chore(base-image): Migrate Konflux builds to UBI9/RHEL9 by davdhacs · Pull Request #2562 · stackrox/scanner

davdhacs · 2026-01-15T04:28:55Z

Description

Migrates scanner builds from UBI8/RHEL8 to UBI9/RHEL9 base images.

Key Changes

Konflux Base Images:

Builder: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.24
Scanner runtime: registry.access.redhat.com/ubi9-minimal:latest
Scanner DB: registry.redhat.io/rhel9/postgresql-15:latest
Image names: rhacs-scanner-rhel9, rhacs-scanner-slim-rhel9, rhacs-scanner-db-rhel9, rhacs-scanner-db-slim-rhel9

Non-Konflux Base Images:

Scanner: ubi9-minimal
Scanner DB: ubi9 / ubi9-minimal
Vulnerabilities: ubi9-minimal

RPM/Repo Updates:

rpms.lock.yaml: xz updated from RHEL 8 (5.2.4) to RHEL 9 (5.2.5)
rpms.rhel.repo: repos updated from rhel8 to rhel9
PostgreSQL download script: pg_rhel_major=9

Tekton Labels:

CPE labels: el8 → el9

UBI9 Compatibility Fixes:

update-ca-trust extract -o /etc/pki/ca-trust/extracted for unprivileged containers (RHBZ#2241240)
cp --recursive --no-dereference --no-clobber in restore-all-dir-contents
microdnf install -y xz (explicit -y flag)

Checklist

Investigated and inspected CI test results

Testing Performed

TBD

openshift-ci · 2026-01-15T04:29:19Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

davdhacs · 2026-01-27T14:57:14Z

@tommartensen fyi this is the parallel scanner update for UBI9. In this, we also have to add the update-ca-trust workaround for UBI9 changed perms on second execution.

The arm build fails because tar hits a bug in a syscall in qemu; I still have some debug logging around that, and I expect the arm arch build to fail because of it.

davdhacs · 2026-02-18T05:39:24Z

/test all

Migrate all scanner base images from UBI8/RHEL8 to UBI9/RHEL9: Konflux base images: - Builder: openshift-golang-builder:rhel_9_golang_1.25 - Scanner runtime: ubi9-minimal - Scanner DB: rhel9/postgresql-15 Non-Konflux base images: - Scanner: ubi9-minimal - Scanner DB: ubi9 / ubi9-minimal - Vulnerabilities: ubi9-minimal Other updates: - Tekton CPE labels: el8 -> el9 - rpms.lock.yaml: xz updated to RHEL 9 version (5.2.5-8.el9_0) - rpms.rhel.repo: RHEL 8 repos -> RHEL 9 repos - PostgreSQL download script: pg_rhel_major=9 - Image name labels: rhel8 -> rhel9 - microdnf install -y xz (explicit -y for UBI9 compatibility) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

In UBI9, update-ca-trust fails when running as an unprivileged user (nobody:nobody) because it attempts to write to system-wide paths. Use the -o flag to specify a user-writable output directory. Also switch restore-all-dir-contents to use --no-clobber to avoid overwriting CA trust files that were already updated at runtime. See: https://bugzilla.redhat.com/show_bug.cgi?id=2241240 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

davdhacs · 2026-02-18T21:32:25Z

/retest

davdhacs · 2026-02-19T00:07:01Z

@tommartensen could you review this? (the ubi9 upgrade for scanner(v2); includes the update-ca-trust permissions workaround)

tommartensen

LGTM to me from a Konflux perspective. Have you deployed and smoke tested the resulting images (like we did for collector)?

davdhacs · 2026-02-19T14:44:43Z

LGTM to me from a Konflux perspective. Have you deployed and smoke tested the resulting images (like we did for collector)?

Yes, I tested with these changes (minus the master-merge [empty] commits). I'll re-do the smoke test with this and the latest master collector builds.

