CMP-4572: Switch runtime base image to ubi9-minimal-pqc for PQC support

[guzalv]

What

Switch the Dockerfile.openshift runtime base image from registry.redhat.io/rhel9-4-els/rhel-minimal to registry.redhat.io/ubi9/ubi-minimal-pqc to enable Post-Quantum Cryptography (PQC) support via the DEFAULT:PQ crypto policy in OpenSSL.

Also fix the runtime package install: libbpf-devel -> libbpf. The runtime only needs the shared library (.so), not development headers. This also fixes the root cause of stale PR #109 (CMP-3943), which dropped libbpf entirely while BPF_ENABLED=1 was set.

Why

Required by OCPSTRAT-3113: OCP and layered-product images must ship with DEFAULT:PQ crypto policy. See epic CMP-4570.

Changes

Line	Before	After
Runtime FROM	registry.redhat.io/rhel9-4-els/rhel-minimal:latest	registry.redhat.io/ubi9/ubi-minimal-pqc:latest
Runtime packages	tar libseccomp libbpf-devel	tar libseccomp libbpf

Build stage unchanged.

ELS trade-off

The previous base (rhel9-4-els/rhel-minimal) pins to RHEL 9.4 with ~6yr ELS errata. ubi9-minimal-pqc ships a rolling 9.8 stream with no ELS variant. This is unavoidable since no rhel9-4-els-pqc image exists.

Package compatibility

All runtime packages verified available on ubi9-minimal-pqc via microdnf repoquery:

Package	Repo	Version
tar	ubi-9-baseos-rpms	1.34-11.el9
libseccomp	ubi-9-baseos-rpms	2.5.2-2.el9
libbpf	ubi-9-baseos-rpms	1.5.0-3.el9

libbpf-devel is only in RHEL CDN (codeready-builder), not UBI repos — but it was never needed at runtime anyway.

Testing

1. Built operator image, deployed to OCP 4.22.8 cluster (6 nodes)
2. DEFAULT:PQ crypto policy verified active in running pod
3. SeccompProfile CR propagated to all nodes with kernel-level enforcement confirmed
4. SelinuxProfile CR compiled and loaded via semodule on all nodes
5. log-enricher and spoc CLI both functional
6. No crashloops or dynamic-linking errors across ~50 min runtime
7. e2e suite seccomp tests passed across all nodes

Fixes: CMP-4572

[openshift-ci-robot]

@guzalv: This pull request references CMP-4572 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

What

Switch the Dockerfile.ubi runtime stage base image from registry.access.redhat.com/ubi8/ubi-minimal to registry.redhat.io/ubi9/ubi-minimal-pqc to enable Post-Quantum Cryptography (PQC) support via the DEFAULT:PQ crypto policy in OpenSSL.

The ubi-minimal-pqc image is identical to ubi-minimal except it ships with the DEFAULT:PQ crypto policy pre-configured, enabling ML-KEM (post-quantum key encapsulation) in OpenSSL on RHEL 9. On FIPS-mode clusters the FIPS-140 regulation is observed and PQC is disabled.

Why

Required by OCPSTRAT-3113: OCP and layered-product images must ship with DEFAULT:PQ crypto policy. See parent epic CMP-4570. Matching approach already taken in Compliance Operator (PR #1346).

Changes

File	Old base image	New base image
Dockerfile.ubi (runtime stage)	registry.access.redhat.com/ubi8/ubi-minimal	registry.redhat.io/ubi9/ubi-minimal-pqc

The build stage (ubi8/go-toolset) is intentionally unchanged — see rationale below.

Build stage: why UBI8 go-toolset is kept

The binaries are dynamically linked (STATIC_LINK=no) against libseccomp and glibc. Building on older glibc (2.28, UBI8) and running on newer glibc (2.34, UBI9) is the safe direction per glibc's symbol-versioning backward-compatibility guarantee. libseccomp is the same upstream version (2.5.2) on both UBI8 and UBI9. The netgo build tag forces the pure-Go DNS resolver, sidestepping cgo NSS compatibility concerns. This was verified empirically:

• ldd on both binaries against the new runtime: all libraries resolve cleanly (libseccomp.so.2, libpthread.so.0, libdl.so.2, libc.so.6)
• Both binaries execute correctly, reporting Libseccomp: 2.5.2 queried live from the new runtime's .so

Package compatibility

Package	Installed via	Available on ubi9-minimal-pqc?	Version
libseccomp (runtime)	microdnf	Yes (ubi-9-baseos-rpms)	2.5.2-2.el9 (same upstream as UBI8's 2.5.2-1.el8)

This is the only package Dockerfile.ubi installs in the runtime stage.

Testing

1. Built both baseline (UBI8) and PQC (UBI9-pqc) images locally with podman build -f Dockerfile.ubi
2. Verified DEFAULT:PQ crypto policy:

$ podman run --rm --entrypoint cat <image> /etc/crypto-policies/state/current
DEFAULT:PQ

3. Deployed to OCP 4.22.8 cluster (ga-ocp4-cron-2, 3 masters + 3 workers), verified:

• Operator deployment (3 replicas) running with DEFAULT:PQ crypto policy
• SeccompProfile CR propagated to all 6 nodes (Installed status), JSON files confirmed on node filesystems
• Seccomp enforcement verified at kernel level: allowed syscalls succeed, disallowed syscalls return EPERM
• SelinuxProfile CR created, CIL policy compiled and loaded via semodule on all 6 nodes
• log-enricher component starts and connects to audit log
• spoc CLI runs correctly inside the cluster pod
• No crashloops, panics, or dynamic-linking errors in operator/webhook/spod logs across ~50 minutes of runtime

4. Ran repo's e2e test suite (E2E_CLUSTER_TYPE=openshift): seccomp profile verification passed across all nodes for 3 profiles; run was bounded to 20 minutes (self-imposed, not a failure from the base image change)

Fixes: CMP-4572

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: guzalv
Once this PR has been reviewed and has the lgtm label, please assign saschagrunert for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @guzalv. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yuumasato]

/ok-to-test

[yuumasato]

/ok-to-test