CNF-18836 / CNF-20367: Use ubi for both builder and runtime#733
Conversation
|
@fontivan: This pull request references CNF-20367 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Warning Rate limit exceeded@fontivan has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 3 minutes and 28 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (6)
WalkthroughMigrates build-stage image and build-time RPM sources from RHEL 9.6 to UBI9: builder image and container build args updated to UBI, lock-build repo definitions converted to UBI-based repos/metadata, two runtime Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@fontivan: This pull request references CNF-20367 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.konflux/Dockerfile(1 hunks).konflux/container_build_args.conf(1 hunks).konflux/lock-build/rpms.in.yaml(4 hunks).konflux/lock-runtime/rpms.lock.yaml(0 hunks)renovate.json(1 hunks)
💤 Files with no reviewable changes (1)
- .konflux/lock-runtime/rpms.lock.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / recert-4-21-on-pull-request
- GitHub Check: build
🔇 Additional comments (4)
renovate.json (1)
10-11: Renovate regex manager now correctly targets rpms.in.yamlAdding
/.*rpms\\.in\\.yaml$/alongsidecontainer_build_args.conflooks consistent with howvarsFromImagedigests are encoded and should let Renovate manage those image digests as intended. Please just confirm via a Renovate dry‑run or logs that updates to.konflux/lock-*/rpms.in.yamlare detected as expected..konflux/container_build_args.conf (1)
8-8: BUILDER_IMAGE pin to UBI digest aligns with lock-build metadataSwitching
BUILDER_IMAGEto the pinnedubi9/ubi@sha256:…matches thevarsFromImagevalues used in.konflux/lock-build/rpms.in.yaml, which should keep Mintmaker and Conforma in sync. The Dockerfile still defaults toubi9/ubi:latest, so it’s worth confirming your pipeline actually sources the builder image from this args file (and not the Dockerfile default) in all Konflux jobs..konflux/Dockerfile (1)
2-2: Builder stage now based on ubi9/ubi as intendedUpdating
BUILDER_IMAGE’s default toubi9/ubi:latestaligns the Dockerfile with the UBI‑based build image used in.konflux/container_build_args.confand.konflux/lock-build/rpms.in.yaml. Since the Dockerfile uses a tag while the lock/config files use a pinned digest, please double‑check that your Konflux build path always overrides this ARG with the digest fromcontainer_build_args.confso builds stay reproducible..konflux/lock-build/rpms.in.yaml (1)
99-159: RHEL repos correctly demoted and aligned with UBI builder imageThe RHEL repo block clearly documents that RHEL repos are only used for packages not available from UBI and omits EUS variants to “match ubi” (latest), which fits the PR’s goal to prefer UBI. These entries retain the expected RHSM TLS fields and now set
varsFromImageto the sameubi9/ubi@sha256:bbac…digest as the builder image incontainer_build_args.conf, so the comment about matchingBUILDER_IMAGEis accurate.This looks consistent with the new UBI‑first strategy and should play nicely with Conforma’s known‑repos policy.