BradLugo · 2026-02-23T17:06:39Z

Note to self and @stackrox/scanner: we need to follow up on #2092 and update the image for s390x to avoid using a different version of psql.

image/scanner/scripts/import-additional-cas

…migration

…migration # Conflicts: # image/db/rhel/konflux.Dockerfile

davdhacs · 2026-03-09T16:32:46Z

/test ?

davdhacs · 2026-03-10T04:25:22Z

The test failures are not-related to UBI9/changes in this PR.

Align the scanner entrypoint scripts and Dockerfiles with the proven CA trust setup from stackrox/stackrox#19454: - save-dir-contents: Only save /etc/pki/ca-trust/source (not the full /etc/pki/ca-trust or /etc/ssl). The extracted dir is regenerated at runtime by update-ca-trust. - Remove /etc/ssl from chown and save-dir-contents (not needed). - import-additional-cas: Add logging, use --output flag with detailed comment explaining why it's needed (BZ#2241240). - trust-root-ca: Same --output flag and comment. - restore-all-dir-contents: Add comment explaining --no-clobber. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

davdhacs · 2026-03-25T18:00:06Z

/retest-failed-builds

davdhacs · 2026-03-25T19:05:29Z

/test e2e-tests

…migration

…anner into konflux-ubi9-rhel9-migration

davdhacs · 2026-03-25T23:03:43Z

/retest

image/scanner/scripts/trust-root-ca

…anner into konflux-ubi9-rhel9-migration

davdhacs · 2026-03-27T13:58:53Z

/test e2e-tests

openshift-ci · 2026-04-01T13:54:44Z

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-db-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

davdhacs · 2026-04-03T13:56:59Z

🥳 CA-refactor PR approved and merged into this branch. Now I am re-running CI, and I intend to merge this next week (I'll request approvals after the holiday weekend).

openshift-ci · 2026-04-03T14:06:40Z

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-db-slim-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-04-03T14:14:34Z

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-db-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

…migration

…anner into konflux-ubi9-rhel9-migration

github-actions · 2026-04-13T19:31:37Z

/retest scanner-db-on-push

openshift-ci · 2026-04-13T19:31:47Z

@github-actions[bot]: The /retest command does not accept any targets.
The following commands are available to trigger optional jobs:

/test e2e-tests

/test slim-e2e-tests

Use /test all to run all jobs.

Details

In response to this:

/retest scanner-db-on-push

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

davdhacs · 2026-04-14T13:07:16Z

@BradLugo is scanner CI in a good place -- and we can proceed with this UBI9 bump for scanner (v2)? (in preparation for 4.11.0 having all containers on ubi9/rhel9)

davdhacs · 2026-04-14T13:08:49Z

@mclasmeier re-review please? (holding for Scanner team to sign-off again now since time has passed and there were scanner-repo CI blockers and fixes that I don't know about)

mclasmeier · 2026-04-14T13:36:00Z

Can review either later today or tomorrow.

davdhacs added the konflux-build Run Konflux in PR. Push commit to trigger it. label Jan 15, 2026

openshift-ci bot added the do-not-merge/work-in-progress label Jan 15, 2026

davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from d9cdc31 to d2f149d Compare February 5, 2026 16:58

davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from 34c5d67 to 5a2e599 Compare February 18, 2026 05:37

davdhacs marked this pull request as ready for review February 18, 2026 05:39

davdhacs requested review from a team and rhacs-bot as code owners February 18, 2026 05:39

openshift-ci bot removed the do-not-merge/work-in-progress label Feb 18, 2026

rhacs-bot requested a review from a team February 18, 2026 05:48

davdhacs and others added 2 commits February 18, 2026 14:01

davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from 5a2e599 to b3addf3 Compare February 18, 2026 21:07

