Use UBI base images and OCI labels for Konflux Enterprise Contract#126
Conversation
Switch the builder and runtime from golang:alpine and distroless to Red Hat UBI images and add the labels required by Enterprise Contract. Co-authored-by: Cursor <cursoragent@cursor.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift-online/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe Dockerfile migrates build and runtime stages to Red Hat UBI images, preserves the Go compilation flow, adds image metadata, and updates the runtime port and user settings. ChangesContainer image migration
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
Dockerfile (1)
20-20: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider a version-based floating tag instead of
:latestforubi-minimal.While
:latestis technically a floating tag and satisfies the path instruction, it could pull UBI 10 when released, introducing unexpected breaking changes. A version-based floating tag like:9.5or:9is safer while still allowing Red Hat to manage updates within the major version.♻️ Suggested change
-FROM registry.access.redhat.com/ubi9/ubi-minimal:latest +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.5🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` at line 20, Update the Dockerfile’s ubi-minimal base image reference from the unbounded :latest tag to a version-based floating tag such as :9 or :9.5, preserving automatic updates while constraining the image to the intended UBI 9 release line.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 41: Update the Dockerfile EXPOSE declaration to use port 8081 instead of
8080, exposing the application’s ports as 8000, 8081, and 9090 while leaving the
other ports unchanged.
- Around line 25-35: Update the Dockerfile LABEL metadata to use the actual
project name “rosa-regional-platform-api” consistently, including name,
display-name, component, summary, description, and related values; correct the
url to the project’s actual repository under
github.com/openshift/rosa-regional-platform-api.
- Around line 37-45: Add a Docker HEALTHCHECK after the USER instruction,
targeting the application’s configured health port 8081 and the verified health
endpoint path. Confirm whether the rosa-regional-platform-api binary provides a
health-check mechanism; otherwise use an available curl or wget command. Keep
the existing ENTRYPOINT unchanged.
---
Nitpick comments:
In `@Dockerfile`:
- Line 20: Update the Dockerfile’s ubi-minimal base image reference from the
unbounded :latest tag to a version-based floating tag such as :9 or :9.5,
preserving automatic updates while constraining the image to the intended UBI 9
release line.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 16b5f5d6-b4ff-416f-96cb-d1ee8eb95c62
📒 Files selected for processing (1)
Dockerfile
The deployment runs the API health server on 8081; 8080 is reserved for the Envoy sidecar in manifests. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed CodeRabbit feedback: Fixed
Keeping as-is (intentional)
AI attribution
|
Konflux build contexts do not include git metadata, so go build fails with "error obtaining VCS status" unless -buildvcs=false is set. Co-authored-by: Cursor <cursoragent@cursor.com>
Use fully qualified go-toolset and ubi-minimal tags instead of floating 1.26 and latest. Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
||
| # Run as non-root user | ||
| USER nonroot:nonroot | ||
| USER 1001 |
There was a problem hiding this comment.
on OpenShift in the past we;ve used USER 65534:65534 - what's te recommendation from Konflux - sorry I missed this first pass @MitaliBhalla
There was a problem hiding this comment.
Good question — Konflux/EC doesn't prescribe a specific UID, it just checks we're not running as root.
I used 1001 because that's the common UBI/operator pattern (e.g. cloud-ingress-operator on ubi-minimal). The old distroless image used nonroot (65532).
65534:65534 (nobody) is totally fine and matches what we've used on OpenShift elsewhere — happy to switch for fleet consistency if that's the team preference. Functionally both work as long as the binary + /app are readable by that UID.
There was a problem hiding this comment.
Done — switched to USER 65534:65534 in the latest commit.
Use USER 65534:65534 instead of 1001 to match existing OpenShift deployment conventions. Co-authored-by: Cursor <cursoragent@cursor.com>
|
/approved |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: MitaliBhalla, typeid The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
3 participants
Summary
golang:1.25-alpineandgcr.io/distroless/static-debian12with Red Hat UBI builder/runtime images so Konflux Enterprise Contract accepts the base registries.name,vendor,version,release,description,com.redhat.component,distribution-scope,url, etc.) expected byapp-interface-standard.Context
Konflux build on #125 succeeded, but EC failed with:
base_image_registries— distroless not on permitted registry listlabels.required_labels— missing Red Hat OCI labelsecosystem-cert-preflight-checkserrored (downstream of the above)Plan: merge this first, then update/retest #125 so the bootstrap PR gets a green EC check.
Test plan
ci/prow/imagespasses with new Dockerfile/reteston Red Hat Konflux kflux-prd-rh02 update rosa-hyperfleet-api #125Made with Cursor
Summary by CodeRabbit
8000,8081, and9090(removing8080).