Build ubi image (#244)

tamalsaha · web-flow · commit 5ba30c6f0bd5 · 2025-12-07T20:09:47.000+06:00
Signed-off-by: Tamal Saha &lt;tamal@appscode.com&gt;
diff --git a/apis/installer/v1alpha1/kubestash_operator_types.go b/apis/installer/v1alpha1/kubestash_operator_types.go
@@ -205,8 +205,12 @@ type SeccompSpec struct {
 	Enabled bool `json:"enabled"`
 }
 
+// +kubebuilder:validation:Enum=all;catalog;operator
+type UBIMode string
+
 type DistroSpec struct {
-	Openshift bool `json:"openshift"`
+	Openshift bool    `json:"openshift"`
+	UBI       UBIMode `json:"ubi"`
 }
 
 type NetVolAccessor struct {
diff --git a/charts/kubestash-catalog/README.md b/charts/kubestash-catalog/README.md
@@ -57,6 +57,8 @@ The following table lists the configurable parameters of the `kubestash-catalog`
 | volumesnapshot.enabled            | If true, deploys VolumeSnapshot addon                                                                                           | <code>true</code>    |
 | workload.enabled                  | If true, deploys Workload addon                                                                                                 | <code>true</code>    |
 | manifest.enabled                  | If true, deploys Manifest addon                                                                                                 | <code>true</code>    |
+| distro.openshift                  | Set true, if installed in OpenShift                                                                                             | <code>false</code>   |
+| distro.ubi                        | Set operator or all to use ubi images                                                                                           | <code>""</code>      |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:
diff --git a/charts/kubestash-catalog/templates/_helpers.tpl b/charts/kubestash-catalog/templates/_helpers.tpl
@@ -65,3 +65,10 @@ Create the name of the service account to use
 {{- define "image.ghcr" -}}
 {{ list .Values.proxies.ghcr ._repo | compact | join "/" }}
 {{- end }}
+
+{{/*
+Returns if ubi images are to be used
+*/}}
+{{- define "catalog.ubi" -}}
+{{ ternary "-ubi" "" (list "catalog" "all" | has .Values.distro.ubi) }}
+{{- end }}
diff --git a/charts/kubestash-catalog/templates/kubedump/kubedump-backup.yaml b/charts/kubestash-catalog/templates/kubedump/kubedump-backup.yaml
@@ -19,6 +19,6 @@ spec:
   - --exclude-namespaces=${ExcludeNamespaces:=}
   - --include-resources=${IncludeResources:=}
   - --exclude-resources=${ExcludeResources:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/kubedump") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/kubedump") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/kubedump/kubedump-restore.yaml b/charts/kubestash-catalog/templates/kubedump/kubedump-restore.yaml
@@ -23,6 +23,6 @@ spec:
   - --override-resources=${OverrideResources:=}
   - --storage-class-mappings=${StorageClassMappings:=}
   - --restore-pvs=${RestorePVs:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/kubedump") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/kubedump") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/manifest/manifest-backup.yaml b/charts/kubestash-catalog/templates/manifest/manifest-backup.yaml
@@ -13,6 +13,6 @@ spec:
   - --enable-cache=${enableCache:=}
   - --scratch-dir=${scratchDir:=}
   - --include-rbac-resources=${includeRBACResources:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/manifest") $) }}:v0.13.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/manifest") $) }}:v0.13.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/manifest/manifest-restore.yaml b/charts/kubestash-catalog/templates/manifest/manifest-restore.yaml
@@ -15,6 +15,6 @@ spec:
   - --scratch-dir=${scratchDir:=}
   - --include-rbac-resources=${includeRBACResources:=}
   - --override-resources=${overrideResources:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/manifest") $) }}:v0.13.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/manifest") $) }}:v0.13.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/pvc/pvc-backup.yaml b/charts/kubestash-catalog/templates/pvc/pvc-backup.yaml
@@ -14,6 +14,6 @@ spec:
   - --scratch-dir=${scratchDir:=}
   - --exclude=${exclude:=}
   - --paths=${paths:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/pvc") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/pvc") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/pvc/pvc-restore.yaml b/charts/kubestash-catalog/templates/pvc/pvc-restore.yaml
@@ -13,6 +13,6 @@ spec:
   - --snapshot=${snapshot:=}
   - --enable-cache=${enableCache:=}
   - --scratch-dir=${scratchDir:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/pvc") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/pvc") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/volumesnapshot/volumesnapshot-backup.yaml b/charts/kubestash-catalog/templates/volumesnapshot/volumesnapshot-backup.yaml
