ACM-38044: update Containerfile.cli base images to floating tags [release-4.18]#9044
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: yiraeChristineKim The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
21d7318 to
330bcc4
Compare
|
/cc @gparvin |
330bcc4 to
c17e7d0
Compare
|
Thanks @gparvin! Updated to /area dependency |
openshift-ci
Bot
added
area/dependency
|
/retest images |
|
@yiraeChristineKim: The The following commands are available to trigger optional jobs: Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
c17e7d0 to
ad432b3
Compare
|
Fixed the build failure — |
…lease-4.18)
Move the hypershift-cli builder and runtime base images off pinned
build-stamp tags to floating tags so rebuilds automatically pick up
the latest CVE-fixed layers.
- Builder: registry.redhat.io/rhel9/go-toolset:1.24.6-1763548439
→ brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24
- Runtime: registry.redhat.io/ubi9/nginx-124:1-1767745334
→ registry.redhat.io/ubi9/nginx-124:latest
registry.redhat.io/rhel9/go-toolset:1.24 is no longer supported;
using the OpenShift build of the Go toolset on brew.registry.redhat.io,
consistent with the rhel_9_1.22 tag used by Containerfile.operator and
Containerfile.control-plane on this branch.
Drop --chown=default from the builder COPY: openshift-golang-builder
runs as root and does not define a "default" user. Add
--chown=1001:0 to the runtime COPY --from=builder so the binaries
arrive owned by the nginx user (uid 1001) and the find -delete step
can remove the unwanted non-.tar.gz files.
Fixes: https://redhat.atlassian.net/browse/ACM-38044
Co-authored-by: Cursor <cursoragent@cursor.com>
ad432b3 to
e7428e5
Compare
|
Fixed another build failure caused by the builder switch: Root cause: Fix: Added |
|
@yiraeChristineKim: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
A few concerns with this PR:
1. Missing PRs for 4.19, 4.20, etc... — Both release-4.19 and release-4.20 have the same stale nginx-124:1-1767745334 pinned image. If the goal is to fix the catalog grade for stale base images, the same fix should apply to those branches too. The standard process is to fix in main first (already done there) and cherry-pick backwards — not to target only the oldest affected branch.
2. PR description doesn't match the diff — The description says "Both images stay on registry.redhat.io (no registry change)" but the builder actually changes from registry.redhat.io/rhel9/go-toolset to brew.registry.redhat.io/rh-osbs/openshift-golang-builder. That's a registry and image change.
3. No OCPBUGS ticket — Changes to release branches should have an associated OCPBUGS for traceability in the OCP release process. ACM-38044 is an ACM-scoped ticket, not an OCP one.
4. Undocumented functional change — The --chown=1001:0 addition on the runtime COPY is a functional change that isn't mentioned in the PR description or rationale. See inline comment.
| FROM registry.redhat.io/ubi9/nginx-124:latest | ||
|
|
||
| COPY --from=builder /hypershift/bin/ /opt/app-root/src/ | ||
| COPY --chown=1001:0 --from=builder /hypershift/bin/ /opt/app-root/src/ |
There was a problem hiding this comment.
This --chown=1001:0 doesn't exist on release-4.19, release-4.20, or main. What's the rationale for adding it only here? This is a functional change (changes file ownership in the runtime image) that isn't mentioned in the PR description.
There was a problem hiding this comment.
Let me add to description why I change this
|
/retitle ACM-38044: update Containerfile.cli base images to floating tags [release-4.18] |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@yiraeChristineKim: This pull request references ACM-38044 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.18.z" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jparrill Missing PRs for 4.19, 4.20 -> We only got 4.18 alert so far when we get other alert then I will open a PR |
4 participants
Summary
Updates
Containerfile.clionrelease-4.18to use floating base image tags so each rebuild automatically picks up the latest CVE-fixed layers, improving the catalog security grade formulticluster-engine/hypershift-cli-rhel9.Changes
registry.redhat.io/rhel9/go-toolset:1.24.6-1763548439brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24registry.redhat.io/ubi9/nginx-124:1-1767745334registry.redhat.io/ubi9/nginx-124:latestCOPY --chown=default . .COPY . .COPY --from=builder /hypershift/bin/ ...COPY --chown=1001:0 --from=builder /hypershift/bin/ ...Why floating tags
The pinned/stale base images are contributing to a catalog grade of D for
multicluster-engine/hypershift-cli-rhel9(MCE 2.8). Floating tags allow rebuilds to pick up current CVE-fixed layers automatically.Why
brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24Using the recommended Konflux/CPaaS builder image as suggested by @gparvin.
Why
COPY . .(no--chown=default)The previous image (
go-toolset) defined adefaultuser, so--chown=defaultworked. The newopenshift-golang-builderimage does not define adefaultuser, causing:Removing
--chown=defaultfixes the build. The builder stage runs as root, which is expected for a build-only stage.Why
--chown=1001:0on the runtime COPYBecause
--chown=defaultwas removed from the builder-stage COPY, the compiled binaries are owned by root. When copied into the runtime stage, the nginx process (uid 1001) cannot delete them during cleanup:Adding
--chown=1001:0toCOPY --from=buildertransfers ownership to the nginx user (uid 1001), allowing thefind -deletestep to succeed. This is the standard pattern for UBI-based runtime images running as a non-root user.Why only on this branch:
release-4.19,release-4.20, andmainstill useregistry.redhat.io/rhel9/go-toolsetas the builder, which does define adefaultuser — so theirCOPY --chown=defaultcontinues to work and the binaries are already owned by the correct user when copied to the runtime stage. This change is a consequence of switching toopenshift-golang-builderonrelease-4.18.Jira
https://redhat.atlassian.net/browse/ACM-38044
Test plan
Permission deniederrorshypershift-cliimproves after rebuild