Pre-certify the edge UBI images for Red Hat container certification

[ciarams87]

We need to submit UBI-based NGF images to Red Hat Partner Connect for certification so that the images can be used in certified operators. We need to use the preflight tool
for this. See the RH documentation

This ticket is to submit the edge images to increase certainty the release images will pass certification when they are submitted

Acceptance Criteria:

• The NGF control plane, NGINX oss, and NGF Operator UBI edge images uploaded to Red Hat scanning registry using preflight
• Automated security scans pass with no critical vulnerabilities
• Container certification status is "approved"
• NB: The images should NOT be published

Notes:

• Because the work for the ubi images and the operator is going into 2.2.0, we will need to wait for the images to be released before we can fully certify them, but we can initiate the process with the edge builds once it all goes into main
• We can submit edge builds to make sure no failures occurs before we actually publish the build. (edge certification)

[shaun-nx]

NGF Edge UBI Container Preflight results:

{
    "image": "ghcr.io/nginx/nginx-gateway-fabric:edge-ubi",
    "passed": true,
    "test_library": {
        "name": "github.com/redhat-openshift-ecosystem/openshift-preflight",
        "version": "0.0.0",
        "commit": "c2622b141bbdf865776690fdac3221bd799d367f"
    },
    "results": {
        "passed": [
            {
                "name": "HasLicense",
                "elapsed_time": 0,
                "description": "Checking if terms and conditions applicable to the software including open source licensing information are present. The license must be at /licenses"
            },
            {
                "name": "HasUniqueTag",
                "elapsed_time": 0,
                "description": "Checking if container has a tag other than 'latest', so that the image can be uniquely identified."
            },
            {
                "name": "LayerCountAcceptable",
                "elapsed_time": 0,
                "description": "Checking if container has less than 40 layers.  Too many layers within the container images can degrade container performance."
            },
            {
                "name": "HasNoProhibitedPackages",
                "elapsed_time": 27,
                "description": "Checks to ensure that the image in use does not include prohibited packages, such as Red Hat Enterprise Linux (RHEL) kernel packages."
            },
            {
                "name": "HasRequiredLabel",
                "elapsed_time": 0,
                "description": "Checking if the required labels (name, vendor, version, release, summary, description, maintainer) are present in the container metadata"
            },
            {
                "name": "HasNoProhibitedLabels",
                "elapsed_time": 0,
                "description": "Checking if the labels (name, vendor, maintainer) violate Red Hat trademark."
            },
            {
                "name": "RunAsNonRoot",
                "elapsed_time": 0,
                "description": "Checking if container runs as the root user because a container that does not specify a non-root user will fail the automatic certification, and will be subject to a manual review before the container can be approved for publication"
            },
            {
                "name": "HasModifiedFiles",
                "elapsed_time": 3944,
                "description": "Checks that no files installed via RPM in the base Red Hat layer have been modified"
            },
            {
                "name": "BasedOnUbi",
                "elapsed_time": 2153,
                "description": "Checking if the container's base image is based upon the Red Hat Universal Base Image (UBI)"
            },
            {
                "name": "HasProhibitedContainerName",
                "elapsed_time": 0,
                "description": "Checking if the container-name violates Red Hat trademark."
            }
        ],
        "failed": [],
        "errors": []
    }
}

[shaun-nx]

NGINX OSS Edge UBI Container Preflight results:

{
    "image": "ghcr.io/nginx/nginx-gateway-fabric/nginx:edge-ubi",
    "passed": true,
    "test_library": {
        "name": "github.com/redhat-openshift-ecosystem/openshift-preflight",
        "version": "0.0.0",
        "commit": "c2622b141bbdf865776690fdac3221bd799d367f"
    },
    "results": {
        "passed": [
            {
                "name": "HasLicense",
                "elapsed_time": 0,
                "description": "Checking if terms and conditions applicable to the software including open source licensing information are present. The license must be at /licenses"
            },
            {
                "name": "HasUniqueTag",
                "elapsed_time": 0,
                "description": "Checking if container has a tag other than 'latest', so that the image can be uniquely identified."
            },
            {
                "name": "LayerCountAcceptable",
                "elapsed_time": 0,
                "description": "Checking if container has less than 40 layers.  Too many layers within the container images can degrade container performance."
            },
            {
                "name": "HasNoProhibitedPackages",
                "elapsed_time": 30,
                "description": "Checks to ensure that the image in use does not include prohibited packages, such as Red Hat Enterprise Linux (RHEL) kernel packages."
            },
            {
                "name": "HasRequiredLabel",
                "elapsed_time": 0,
                "description": "Checking if the required labels (name, vendor, version, release, summary, description, maintainer) are present in the container metadata"
            },
            {
                "name": "HasNoProhibitedLabels",
                "elapsed_time": 0,
                "description": "Checking if the labels (name, vendor, maintainer) violate Red Hat trademark."
            },
            {
                "name": "RunAsNonRoot",
                "elapsed_time": 0,
                "description": "Checking if container runs as the root user because a container that does not specify a non-root user will fail the automatic certification, and will be subject to a manual review before the container can be approved for publication"
            },
            {
                "name": "HasModifiedFiles",
                "elapsed_time": 6213,
                "description": "Checks that no files installed via RPM in the base Red Hat layer have been modified"
            },
            {
                "name": "BasedOnUbi",
                "elapsed_time": 1660,
                "description": "Checking if the container's base image is based upon the Red Hat Universal Base Image (UBI)"
            },
            {
                "name": "HasProhibitedContainerName",
                "elapsed_time": 0,
                "description": "Checking if the container-name violates Red Hat trademark."
            }
        ],
        "failed": [],
        "errors": []
    }
}

[shaun-nx]

Operator Edge Container Preflight results:

{
    "image": "ghcr.io/nginx/nginx-gateway-fabric/operator:edge",
    "passed": true,
    "test_library": {
        "name": "github.com/redhat-openshift-ecosystem/openshift-preflight",
        "version": "0.0.0",
        "commit": "c2622b141bbdf865776690fdac3221bd799d367f"
    },
    "results": {
        "passed": [
            {
                "name": "HasLicense",
                "elapsed_time": 0,
                "description": "Checking if terms and conditions applicable to the software including open source licensing information are present. The license must be at /licenses"
            },
            {
                "name": "HasUniqueTag",
                "elapsed_time": 0,
                "description": "Checking if container has a tag other than 'latest', so that the image can be uniquely identified."
            },
            {
                "name": "LayerCountAcceptable",
                "elapsed_time": 0,
                "description": "Checking if container has less than 40 layers.  Too many layers within the container images can degrade container performance."
            },
            {
                "name": "HasNoProhibitedPackages",
                "elapsed_time": 30,
                "description": "Checks to ensure that the image in use does not include prohibited packages, such as Red Hat Enterprise Linux (RHEL) kernel packages."
            },
            {
                "name": "HasRequiredLabel",
                "elapsed_time": 0,
                "description": "Checking if the required labels (name, vendor, version, release, summary, description, maintainer) are present in the container metadata"
            },
            {
                "name": "HasNoProhibitedLabels",
                "elapsed_time": 0,
                "description": "Checking if the labels (name, vendor, maintainer) violate Red Hat trademark."
            },
            {
                "name": "RunAsNonRoot",
                "elapsed_time": 0,
                "description": "Checking if container runs as the root user because a container that does not specify a non-root user will fail the automatic certification, and will be subject to a manual review before the container can be approved for publication"
            },
            {
                "name": "HasModifiedFiles",
                "elapsed_time": 5243,
                "description": "Checks that no files installed via RPM in the base Red Hat layer have been modified"
            },
            {
                "name": "BasedOnUbi",
                "elapsed_time": 1899,
                "description": "Checking if the container's base image is based upon the Red Hat Universal Base Image (UBI)"
            },
            {
                "name": "HasProhibitedContainerName",
                "elapsed_time": 0,
                "description": "Checking if the container-name violates Red Hat trademark."
            }
        ],
        "failed": [],
        "errors": []
    }
}