Skip to content

NO-JIRA: [RHCOS10] Migrate base images and operand images to UBI10/RHEL10 #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PillaiManish wants to merge 1 commit into
base: main
Choose a base branch
from
+91 −24
Open

NO-JIRA: [RHCOS10] Migrate base images and operand images to UBI10/RHEL10 #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions .work/compliance/rhcos10/PR2-ubi10-migration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
# RHCOS10: UBI10 Migration

## Summary

Migrate container base images and operand images from UBI9/RHEL9 and upstream
`ghcr.io/spiffe` mirrors to UBI10/RHEL10 and Red Hat internal
`quay.io/rh-ee-rausingh` mirrors for native RHCOS10 compatibility.

```text
registry.access.redhat.com/ubi9-minimal:9.4 → registry.redhat.io/ubi10:10.1 (Dockerfile runtime)
registry.access.redhat.com/ubi9:latest → registry.redhat.io/ubi10/ubi:10.1 (init container)
ghcr.io/spiffe/* → quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-*
```

## Operator Image Changes

| File | Before | After |
|------|--------|-------|
| `Dockerfile` (builder stage) | `registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.23-openshift-4.18` | `registry.redhat.io/ubi10/go-toolset:10.1` |
| `Dockerfile` (runtime stage) | `registry.access.redhat.com/ubi9-minimal:9.4` | `registry.redhat.io/ubi10:10.1` |
| `vendor/…/build-machinery-go/.ci-operator.yaml` | `rhel-9-release-golang-1.23-openshift-4.19` | `rhel-10-release-golang-1.24-openshift-4.20` |

## Operand / Related Image Changes

| Env Var | Before | After |
|---------|--------|-------|
| `RELATED_IMAGE_SPIRE_SERVER` | `ghcr.io/spiffe/spire-server:1.13.3` | `quay.io/rh-ee-rausingh/…-spire-server:v1.13.3` |
| `RELATED_IMAGE_SPIRE_AGENT` | `ghcr.io/spiffe/spire-agent:1.13.3` | `quay.io/rh-ee-rausingh/…-spire-agent:v1.13.3` |
| `RELATED_IMAGE_SPIFFE_CSI_DRIVER` | `ghcr.io/spiffe/spiffe-csi-driver:0.2.8` | `quay.io/rh-ee-rausingh/…-spiffe-spiffe-csi:v0.2.8` |
| `RELATED_IMAGE_SPIRE_OIDC_DISCOVERY_PROVIDER` | `ghcr.io/spiffe/oidc-discovery-provider:1.13.3` | `quay.io/rh-ee-rausingh/…-spire-oidc-discovery-provider:v1.13.3` |
| `RELATED_IMAGE_SPIRE_CONTROLLER_MANAGER` | `ghcr.io/spiffe/spire-controller-manager:0.6.3` | `quay.io/rh-ee-rausingh/…-spiffe-spire-controller-manager:v0.6.3` |
| `RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER` | `registry.access.redhat.com/ubi9:latest` | `registry.redhat.io/ubi10/ubi:10.1` |
| `RELATED_IMAGE_SPIFFE_HELPER` _(new)_ | `ghcr.io/spiffe/spiffe-helper:0.11.0` | `quay.io/rh-ee-rausingh/…-spiffe-spiffe-helper:v0.10.0` |

## Files Changed

- `Dockerfile`
- `config/manager/manager.yaml`
- `bundle/manifests/zero-trust-workload-identity-manager.clusterserviceversion.yaml`
- `pkg/controller/utils/relatedImages.go`
- `pkg/controller/spiffe-csi-driver/daemonset_test.go`
- `test/e2e/utils/constants.go`
- `vendor/github.com/openshift/build-machinery-go/.ci-operator.yaml`

## Prerequisite

PR1 (`rhcos10-ubi9-compat-test`) must pass CI on RHCOS10 nodes before merging this.

## Test Checklist

- [ ] `e2e` passes on RHCOS10 nodes
- [ ] `e2e-fips` passes on RHCOS10 nodes
- [ ] Operator image pulls successfully from RHCOS10 nodes
- [ ] SPIRE server, agent, CSI driver, OIDC provider all reach `Available`
- [ ] No regressions against existing RHEL9 CI jobs

## Exclusions

- `bundle.Dockerfile` — uses `FROM scratch`, no base image change needed
- `.ci-operator.yaml` (root) — build root remains on RHEL9 for this cycle
5 changes: 3 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
# Build the Zero Trust Workload Identity Manager binary
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.23-openshift-4.18 AS builder
FROM registry.redhat.io/ubi10/go-toolset:10.1 AS builder
ARG TARGETOS
ARG TARGETARCH

WORKDIR /workspace
USER root

COPY . .

