From c39e161f1bd9fdcebf203f62018c2d16f0c9f8e4 Mon Sep 17 00:00:00 2001 From: Yan Sun Date: Wed, 8 Jul 2026 06:06:51 -0700 Subject: [PATCH 1/2] fix(security): bump UBI9 base image from 9.7 to 9.8 (#1583) * fix(security): bump UBI9 base image from 9.7 to 9.8 across all Dockerfiles Update all UBI9 minimal base image references to the latest stable release (9.8, confirmed via skopeo inspect on registry.access.redhat.com). Also pins previously untagged/floating references in KMM CoreOS template Dockerfiles for reproducible builds. Files updated: - Dockerfile (operator controller): 9.7 -> 9.8 - internal/utils_container/Dockerfile: 9.7 -> 9.8 - internal/remediation_config_utils_container/Dockerfile: 9.7 -> 9.8 - internal-example/driverSrcImage/Dockerfile.coreos: :latest -> 9.8 - internal/kmmmodule/dockerfiles/DockerfileTemplate.{rpm,srcimg}.coreos: untagged -> 9.8 - internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim: untagged -> 9.8 Co-Authored-By: Claude * docs: add plan file for UBI9 9.8 base image bump Plan: docs-internal/knowledge/plans/2026-07-06-ubi9-update.md Co-Authored-By: Claude * fix(security): bump Makefile OPERATOR_CONTROLLER_BASE_IMAGE to UBI9 9.8 Makefile was passing ubi-minimal:9.7 as build-arg to docker build, overriding the Dockerfile ARG default. Update to 9.8 to keep the build-arg consistent with the Dockerfile change. Co-Authored-By: Claude --------- Co-authored-by: Claude Co-authored-by: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> (cherry picked from commit 7939ce0a8f44408e679ae3ec91aa8cdece15bd66) --- Dockerfile | 2 +- Makefile | 2 +- .../knowledge/plans/2026-07-06-ubi9-update.md | 89 +++++++++++++++++++ .../dockerfiles/DockerfileTemplate.coreos.gim | 2 +- .../dockerfiles/DockerfileTemplate.rpm.coreos | 2 +- .../DockerfileTemplate.srcimg.coreos | 2 +- internal/utils_container/Dockerfile | 2 +- 7 files changed, 95 insertions(+), 6 deletions(-) create mode 100644 docs-internal/knowledge/plans/2026-07-06-ubi9-update.md diff --git a/Dockerfile b/Dockerfile index fffe6c243..6089ba13e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ ARG GOLANG_BASE_IMG=golang:1.26.4 -ARG OPERATOR_CONTROLLER_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.7 +ARG OPERATOR_CONTROLLER_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.8 # Build the manager binary FROM ${GOLANG_BASE_IMG} AS builder diff --git a/Makefile b/Makefile index 9cb55fa9f..b1b4d6c70 100644 --- a/Makefile +++ b/Makefile @@ -131,7 +131,7 @@ BUILD_BASE_IMG ?= ubuntu:22.04 DOCKER_CACHE_FROM ?= DOCKER_CACHE_TO ?= GOLANG_BASE_IMG ?= golang:1.26.4 -OPERATOR_CONTROLLER_BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi-minimal:9.7 +OPERATOR_CONTROLLER_BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi-minimal:9.8 # Helm binary installed into the build-shell image (Dockerfile.build). Pin the # version and its published sha256 together; bump both when upgrading. HELM_VERSION ?= v3.19.0 diff --git a/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md b/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md new file mode 100644 index 000000000..da1ccfba6 --- /dev/null +++ b/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md @@ -0,0 +1,89 @@ +# UBI9 Base Image Update to 9.8 + +- **Date:** 2026-07-06 +- **Author:** yan.sun3@amd.com +- **Related PR(s):** TBD +- **Related issue(s) / JIRA:** N/A + +## Context + +Red Hat has released UBI9 (Universal Base Image 9) version 9.8 as of mid-2025. +Several Dockerfiles in this repo were pinned to `ubi9/ubi-minimal:9.7` (released +~mid-2025), while others used unpinned (`latest` or no tag) references. + +Using outdated base images accumulates CVE exposure. UBI 9.8 ships updated RPM +packages and security fixes compared to 9.7. Pinning to a specific minor version +(rather than `latest` or untagged) improves build reproducibility. + +The update was confirmed