Skip to content

NO-JIRA: [RHCOS10] Migrate base images from UBI9 to UBI10 #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PillaiManish wants to merge 6 commits into
base: main
Choose a base branch
from
Open

NO-JIRA: [RHCOS10] Migrate base images from UBI9 to UBI10 #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8b9f9f7
UPSTREAM: <carry>: Add RHCOS10 UBI10 migration compliance doc
PillaiManish Apr 10, 2026
26fabfc
UPSTREAM: <carry>: Migrate base images from UBI9 to UBI10 for RHCOS10
PillaiManish Apr 10, 2026
7ccafc7
UPSTREAM: <carry>: Add USER root in go-toolset builder stage to fix g…
PillaiManish Apr 10, 2026
2bffb28
UPSTREAM: <carry>: Remove RPM-managed urllib3 before pip installs in …
PillaiManish Apr 10, 2026
26a787d
UPSTREAM: <carry>: Remove all conflicting RPM Python packages before …
PillaiManish Apr 10, 2026
59de6c0
UPSTREAM: <carry>: Update requirements-build.txt for ubi10 dependency…
PillaiManish Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions .work/compliance/rhcos10/PR2-ubi10-migration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# RHCOS10 UBI10 Migration

## Summary

Migrate all container base images from UBI9/RHEL9 to UBI10/RHEL10 for native RHCOS10 compatibility.
Also moves the registry from `registry.access.redhat.com` to `registry.redhat.io`.

```text
registry.access.redhat.com → registry.redhat.io
```

## Image Changes

| Dockerfile | Before | After |
| -------------------------------------------------- | ------------------------------------------------------------------- | -------------------------------------------------- |
| `images/ansible-operator/Dockerfile` (basebuilder) | `registry.access.redhat.com/ubi9/ubi-minimal:9.7` | `registry.redhat.io/ubi10/ubi-minimal:10.1` |
| `images/ansible-operator/Dockerfile` (base) | `registry.access.redhat.com/ubi9/ubi-minimal:9.7` | `registry.redhat.io/ubi10/ubi-minimal:10.1` |
| `images/ansible-operator/pipfile.Dockerfile` | `registry.access.redhat.com/ubi9/ubi-minimal:9.7` | `registry.redhat.io/ubi10/ubi-minimal:10.1` |
| `openshift/Dockerfile` (builder) | `registry.ci.openshift.org/ocp/builder:rhel-9-golang-*` | `registry.redhat.io/ubi10/go-toolset:10.1` |
| `openshift/Dockerfile` (runtime) | `registry.ci.openshift.org/ocp/4.22:base-rhel9` | `registry.redhat.io/ubi10/ubi:10.1` |
| `openshift/Dockerfile.requirements` | `registry.ci.openshift.org/ocp/4.22:base-rhel9` | `registry.redhat.io/ubi10/ubi:10.1` |
| `openshift/release/ansible/Dockerfile.collections` | `registry.ci.openshift.org/ocp/4.22:base-rhel9` | `registry.redhat.io/ubi10/ubi:10.1` |

## Exclusions

- `openshift/ci/dockerfiles/ansible-e2e.Dockerfile` — builds `FROM openshift-ansible-operator-plugins` (CI-internal); no base image to change.
- `testdata/memcached-molecule-operator/Dockerfile` — uses `quay.io/operator-framework/ansible-operator:dev`; not in scope.

## Prerequisite

PR1 (`rhcos10-ubi9-compat-test`) should pass CI on RHCOS10 nodes before merging this.

## Test Checklist

- [ ] `e2e-ansible`
- [ ] `e2e-ansible-fips`
- [ ] `e2e-ansible-rhcos10`
- [ ] `e2e-ansible-rhcos10-fips`
Comment on lines +29 to +38
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Dockerfiles now pulling from registry.redhat.io:"
rg -n '^\s*FROM\s+registry\.redhat\.io/' --glob 'images/**Dockerfile*' --glob 'openshift/**Dockerfile*'

echo
echo "Current prerequisite + checklist section:"
sed -n '29,38p' .work/compliance/rhcos10/PR2-ubi10-migration.md

Repository: openshift/ansible-operator-plugins

Length of output: 616

Add a build-path check for the new registry.redhat.io bases.

Multiple Dockerfiles in this PR now pull from registry.redhat.io (e.g., openshift/Dockerfile, openshift/Dockerfile.requirements), but the test checklist only covers downstream e2e lanes. Missing credentials or UBI10 package regressions will fail much earlier during the build phase, not during e2e.

Suggested doc update 
 ## Prerequisite
 
 PR1 (`rhcos10-ubi9-compat-test`) should pass CI on RHCOS10 nodes before merging this.
+- All CI/rehearsal/local build environments that build these Dockerfiles must have pull credentials for `registry.redhat.io`.
 
