CNF-20367 / CNF-18836: Align on changes to telco5g-konflux

[fontivan]

• Update telco5g-konflux to the latest commit
• Remove now unnecessary RHEL9_RELEASE variable
• Add latest tag to the builder and runtime images

Summary by CodeRabbit

• Chores
  • Updated container builder and runtime images to use latest tags instead of specific digests
  • Updated dependency lock files to reference latest image variants
  • Simplified build configuration by removing release version variable
  • Updated internal submodule reference

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[openshift-ci-robot]

@fontivan: This pull request references CNF-18836 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

• Update telco5g-konflux to the latest commit
• Remove now unnecessary RHEL9_RELEASE variable
• Add latest tag to the builder and runtime images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[fontivan]

/cc @rauhersu

[coderabbitai]

Walkthrough

Container image references in Konflux configuration files were updated to use :latest tags alongside digest references. The RHEL9_RELEASE variable was removed from the Makefile and its associated target call. The telco5g-konflux submodule pointer was updated to a new commit.

Changes

Cohort / File(s)	Change Summary
Konflux image configuration .konflux/container_build_args.conf, .konflux/lock-build/rpms.in.yaml, .konflux/lock-runtime/rpms.in.yaml	Updated container image references to include :latest tag before digest (e.g., ubi@sha256:... → ubi:latest@sha256:...) across builder and runtime image specifications
Build system Makefile	Removed global RHEL9_RELEASE variable definition and its propagation to the konflux-update-rpm-lock-build target
Submodule telco5g-konflux	Updated submodule pointer from commit a3d90721bf11b308a5f916d49c293bc09e03828d to 01c334c3144684789edab99f5a20a52eb171eac4

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify that adding :latest tag before digest in image references does not affect build reproducibility or image resolution behavior
• Confirm that removing RHEL9_RELEASE variable and its usage does not break dependent build processes or lock generation steps
• Review telco5g-konflux submodule commit to ensure compatibility with current project state

Possibly related PRs

• CNF-18836 / CNF-20367: Reconfigure repo to allow mintmaker rpm updates to work with ubi9 images #716: Modifies the same Konflux image configuration files and Makefile image/lock handling logic
• CNF-18558: Integrate rpm lockfile scripts #521: Updates the same rpm-lock files and directly involves the RHEL9_RELEASE variable removal
• CNF-18836 / CNF-20367: Use ubi for both builder and runtime #733: Changes the same config files to update builder/runtime image references to UBI

Suggested labels

lgtm, approved

Suggested reviewers

• danmanor
• tsorya
• mresvanis
• omertuc

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: updating telco5g-konflux and aligning related configuration changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1f5c4f5 and ac671c7.

📒 Files selected for processing (5)

• .konflux/container_build_args.conf (1 hunks)
• .konflux/lock-build/rpms.in.yaml (6 hunks)
• .konflux/lock-runtime/rpms.in.yaml (3 hunks)
• Makefile (0 hunks)
• telco5g-konflux (1 hunks)

💤 Files with no reviewable changes (1)

• Makefile

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: Red Hat Konflux / recert-4-21-on-pull-request
• GitHub Check: build

🔇 Additional comments (4)

telco5g-konflux (1)

1-1: Verify submodule changes align with PR objectives.

Submodule updates carry inherent risk since the actual changes within telco5g-konflux are not visible in this PR review. The submodule is not accessible in the verification environment, so direct inspection of the commit diff is not possible.

Please confirm that:

1. The new commit (01c334c3144684789edab99f5a20a52eb171eac4) has been reviewed and contains the expected changes related to adding :latest tag support to builder and runtime images
2. No breaking changes were introduced in this update
3. The new commit has been tested (e.g., CI pipeline results, manual verification)

.konflux/lock-runtime/rpms.in.yaml (1)

21-21: Image references correctly aligned with RUNTIME_IMAGE definition.

All three varsFromImage entries consistently reference ubi-minimal:latest@sha256:61d5ad..., matching the RUNTIME_IMAGE in .konflux/container_build_args.conf. The addition of the :latest tag alongside the digest provides semantic clarity while maintaining reproducibility through digest pinning.

Please verify that the Konflux build system correctly processes the image:latest@digest format. This combines semantic tagging with digest-based reproducibility, which is valid in container registries, but confirmation that your build pipeline properly handles this format would be prudent.

Also applies to: 35-35, 49-49

.konflux/lock-build/rpms.in.yaml (1)

23-23: Image references consistently updated across all build repositories.

All six varsFromImage entries now reference ubi:latest@sha256:dcd8128d..., matching the BUILDER_IMAGE in .konflux/container_build_args.conf. The change is uniformly applied across all six repository definitions (UBI and RHEL, AppStream, BaseOS, and CodeReady Builder variants), maintaining consistency in the build configuration.

Also applies to: 38-38, 53-53, 75-75, 96-96, 117-117

.konflux/container_build_args.conf (1)

8-8: BUILDER_IMAGE and RUNTIME_IMAGE correctly updated with :latest tags.

Both variables now include the :latest semantic tag while maintaining digest-based reproducibility. The updates align with the PR objectives and are consistent with the corresponding varsFromImage references in .konflux/lock-build/rpms.in.yaml and .konflux/lock-runtime/rpms.in.yaml.

Also applies to: 14-14

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@fontivan: This pull request references CNF-18836 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

Details

In response to this:

• Update telco5g-konflux to the latest commit
• Remove now unnecessary RHEL9_RELEASE variable
• Add latest tag to the builder and runtime images

Summary by CodeRabbit

• Chores
• Updated container builder and runtime images to use latest tags instead of specific digests
• Updated dependency lock files to reference latest image variants
• Simplified build configuration by removing release version variable
• Updated internal submodule reference

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[rauhersu]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fontivan, rauhersu
Once this PR has been reviewed and has the lgtm label, please assign danmanor, fontivan, rauhersu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS [fontivan,rauhersu]

  Need more approvers for rest parts.

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@fontivan: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-single-node-recert-serial	ac671c7	link	true	/test e2e-aws-ovn-single-node-recert-serial
ci/prow/e2e-aws-ovn-single-node-recert-parallel	ac671c7	link	true	/test e2e-aws-ovn-single-node-recert-parallel

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.