chore: upgrade UBI images to v10.2

Upgrade UBI images to 10.2. With this update, dbus-glib and iptables
are not available on UBI v10.2, but checking the playwright
dependencies, both packages are not listed in the version in use.

Author: mcapell

changelog/fragments/1779986777-update-ubi-10.2.yaml

@@ -0,0 +1,45 @@
+# REQUIRED
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: other
+
+# REQUIRED for all kinds
+# Change summary; a 80ish characters long description of the change.
+summary: update UBI images to v10.2
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# description:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# impact:
+
+# REQUIRED for breaking-change, deprecation, known-issue
+# action:
+
+# REQUIRED for all kinds
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: all
+
+# AUTOMATED
+# OPTIONAL to manually add other PR URLs
+# PR URL: A link the PR that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+# pr: https://github.com/owner/repo/1234
+
+# AUTOMATED
+# OPTIONAL to manually add other issue URLs
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+# issue: https://github.com/owner/repo/1234

dev-tools/dependencies-report

@@ -46,9 +46,9 @@ go list -m -json all $@ | go run go.elastic.co/go-licence-detector \
 # Fill-in required values for UBI images
 # Check headers in $SRCPATH/notice/dependencies.csv.tmpl:
 # name,url,version,revision,license
-ubiurl='https://catalog.redhat.com/software/containers/ubi9/ubi-minimal/615bd9b4075b022acc111bf5'
-ubisource='https://oss-dependencies.elastic.co/red-hat-universal-base-image-minimal/9/ubi-minimal-9-source.tar.gz'
+ubiurl='https://catalog.redhat.com/software/containers/ubi10/ubi-minimal/66f1504a379b9c2cf23e145c'
+ubisource='https://oss-dependencies.elastic.co/red-hat-universal-base-image-minimal/10/ubi-minimal-10-source.tar.gz'
 ubilicense='Custom;https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf'
 cat <<EOF >> $outfile
-Red Hat Universal Base Image minimal,$ubiurl,9,,$ubilicense,$ubisource
+Red Hat Universal Base Image minimal,$ubiurl,10,,$ubilicense,$ubisource
 EOF

dev-tools/packaging/packages.yml

@@ -170,7 +170,7 @@ shared:
   - &docker_spec
     <<: *binary_spec
     extra_vars:
-      from: '--platform=linux/amd64 redhat/ubi9-minimal'
+      from: '--platform=linux/amd64 redhat/ubi10-minimal'
       buildFrom: '--platform=linux/amd64 cgr.dev/chainguard/wolfi-base'
       user: '{{ .BeatName }}'
       linux_capabilities: ''
@@ -183,18 +183,18 @@ shared:
   - &docker_arm_spec
     <<: *docker_spec
     extra_vars:
-      from: '--platform=linux/arm64 redhat/ubi9-minimal'
+      from: '--platform=linux/arm64 redhat/ubi10-minimal'
       buildFrom: '--platform=linux/arm64 cgr.dev/chainguard/wolfi-base'
 
   - &docker_ubi_spec
     extra_vars:
       image_name: '{{.BeatName}}-ubi'
-      from: '--platform=linux/amd64 redhat/ubi9-minimal'
+      from: '--platform=linux/amd64 redhat/ubi10-minimal'
 
   - &docker_arm_ubi_spec
     extra_vars:
       image_name: '{{.BeatName}}-ubi'
-      from: '--platform=linux/arm64 redhat/ubi9-minimal'
+      from: '--platform=linux/arm64 redhat/ubi10-minimal'
 
   - &docker_wolfi_spec
     extra_vars:

dev-tools/packaging/templates/docker/Dockerfile.tmpl

@@ -158,7 +158,7 @@ USER {{ .user }}
 RUN (npm i -g --loglevel verbose --production --engine-strict  @elastic/synthetics@stack_release || sh -c 'tail -n +1 ${NPM_CONFIG_PREFIX}/_logs/* && exit 1')
 {{- end }}
 
-{{- if (and (eq .BeatName "heartbeat") (contains .from "ubi9-minimal")) }}
+{{- if (and (eq .BeatName "heartbeat") (contains .from "ubi10-minimal")) }}
 USER root
 