 ## Test Checklist
 
+- [ ] Rehearsal/build validation for each changed Dockerfile can pull from `registry.redhat.io`
 - [ ] `e2e-ansible`
 - [ ] `e2e-ansible-fips`
 - [ ] `e2e-ansible-rhcos10`
 - [ ] `e2e-ansible-rhcos10-fips`
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## Prerequisite
PR1 (`rhcos10-ubi9-compat-test`) should pass CI on RHCOS10 nodes before merging this.
## Test Checklist
- [ ] `e2e-ansible`
- [ ] `e2e-ansible-fips`
- [ ] `e2e-ansible-rhcos10`
- [ ] `e2e-ansible-rhcos10-fips`
## Prerequisite
PR1 (`rhcos10-ubi9-compat-test`) should pass CI on RHCOS10 nodes before merging this.
- All CI/rehearsal/local build environments that build these Dockerfiles must have pull credentials for `registry.redhat.io`.
## Test Checklist
- [ ] Rehearsal/build validation for each changed Dockerfile can pull from `registry.redhat.io`
- [ ] `e2e-ansible`
- [ ] `e2e-ansible-fips`
- [ ] `e2e-ansible-rhcos10`
- [ ] `e2e-ansible-rhcos10-fips`
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.work/compliance/rhcos10/PR2-ubi10-migration.md around lines 29 - 38, Add an
explicit build-path check that verifies the new registry.redhat.io base images
are accessible and buildable before relying solely on downstream e2e lanes:
update the CI checks to include a lightweight image build job (or docker/podman
pull test) that attempts to pull/build using the bases referenced in
openshift/Dockerfile and openshift/Dockerfile.requirements and fail fast if
credentials or UBI10 package issues occur; ensure this new job is added
alongside the existing e2e entries (`e2e-ansible`, `e2e-ansible-fips`,
`e2e-ansible-rhcos10`, `e2e-ansible-rhcos10-fips`) in the test checklist and CI
pipeline so build-time regressions are caught early.


## CI Image References

```text
registry.access.redhat.com/ubi9/ubi-minimal:9.7
→
registry.redhat.io/ubi10/ubi-minimal:10.1

registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22
→
registry.redhat.io/ubi10/go-toolset:10.1

registry.ci.openshift.org/ocp/4.22:base-rhel9
→
registry.redhat.io/ubi10/ubi:10.1
```
4 changes: 2 additions & 2 deletions images/ansible-operator/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# It is built with dependencies that take a while to download, thus speeding
# up ansible deploy jobs.

FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 AS basebuilder
FROM registry.redhat.io/ubi10/ubi-minimal:10.1 AS basebuilder

# Install Rust so that we can ensure backwards compatibility with installing/building the cryptography wheel across all platforms
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
Expand Down Expand Up @@ -35,7 +35,7 @@ RUN set -e && microdnf clean all && rm -rf /var/cache/dnf/* \
&& microdnf clean all \
&& rm -rf /var/cache/dnf

FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 AS base
FROM registry.redhat.io/ubi10/ubi-minimal:10.1 AS base
ARG TARGETARCH

# Label this image with the repo and commit that built it, for freshmaking purposes.
Expand Down
2 changes: 1 addition & 1 deletion images/ansible-operator/pipfile.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 AS basebuilder
FROM registry.redhat.io/ubi10/ubi-minimal:10.1 AS basebuilder

# Install Rust so that we can ensure backwards compatibility with installing/building the cryptography wheel across all platforms
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
Expand Down
37 changes: 34 additions & 3 deletions openshift/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
FROM registry.redhat.io/ubi10/go-toolset:10.1 AS builder
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

if [[ -f go.mod ]]; then
  echo "go.mod version directives:"
  awk '/^go / || /^toolchain / { print FILENAME ":" NR ": " $0 }' go.mod
else
  echo "go.mod not found"
fi

echo
echo "Other repo references to Go versions or builder images:"
rg -n -C2 'go-toolset|golang-[0-9]+\.[0-9]+|^go [0-9]+\.[0-9]+|^toolchain go[0-9]+\.[0-9]+' --glob '!**/vendor/**'

Repository: openshift/ansible-operator-plugins

Length of output: 675

🌐 Web query:

registry.redhat.io ubi10 go-toolset 10.1 Go version

💡 Result:

For registry.redhat.io/ubi10/go-toolset:10.1, the Go toolchain version is Go 1.25.x—the Red Hat Ecosystem Catalog lists the current image version as 1.25.8 for UBI 10.1 Go Toolset. [1]

Red Hat’s Go Toolset status page also shows RHEL/UBI 10.1 carrying Go 1.25.3 (and later 1.25.z updates), consistent with the 1.25 series used in that stream. [2]

Sources: [1], [2]

Builder image Go version mismatch: openshift/Dockerfile uses Go 1.25.x, but openshift/go.mod requires Go 1.21.3.