via: +- `skopeo inspect docker://registry.access.redhat.com/ubi9/ubi-minimal:latest` + → `version: 9.8` +- `skopeo list-tags docker://registry.access.redhat.com/ubi9/ubi-minimal` + → clean version tags: `9.1`, `9.2`, `9.3`, `9.4`, `9.5`, `9.6`, `9.7`, `9.8` + +## Approach + +Pin all UBI9 base image references to `9.8`, the latest stable minor version +available on `registry.access.redhat.com` and `registry.redhat.io`. + +Changes made: + +1. **`Dockerfile`** — ARG default `ubi-minimal:9.7` → `ubi-minimal:9.8` +2. **`internal/utils_container/Dockerfile`** — FROM `ubi-minimal:9.7` → `9.8` +3. **`internal/remediation_config_utils_container/Dockerfile`** — FROM `ubi-minimal:9.7` → `9.8` +4. **`internal-example/driverSrcImage/Dockerfile.coreos`** — FROM `ubi-minimal:latest` → `9.8` (also improves build reproducibility) +5. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` +6. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` +7. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` + +The KMM template files use `registry.redhat.io` (which requires Red Hat +subscription credentials at build time — this is expected for OpenShift/RHEL +driver module builds). The tag addition makes these reproducible rather than +floating to whatever `latest` resolves to at build time. + +### Alternatives considered + +- **Pin to `latest`** — rejected: `latest` is mutable and makes builds + non-reproducible. CVE tracking requires a known version. +- **Pin to a timestamp-suffixed tag (e.g., `9.8-1782797275`)** — the + minor-version tag (e.g., `9.8`) is Red Hat's recommended stable reference for + a given release; timestamp tags are build IDs that change frequently and are + harder to reason about in policy/CVE tooling. +- **No change to KMM templates** — rejected: untagged `FROM` lines float to + `latest` by Docker default, causing non-reproducible builds. The KMM templates + are instantiated at module-build time; reproducibility matters. + +## Scope + +- **In scope:** All non-generated Dockerfiles that reference `ubi9/ubi-minimal` + directly in `FROM` lines or as ARG defaults. +- **Out of scope:** + - `Dockerfile.build` — uses `ubuntu:22.04` as its base, no UBI reference. + - `internal/kmmmodule/dockerfiles/DockerfileTemplate.ubuntu` / `.sles` / `.rhel` + — use Ubuntu or generic RHEL base images, not UBI9 minimal. + - `tests/` Dockerfiles — not using UBI9 (confirmed by grep). + - Generated files (`bundle/`, `config/crd/bases/`, `vendor/`) — never edited. + - `example/` Dockerfiles — not using UBI9 (confirmed by grep). + +## Validation + +- **Grep check:** `grep -rn "ubi9/ubi-minimal" . --include="Dockerfile*" --include="Makefile"` confirms all references (Dockerfiles + Makefile build-arg default) show `9.8`. +- **Build test (manual):** `make docker-build-env && make all` in the dev + container; `docker build -t test-utils internal/utils_container/` on a machine + with Red Hat registry access (or public `registry.access.redhat.com`). +- **CI:** Any pipeline that builds the operator image (`Dockerfile`) or the + utils/remediation images will exercise the updated base image pull. +- **No unit/e2e test changes needed** — this is a base image pin bump with no + behavioral change to the operator logic. + +## Risks and rollback + +- **Risk — 9.8 build breakage:** If a package installed via `microdnf` was + removed or renamed between 9.7 and 9.8, the build fails. UBI minor versions + are generally backward-compatible; this risk is low but non-zero. +- **Risk — registry.redhat.io tag availability:** The KMM template files pull + from `registry.redhat.io` which requires subscription auth at build time. + Tag `9.8` must be present there (confirmed available on + `registry.access.redhat.com`; Red Hat mirrors tags across both registries). +- **Rollback:** Revert all `9.8` references back to `9.7` (or to `latest`/untagged + for files that previously had no pin). This is a one-line change per file. diff --git a/internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim b/internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim index b150cdb74..e6ee57909 100644 --- a/internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim +++ b/internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim @@ -32,7 +32,7 @@ RUN mkdir -p /modules_files && \ cp -r /lib/modules/${KERNEL_VERSION}/extra/* /gim_ko_files/ && \ cp -r /lib/modules/${KERNEL_VERSION}/kernel/* /kernel_files/ -FROM registry.redhat.io/ubi9/ubi-minimal +FROM registry.redhat.io/ubi9/ubi-minimal:9.8 ARG KERNEL_VERSION diff --git a/internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos b/internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos index 7668572c3..f9726221e 100644 --- a/internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos +++ b/internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos @@ -42,7 +42,7 @@ RUN mkdir -p /modules_files && \ cp -r /lib/modules/${KERNEL_VERSION}/extra/* /amdgpu_ko_files/ && \ cp -r /lib/modules/${KERNEL_VERSION}/kernel/* /kernel_files/ -FROM registry.redhat.io/ubi9/ubi-minimal +FROM registry.redhat.io/ubi9/ubi-minimal:9.8 ARG KERNEL_VERSION diff --git a/internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos b/internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos index 5b01c78ba..974b3aab1 100644 --- a/internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos +++ b/internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos @@ -27,7 +27,7 @@ RUN mkdir -p /modules_files && \ cp -r /lib/modules/${KERNEL_VERSION}/extra/* /amdgpu_ko_files/ && \ cp -r /lib/modules/${KERNEL_VERSION}/kernel/* /kernel_files/ -FROM registry.redhat.io/ubi9/ubi-minimal +FROM registry.redhat.io/ubi9/ubi-minimal:9.8 ARG KERNEL_VERSION diff --git a/internal/utils_container/Dockerfile b/internal/utils_container/Dockerfile index 1849f6b29..77913f234 100644 --- a/internal/utils_container/Dockerfile +++ b/internal/utils_container/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8 LABEL name="amd-gpu-operator-utils" LABEL maintainer="sriram.ravishankar@amd.com,yan.sun3@amd.com" From 7716c366a830edb1394fe592badd1a04524e995c Mon Sep 17 00:00:00 2001 From: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> Date: Wed, 8 Jul 2026 06:13:34 -0700 Subject: [PATCH 2/2] Delete docs-internal/knowledge/plans/2026-07-06-ubi9-update.md --- .../knowledge/plans/2026-07-06-ubi9-update.md | 89 ------------------- 1 file changed, 89 deletions(-) delete mode 100644 docs-internal/knowledge/plans/2026-07-06-ubi9-update.md diff --git a/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md b/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md deleted file mode 100644 index da1ccfba6..000000000 --- a/docs-internal/knowledge/plans/2026-07-06-ubi9-update.md +++ /dev/null @@ -1,89 +0,0 @@ -# UBI9 Base Image Update to 9.8 - -- **Date:** 2026-07-06 -- **Author:** yan.sun3@amd.com -- **Related PR(s):** TBD -- **Related issue(s) / JIRA:** N/A - -## Context - -Red Hat has released UBI9 (Universal Base Image 9) version 9.8 as of mid-2025. -Several Dockerfiles in this repo were pinned to `ubi9/ubi-minimal:9.7` (released -~mid-2025), while others used unpinned (`latest` or no tag) references. - -Using outdated base images accumulates CVE exposure. UBI 9.8 ships updated RPM -packages and security fixes compared to 9.7. Pinning to a specific minor version -(rather than `latest` or untagged) improves build reproducibility. - -The update was confirmed via: -- `skopeo inspect docker://registry.access.redhat.com/ubi9/ubi-minimal:latest` - → `version: 9.8` -- `skopeo list-tags docker://registry.access.redhat.com/ubi9/ubi-minimal` - → clean version tags: `9.1`, `9.2`, `9.3`, `9.4`, `9.5`, `9.6`, `9.7`, `9.8` - -## Approach - -Pin all UBI9 base image references to `9.8`, the latest stable minor version -available on `registry.access.redhat.com` and `registry.redhat.io`. - -Changes made: - -1. **`Dockerfile`** — ARG default `ubi-minimal:9.7` → `ubi-minimal:9.8` -2. **`internal/utils_container/Dockerfile`** — FROM `ubi-minimal:9.7` → `9.8` -3. **`internal/remediation_config_utils_container/Dockerfile`** — FROM `ubi-minimal:9.7` → `9.8` -4. **`internal-example/driverSrcImage/Dockerfile.coreos`** — FROM `ubi-minimal:latest` → `9.8` (also improves build reproducibility) -5. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.rpm.coreos`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` -6. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.srcimg.coreos`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` -7. **`internal/kmmmodule/dockerfiles/DockerfileTemplate.coreos.gim`** — FROM `ubi9/ubi-minimal` (untagged) → `ubi9/ubi-minimal:9.8` - -The KMM template files use `registry.redhat.io` (which requires Red Hat -subscription credentials at build time — this is expected for OpenShift/RHEL -driver module builds). The tag addition makes these reproducible rather than -floating to whatever `latest` resolves to at build time. - -### Alternatives considered - -- **Pin to `latest`** — rejected: `latest` is mutable and makes builds - non-reproducible. CVE tracking requires a known version. -- **Pin to a timestamp-suffixed tag (e.g., `9.8-1782797275`)** — the - minor-version tag (e.g., `9.8`) is Red Hat's recommended stable reference for - a given release; timestamp tags are build IDs that change frequently and are - harder to reason about in policy/CVE tooling. -- **No change to KMM templates** — rejected: untagged `FROM` lines float to - `latest` by Docker default, causing non-reproducible builds. The KMM templates - are instantiated at module-build time; reproducibility matters. - -## Scope - -- **In scope:** All non-generated Dockerfiles that reference `ubi9/ubi-minimal` - directly in `FROM` lines or as ARG defaults. -- **Out of scope:** - - `Dockerfile.build` — uses `ubuntu:22.04` as its base, no UBI reference. - - `internal/kmmmodule/dockerfiles/DockerfileTemplate.ubuntu` / `.sles` / `.rhel` - — use Ubuntu or generic RHEL base images, not UBI9 minimal. - - `tests/` Dockerfiles — not using UBI9 (confirmed by grep). - - Generated files (`bundle/`, `config/crd/bases/`, `vendor/`) — never edited. - - `example/` Dockerfiles — not using UBI9 (confirmed by grep). - -## Validation - -- **Grep check:** `grep -rn "ubi9/ubi-minimal" . --include="Dockerfile*" --include="Makefile"` confirms all references (Dockerfiles + Makefile build-arg default) show `9.8`. -- **Build test (manual):** `make docker-build-env && make all` in the dev - container; `docker build -t test-utils internal/utils_container/` on a machine - with Red Hat registry access (or public `registry.access.redhat.com`). -- **CI:** Any pipeline that builds the operator image (`Dockerfile`) or the - utils/remediation images will exercise the updated base image pull. -- **No unit/e2e test changes needed** — this is a base image pin bump with no - behavioral change to the operator logic. - -## Risks and rollback - -- **Risk — 9.8 build breakage:** If a package installed via `microdnf` was - removed or renamed between 9.7 and 9.8, the build fails. UBI minor versions - are generally backward-compatible; this risk is low but non-zero. -- **Risk — registry.redhat.io tag availability:** The KMM template files pull - from `registry.redhat.io` which requires subscription auth at build time. - Tag `9.8` must be present there (confirmed available on - `registry.access.redhat.com`; Red Hat mirrors tags across both registries). -- **Rollback:** Revert all `9.8` references back to `9.7` (or to `latest`/untagged - for files that previously had no pin). This is a one-line change per file.