Expand All @@ -13,7 +14,7 @@ RUN go mod download
RUN CGO_ENABLED=1 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
go build -mod=mod -a -o zero-trust-workload-identity-manager ./cmd/zero-trust-workload-identity-manager/main.go

FROM registry.access.redhat.com/ubi9-minimal:9.4
FROM registry.redhat.io/ubi10:10.1

@coderabbitai coderabbitai Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# Find and inspect the Dockerfile
fd -t f "Dockerfile" --exec wc -l {} \;

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 594

🏁 Script executed:

# Show current Dockerfile content
cat -n Dockerfile

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 844

🏁 Script executed:

# Check git diff to see what changed
git diff HEAD Dockerfile | head -100

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 72

🏁 Script executed:

# Search for all UBI10 references in the repository
rg "registry\.redhat\.io/ubi" --no-heading -n

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 928

🏁 Script executed:

# Check git log to understand the context of changes
git log --oneline -10

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 171

🌐 Web query:

Red Hat UBI10 container image registry path format registry.redhat.io/ubi10

💡 Result:

The registry path format for Red Hat UBI 10 (Universal Base Image 10) container images on registry.redhat.io is registry.redhat.io/ubi10/<image-name>:<tag>. This requires authentication via a Red Hat subscription. Examples: - registry.redhat.io/ubi10/ubi:latest (standard UBI image) - registry.redhat.io/ubi10/ubi-minimal:latest - registry.redhat.io/ubi10/ubi-init:latest - registry.redhat.io/ubi10/s2i-base (as seen in updates) UBI images are also available without authentication from registry.access.redhat.com/ubi10/<image-name>:<tag> for public use. To pull from registry.redhat.io, authenticate first: podman login registry.redhat.io using your customer portal credentials.

Citations:

Fix the runtime image reference path to include the image name.

Line 17 uses registry.redhat.io/ubi10:10.1, which is an invalid registry path. Red Hat's UBI10 image registry requires the format registry.redhat.io/ubi10/<image-name>:<tag>. This reference will fail to pull. The codebase consistently uses registry.redhat.io/ubi10/ubi:10.1 elsewhere (config/manager, tests, manifests, and relatedImages). Update line 17 to match: FROM registry.redhat.io/ubi10/ubi:10.1.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile` at line 17, Replace the invalid runtime image reference in the
Dockerfile FROM instruction: change the existing "FROM
registry.redhat.io/ubi10:10.1" to include the image name so it reads "FROM
registry.redhat.io/ubi10/ubi:10.1"; update the Dockerfile's FROM line (the FROM
instruction) to match the registry format used elsewhere.

WORKDIR /
COPY --from=builder /workspace/zero-trust-workload-identity-manager /usr/bin
USER 65532:65532
Expand Down
28 changes: 16 additions & 12 deletions bundle/manifests/zero-trust-workload-identity-manager.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -694,19 +694,21 @@ spec:
- name: OPERATOR_VERSION
value: 1.0.0
- name: RELATED_IMAGE_SPIRE_SERVER
value: ghcr.io/spiffe/spire-server:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-server:v1.13.3
- name: RELATED_IMAGE_SPIRE_AGENT
value: ghcr.io/spiffe/spire-agent:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-agent:v1.13.3
- name: RELATED_IMAGE_SPIFFE_CSI_DRIVER
value: ghcr.io/spiffe/spiffe-csi-driver:0.2.8
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-csi:v0.2.8
- name: RELATED_IMAGE_SPIRE_OIDC_DISCOVERY_PROVIDER
value: ghcr.io/spiffe/oidc-discovery-provider:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-oidc-discovery-provider:v1.13.3
- name: RELATED_IMAGE_SPIRE_CONTROLLER_MANAGER
value: ghcr.io/spiffe/spire-controller-manager:0.6.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spire-controller-manager:v0.6.3
- name: RELATED_IMAGE_NODE_DRIVER_REGISTRAR
value: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.4
- name: RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER
value: registry.access.redhat.com/ubi9:latest
value: registry.redhat.io/ubi10/ubi:10.1
- name: RELATED_IMAGE_SPIFFE_HELPER
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-helper:v0.10.0
Comment on lines +710 to +711

@coderabbitai coderabbitai Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

RELATED_IMAGE_SPIFFE_HELPER is added in CSV but not wired into operator image resolution

Line 710 and Line 800 introduce helper image config, but the operator utility layer does not define/read this env var (pkg/controller/utils/constants.go:55-62, pkg/controller/utils/relatedImages.go:1-59). This leaves the helper image outside the existing RELATED_IMAGE plumbing and can break maintainability/disconnected image override expectations.

