Update to ubi9 and use -ubi prefix for operator image (#7321)

This updates the base image of the UBI operator image from `ubi8` to `ubi9`
and changes the naming of the UBI operator image to be version agnostic by
just using `-ubi` prefix.

.buildkite/pipeline-release.yml

@@ -21,7 +21,7 @@ steps:
             - trigger: unified-release-copy-elastic-images-to-dockerhub
               build:
                 env:
-                  IMAGES_NAMES: "eck/eck-operator,eck/eck-operator-fips,eck/eck-operator-ubi8,eck/eck-operator-ubi8-fips"
+                  IMAGES_NAMES: "eck/eck-operator,eck/eck-operator-fips,eck/eck-operator-ubi,eck/eck-operator-ubi-fips"
                   IMAGES_TAG: "$${BUILDKITE_TAG#v}"
           YAML
 

.buildkite/scripts/common/operator-image.sh

@@ -49,7 +49,7 @@ operator::set_build_flavors_var() {
     trigger=$1
     if [[ "${BUILD_FLAVORS:-}" == "" ]]; then
         case $trigger in
-            tag-*)           BUILD_FLAVORS="eck,eck-dev,eck-fips,eck-ubi8,eck-ubi8-fips" ;;
+            tag-*)           BUILD_FLAVORS="eck,eck-dev,eck-fips,eck-ubi,eck-ubi-fips" ;;
             *-main)          BUILD_FLAVORS="eck,eck-dev" ;;
             *-test-snapshot) BUILD_FLAVORS="eck,eck-dev" ;;
             pr-*|merge-xyz)  BUILD_FLAVORS="eck" ;;

build/Dockerfile-ubi

@@ -27,7 +27,7 @@ RUN --mount=type=cache,mode=0755,target=/go/pkg/mod \
 
 # ---------------------------------------------
 # Copy the operator binary into a lighter image
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9-1029
+FROM registry.access.redhat.com/ubi9/ubi-minimal:8.9-1029
 
 # Update the base image packages to the latest versions
 RUN microdnf update --setopt=tsflags=nodocs && microdnf clean all

build/gen-drivah.toml.sh

@@ -80,9 +80,9 @@ main() {
                 license_pubkey=dev-license.key
                 BUILD_LICENSE_PUBKEY=dev
         fi
-        # UBI8 build
-        if [[ "$flavor" =~ -ubi8 ]]; then
-                name="$name-ubi8"
+        # UBI build
+        if [[ "$flavor" =~ -ubi ]]; then
+                name="$name-ubi"
                 container_file_path=$HERE/Dockerfile-ubi
         fi
         # FIPS build

config/recipes/elastic-agent/fleet-kubernetes-integration-nonroot.yaml

@@ -26,7 +26,7 @@ spec:
           # UBI is only required when needing the `chcon` binary when running
           # in an SELinux-enabled/OpenShift environment. If that
           # is not required then the following smaller image can be used instead:
-          # image: registry.access.redhat.com/ubi8/ubi-minimal:latest
+          # image: registry.access.redhat.com/ubi9/ubi-minimal:latest
           image: docker.io/bash:5.2.15
           resources:
             limits:

docs/orchestrating-elastic-stack-applications/agent-fleet.asciidoc

@@ -579,7 +579,7 @@ spec:
           name: "agent-data"
       initContainers:
         - name: manage-agent-hostpath-permissions
-          # image: registry.access.redhat.com/ubi8/ubi-minimal:latest <2>
+          # image: registry.access.redhat.com/ubi9/ubi-minimal:latest <2>
           image: docker.io/bash:5.2.15
           resources:
             limits:

hack/deployer/clients/ocp/Dockerfile

@@ -12,6 +12,6 @@ RUN curl -fsSLO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${CLIE
     mv oc /usr/local/bin/oc && \
     rm openshift-client-linux-${CLIENT_VERSION}.tar.gz
 
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9-1029
+FROM registry.access.redhat.com/ubi9/ubi-minimal:8.9-1029
 COPY --from=builder /usr/local/bin/openshift-install .
 COPY --from=builder /usr/local/bin/oc .

hack/operatorhub/README.md

@@ -80,7 +80,7 @@ If `enable-vault` flag is `true` the following keys will attempt to be read from
 The `container push` sub-command will perform the following tasks:
 1. Determine if there is an image in the [redhat certification API](https://catalog.redhat.com/api/containers/v1) that has the given `tag` associated with `newVersion`, using the provided `project-id`.
 2. If image is already found, nothing is done without using the `force` flag.
-3. If image not found, or `force` flag set, will push `docker.elastic.co/eck/eck-operator-ubi8:$(newVersion)` to `quay.io` docker registry, tagged as `quay.io/redhat-isv-containers/$(project-id):$(newVersion)`.
+3. If image not found, or `force` flag set, will push `docker.elastic.co/eck/eck-operator-ubi:$(newVersion)` to `quay.io` docker registry, tagged as `quay.io/redhat-isv-containers/$(project-id):$(newVersion)`.
 
 ### Publish sub-command
 

hack/operatorhub/internal/container/container.go

@@ -21,7 +21,7 @@ import (
 )
 
 const (
-	eckOperatorFormat              = "docker.elastic.co/eck/eck-operator-ubi8:%s"
+	eckOperatorFormat              = "docker.elastic.co/eck/eck-operator-ubi:%s"
 	registryURL                    = "quay.io"
 	httpAcceptHeader               = "Accept"
 	httpContentTypeHeader          = "Content-Type"