@@ -11,6 +11,6 @@ spec:
   - --namespace=${namespace:=default}
   - --backupsession=${backupSession:=}
   - --volume-snapshot-class-name=${volumeSnapshotClassName:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/volume-snapshotter") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/volume-snapshotter") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/volumesnapshot/volumesnapshot-restore.yaml b/charts/kubestash-catalog/templates/volumesnapshot/volumesnapshot-restore.yaml
@@ -12,6 +12,6 @@ spec:
   - --restoresession=${restoreSession:=}
   - --snapshot=${snapshot:=}
   - --task-name=${taskName:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/volume-snapshotter") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/volume-snapshotter") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/workload/workload-backup.yaml b/charts/kubestash-catalog/templates/workload/workload-backup.yaml
@@ -14,6 +14,6 @@ spec:
   - --scratch-dir=${scratchDir:=}
   - --paths=${paths:=}
   - --exclude=${exclude:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/workload") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/workload") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/templates/workload/workload-restore.yaml b/charts/kubestash-catalog/templates/workload/workload-restore.yaml
@@ -15,6 +15,6 @@ spec:
   - --scratch-dir=${scratchDir:=}
   - --exclude=${exclude:=}
   - --include=${include:=}
-  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/workload") $) }}:v0.20.0'
+  image: '{{ include "image.ghcr" (merge (dict "_repo" "kubestash/workload") $) }}:v0.20.0{{ include "catalog.ubi" $ }}'
 {{ end }}
 
diff --git a/charts/kubestash-catalog/values.yaml b/charts/kubestash-catalog/values.yaml
@@ -32,3 +32,8 @@ workload:
 manifest:
   # If true, deploys Manifest addon
   enabled: true
+distro:
+  # Set true, if installed in OpenShift
+  openshift: false
+  # Set operator or all to use ubi images
+  ubi: ""
diff --git a/charts/kubestash-operator/README.md b/charts/kubestash-operator/README.md
@@ -99,6 +99,7 @@ The following table lists the configurable parameters of the `kubestash-operator
 | security.apparmor.enabled             | `Optional:` Allows the default AppArmor profile, requires setting the default.                                                                                                                                                                                                                                                                                                     | <code>false</code>                                                                                                                                                                             |
 | security.seccomp.enabled              | `Optional:` Allows the default seccomp profile, requires setting the default.                                                                                                                                                                                                                                                                                                      | <code>false</code>                                                                                                                                                                             |
 | distro.openshift                      | Set true, if installed in OpenShift                                                                                                                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                             |
+| distro.ubi                            | Set operator or all to use ubi images                                                                                                                                                                                                                                                                                                                                              | <code>""</code>                                                                                                                                                                                |
 | netVolAccessor.cpu                    | CPU resource for each network volume accessor deployment                                                                                                                                                                                                                                                                                                                           | <code>"100m"</code>                                                                                                                                                                            |