The ubi10/go-toolset:10.1 image provides Go 1.25.x (1.25.8 or later), but the openshift/go.mod specifies go 1.21.3. Update the builder image tag to one that provides Go 1.21.3, or update go.mod if the version bump is intentional.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@openshift/Dockerfile` at line 1, The builder image in the Dockerfile
currently uses "FROM registry.redhat.io/ubi10/go-toolset:10.1" which pulls Go
1.25.x while openshift/go.mod declares "go 1.21.3"; fix by either (A) pinning
the builder image to a tag that provides Go 1.21.3 (replace the FROM image with
the appropriate ubi/go-toolset tag that bundles Go 1.21.3) or (B) if the intent
is to use a newer Go, update openshift/go.mod to "go 1.25" (or the exact minor
version you intend) and run go mod tidy; change the Dockerfile's FROM or the
go.mod "go" directive accordingly and re-run your build to verify consistency.


USER root

ENV GO111MODULE=on \
GOFLAGS=-mod=vendor
Expand All @@ -9,7 +11,7 @@ RUN cd /go/src/github.com/openshift/ansible-operator-plugins \
&& export GIT_VERSION="$(make -pRrq --no-print-directory | grep '^IMAGE_VERSION' | awk -F'= ' '{print $2}')-ocp" \
&& make -e build

FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.redhat.io/ubi10/ubi:10.1

RUN mkdir -p /etc/ansible \
&& echo "localhost ansible_connection=local" > /etc/ansible/hosts \
Expand All @@ -36,7 +38,36 @@ COPY ${REMOTE_SOURCES} ${REMOTE_SOURCES_DIR}
# Copy our local ansible-runner-http replacement module
COPY images/ansible-operator/ansible_runner_http /ansible_runner_http
COPY openshift/install-ansible.sh .
RUN chmod +x /install-ansible.sh \
# ubi10/ubi:10.1 ships many Python packages as RPM-managed installs that have
# no pip RECORD file, causing pip to fail when requirements.txt pins different
# versions. Remove all potentially conflicting RPM Python packages upfront so
# pip can install the pinned versions cleanly. Uses || true per package so the
# step succeeds even if a package is not present in the base image.
RUN for pkg in \
python3-urllib3 \
python3-six \
python3-requests \
python3-idna \
python3-certifi \
python3-charset-normalizer \
python3-chardet \
python3-resolvelib \
python3-pyyaml \
python3-pyasn1 \
python3-pyasn1-modules \
python3-oauthlib \
python3-markupsafe \
python3-jinja2 \
python3-packaging \
python3-dateutil \
python3-pexpect \
python3-ptyprocess \
python3-lockfile \
python3-rsa \
python3-websocket-client; do \
rpm -e --nodeps "$pkg" 2>/dev/null || true; \
done \
&& chmod +x /install-ansible.sh \
&& ./install-ansible.sh

# Remove packages which are only needed for cachito
Expand Down
2 changes: 1 addition & 1 deletion openshift/Dockerfile.requirements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.redhat.io/ubi10/ubi:10.1

RUN set -e && dnf clean all && rm -rf /var/cache/dnf/* \
&& dnf update -y \
Expand Down
2 changes: 1 addition & 1 deletion openshift/release/ansible/Dockerfile.collections
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
FROM registry.redhat.io/ubi10/ubi:10.1

RUN set -e && dnf clean all && rm -rf /var/cache/dnf/* \
&& dnf update -y \
Expand Down
9 changes: 7 additions & 2 deletions openshift/requirements-build.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ packaging==26.0
# -r requirements-build.in
# hatchling
# setuptools-scm
# vcs-versioning
# wheel
pathspec==1.0.4
# via
Expand All @@ -38,18 +39,22 @@ pluggy==1.6.0
# via
# -r requirements-build.in
# hatchling
poetry-core==2.3.1
poetry-core==2.3.2
# via -r requirements-build.in
semver==3.0.4
# via
# -r requirements-build.in
# changelog-chug
setuptools-scm==9.2.2
setuptools-scm==10.0.5
# via hatch-vcs
trove-classifiers==2026.1.14.14
# via
# -r requirements-build.in
# hatchling
vcs-versioning==1.1.1
# via
# -r requirements-build.in
# setuptools-scm
wheel==0.46.3
# via -r requirements-build.in

Expand Down