Backport: fix: include system CA certificates in controller container images (#1118) - #1120
Conversation
…1118) The `ubi9/ubi-micro` runtime images used for controller containers do not include a CA certificates bundle. This causes TLS verification failures when connecting to external services using publicly trusted CAs (e.g. OIDC providers behind Let's Encrypt certificates): ``` tls: failed to verify certificate: x509: certificate signed by unknown authority ``` Copy the system CA bundle (`/etc/pki/tls/certs/ca-bundle.crt`) into all runtime images: - **Multi-stage builds** (Containerfile, Containerfile.operator, Containerfile.exporter-set-controller): copy from the existing builder stage - **Prebuilt images** (Containerfile.prebuilt, Containerfile.telemetry.prebuilt): add `ubi9/ubi-minimal` as a cert source stage Fixes #1117 Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> (cherry picked from commit bc769ca)
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
merging to release-0.9 is blocked by some macos pytest issue, I'll investigate later |
2 participants
Backport of bc769ca (PR #1118) to release-0.9.
The auto-backport failed because Containerfile.exporter-set-controller, Containerfile.prebuilt and Containerfile.telemetry.prebuilt do not exist in release-0.9; those changes are dropped. Only controller/Containerfile and controller/Containerfile.operator are patched.