 | netVolAccessor.memory                 | Memory for each network volume accessor deployment                                                                                                                                                                                                                                                                                                                                 | <code>"128Mi"</code>                                                                                                                                                                           |
 | netVolAccessor.runAsUser              | Run the network volume accessor with this UID.                                                                                                                                                                                                                                                                                                                                     | <code>2000</code>                                                                                                                                                                              |
diff --git a/charts/kubestash-operator/templates/_helpers.tpl b/charts/kubestash-operator/templates/_helpers.tpl
@@ -144,6 +144,13 @@ Returns whether the OpenShift distribution is used
 {{- or (.Capabilities.APIVersions.Has "project.openshift.io/v1/Project") .Values.distro.openshift -}}
 {{- end }}
 
+{{/*
+Returns if ubi images are to be used
+*/}}
+{{- define "operator.ubi" -}}
+{{ ternary "-ubi" "" (list "operator" "all" | has .Values.distro.ubi) }}
+{{- end }}
+
 {{/*
 Prepare certs
 */}}
diff --git a/charts/kubestash-operator/templates/cleaner/job.yaml b/charts/kubestash-operator/templates/cleaner/job.yaml
@@ -19,7 +19,7 @@ spec:
       serviceAccountName: {{ include "kubestash-operator.serviceAccountName" . }}-cleaner
       containers:
       - name: busybox
-        image: "{{ include "cleaner.registry" . }}/{{ .Values.cleaner.repository }}:{{ .Values.cleaner.tag }}"
+        image: {{ include "cleaner.registry" . }}/{{ .Values.cleaner.repository }}:{{ .Values.cleaner.tag }}{{ include "operator.ubi" . }}
         command:
           - sh
           - -c
diff --git a/charts/kubestash-operator/templates/operator/configuration.yaml b/charts/kubestash-operator/templates/operator/configuration.yaml
@@ -36,7 +36,7 @@ data:
     docker:
       registry: {{ include "operator.registry" . }}
       image: {{ .Values.operator.repository }}
-      tag: {{ .Values.operator.tag | default .Chart.AppVersion }}
+      tag: {{ .Values.operator.tag | default .Chart.AppVersion }}{{ include "operator.ubi" . }}
     netVolAccessor:
       cpu: {{ .Values.netVolAccessor.cpu }}
       memory: {{ .Values.netVolAccessor.memory }}
diff --git a/charts/kubestash-operator/templates/operator/deployment.yaml b/charts/kubestash-operator/templates/operator/deployment.yaml
@@ -37,7 +37,7 @@ spec:
       serviceAccountName: {{ include "kubestash-operator.serviceAccountName" . }}
       containers:
       - name: operator
-        image: "{{ include "operator.registry" . }}/{{ .Values.operator.repository }}:{{ .Values.operator.tag | default .Chart.AppVersion }}"
+        image: {{ include "operator.registry" . }}/{{ .Values.operator.repository }}:{{ .Values.operator.tag | default .Chart.AppVersion }}{{ include "operator.ubi" . }}
         imagePullPolicy: {{ .Values.imagePullPolicy }}
         securityContext:
           {{- toYaml .Values.operator.securityContext | nindent 10 }}
diff --git a/charts/kubestash-operator/templates/webhook-server/deployment.yaml b/charts/kubestash-operator/templates/webhook-server/deployment.yaml
@@ -37,7 +37,7 @@ spec:
       serviceAccountName: {{ include "kubestash-operator.serviceAccountName" . }}
       containers:
       - name: webhook-server
-        image: "{{ include "operator.registry" . }}/{{ .Values.operator.repository }}:{{ .Values.operator.tag | default .Chart.AppVersion }}"
+        image: {{ include "operator.registry" . }}/{{ .Values.operator.repository }}:{{ .Values.operator.tag | default .Chart.AppVersion }}{{ include "operator.ubi" . }}
         imagePullPolicy: {{ .Values.imagePullPolicy }}
         securityContext:
           {{- toYaml .Values.operator.securityContext | nindent 10 }}
diff --git a/charts/kubestash-operator/values.openapiv3_schema.yaml b/charts/kubestash-operator/values.openapiv3_schema.yaml
@@ -2978,8 +2978,15 @@ properties:
     properties:
       openshift:
         type: boolean
+      ubi:
+        enum:
+        - all
+        - catalog
+        - operator
+        type: string
     required:
     - openshift
+    - ubi
     type: object
   env:
     description: 'List of environment variables to set in the container.
