[spike] Gather means for getting the ubi images updates notification

[harshad16]

As the DevSecOps operator, I would like to gather notifications about the ubi image updates to enable the upgrade of the base image used for our project image development.

Goals

• Gather different methods to get the notifications or update info
• Formulate an application that could be utilized to upgrade the base image based on the information.

Acceptance Criteria

• Investigate if the email notification sent out by red hat container images can be accumulated via API
• Investigate if the email notification sent out by red hat container images can be formulated to something machine readable
• Search for existing tools

[harshad16]

/triage accepted
/sig devsecops
/priority important-soon

[VannTen]

Could we leverage openshfit ImageStreams for that ? (if the images are external, with periodic pulling)

[harshad16]

maybe ?
is there a know method?

[VannTen]

I'm not completely sure about the environment regarding this but I know that : 1. ImageStream can track images hosted in external repositories (public or authenticated using a regular scheduled pulling) : https://docs.openshift.com/container-platform/4.7/openshift_images/image-streams-manage.html#images-imagestream-import_image-streams-managing 2. I think (it's been quite a time since I've used them) the ImageSteamTrigger stuff on BuildConfig and the like is done by producing standard Events, so another api client could probably do the same kind of watch ? Could that apply to the base image update scenario ?

[goern]

/kind feature

[VannTen]

the upgrade of the base image

How is that accomplished ? I'm pretty sure we can import the images in Openshift
in a ImageStream and rely on scheduled pull -> which generates an event.

The question would be can the builder consume those events.

[codificat]

Related: thoth-station/core#359