Proposed wiring changes 
diff --git a/pkg/controller/utils/constants.go b/pkg/controller/utils/constants.go
@@
 	SpireControllerManagerImageEnv     = "RELATED_IMAGE_SPIRE_CONTROLLER_MANAGER"
 	NodeDriverRegistrarImageEnv        = "RELATED_IMAGE_NODE_DRIVER_REGISTRAR"
 	SpiffeCSIInitContainerImageEnv     = "RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER"
+	SpiffeHelperImageEnv               = "RELATED_IMAGE_SPIFFE_HELPER"
diff --git a/pkg/controller/utils/relatedImages.go b/pkg/controller/utils/relatedImages.go
@@
 func GetSpiffeCsiInitContainerImage() string {
 	containerImage := os.Getenv(SpiffeCSIInitContainerImageEnv)
 	if containerImage == "" {
 		return "registry.redhat.io/ubi10/ubi:10.1"
 	}
 	return containerImage
 }
+
+func GetSpiffeHelperImage() string {
+	spiffeHelperImage := os.Getenv(SpiffeHelperImageEnv)
+	if spiffeHelperImage == "" {
+		return ""
+	}
+	return spiffeHelperImage
+}

As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."

Also applies to: 800-801

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In
`@bundle/manifests/zero-trust-workload-identity-manager.clusterserviceversion.yaml`
around lines 710 - 711, The CSV added RELATED_IMAGE_SPIFFE_HELPER but the
operator code doesn't declare or include that key in the RELATED_IMAGE plumbing;
add a constant named RELATED_IMAGE_SPIFFE_HELPER to
pkg/controller/utils/constants.go and then wire it into the related images
resolution in pkg/controller/utils/relatedImages.go by adding the same key to
the relatedImages map/processing (the same place other RELATED_IMAGE_* entries
are handled, e.g., where GetRelatedImages()/relatedImages map is defined) so the
operator reads the env var and resolves/overrides the helper image just like the
other RELATED_IMAGE variables.

- name: OPERATOR_LOG_LEVEL
value: "2"
- name: METRICS_BIND_ADDRESS
Expand Down Expand Up @@ -785,18 +787,20 @@ spec:
provider:
name: Red Hat
relatedImages:
- image: ghcr.io/spiffe/spire-server:1.13.3
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-server:v1.13.3
name: spire-server
- image: ghcr.io/spiffe/spire-agent:1.13.3
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-agent:v1.13.3
name: spire-agent
- image: ghcr.io/spiffe/spiffe-csi-driver:0.2.8
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-csi:v0.2.8
name: spiffe-csi-driver
- image: ghcr.io/spiffe/oidc-discovery-provider:1.13.3
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-oidc-discovery-provider:v1.13.3
name: spire-oidc-discovery-provider
- image: ghcr.io/spiffe/spire-controller-manager:0.6.3
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spire-controller-manager:v0.6.3
name: spire-controller-manager
- image: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-helper:v0.10.0
name: spiffe-helper
- image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.4
name: node-driver-registrar
- image: registry.access.redhat.com/ubi9:latest
- image: registry.redhat.io/ubi10/ubi:10.1
name: spiffe-csi-init-container
version: 1.0.0
14 changes: 8 additions & 6 deletions config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,19 +79,21 @@ spec:
- name: OPERATOR_VERSION
value: 1.0.0
- name: RELATED_IMAGE_SPIRE_SERVER
value: ghcr.io/spiffe/spire-server:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-server:v1.13.3
- name: RELATED_IMAGE_SPIRE_AGENT
value: ghcr.io/spiffe/spire-agent:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-agent:v1.13.3
- name: RELATED_IMAGE_SPIFFE_CSI_DRIVER
value: ghcr.io/spiffe/spiffe-csi-driver:0.2.8
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-csi:v0.2.8
- name: RELATED_IMAGE_SPIRE_OIDC_DISCOVERY_PROVIDER
value: ghcr.io/spiffe/oidc-discovery-provider:1.13.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spire-oidc-discovery-provider:v1.13.3
- name: RELATED_IMAGE_SPIRE_CONTROLLER_MANAGER
value: ghcr.io/spiffe/spire-controller-manager:0.6.3
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spire-controller-manager:v0.6.3
- name: RELATED_IMAGE_NODE_DRIVER_REGISTRAR
value: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.4
- name: RELATED_IMAGE_SPIFFE_CSI_INIT_CONTAINER
value: registry.access.redhat.com/ubi9:latest
value: registry.redhat.io/ubi10/ubi:10.1
- name: RELATED_IMAGE_SPIFFE_HELPER
value: quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-helper:v0.10.0
Comment on lines +95 to +96