diff --git a/charts/kubestash-operator/values.yaml b/charts/kubestash-operator/values.yaml
@@ -166,6 +166,8 @@ security:
 distro:
   # Set true, if installed in OpenShift
   openshift: false
+  # Set operator or all to use ubi images
+  ubi: ""
 # Network volume accessor configurations
 netVolAccessor:
   # CPU resource for each network volume accessor deployment
diff --git a/charts/kubestash/README.md b/charts/kubestash/README.md
@@ -56,6 +56,7 @@ The following table lists the configurable parameters of the `kubestash` chart a
 | global.taskQueue.maxConcurrentSessions                | It'll be applicable only If the EnableTaskQueue=true. It defines the Max concurrent BackupSessions that can run at a time.                                                                                                                                                                                                                                                     | <code>10</code>    |
 | global.networkPolicy.enabled                          |                                                                                                                                                                                                                                                                                                                                                                                | <code>false</code> |
 | global.distro.openshift                               | Set true, if installed in OpenShift                                                                                                                                                                                                                                                                                                                                            | <code>false</code> |
+| global.distro.ubi                                     | Set operator or all to use ubi images                                                                                                                                                                                                                                                                                                                                          | <code>""</code>    |
 | kubestash-operator.enabled                            |                                                                                                                                                                                                                                                                                                                                                                                | <code>true</code>  |
 | kubestash-catalog.enabled                             |                                                                                                                                                                                                                                                                                                                                                                                | <code>true</code>  |
 | kubestash-metrics.enabled                             |                                                                                                                                                                                                                                                                                                                                                                                | <code>true</code>  |
diff --git a/charts/kubestash/templates/_helpers.tpl b/charts/kubestash/templates/_helpers.tpl
@@ -167,3 +167,17 @@ Returns whether the OpenShift distribution is used
 {{- define "distro.openshift" -}}
 {{- or (.Capabilities.APIVersions.Has "project.openshift.io/v1/Project") .Values.global.distro.openshift (and .Values.distro .Values.distro.openshift) -}}
 {{- end }}
+
+{{/*
+Returns if ubi images are to be used
+*/}}
+{{- define "operator.ubi" -}}
+{{ ternary "-ubi" "" (list "operator" "all" | has (default .Values.distro.ubi .Values.global.distro.ubi)) }}
