Investigate UBI-micro for Ansible, Helm and SDK base images

[fgiloux]

Feature Request

Describe the problem you need a feature to resolve.

UBI-micro has a few advantages compared to UBI-minimal

• smaller attack surface
• no package manager
• size

In addition it is not uncommon for image scanners to report vulnerabilities against versions of UBI-minimal. Even if they may be false positives it still creates burden for investigating them and makes acceptance more difficult on user side.

Describe the solution you'd like.

This is a follow up of #5619

Using UBI-micro would help with the points mentioned above.

[varshaprasad96]

@fgiloux Thanks for raising this issue. We do not have a full picture on what needs to be done to move to ubi-micro. To get started, we would just have to swap the base image, check if the tests pass and proceed with debugging the issues. This is an investigative feature.

It would be helpful if someone from the community could take this up.

[fgiloux]

Hi @varshaprasad96 Thanks for the feedback.
I gave it a try but the repo does not compile currently. It depends on helm, which has a dependency on distribution/distribution, which has a dependency on github.com/mitchellh/osext, which does not exist any more.
I tried to work around it by pointing to a newer version of distribution/distribution but there were other dependency issues and I gave up. There is for instance #6569, which was raised for docker/distribution, which redirects to distribution/distribution

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[fgiloux]

/remove-lifecycle stale

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[fgiloux]

/remove-lifecycle stale

[fgiloux]

/remove-lifecycle rotten