From a6f85a15e849c730668b87119ef8f37f603ee0e7 Mon Sep 17 00:00:00 2001 From: Guzman Date: Mon, 17 Aug 2026 12:36:18 +0000 Subject: [PATCH] CMP-4571: Switch production base images to ubi9-minimal-pqc for PQC support Switch production and CI container base images to registry.redhat.io/ubi9/ubi-minimal-pqc to enable Post-Quantum Cryptography (PQC) support via the DEFAULT:PQ crypto policy in OpenSSL. Production Containerfiles (operator, openscap, must-gather) and CI Dockerfiles (Dockerfile.ci, openscap/Dockerfile.ci) are switched to ubi-minimal-pqc. Upstream community Dockerfiles (build/Dockerfile, openscap/Dockerfile, broken-content.Dockerfile) keep their original unauthenticated base images since the GitHub Actions workflows that build them cannot authenticate to registry.redhat.io. The must-gather fetch-raw-results pod template is switched to ubi-minimal-pqc and now installs tar at runtime, which is required by oc cp to extract scan results. Test helper pods and the must-gather template use ubi-minimal-pqc since they run on OCP clusters with registry.redhat.io pull secrets. The ubi-minimal-pqc image is identical to ubi-minimal except it ships with the DEFAULT:PQ crypto policy pre-configured, enabling ML-KEM (post-quantum key encapsulation) in OpenSSL on RHEL 9. On FIPS-mode clusters the FIPS-140 regulation is properly observed and PQC is disabled. Tested: built operator image, deployed to OCP 4.22 cluster, verified DEFAULT:PQ crypto policy is active, ran a CIS compliance scan to completion. Fixes: CMP-4571 --- Dockerfile.ci | 2 +- images/must-gather/Containerfile | 2 +- images/openscap/Containerfile | 2 +- images/openscap/Dockerfile.ci | 2 +- images/operator/Dockerfile | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile.ci b/Dockerfile.ci index c89ebff189..2d2695d68f 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -10,7 +10,7 @@ COPY . . RUN make manager # Step two: containerize compliance-operator -FROM registry.access.redhat.com/ubi9/ubi-micro:latest +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest ENV OPERATOR=/usr/local/bin/compliance-operator diff --git a/images/must-gather/Containerfile b/images/must-gather/Containerfile index 33cb835a41..eac4d40143 100644 --- a/images/must-gather/Containerfile +++ b/images/must-gather/Containerfile @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/ubi-minimal:latest +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest LABEL \ io.k8s.display-name="must-gather cli for compliance-operator" \ diff --git a/images/openscap/Containerfile b/images/openscap/Containerfile index 204e727ad2..1503126c20 100644 --- a/images/openscap/Containerfile +++ b/images/openscap/Containerfile @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/ubi-minimal:latest +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest LABEL \ io.k8s.display-name="OpenSCAP scanner for compliance-operator" \ diff --git a/images/openscap/Dockerfile.ci b/images/openscap/Dockerfile.ci index aad92a8c58..7976748e2b 100644 --- a/images/openscap/Dockerfile.ci +++ b/images/openscap/Dockerfile.ci @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi8/ubi-minimal +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest LABEL \ name="openscap-ocp" \ diff --git a/images/operator/Dockerfile b/images/operator/Dockerfile index 2dfd2a350f..5356291a5f 100644 --- a/images/operator/Dockerfile +++ b/images/operator/Dockerfile @@ -19,7 +19,7 @@ RUN expected=$(awk '/^go / { print $2 }' go.mod) && \ RUN make manager -FROM registry.redhat.io/ubi9/ubi-minimal:latest +FROM registry.redhat.io/ubi9/ubi-minimal-pqc:latest RUN microdnf install -y --setopt=tsflags=nodocs tar RUN microdnf clean all && rm -rf /var/cache/*