[release-4.22] COS-4051: tree: add labels.json and security OCI labels for Clair scanning#1933
Conversation
OKD doesn't care about this anymore and we don't either. So this is essentially dead code. Nuke all c9s-related bits. Assisted-by: OpenCode (Claude Opus 4.6)
As part of container-first reporting (KONFLUX-6210), security scanners like Clair expect metadata at the OCI level (as labels) _and_ in the rootfs itself (as a JSON file at `/usr/share/buildinfo/labels.json`). To accommodate this, each variant now has a `build-args-*.conf` file that specifies the image name and CPE, but also while we're here, the image `FROM` to use which nicely cleans up the building docs. For the architecture, we use buildah's built-in `TARGETARCH`. This is only relevant on OCP, not OKD. So skip it there. Once we start building the node image through Konflux, this should in theory no longer be necessary because the Konflux pipeline itself automatically adds this information (though there's still details there to figure out on where that information comes from/whether it's correct). Closes: https://redhat.atlassian.net/browse/COS-4051 Assisted-by: OpenCode (Claude Opus 4.6)
ART is no longer populating the 98 repo currently. To get pre-release content, we need to use the 9 repo directly.
|
@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: COS-4051 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: openshift-cherrypick-robot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@openshift-cherrypick-robot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/hold Let's hold this until the pipeline has stabilized and we've confirmed the new labels work in 4.23. |
openshift-ci
Bot
added
the
do-not-merge/hold
3 participants
This is an automated cherry-pick of #1919
/assign jlebon