empty commit

46d33f6

davdhacs requested a review from tommartensen February 19, 2026 00:06

tommartensen reviewed Feb 19, 2026

View reviewed changes

BradLugo approved these changes Feb 23, 2026

View reviewed changes

mclasmeier reviewed Mar 3, 2026

View reviewed changes

image/scanner/scripts/import-additional-cas Outdated Show resolved Hide resolved

davdhacs added 2 commits March 5, 2026 13:22

Merge remote-tracking branch 'origin/master' into konflux-ubi9-rhel9-…

1ec1ed6

…migration

Merge remote-tracking branch 'origin/master' into konflux-ubi9-rhel9-…

64b335a

…migration # Conflicts: # image/db/rhel/konflux.Dockerfile

davdhacs added 3 commits March 25, 2026 14:34

Merge branch 'master' into konflux-ubi9-rhel9-migration

ea5e1fe

Merge remote-tracking branch 'origin/master' into konflux-ubi9-rhel9-…

0bbcdeb

…migration

Merge branch 'konflux-ubi9-rhel9-migration' of github.com:stackrox/sc…

f48b1c7

…anner into konflux-ubi9-rhel9-migration

davdhacs commented Mar 25, 2026

View reviewed changes

image/scanner/scripts/trust-root-ca Outdated Show resolved Hide resolved

davdhacs added 2 commits March 25, 2026 18:42

Merge branch 'konflux-ubi9-rhel9-migration' of github.com:stackrox/sc…

d795c42

…anner into konflux-ubi9-rhel9-migration

Merge branch 'konflux-ubi9-rhel9-migration' of github.com:stackrox/sc…

d285ba8

…anner into konflux-ubi9-rhel9-migration

davdhacs requested a review from mclasmeier March 26, 2026 00:44

davdhacs force-pushed the konflux-ubi9-rhel9-migration branch from 5c49c9f to d285ba8 Compare March 26, 2026 21:46

restore before refactor

8222ac2

davdhacs requested a review from vladbologa April 1, 2026 13:41

Merge branch 'master' into konflux-ubi9-rhel9-migration

6f8d323

davdhacs and others added 2 commits April 3, 2026 07:55

refactor: Consolidate CA trust setup into import-additional-cas (#2991)

ae9b8ec

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Merge branch 'master' into konflux-ubi9-rhel9-migration

8ef8573

davdhacs added 2 commits April 13, 2026 13:19

Merge remote-tracking branch 'origin/master' into konflux-ubi9-rhel9-…

8598672

…migration

Merge branch 'konflux-ubi9-rhel9-migration' of github.com:stackrox/sc…

8838582

…anner into konflux-ubi9-rhel9-migration

davdhacs requested a review from tommartensen April 14, 2026 13:07

Conversation

davdhacs commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Changes

Checklist

Testing Performed

Uh oh!

openshift-ci bot commented Jan 15, 2026

Uh oh!

davdhacs commented Jan 27, 2026

Uh oh!

davdhacs commented Feb 18, 2026

Uh oh!

davdhacs commented Feb 18, 2026

Uh oh!

davdhacs commented Feb 19, 2026

Uh oh!

tommartensen left a comment

Choose a reason for hiding this comment

Uh oh!

davdhacs commented Feb 19, 2026

Uh oh!

BradLugo commented Feb 23, 2026

Uh oh!

Uh oh!

davdhacs commented Mar 9, 2026

Uh oh!

davdhacs commented Mar 10, 2026

Uh oh!

davdhacs commented Mar 25, 2026

Uh oh!

davdhacs commented Mar 25, 2026

Uh oh!

davdhacs commented Mar 25, 2026

Uh oh!

Uh oh!

davdhacs commented Mar 27, 2026

Uh oh!

openshift-ci bot commented Apr 1, 2026

Uh oh!

davdhacs commented Apr 3, 2026

Uh oh!

openshift-ci bot commented Apr 3, 2026

Uh oh!

openshift-ci bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 13, 2026

Uh oh!

openshift-ci bot commented Apr 13, 2026

Uh oh!

davdhacs commented Apr 14, 2026

Uh oh!

davdhacs commented Apr 14, 2026

Uh oh!

mclasmeier commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

davdhacs commented Jan 15, 2026 •

edited

Loading