+{{- end }}
+
+{{/*
+Returns if ubi images are to be used for catalog
+*/}}
+{{- define "catalog.ubi" -}}
+{{ ternary "-ubi" "" (list "catalog" "all" | has (default .Values.distro.ubi .Values.global.distro.ubi)) }}
+{{- end }}
diff --git a/charts/kubestash/values.openapiv3_schema.yaml b/charts/kubestash/values.openapiv3_schema.yaml
@@ -58,8 +58,15 @@ properties:
         properties:
           openshift:
             type: boolean
+          ubi:
+            enum:
+            - all
+            - catalog
+            - operator
+            type: string
         required:
         - openshift
+        - ubi
         type: object
       imagePullSecrets:
         items:
@@ -3238,8 +3245,15 @@ properties:
         properties:
           openshift:
             type: boolean
+          ubi:
+            enum:
+            - all
+            - catalog
+            - operator
+            type: string
         required:
         - openshift
+        - ubi
         type: object
       enabled:
         type: boolean
diff --git a/charts/kubestash/values.yaml b/charts/kubestash/values.yaml
@@ -40,6 +40,8 @@ global:
   distro:
     # Set true, if installed in OpenShift
     openshift: false
+    # Set operator or all to use ubi images
+    ubi: ""
 
 # Pass values to kubestash-operator chart
 kubestash-operator:
diff --git a/go.mod b/go.mod
@@ -16,7 +16,7 @@ require (
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
 	kmodules.xyz/client-go v0.32.8
 	kmodules.xyz/go-containerregistry v0.0.14
-	kmodules.xyz/image-packer v0.0.0-20250820194218-ae3ef975f5df
+	kmodules.xyz/image-packer v0.0.0-20251207101219-5eac37d8b469
 	kmodules.xyz/schema-checker v0.4.2
 	kubeops.dev/installer v0.0.0-20250902033726-2d6945608620
 	sigs.k8s.io/yaml v1.4.0
diff --git a/go.sum b/go.sum
@@ -251,8 +251,8 @@ kmodules.xyz/client-go v0.32.8 h1:KZwJkv6U01kk8RR8M+ZWBhcyd5LusX4mDunJYXA7N3E=
 kmodules.xyz/client-go v0.32.8/go.mod h1:ZwLnc7UqEXUNSe43n/SnER6+7YAQCu38L2te6YefoHU=
 kmodules.xyz/go-containerregistry v0.0.14 h1:8MgLFa74HymAJEyjH7fyQJn5u2Ok6qPPFQX8ARfcXp0=
 kmodules.xyz/go-containerregistry v0.0.14/go.mod h1:xz0iGC3noyMi5NNAzXWTH6KqfiIgFWZAomw+U2zVOXs=
-kmodules.xyz/image-packer v0.0.0-20250820194218-ae3ef975f5df h1:uXpvDUH+fvoIYpAsSygMHm+FqqQ/CA4YIzpPv/NYWkM=
-kmodules.xyz/image-packer v0.0.0-20250820194218-ae3ef975f5df/go.mod h1:omVD7/HWsLm3fyROTZC80BdWdKS28hhhn1cLE6XgXF0=
+kmodules.xyz/image-packer v0.0.0-20251207101219-5eac37d8b469 h1:d2GNL6JKfXNVuPWczOx4tR9Mi76e62dAFujfwBcO6uo=
+kmodules.xyz/image-packer v0.0.0-20251207101219-5eac37d8b469/go.mod h1:bq2HtmP2cskTXUVhzFrcSl9jLrm9PGxjv4Hpg4fmlss=
 kmodules.xyz/schema-checker v0.4.2 h1:tAbxEtM759GxDM/3sQi/+OKKwUsEF+Ih4KReV3Eb/Xw=
 kmodules.xyz/schema-checker v0.4.2/go.mod h1:N7ETPwfY4LbTHbydC9jjssPmYKKgZ8DC0IuLCU55wwc=
 kubeops.dev/installer v0.0.0-20250902033726-2d6945608620 h1:1yFNfZpLBiAqf4yFGcjtBfHq0wZW8mJ/UWcY51WC+yk=
diff --git a/hack/fmt/main.go b/hack/fmt/main.go
@@ -186,7 +186,7 @@ func main() {
 					panic("unsupported registry for image " + img)
 				}
 				if found {
-					newimg += ":" + tag
+					newimg += ":" + tag + `{{ include "catalog.ubi" $ }}`
 				}
 				err = unstructured.SetNestedField(obj.UnstructuredContent(), newimg, "spec", "image")
 				if err != nil {
diff --git a/tests/check-charts_test.go b/tests/check-charts_test.go
diff --git a/vendor/kmodules.xyz/image-packer/pkg/lib/image.go b/vendor/kmodules.xyz/image-packer/pkg/lib/image.go
diff --git a/vendor/kmodules.xyz/image-packer/pkg/lib/tests.go b/vendor/kmodules.xyz/image-packer/pkg/lib/tests.go
diff --git a/vendor/modules.txt b/vendor/modules.txt

Original file line number	Diff line number	Diff line change
`@@ -205,8 +205,12 @@ type SeccompSpec struct {`
`205`	`205`	Enabled bool `json:"enabled"`
`206`	`206`	`}`
`207`	`207`
	`208`	`+// +kubebuilder:validation:Enum=all;catalog;operator`
	`209`	`+type UBIMode string`
	`210`	`+`
`208`	`211`	`type DistroSpec struct {`
`209`		- Openshift bool `json:"openshift"`
	`212`	+ Openshift bool `json:"openshift"`
	`213`	+ UBI UBIMode `json:"ubi"`
`210`	`214`	`}`
`211`	`215`
`212`	`216`	`type NetVolAccessor struct {`