CMP-4571: Switch production base images to ubi9-minimal-pqc for PQC support - #1346
Conversation
|
@guzalv: This pull request references CMP-4571 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Hi @guzalv. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
b268e92 to
d705498
Compare
guzalv
changed the title
|
🤖 To deploy this PR, run the following command: |
d705498 to
6154744
Compare
|
🤖 To deploy this PR, run the following command: |
6154744 to
166241c
Compare
|
🤖 To deploy this PR, run the following command: |
|
/ok-to-test |
|
/retest-required |
166241c to
297cd06
Compare
|
🤖 To deploy this PR, run the following command: |
…upport Switch production and CI container base images to registry.redhat.io/ubi9/ubi-minimal-pqc to enable Post-Quantum Cryptography (PQC) support via the DEFAULT:PQ crypto policy in OpenSSL. Production Containerfiles (operator, openscap, must-gather) and CI Dockerfiles (Dockerfile.ci, openscap/Dockerfile.ci) are switched to ubi-minimal-pqc. Upstream community Dockerfiles (build/Dockerfile, openscap/Dockerfile, broken-content.Dockerfile) keep their original unauthenticated base images since the GitHub Actions workflows that build them cannot authenticate to registry.redhat.io. The must-gather fetch-raw-results pod template is switched to ubi-minimal-pqc and now installs tar at runtime, which is required by oc cp to extract scan results. Test helper pods and the must-gather template use ubi-minimal-pqc since they run on OCP clusters with registry.redhat.io pull secrets. The ubi-minimal-pqc image is identical to ubi-minimal except it ships with the DEFAULT:PQ crypto policy pre-configured, enabling ML-KEM (post-quantum key encapsulation) in OpenSSL on RHEL 9. On FIPS-mode clusters the FIPS-140 regulation is properly observed and PQC is disabled. Tested: built operator image, deployed to OCP 4.22 cluster, verified DEFAULT:PQ crypto policy is active, ran a CIS compliance scan to completion. Fixes: CMP-4571
297cd06 to
a6f85a1
Compare
|
🤖 To deploy this PR, run the following command: |
|
/ok-to-test |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: guzalv, taimurhafeez, yuumasato The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
It seems another flaky test was found: /retest |
|
e2e tests passed |
4 participants
What
Switch production and CI container base images to
registry.redhat.io/ubi9/ubi-minimal-pqcto enable Post-Quantum Cryptography (PQC) support via theDEFAULT:PQcrypto policy in OpenSSL.Why
Required by OCPSTRAT-3113: all OCP and layered-product images must ship with
DEFAULT:PQcrypto policy so the release pipeline check finds it. The PQC base images (ubi-minimal-pqc) are now GA (announcement).The
ubi-minimal-pqcimage is identical toubi-minimalexcept it ships with theDEFAULT:PQcrypto policy pre-configured, enabling ML-KEM (post-quantum key encapsulation) in OpenSSL on RHEL 9. On FIPS-mode clusters the FIPS-140 regulation is properly observed and PQC is disabled.Changes
images/operator/Dockerfileregistry.redhat.io/ubi9/ubi-minimalregistry.redhat.io/ubi9/ubi-minimal-pqcimages/openscap/Containerfileregistry.redhat.io/ubi9/ubi-minimalregistry.redhat.io/ubi9/ubi-minimal-pqcimages/must-gather/Containerfileregistry.redhat.io/ubi9/ubi-minimalregistry.redhat.io/ubi9/ubi-minimal-pqcDockerfile.ciregistry.access.redhat.com/ubi9/ubi-microregistry.redhat.io/ubi9/ubi-minimal-pqcimages/openscap/Dockerfile.ciregistry.access.redhat.com/ubi8/ubi-minimalregistry.redhat.io/ubi9/ubi-minimal-pqcUpstream community Dockerfiles (
build/Dockerfile,images/openscap/Dockerfile,images/testcontent/broken-content.Dockerfile) are not changed because they are built by GitHub Actions which cannot authenticate toregistry.redhat.io, and they are not checked by the OCP release pipeline.Testing
make image-- build succeeded.DEFAULT:PQcrypto policy inside the built image.DEFAULT:PQand ran a CIS compliance scan to completion.Fixes: CMP-4571