ROX-14475: Upgrade to UBI9 #15178
Draft
ROX-14475: Upgrade to UBI9 #15178
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Skipping CI for Draft Pull Request. |
Contributor
|
Images are ready for the commit at 007ed67. To use with deploy scripts, first |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #15178 +/- ##
==========================================
+ Coverage 49.04% 49.08% +0.03%
==========================================
Files 2635 2640 +5
Lines 195420 195603 +183
==========================================
+ Hits 95852 96008 +156
- Misses 92067 92089 +22
- Partials 7501 7506 +5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Contributor
Author
|
/retest |
davdhacs
reviewed
May 16, 2025
| # PyYAML > 6.0 requires Python > 3.6. | ||
| PyYAML==6.0 | ||
| # pytest==7.0.1 is the latest available for the quay.io/stackrox-io/apollo-ci:stackrox-test-0.4.8 job container's Python. | ||
| # pytest==7.0.1 is the latest available for the quay.io/stackrox-io/apollo-ci:stackrox-test-0.4.8-3-g679cfb72eb job container's Python. |
Contributor
There was a problem hiding this comment.
I think this change can be removed, but later can be resolved because UBI9 system python is 3.9 (I checked in quay.io/stackrox-io/apollo-ci:stackrox-test-0.4.8-3-g679cfb72eb).
Contributor
Author
|
Rebased, added messages to the fixups commits (you can read them by clicking on the kabob / more-options icon), and hopefully fixed the permission issues we were seeing. |
Contributor
Author
|
Cherry-picking some commits from #15337. One of them should resolve the scanner build errors. Hoping it shares the history cleanly. |
Contributor
Author
|
/retest-required |
1 similar comment
Contributor
Author
|
/retest-required |
Contributor
Author
|
/retest |
1 similar comment
Contributor
Author
|
/retest |
Contributor
Author
|
/retest |
1 similar comment
Contributor
Author
|
/retest |
BradLugo
force-pushed
the
ROX-14475-ubi9
branch
from
822716b to
80f80ef
Compare
Contributor
Author
|
rebasing and testing a simpler change |
Contributor
Author
|
/retest |
1 similar comment
Contributor
Author
|
/retest |
Contributor
Author
|
/retest |
Missed the actually runtime container images in the last commit (only changed the builder images).
Should resolve the permission issues we're seeing in CI. Regarding why we do all the certificate business in the first place, I think it's because we want to update the trusted certificates in the container with any stackrox-generate certs+any relevant OCP certs. However, there may be a better way to go about it. Needs further investigation and possibly roping in other teams (e.g., Install team).
Update `pg_rhel_major` to 9 for the rest of the download scripts.
Don't globber files when restoring. Should resolve the sensor errors. I suspect this approach won't be the one we ship - just trying to get everything to work for now.
Turns out we weren't running the `update-ca-trust` command from the last fixup since we were restoring `/etc/pki/ca-trust/extracted` that was saved during the container build process. These changes should implement the original fixup correctly and allow the operator-related CA tests to pass.
BradLugo
force-pushed
the
ROX-14475-ubi9
branch
from
a39a7d5 to
0cdb846
Compare
Contributor
Author
|
/retest |
Contributor
|
Caution There are some errors in your PipelineRun template.
|
Contributor
Author
|
/retest |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Upgrade to UBI9. This is currently a proof-of-concept to see what will break or otherwise block us from moving forward with this upgrade.
Related PRs:
User-facing documentation
Testing and quality
Automated testing
How I validated my change
change me!