Update registry.redhat.io/openshift4/ose-must-gather-rhel9 Docker digest to 7658453 main

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-must-gather-rhel9	stage	digest	058e4cf → 7658453

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by CodeRabbit

• Chores
  • Updated the container build image used for must-gather to a newer RHEL 9 OpenShift image digest.

[coderabbitai]

Walkthrough

The must-gather/Dockerfile updates the pinned sha256 digest for the ose-must-gather-rhel9 image used by the builder stage.

Changes

Must-gather Builder Base Image Digest Update

Layer / File(s)	Summary
Builder image digest refresh must-gather/Dockerfile	The builder stage FROM line keeps the same image repository and alias while changing the pinned ose-must-gather-rhel9 digest.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• openshift/kueue-operator#2036: Both PRs modify must-gather/Dockerfile’s builder stage FROM reference for the ose-must-gather-rhel9 must-gather image.
• openshift/kueue-operator#2047: Both PRs update the must-gather image reference/digest at the image pinning level.
• openshift/kueue-operator#2055: Both PRs touch must-gather image digest pinning, with this PR updating the Dockerfile base image digest and the related PR updating related_images.json.

Suggested labels

lgtm

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the Docker digest update for the must-gather image and matches the PR's main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR changes only must-gather/Dockerfile digest; no Ginkgo test titles were added or edited.
Test Structure And Quality	✅ Passed	PASS: PR only updates must-gather/Dockerfile digest; no Ginkgo test files or test logic changed, so the test-structure checklist doesn't apply.
Microshift Test Compatibility	✅ Passed	Only must-gather/Dockerfile changed to bump an image digest; no Ginkgo e2e tests or MicroShift-relevant APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only must-gather/Dockerfile digest changed; no e2e/test files or Ginkgo specs were added, so SNO compatibility is not impacted.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only updates a must-gather Dockerfile image digest; no deployment manifests, controllers, anti-affinity, node selectors, or replica settings were changed.
Ote Binary Stdout Contract	✅ Passed	Only must-gather/Dockerfile digest changed; no process-level code or stdout writes were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only updates a Docker image digest in must-gather/Dockerfile; no new Ginkgo tests or network-sensitive code were added.
No-Weak-Crypto	✅ Passed	The only changed file is a Dockerfile with sha256 image digests; no MD5/SHA1/DES/RC4/3DES/Blowfish, custom crypto, or secret comparisons appear.
Container-Privileges	✅ Passed	Only the must-gather Dockerfile digest changed; no privileged, host*, SYS_ADMIN, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	PR only updates a Dockerfile base-image digest; the changed file contains no logging or sensitive-data exposure.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/registry.redhat.io-openshift4-ose-must-gather-rhel9

---

_{Comment @coderabbitai help to get the list of available commands.}

[kannon92]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kannon92, red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kannon92]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 1b9c906 and 2 for PR HEAD c605733 in total

[kannon92]

/lgtm

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 1671228 and 2 for PR HEAD dc8e84f in total

[openshift-ci]

New changes are detected. LGTM label has been removed.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

must-gather/Dockerfile (1)

3-38: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Run the final image as a non-root user.

The runtime stage never switches away from root, so this image violates the repo's Dockerfile security requirement and Trivy's DS-0002 finding. Add a USER before CMD and keep the copied scripts executable for that UID.

As per path instructions, Dockerfiles should never run as root; static analysis already flags the missing USER.

Suggested fix

 COPY must-gather/collection-scripts/gather /usr/bin/gather
 COPY must-gather/collection-scripts/gather-kueue /usr/bin/gather-kueue
 
 RUN chmod +x /usr/bin/gather /usr/bin/gather-kueue
+USER 1001
 
 CMD ["/bin/bash", "/usr/bin/gather"]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@must-gather/Dockerfile` around lines 3 - 38, The runtime stage in the
must-gather Dockerfile still runs as root, which triggers the security finding.
Update the final image setup by switching to a non-root USER before the CMD
instruction, and make sure the copied entry scripts (/usr/bin/gather and
/usr/bin/gather-kueue) remain executable for that user. Use the existing COPY
and RUN chmod steps in the runtime stage to keep the binaries accessible after
the USER change.

Sources: Path instructions, Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@must-gather/Dockerfile`:
- Around line 3-38: The runtime stage in the must-gather Dockerfile still runs
as root, which triggers the security finding. Update the final image setup by
switching to a non-root USER before the CMD instruction, and make sure the
copied entry scripts (/usr/bin/gather and /usr/bin/gather-kueue) remain
executable for that user. Use the existing COPY and RUN chmod steps in the
runtime stage to keep the binaries accessible after the USER change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 72c9682d-8f53-4e3e-87d6-4a5566793337

📥 Commits

Reviewing files that changed from the base of the PR and between dc8e84f and 9c9d897.

📒 Files selected for processing (1)

• must-gather/Dockerfile

[openshift-ci]

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.