Use ubi10-micro as a base image by Frawless · Pull Request #13056 · strimzi/strimzi-kafka-operator

Frawless · 2026-08-13T20:03:37Z

Type of change

Enhancement / new feature

Description

This PR implements https://github.com/strimzi/proposals/blob/main/152-use-ubi10-as-base-image.md for current repo.

The following table shows testing results (✅/❌/❔):

Cluster type	Version	Status	Details
Kind	1.30	✅	GHA Run - there were two flaky runs, failures wasn't connected to changes but to slow arm runners
Kind	1.31	✅	GHA Run
Kind	1.32	✅	GHA Run
Kind	1.33	✅	GHA Run
Kind	1.34	✅	GHA Run
Kind	1.35	✅	GHA Run
Kind	1.36	✅	GHA Run
OCP	4.20	✅
OCP	4.21-FIPS	❔
OCP	4.22	✅
OCP	4.23	❔
OCP	5.0	❔
IPv6/Dual stack	1.36	❔

Checklist

TODO - change the checklist once testing is done

Update documentation
Update CHANGELOG.md (if present)
Reference relevant issue(s) and close them after merging
Write tests
Make sure all tests pass
Try your changes inside a Kubernetes cluster, not just from unit tests
AI assistance was used to create this PR (see the Strimzi AI policy)

snyk-io · 2026-08-13T20:03:46Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

codecov · 2026-08-13T20:42:13Z

Codecov Report

❌ Patch coverage is 64.70588% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.85%. Comparing base (40768d3) to head (9ceee1a).

Files with missing lines	Patch %	Lines
...src/main/java/io/strimzi/fips/agent/FipsAgent.java	64.70%	6 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13056      +/-   ##
============================================
- Coverage     80.88%   80.85%   -0.03%     
- Complexity     6737     6739       +2     
============================================
  Files           355      356       +1     
  Lines         23072    23089      +17     
  Branches       3148     3148              
============================================
+ Hits          18662    18669       +7     
- Misses         3183     3191       +8     
- Partials       1227     1229       +2

Files with missing lines	Coverage Δ
...src/main/java/io/strimzi/fips/agent/FipsAgent.java	`64.70% <64.70%> (ø)`

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Frawless · 2026-08-13T20:43:15Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.30.13@sha256:397209b3d947d154f6641f2d0ce8d473732bd91c87d9575ade99049aa33cd648

see-quick · 2026-08-14T06:38:53Z

Also IPv6/Dual stack would be worth check?

Frawless · 2026-08-14T14:32:52Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.31.14@sha256:6f86cf509dbb42767b6e79debc3f2c32e4ee01386f0489b3b2be24b0a55aac2b

Frawless · 2026-08-14T16:28:51Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.32.11@sha256:5fc52d52a7b9574015299724bd68f183702956aa4a2116ae75a63cb574b35af8

Frawless · 2026-08-14T16:29:38Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.33.12@sha256:3f5c8443c620245e4d355cfe09e96a91ead32ceaa569d3f1ca9edf0cb2fe2ff4

Frawless · 2026-08-14T22:00:26Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.34.8@sha256:02722c2dedddcfc00febf5d27fbeb9b7b2c14294c82109ff4a85d89ac9ba3256

Frawless · 2026-08-14T22:00:55Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95

Frawless · 2026-08-14T22:02:10Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5

scholzj · 2026-08-15T10:18:53Z

 #####
 # Get Tini
 #####
 ENV TINI_VERSION=v0.19.0


Would it make sense to download tini directly to /mnt/rootfs and then copy it with it?

scholzj · 2026-08-15T10:19:28Z

+        java-${JAVA_VERSION}-openjdk-headless \
+        openssl \
+        bash \
+        tzdata \


Here and in the other dockerfiles ... can you keep the comments what is needed why?

scholzj · 2026-08-15T10:20:33Z

Are these still needed?

