Switch BASE_IMAGE to ubi9-minimal

dlom · dlom · commit d668be4b5fa7 · 2025-12-08T15:43:02.000-08:00
diff --git a/.tekton/hive-mce-210-pull-request.yaml b/.tekton/hive-mce-210-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-210-push.yaml b/.tekton/hive-mce-210-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-211-pull-request.yaml b/.tekton/hive-mce-211-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-211-push.yaml b/.tekton/hive-mce-211-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-26-pull-request.yaml b/.tekton/hive-mce-26-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-26-push.yaml b/.tekton/hive-mce-26-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-27-pull-request.yaml b/.tekton/hive-mce-27-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-27-push.yaml b/.tekton/hive-mce-27-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-28-pull-request.yaml b/.tekton/hive-mce-28-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-28-push.yaml b/.tekton/hive-mce-28-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-29-pull-request.yaml b/.tekton/hive-mce-29-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-mce-29-push.yaml b/.tekton/hive-mce-29-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-pull-request.yaml b/.tekton/hive-pull-request.yaml
@@ -45,7 +45,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/.tekton/hive-push.yaml b/.tekton/hive-push.yaml
@@ -42,7 +42,7 @@ spec:
     - CONTAINER_SUB_MANAGER_OFF=1
     - EL8_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g35b6b0c.el8
     - EL9_BUILD_IMAGE=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.24.4-202507171054.g2f6f49f.el9
-    - BASE_IMAGE=registry.redhat.io/rhel9-6-els/rhel:9.6
+    - BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:80f3902b6dcb47005a90e14140eef9080ccc1bb22df70ee16b27d5891524edb2
   - name: build-source-image
     value: 'true'
   - name: build-image-index
diff --git a/Dockerfile b/Dockerfile
@@ -1,7 +1,7 @@
 ARG CONTAINER_SUB_MANAGER_OFF=0
 ARG EL8_BUILD_IMAGE=${EL8_BUILD_IMAGE:-registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.24-openshift-4.20}
 ARG EL9_BUILD_IMAGE=${EL9_BUILD_IMAGE:-registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20}
-ARG BASE_IMAGE=${BASE_IMAGE:-registry.ci.openshift.org/ocp/4.20:base-rhel9}
+ARG BASE_IMAGE=${BASE_IMAGE:-registry.access.redhat.com/ubi9/ubi-minimal:latest}
 
 FROM ${EL8_BUILD_IMAGE} as builder_rhel8
 ARG GO=${GO:-go}
@@ -37,10 +37,7 @@ RUN make build-hiveadmission build-manager build-operator && \
 FROM ${BASE_IMAGE}
 ARG CONTAINER_SUB_MANAGER_OFF
 ENV SMDEV_CONTAINER_OFF=${CONTAINER_SUB_MANAGER_OFF}
-ARG DNF=dnf
-
-# CVE-2023-6597
-RUN ${DNF} upgrade -y python3
+ARG DNF=${DNF:-microdnf}
 
 RUN if [ -e "/activation-key/org" ]; then unlink /etc/rhsm-host; subscription-manager register --force --org $(cat "/activation-key/org") --activationkey $(cat "/activation-key/activationkey"); fi
 
diff --git a/hack/hermetic/redhat.repo b/hack/hermetic/redhat.repo
@@ -9,6 +9,20 @@
 # a "yum repolist" to refresh available repos
 #
 
+[ubi-9-baseos-rpms]
+name = Red Hat Universal Base Image 9 (RPMs) - BaseOS
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os
+enabled = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
+[ubi-9-appstream-rpms]
+name = Red Hat Universal Base Image 9 (RPMs) - AppStream
+baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os
+enabled = 1
+gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
+gpgcheck = 1
+
 [rhel-9-for-$basearch-baseos-eus-rpms]
 name = Red Hat Enterprise Linux 9 for $basearch - BaseOS - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/baseos/os
@@ -17,8 +31,8 @@ gpgcheck = 1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 sslverify = 1
 sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslclientkey = /etc/pki/entitlement/6968121214801895763-key.pem
-sslclientcert = /etc/pki/entitlement/6968121214801895763.pem
+sslclientkey = /etc/pki/entitlement/1854593583666030012-key.pem
+sslclientcert = /etc/pki/entitlement/1854593583666030012.pem
 sslverifystatus = 1
 metadata_expire = 86400
 enabled_metadata = 1
@@ -31,8 +45,8 @@ gpgcheck = 1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 sslverify = 1
 sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslclientkey = /etc/pki/entitlement/6968121214801895763-key.pem
-sslclientcert = /etc/pki/entitlement/6968121214801895763.pem
+sslclientkey = /etc/pki/entitlement/1854593583666030012-key.pem
+sslclientcert = /etc/pki/entitlement/1854593583666030012.pem
 sslverifystatus = 1
 metadata_expire = 86400
 enabled_metadata = 1
diff --git a/hack/hermetic/rpms.in.yaml b/hack/hermetic/rpms.in.yaml
@@ -1,7 +1,7 @@
 contentOrigin:
   repofiles:
     - ./redhat.repo
-packages: [openssh-clients, libvirt-libs, tar, krb5-libs, krb5-devel] # this should be kept in sync with the Dockerfile
+packages: [openssh-clients, libvirt-libs, tar] # this should be kept in sync with the Dockerfile
 arches:
   - x86_64
   - ppc64le
diff --git a/hack/hermetic/rpms.lock.yaml b/hack/hermetic/rpms.lock.yaml