@coderabbitai coderabbitai Bot Mar 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify whether RELATED_IMAGE_SPIFFE_HELPER is wired through Go code.
rg -n -C2 'RELATED_IMAGE_SPIFFE_HELPER|SpiffeHelperImageEnv\b|func GetSpiffeHelperImage\('

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 1296

🏁 Script executed:

# Check what actually exists in constants.go around the mentioned lines
cat -n pkg/controller/utils/constants.go | head -70 | tail -20

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 1270

🏁 Script executed:

# Check what getters exist in relatedImages.go
grep -n "^func Get" pkg/controller/utils/relatedImages.go

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 409

🏁 Script executed:

# Search for any references to spiffe-helper or SpiffeHelper in Go code
rg -n "spiffe.?helper|SpiffeHelper" --type go

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 1933

🏁 Script executed:

# Check if there's any other pattern for consuming RELATED_IMAGE_* variables
rg -n "RELATED_IMAGE_" --type go -A 2 -B 2 | head -50

Repository: openshift/zero-trust-workload-identity-manager

Length of output: 1095

Add SpiffeHelperImageEnv to constants and GetSpiffeHelperImage() to relatedImages, or remove this unused env var.

The RELATED_IMAGE_SPIFFE_HELPER env var is added to the manifest, but the controller does not wire it. pkg/controller/utils/constants.go (lines 56–62) defines env var constants for all other images (SpireServerImageEnv, SpiffeCSIInitContainerImageEnv, etc.) but has no SpiffeHelperImageEnv. Similarly, pkg/controller/utils/relatedImages.go has getters for all other images but no GetSpiffeHelperImage(). This is dead configuration.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@config/manager/manager.yaml` around lines 95 - 96, Add a SpiffeHelperImageEnv
constant and a GetSpiffeHelperImage() accessor so the
RELATED_IMAGE_SPIFFE_HELPER env var is actually used: define
SpiffeHelperImageEnv alongside the other image constants (matching the naming
pattern used for SpireServerImageEnv, SpiffeCSIInitContainerImageEnv, etc.), add
a corresponding field/getter on the related images helper (e.g., implement
GetSpiffeHelperImage() on the same type that provides the other getters), and
wire that getter where related images are injected so the manifest env var is
consumed; alternatively remove the RELATED_IMAGE_SPIFFE_HELPER entry from the
manifest if you choose not to add SpiffeHelperImageEnv/GetSpiffeHelperImage().

- name: OPERATOR_LOG_LEVEL
value: "2"
- name: METRICS_BIND_ADDRESS
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/spiffe-csi-driver/daemonset_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,8 +166,8 @@ func testInitContainer(t *testing.T, container corev1.Container) {
t.Errorf("Expected init container name 'set-context', got '%s'", container.Name)
}

if container.Image != "registry.access.redhat.com/ubi9:latest" {
t.Errorf("Expected init container image 'registry.access.redhat.com/ubi9:latest', got '%s'", container.Image)
if container.Image != "registry.redhat.io/ubi10/ubi:10.1" {
t.Errorf("Expected init container image 'registry.redhat.io/ubi10/ubi:10.1', got '%s'", container.Image)
}

expectedCommand := []string{"chcon", "-Rvt", "container_file_t", "spire-agent-socket/"}
Expand Down
2 changes: 1 addition & 1 deletion pkg/controller/utils/relatedImages.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ func GetNodeDriverRegistrarImage() string {
func GetSpiffeCsiInitContainerImage() string {
containerImage := os.Getenv(SpiffeCSIInitContainerImageEnv)
if containerImage == "" {
return "registry.access.redhat.com/ubi9:latest"
return "registry.redhat.io/ubi10/ubi:10.1"
}
return containerImage
}
2 changes: 1 addition & 1 deletion test/e2e/utils/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ const (

SpiffeHelperConfigMapName = "spiffe-helper-config"
SpiffeHelperContainerName = "spiffe-helper"
SpiffeHelperImage = "ghcr.io/spiffe/spiffe-helper:0.11.0"
SpiffeHelperImage = "quay.io/rh-ee-rausingh/zero-trust-workload-identity-manager-spiffe-spiffe-helper:v0.10.0"

DefaultInterval = 10 * time.Second
ShortInterval = 5 * time.Second
Expand Down