chore(CI): Konflux build to UBI9 #2815

davdhacs · 2026-01-23T04:11:31Z

Description

A detailed explanation of the changes in your PR.

Feel free to remove this section if it is overkill for your PR, and the title of your PR is sufficiently descriptive.

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

TODO(replace-me)
Use this space to explain how you tested your PR, or, if you didn't test it, why you did not do so. (Valid reasons include "CI is sufficient" or "No testable changes")
In addition to reviewing your code, reviewers must also review your testing instructions, and make sure they are sufficient.

For more details, ref the Confluence page about this section.

Update Konflux build configuration to use UBI9 and RHEL 9: - Update builder base image: ubi8/ubi -> ubi9/ubi Pinned to sha256:22e95731596d661ff08daabaa5ef751b20ac42d0a58492dac5efa7373f471389 - Update runtime base image: ubi8/ubi-minimal -> ubi9/ubi-minimal Pinned to sha256:90bd85dcd061d1ad6dbda70a867c41958c04a86462d05c631f8205e8870f28f8 - Add Cachi2 environment sourcing for hermetic RPM builds - Update image label: rhacs-collector-rhel8 -> rhacs-collector-rhel9 - Update Tekton CPE label: el8 -> el9 This aligns collector Konflux builds with the UBI9 migration already completed for GitHub CI builds.

Configure hermetic builds with RHEL 9 package dependencies: - Update rpms.in.yaml: * Change context from bare:true to UBI9 image * Update clang version: clang-19.1.7 -> clang-20.1.8 - Add rpms.rhel.repo with RHEL 9 repository configurations * Updated from RHEL 8 to RHEL 9 base URLs * Includes all required repos for 4 architectures - Add rpms.lock.yaml with locked package versions * Generated for aarch64, ppc64le, s390x, x86_64 * Enables hermetic builds with reproducible dependencies * Required for RHEL-only packages (elfutils-libelf-devel, tbb-devel, c-ares-devel) not in public UBI repos Hermetic builds ensure reproducible container images by prefetching all RPM dependencies before the build starts.

davdhacs · 2026-01-23T04:51:55Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

davdhacs · 2026-01-23T04:55:37Z

@tommartensen does this include all of the Konflux-built collector images? I think this does what is needed: base image update, pinned to latest image shas, and updated rpm lockfiles. Is there anything missing?

tommartensen · 2026-01-23T08:45:53Z

collector/container/konflux.Dockerfile

    io.openshift.tags="rhacs,collector,stackrox" \
    maintainer="Red Hat, Inc." \
-    name="advanced-cluster-security/rhacs-collector-rhel8" \
+    name="advanced-cluster-security/rhacs-collector-rhel9" \


I think this should map to the repo name, which is yet to be decided. The proposal is to not include the RHEL version number in the name.

I'll update it to remove the "9" for now

collector/container/konflux.Dockerfile

rpms.in.yaml

tommartensen · 2026-01-23T08:57:33Z

rpms.in.yaml

 - wget
 - unzip
- clang-19.1.7
+- clang-20.1.8


Please check with @stackrox/collector-team if this clang version is compatible.

The kind of issues we get with incompatible versions of clang are usually detected pretty well by integration tests. Making sure that all the tests pass should be enough.

I think that clang-20 is already what is used for upstream.

ty. This is the latest stable clang I found for ubi9. @ovalenti would it be better to un-pin clang for ubi9?

rpms.rhel.repo

rpms.lock.yaml

ovalenti · 2026-01-23T09:29:35Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

Unfortunately, github will refuse to run its pipelines unless those conflicts are resolved, it seems.

davdhacs · 2026-01-23T15:38:36Z

"This branch has conflicts that must be resolved" because the konflux base image sha's are updated in master. Until we decide to merge this branch, it is not necessary to "resolve" these conflicts because we are ignoring the updates to the UBI8 images for this change.

Unfortunately, github will refuse to run its pipelines unless those conflicts are resolved, it seems.

Thank you. I'll update and fix the conflicts then.

konflux sources the env file for every RUN already Co-authored-by: Tom Martensen <tmartens@redhat.com>

Analysis showed that bare: true and image: with SHA produce identical lockfiles (4,668 lines, 167 packages). Both correctly exclude base image packages, with only 2 packages overlapping (openssl/openssl-libs as dependencies of openssl-devel). Using bare: true is clearer for our use case since collector has two different base images (ubi9/ubi for builder, ubi9/ubi-minimal for runtime). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Source RPMs are required for build-source-image task in Konflux and GPL compliance. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

codecov-commenter · 2026-01-25T20:01:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.38%. Comparing base (24f41bd) to head (e01bd2b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2815   +/-   ##
=======================================
  Coverage   27.38%   27.38%           
=======================================
  Files          95       95           
  Lines        5427     5427           
  Branches     2548     2548           
=======================================
  Hits         1486     1486           
  Misses       3214     3214           
  Partials      727      727

Flag	Coverage Δ
collector-unit-tests	`27.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

tommartensen · 2026-01-26T08:06:37Z

rpms.rhel.repo

-name = Red Hat Enterprise Linux 8 for $basearch - AppStream (RPMs)
-baseurl = https://cdn.redhat.com/content/dist/rhel8/8/$basearch/appstream/os
+[rhel-9-for-$basearch-appstream-rpms]
+name = Red Hat Enterprise Linux 9 for ARM 64 - AppStream (RPMs)


Hm I wonder why this is hardcoded to ARM 64 now...

Find all occurrences of x86_64 and replace them with $basearch.

This step from documentation is missing: https://spaces.redhat.com/pages/viewpage.action?pageId=580257316&spaceKey=StackRox&title=How%2Bto%2Bprefetch%2BRPMs%2Bfor%2BACS%2BKonflux%2Bbuilds#HowtoprefetchRPMsforACSKonfluxbuilds-update-repofileHowtoupdaterpms.rhel.repo

Thank you for catching this. I should have reviewed this file for errors like that. 💣

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

davdhacs added 2 commits January 22, 2026 21:24

davdhacs force-pushed the konflux-ubi9-migration branch from 2334d7b to 23cacca Compare January 23, 2026 04:26

davdhacs requested a review from tommartensen January 23, 2026 04:52

tommartensen reviewed Jan 23, 2026

View reviewed changes

tommartensen requested changes Jan 23, 2026

View reviewed changes

davdhacs and others added 4 commits January 23, 2026 09:01

remove duplicated cachi2 env sourcing

3f88be9

konflux sources the env file for every RUN already Co-authored-by: Tom Martensen <tmartens@redhat.com>

Regenerate rpms.rhel.repo and rpms.lock.yaml with source RPMs enabled

7f0efb4

Source RPMs are required for build-source-image task in Konflux and GPL compliance. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

remove 9 from repo suffix

a9a6866

davdhacs requested a review from tommartensen January 24, 2026 18:44

Merge master (keep UBI9 rpms)

094e8aa

tommartensen reviewed Jan 26, 2026

View reviewed changes

davdhacs and others added 3 commits January 26, 2026 07:40

Fix rpms.rhel.repo to use $basearch variable in name fields

bc767da

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Merge branch 'master' into konflux-ubi9-migration

e01bd2b

empty commit

6dcdf3d

chore(CI): Konflux build to UBI9 #2815

Are you sure you want to change the base?

chore(CI): Konflux build to UBI9 #2815

Conversation

davdhacs commented Jan 23, 2026

Description

Checklist

Testing Performed

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ovalenti commented Jan 23, 2026

Uh oh!

davdhacs commented Jan 23, 2026

Uh oh!

codecov-commenter commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Jan 25, 2026 •

edited

Loading