It seems they are not, I removed them.

scholzj

FYI: CHANGELOG.md record would be nice for this 😉

Frawless · 2026-08-16T19:47:05Z

FYI: CHANGELOG.md record would be nice for this 😉

I plan to add it within the followup commit when I fill incorporate your suggestions from review.

Frawless · 2026-08-20T13:20:16Z

We had a discussion on community call about this PR. Currently there is a problem on FIPS environments where users uses PEM certificates on RHEL10. Kafka initialize KeyFactory for DSA crypto algorithms that are not allowed on rhel10 FIPS. Basically OpenJDK does not provide such implementation. We all agreed this is a bug in Kafka and needs to be fixed, but it will land in 4.5 and we will need to wait at least until 4.6 to have all Kafka versions with the fix to migrate to ubi10. Full log from Kafka pod is here. We have couple of possible solutions:

Implement some kind of fips-agent (possible implementation is part of this PR) that provide noop implementation for DSA factory. THis works fine. The agent has to run also within components where we create KafkaAdmin client, otherwise the action fails with the same problem.
Implement our own KeyFactory. We can basically copy/paste the one from Kafka and just fix it in the same way as Kafka will. The problem is, that we will need to package it and release to make it available to users and theirs clients. Strimzi will have it directly in the images.
Stick with ubi9 until Kafka fix will be available in all versions we support. This could be later next year for example.

With @scholzj we think that fips-agent path is probably the less complicated/tricky.

What other @strimzi/maintainers think? In case you will have some another idea I will be happy to give it a try. Implementation within this PR currently works fine on OCP with FIPS.

Note that the PR is not ready for review, but current state could be used as a starting point for our decision. Before I will move it to Ready for review I want to rerun all the tests from the table above as the either of the changes will be quite significant to the previous runs.

im-konge · 2026-08-28T09:00:54Z

We had a discussion on community call about this PR. Currently there is a problem on FIPS environments where users uses PEM certificates on RHEL10. Kafka initialize KeyFactory for DSA crypto algorithms that are not allowed on rhel10 FIPS. Basically OpenJDK does not provide such implementation. We all agreed this is a bug in Kafka and needs to be fixed, but it will land in 4.5 and we will need to wait at least until 4.6 to have all Kafka versions with the fix to migrate to ubi10. Full log from Kafka pod is here. We have couple of possible solutions:

Implement some kind of fips-agent (possible implementation is part of this PR) that provide noop implementation for DSA factory. THis works fine. The agent has to run also within components where we create KafkaAdmin client, otherwise the action fails with the same problem.

Implement our own KeyFactory. We can basically copy/paste the one from Kafka and just fix it in the same way as Kafka will. The problem is, that we will need to package it and release to make it available to users and theirs clients. Strimzi will have it directly in the images.

Stick with ubi9 until Kafka fix will be available in all versions we support. This could be later next year for example.

With @scholzj we think that fips-agent path is probably the less complicated/tricky.

What other @strimzi/maintainers think? In case you will have some another idea I will be happy to give it a try. Implementation within this PR currently works fine on OCP with FIPS.

Note that the PR is not ready for review, but current state could be used as a starting point for our decision. Before I will move it to Ready for review I want to rerun all the tests from the table above as the either of the changes will be quite significant to the previous runs.

Sorry for stupid question, but in order to understand what will be better, the fix in Kafka will be that they remove it from the init list? If so, I would go with the first option - the fips-agent. I was just thinking how much it would affect users running on FIPS enabled clusters (and TBH, I don't know much about it :)).

ppatierno · 2026-08-28T10:41:17Z

Sorry for stupid question, but in order to understand what will be better, the fix in Kafka will be that they remove it from the init list?

I don't think this would be the fix. DSA would be anyway still supported on RHEL9 (even with FIPS enabled as it works today) or other distributions. Also it would work if FIPS is not enabled. I think Kafka should catch the error and doing a no-op just like the fips-agent does.