 # Install the deps as needed by the exact version of playwright elastic synthetics uses
@@ -169,7 +169,7 @@ RUN for iter in {1..10}; do \
     microdnf -y install fontconfig freetype cairo glib2 gtk3 pango xorg-x11-fonts-misc xorg-x11-fonts-Type1 \
     at-spi2-atk atk at-spi2-core alsa-lib cups-libs dbus-libs libdrm mesa-libEGL mesa-libgbm nspr nss libX11 \
     libX11-xcb libxcb libXcomposite libXdamage libXext libXfixes libXrandr libxkbcommon libxshmfence glib2 \
-    dbus-glib libicu mesa-libGL unzip \
+    libicu mesa-libGL unzip \
     findutils shadow-utils ca-certificates gawk libcap xz tar -y && \
     mkdir -p /usr/share/fonts/google-noto && \
     curl -L -o NotoSansCJKjp.zip https://github.com/notofonts/noto-cjk/releases/download/Sans2.004/06_NotoSansCJKjp.zip && \

dev-tools/packaging/templates/ironbank/auditbeat/Dockerfile

@@ -3,8 +3,8 @@
 # Extract Auditbeat and make various file manipulations.
 ################################################################################
 ARG BASE_REGISTRY=registry1.dsop.io
-ARG BASE_IMAGE=redhat/ubi/ubi9
-ARG BASE_TAG=10.1
+ARG BASE_IMAGE=redhat/ubi/ubi10
+ARG BASE_TAG=10.2
 
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as builder
 

dev-tools/packaging/templates/ironbank/auditbeat/hardening_manifest.yaml

@@ -13,8 +13,8 @@ tags:
 
 # Build args passed to Dockerfile ARGs
 args:
-  BASE_IMAGE: "redhat/ubi/ubi9"
-  BASE_TAG: "10.1"
+  BASE_IMAGE: "redhat/ubi/ubi10"
+  BASE_TAG: "10.2"
   ELASTIC_STACK: "{{ beat_version }}"
   ELASTIC_PRODUCT: "auditbeat"
 

dev-tools/packaging/templates/ironbank/filebeat/Dockerfile

@@ -3,8 +3,8 @@
 # Extract Filebeat and make various file manipulations.
 ################################################################################
 ARG BASE_REGISTRY=registry1.dsop.io
-ARG BASE_IMAGE=redhat/ubi/ubi9
-ARG BASE_TAG=10.1
+ARG BASE_IMAGE=redhat/ubi/ubi10
+ARG BASE_TAG=10.2
 
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as builder
 

dev-tools/packaging/templates/ironbank/filebeat/hardening_manifest.yaml

@@ -13,8 +13,8 @@ tags:
 
 # Build args passed to Dockerfile ARGs
 args:
-  BASE_IMAGE: "redhat/ubi/ubi9"
-  BASE_TAG: "10.1"
+  BASE_IMAGE: "redhat/ubi/ubi10"
+  BASE_TAG: "10.2"
   ELASTIC_STACK: "{{ beat_version }}"
   ELASTIC_PRODUCT: "filebeat"
 

dev-tools/packaging/templates/ironbank/heartbeat/Dockerfile

@@ -3,8 +3,8 @@
 # Extract Heartbeat and make various file manipulations.
 ################################################################################
 ARG BASE_REGISTRY=registry1.dsop.io
-ARG BASE_IMAGE=redhat/ubi/ubi9
-ARG BASE_TAG=10.1
+ARG BASE_IMAGE=redhat/ubi/ubi10
+ARG BASE_TAG=10.2
 
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as prep_files
 

dev-tools/packaging/templates/ironbank/heartbeat/hardening_manifest.yaml

@@ -13,8 +13,8 @@ tags:
 
 # Build args passed to Dockerfile ARGs
 args:
-  BASE_IMAGE: "redhat/ubi/ubi9"
-  BASE_TAG: "10.1"
+  BASE_IMAGE: "redhat/ubi/ubi10"
+  BASE_TAG: "10.2"
   ELASTIC_STACK: "{{ beat_version }}"
   ELASTIC_PRODUCT: "heartbeat"