fontivan
force-pushed
the
sskeard/cnf-20367-cnf-18836-images-overhaul-fix
branch
from
ed9d05f to
b5268e0
Compare
|
@fontivan: This pull request references CNF-20367 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.konflux/container_build_args.conf (1)
14-14: Update RUNTIME_IMAGE to the latest UBI9 minimal digest.The digest specified at line 14 is outdated. The Red Hat registry currently serves
sha256:2fe691b4392baf6c000ee7621f9f2c4d220186e53e3eb97dbcfed6aeddcf73d5forubi9/ubi-minimal:latest, but the code usessha256:61d5ad475048c2e655cd46d0a55dfeaec182cc3faa6348cb85989a7c9e196483. Update to the current digest to ensure security patches and updates are included.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.konflux/Dockerfile(1 hunks).konflux/container_build_args.conf(1 hunks).konflux/lock-build/rpms.in.yaml(4 hunks).konflux/lock-runtime/rpms.lock.yaml(0 hunks)renovate.json(1 hunks)
💤 Files with no reviewable changes (1)
- .konflux/lock-runtime/rpms.lock.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- renovate.json
- .konflux/Dockerfile
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / recert-4-21-on-pull-request
- GitHub Check: build
🔇 Additional comments (2)
.konflux/lock-build/rpms.in.yaml (1)
99-160: RHEL fallback repository configuration looks correct.The RHEL repositories intentionally lack priority fields, which ensures they serve as fallback sources after the UBI repos (which have
priority: 1). This aligns with the PR objective to prefer UBI repositories by default. The addition of SSL client authentication and updated varsFromImage references to the UBI builder image are appropriate..konflux/container_build_args.conf (1)
8-8: Verify this digest against the current Red Hat registry.The base image is maintained by Red Hat and updated regularly. Red Hat releases new images when critical CVEs are patched. Use
skopeo inspect docker://registry.access.redhat.com/ubi9/ubi:latestor check the Red Hat Ecosystem Catalog directly to confirm the digest matches the current patched version. If this digest is older than the latest available, pull and test the current image.
fontivan
force-pushed
the
sskeard/cnf-20367-cnf-18836-images-overhaul-fix
branch
from
b5268e0 to
67df24a
Compare
|
@fontivan: This pull request references CNF-20367 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
.konflux/lock-build/rpms.in.yaml (2)
21-21: ✅ Comment corrections verified.The comments correctly reference
BUILDER_IMAGE(notRUNTIME_IMAGE), maintaining consistency with the actualvarsFromImagevalues pointing to the builder digest. This aligns with the UBI-based builder stage in.konflux/Dockerfile.Also applies to: 36-36, 51-51, 66-66, 81-81, 96-96, 119-119, 140-140, 161-161
50-50: ✅ Priority field consistency verified.The
ubi-9-for-$basearch-baseos-rpmsrepository now includespriority: 1, ensuring consistent package resolution behavior across all UBI repositories.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.konflux/Dockerfile(1 hunks).konflux/container_build_args.conf(1 hunks).konflux/lock-build/rpms.in.yaml(4 hunks).konflux/lock-runtime/rpms.lock.yaml(0 hunks)renovate.json(1 hunks)
💤 Files with no reviewable changes (1)
- .konflux/lock-runtime/rpms.lock.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- renovate.json
- .konflux/container_build_args.conf
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Red Hat Konflux / recert-4-21-on-pull-request
- GitHub Check: build
🔇 Additional comments (1)
.konflux/Dockerfile (1)
2-2: LGTM! Builder image migrated to UBI.The update from
rhel9-6-elstoubi9/ubi:latestaligns with the PR's objectives and is consistent with the UBI-based repository configuration in.konflux/lock-build/rpms.in.yaml.
- Mixing rhel-els and ubi causes significant conforma issues - Instead, use ubi for everything and add the rhel repos where required to resolve the necessary packages - Prefer ubi repos over rhel repos by default - Update renovate configuration to also allow parsing docker images in rpms.in.yaml files Assisted-by: Cursor/claude-4.5-sonnet AI-attribution: AIA,Primarily human-created,Human-initiated,Reviewed,Cursor/claude-4.5-sonnet,v1.0 For more information on AI attribution statements, see: https://aiattribution.github.io/
fontivan
force-pushed
the
sskeard/cnf-20367-cnf-18836-images-overhaul-fix
branch
from
67df24a to
4817cae
Compare
|
@fontivan: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fontivan, rauhersu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Assisted-by: Cursor/claude-4.5-sonnet
AI-attribution: AIA,Primarily human-created,Human-initiated,Reviewed,Cursor/claude-4.5-sonnet,v1.0
For more information on AI attribution statements, see: https://aiattribution.github.io/
Summary by CodeRabbit