I am fine with the agent but we should also think how to make it working within the bridge which will be affected by the same problem and it runs on bare metal not just in containers where we can set up whatever we want.
It would be just the client side of things which is not addressed here yet. How would it work? Still using the fips-agent? If yes, how we would package and share/distribute it for the bridge as well to avoid code duplication?

Frawless · 2026-08-28T10:48:10Z

Sorry for stupid question, but in order to understand what will be better, the fix in Kafka will be that they remove it from the init list? If so, I would go with the first option - the fips-agent. I was just thinking how much it would affect users running on FIPS enabled clusters (and TBH, I don't know much about it :)).

I am not sure how exactly Kafka will resolve it, but I guess they will add handling of missing algorithms in similar way how fips-agent does it.

Frawless · 2026-08-28T10:54:07Z

I am fine with the agent but we should also think how to make it working within the bridge which will be affected by the same problem and it runs on bare metal not just in containers where we can set up whatever we want. It would be just the client side of things which is not addressed here yet. How would it work? Still using the fips-agent? If yes, how we would package and share/distribute it for the bridge as well to avoid code duplication?

We discuss that on community call. One of the options is - create our implementation of KeyFactory, configure it as default within Strimzi and ship (maven package?) it to allow also clients to use it. It will be probably better then using fips-agent in bridge on rhel. We can also just document it for users. I think on Bridge users can easily configure ssl.engine.factory.class with fixed KeyFactory implementation. It is not possible to do that on Strimzi deployments and that's why it requires some kind of code changes, otherwise we are forced to stay on ubi9 for a while.

Frawless · 2026-09-07T20:50:06Z

There is a fix on Kafka side - apache/kafka#23361 , but most likely it won't be propagated to 4.4 and older versions. Unless there won't be no objections by the end of tomorrow, I will move the PR to ready for review (after workin comments from Jakub) and start with testing.

Frawless · 2026-09-07T20:51:06Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5

github-actions · 2026-09-07T20:51:34Z

⏳ System test verification started: link

The following 10 job(s) will be executed:

regression-brokers-and-security-amd64 (cncf-ubuntu-8-32-x86)
regression-operators-amd64 (cncf-ubuntu-8-32-x86)
regression-operands-amd64 (cncf-ubuntu-8-32-x86)
regression-brokers-and-security-arm64 (cncf-ubuntu-8-32-arm)
regression-operators-arm64 (cncf-ubuntu-8-32-arm)
regression-operands-arm64 (cncf-ubuntu-8-32-arm)
upgrade-azp_kraft_upgrade-amd64 (cncf-ubuntu-4-16-x86)
upgrade-azp_kafka_upgrade-amd64 (cncf-ubuntu-4-16-x86)
upgrade-azp_kraft_upgrade-arm64 (cncf-ubuntu-4-16-arm)
upgrade-azp_kafka_upgrade-arm64 (cncf-ubuntu-4-16-arm)

Tests will start after successful build completion.

github-actions · 2026-09-08T01:57:54Z

❌ System test verification failed: link

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Frawless · 2026-09-09T20:21:41Z

/gha run pipeline=regression,upgrade kubeVersion=kindest/node:v1.36.1@sha256:3489c7674813ba5d8b1a9977baea8a6e553784dab7b84759d1014dbd78f7ebd5

github-actions · 2026-09-09T20:39:36Z

⏳ System test verification started: link
Internal cluster security: encryption tls, authentication mtls

The following 10 job(s) will be executed:

regression-brokers-and-security-amd64 (cncf-ubuntu-8-32-x86)
regression-operators-amd64 (cncf-ubuntu-8-32-x86)
regression-operands-amd64 (cncf-ubuntu-8-32-x86)
regression-brokers-and-security-arm64 (cncf-ubuntu-8-32-arm)
regression-operators-arm64 (cncf-ubuntu-8-32-arm)
regression-operands-arm64 (cncf-ubuntu-8-32-arm)
upgrade-azp_kraft_upgrade-amd64 (cncf-ubuntu-4-16-x86)
upgrade-azp_kafka_upgrade-amd64 (cncf-ubuntu-4-16-x86)
upgrade-azp_kraft_upgrade-arm64 (cncf-ubuntu-4-16-arm)
upgrade-azp_kafka_upgrade-arm64 (cncf-ubuntu-4-16-arm)

