Skip to content

fix: include system CA certificates in controller container images #1118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mangelajo merged 1 commit into from
Sep 23, 2026
Merged

fix: include system CA certificates in controller container images #1118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions controller/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=1

FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1789345812@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650
WORKDIR /
COPY --from=builder /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt
COPY --from=builder /build/manager .
COPY --from=builder /build/router .
USER 65532:65532
Expand Down
1 change: 1 addition & 0 deletions controller/Containerfile.exporter-set-controller
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=10

FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1789345812@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650
WORKDIR /
COPY --from=builder /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt
COPY --from=builder /build/exporter-set-controller .
USER 65532:65532

Expand Down
1 change: 1 addition & 0 deletions controller/Containerfile.operator
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ RUN --mount=type=cache,target=/opt/app-root/src/go/pkg/mod,sharing=locked,uid=10

FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1789345812@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650
WORKDIR /
COPY --from=builder /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt
COPY --from=builder /opt/app-root/src/deploy/operator/manager .
USER 65532:65532

Expand Down
2 changes: 2 additions & 0 deletions controller/Containerfile.prebuilt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@
# BIN selects which binary becomes the default entrypoint.
# COPY ${BIN} /entrypoint works because COPY supports ARG expansion,
# while ENTRYPOINT does not (and ubi-micro has no shell for shell-form).
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8 AS certs
FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1789345812@sha256:7a0454cbd9bd847e8f6a63b6f0254a6efbeb6e0ed71a5d824a4f6cccbe626650
ARG BIN
WORKDIR /
COPY --from=certs /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt
COPY . .
# ENTRYPOINT can't expand ARG; fixed path lets one file serve all three images
COPY ${BIN} /entrypoint
Expand Down
2 changes: 2 additions & 0 deletions controller/Containerfile.telemetry.prebuilt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# CI-only runtime image for the jumpstarter-telemetry binary.
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8 AS certs
FROM registry.access.redhat.com/ubi9/ubi-micro:9.8-1786321990@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95
WORKDIR /
COPY --from=certs /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.crt
COPY telemetry /telemetry
USER 65532:65532
ENTRYPOINT ["/telemetry"]
Loading