumpstarter-dev	quay.io/jumpstarter-dev/jumpstarter-dev:pr-1118
jumpstarter-devspace	quay.io/jumpstarter-dev/jumpstarter-devspace:pr-1118

Images expire after 7 days.

[jumpstarter-backport-bot]

Backport failed for release-0.9, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-0.9
git worktree add -d .worktree/backport-1118-to-release-0.9 origin/release-0.9
cd .worktree/backport-1118-to-release-0.9
git switch --create backport-1118-to-release-0.9
git cherry-pick -x bc769ca235a4e3fdd0ca6500719a2b4203e33ccc