Tests will start after successful build completion.

github-actions · 2026-09-10T02:54:53Z

🎉 System test verification passed: link

ppatierno · 2026-09-11T07:13:22Z

+     * @param agentArgs The agent arguments (unused)
+     */
+    public static void premain(String agentArgs) {
+        applyDsaWorkaround();


I am not comfortable with using the "workaround" term ... would it be better applyNoOpDsaProvider?

ppatierno · 2026-09-11T07:14:57Z

+        try {
+            KeyFactory.getInstance("DSA");
+        } catch (NoSuchAlgorithmException e) {
+            LOGGER.warn("DSA KeyFactory not available (FIPS mode detected). Registering no-op DSA provider to work around Kafka PemStore initialization bug.");


"FIPS mode detected" .. is it possible it's not available not because of FIPS mode? Maybe on some other Linux distribution where people run Strimzi? I would just remove this text from the warning log.
This let me think that maybe the overall FipsAgent name is wrong. If this can happen even on systems where FIPS is not enabled but DSA is disabled, I was wondering if we should change the overall agent name.

Frawless added this to the 1.3.0 milestone Aug 13, 2026

Frawless self-assigned this Aug 13, 2026

strimzi deleted a comment from github-actions Bot Aug 14, 2026

scholzj reviewed Aug 15, 2026

View reviewed changes

Frawless force-pushed the use-ubi10 branch from 11e6db7 to 39e9e6e Compare August 19, 2026 19:48

strimzi deleted a comment from github-actions Bot Aug 20, 2026

ppatierno reviewed Sep 8, 2026

View reviewed changes

Comment thread fips-agent/src/main/java/io/strimzi/fips/agent/FipsDsaWorkaround.java Outdated

Comment thread fips-agent/src/main/java/io/strimzi/fips/agent/FipsDsaWorkaround.java Outdated

Frawless added 5 commits September 9, 2026 21:57

Use ubi10-micro as a base image

84ac834

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Create a workaround for ubi10 + FIPS environments

ef97ecc

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Minor fixes after rebase + adding makefile

9675f4a

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Fix spotbugs

741b0d1

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Comments from Jakub and Paolo

9ceee1a

Signed-off-by: Jakub Stejskal <xstejs24@gmail.com>

Frawless force-pushed the use-ubi10 branch from 97e3307 to 9ceee1a Compare September 9, 2026 20:21

ppatierno reviewed Sep 11, 2026

View reviewed changes

Uh oh!

Conversation

Frawless commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change

Description

Checklist

Uh oh!

snyk-io Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

codecov Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Frawless commented Aug 13, 2026

Uh oh!

see-quick commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

Frawless commented Aug 14, 2026

Uh oh!

scholzj Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

scholzj Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

scholzj Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

Frawless Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

scholzj left a comment

Choose a reason for hiding this comment

Uh oh!

Frawless commented Aug 16, 2026

Uh oh!

Frawless commented Aug 20, 2026

Uh oh!

im-konge commented Aug 28, 2026

Uh oh!

ppatierno commented Aug 28, 2026

Uh oh!

Frawless commented Aug 28, 2026

Uh oh!

Frawless commented Aug 28, 2026

Uh oh!

Frawless commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Frawless commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

Uh oh!

Uh oh!

Frawless commented Sep 9, 2026

Uh oh!

github-actions Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

ppatierno Sep 11, 2026

Choose a reason for hiding this comment

Frawless commented Aug 13, 2026 •

edited

Loading

snyk-io Bot commented Aug 13, 2026 •

edited

Loading

codecov Bot commented Aug 13, 2026 •

edited

Loading

Frawless commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 9, 2026 •

edited

Loading